hackathon: embedding sdk plugin

* Fix linking to public or embed resource on dashboards not working

* Update embedding test name to use a snazzier term

* Add tests

.clj-kondo/babashka/fs/config.edn

@@ -1 +0,0 @@
-{:lint-as {babashka.fs/with-temp-dir clojure.core/let}}

.clj-kondo/babashka/sci/config.edn

@@ -1 +0,0 @@
-{:hooks {:macroexpand {sci.core/copy-ns sci.core/copy-ns}}}

.clj-kondo/babashka/sci/sci/core.clj

@@ -1,9 +0,0 @@
-(ns sci.core)
-
-(defmacro copy-ns
-  ([ns-sym sci-ns]
-   `(copy-ns ~ns-sym ~sci-ns nil))
-  ([ns-sym sci-ns opts]
-   `[(quote ~ns-sym)
-     ~sci-ns
-     (quote ~opts)]))

.clj-kondo/better-cond/better-cond/better_cond/core.clj

@@ -1,145 +0,0 @@
-(ns better-cond.core
-  "A clj-kondo hook to allow linting of better-cond `cond` macro.
-  This supports better-cond version 2.0.0+.
-
-  To use in a project, change the namespace to hooks.better-cond,
-  put this code in file .clj-kondo/hooks/better_cond.clj, and include
-  a config.edn entry in the :hooks key like:
-
-    :hooks {:analyze-call {better-cond.core/cond hooks.better-cond/cond}}
-
-  Note that the expansion of :when-let and :when-some forms currently
-  takes a shortcut that *would* lead to incorrect values in some
-  cases of restructuring during actual expansion/evaluation, e.g.,
-  :when-let [[x y] nil] would not abort the cond, though :when-let
-  [[x y] [nil nil]] would. However, for linting purposes, the current
-  expansion approach works just fine. It seems unnecessary to do the
-  full expansion in these cases for linting purposes, though that could
-  be done if needed."
-  (:refer-clojure :exclude [cond])
-  (:require
-   [clj-kondo.hooks-api :as api]
-   [clojure.string :as str]))
-
-(def better-cond-simple-keys
-  "Special constructs in better cond, either as keywords or symbols.
-  This includes those keys that are simply transformed. Note that
-  :when-let and :when-some are *not* included as better-cond allows
-  multiple bindings but clojure does not. These two must be handled
-  separately."
-  #{:let :when :do
-    'let 'when 'do})
-
-(def better-cond-complex-keys
-  "Special constructs in better cond, either as keywords or symbols.
-  This includes those keys that require a multi-step transformation.
-  For example, :when-let and :when-some get converted to a let
-  wrapping a when, wrapping the continuing cond. Note that clojure
-  does not support multiple bindings in the standard when-let and
-  when-some macros."
-  {:when-let  'identity
-   'when-let  'identity
-   :when-some 'some?
-   'when-some 'some?})
-
-(defn extract-binding-forms
-  [bindings]
-  (keep-indexed #(when (even? %1) %2) bindings))
-
-(defn process-pairs
-  "Transforms a `cond` with the clauses given as a collection of explicit pairs.
-  Handles all the special better-cond constructs as keywords or symbols.
-  Returns a rewrite-clj list-node representing the transformed code."
-  [node-pairs]
-  (loop [[[lhs rhs :as pair] & pairs] node-pairs
-         new-body [(api/token-node 'clojure.core/cond)]] ; Avoid reprocessing the cond with ns here
-    (if pair
-      (let [lhs-sexpr (api/sexpr lhs)]
-        (clojure.core/cond
-          (= 1 (count pair)) ;; better-cond allows single clause for default
-          , (api/list-node (conj new-body (api/keyword-node :else) lhs))
-          (better-cond-simple-keys lhs-sexpr) ;; Handle special better-cond constructs
-          , (api/list-node
-             (conj new-body
-                   (api/keyword-node :else)
-                   (api/list-node [(api/token-node (symbol #_"clojure.core" (name lhs-sexpr)))
-                                   rhs
-                                   (process-pairs pairs)])))
-          (better-cond-complex-keys lhs-sexpr)  ;; Multi stage constructs
-          , (api/list-node
-             (conj new-body
-                   (api/keyword-node :else)
-                   (api/list-node [(api/token-node 'let)
-                                   rhs
-                                   (api/list-node [(api/token-node 'when)
-                                                   (api/list-node    ;; ATTN: shortcut here; fine for linting
-                                                    [(api/token-node 'every?)
-                                                     (api/token-node (better-cond-complex-keys lhs-sexpr))
-                                                     (api/vector-node (->> rhs
-                                                                           api/sexpr
-                                                                           extract-binding-forms
-                                                                           (map api/token-node)))])
-                                                   (process-pairs pairs)])])))
-          :else
-          , (recur pairs (conj new-body lhs rhs))))
-      (api/list-node new-body))))
-
-(defn cond-hook
-  [{:keys [node]}]
-  (let [expr (let [args (rest (:children node))
-                   pairs (partition-all 2 args)]
-               (process-pairs pairs))]
-    {:node (with-meta expr
-             (meta node))}))
-
-(defn process-if-let-pairs [pairs then else]
-  (if (seq pairs)
-    (let [[lhs rhs] (first pairs)]
-      (if (and (api/keyword-node? lhs)
-               (= :let (api/sexpr lhs)))
-        (api/list-node (conj [(api/token-node 'clojure.core/let) rhs
-                              (process-if-let-pairs (next pairs) then else)]))
-        (let [test (api/token-node (gensym "test"))]
-          (api/list-node
-           (conj [(api/token-node 'clojure.core/let) (api/vector-node [test rhs])
-                  (api/list-node [(api/token-node 'if) test
-                                  (api/list-node
-                                   [(api/token-node 'clojure.core/let)
-                                    (api/vector-node [lhs test])
-                                    (process-if-let-pairs (next pairs) then else)])
-                                  else])])))))
-    then))
-
-(defn if-let-hook
-  [{:keys [node]}]
-  (let [expr (let [[binding-vec then else] (rest (:children node))
-                   pairs (partition-all 2 (:children binding-vec))
-                   node (process-if-let-pairs pairs then else)]
-               node)]
-    {:node (with-meta expr
-             (meta node))}))
-
-(defn when-let-hook
-  [{:keys [node]}]
-  (let [expr (let [[binding-vec & body] (rest (:children node))]
-               (api/list-node
-                [(api/token-node 'better-cond.core/if-let)
-                 binding-vec
-                 (api/list-node (list* (api/token-node 'do)
-                                       body))]))]
-    {:node (with-meta expr
-             (meta node))}))
-
-(defn defnc-hook [{:keys [node]}]
-  (let [[defnc-node name-node arg-node & body]
-        (:children node)
-        new-node (api/list-node [(api/token-node (if (str/ends-with? (str defnc-node)
-                                                                     "defnc-")
-                                                   'clojure.core/defn-
-                                                   'clojure.core/defn))
-                                 name-node
-                                 arg-node
-                                 (api/list-node
-                                  (list* (api/token-node 'better-cond.core/cond)
-                                         body))])]
-    {:node new-node}))

.clj-kondo/better-cond/better-cond/config.edn

@@ -1,9 +0,0 @@
-{:hooks
- {:analyze-call
-  {better-cond.core/cond better-cond.core/cond-hook
-   better-cond.core/defnc better-cond.core/defnc-hook
-   better-cond.core/defnc- better-cond.core/defnc-hook
-   better-cond.core/if-let better-cond.core/if-let-hook
-   better-cond.core/if-some better-cond.core/if-let-hook
-   better-cond.core/when-let better-cond.core/when-let-hook
-   better-cond.core/when-some better-cond.core/when-let-hook}}}

.clj-kondo/com.gfredericks/test.chuck/clj_kondo/com/gfredericks/test/chuck/checking.clj

@@ -1,19 +0,0 @@
-(ns clj-kondo.com.gfredericks.test.chuck.checking
-  (:require
-   [clj-kondo.hooks-api :as api]))
-
-(defn checking
-  [{{:keys [children]} :node}]
-  (let [[_checking desc & opt+bindings+body] children
-        [opts binding-vec & body]             (if (api/vector-node? (first opt+bindings+body))
-                                                (into [(api/map-node {})] opt+bindings+body)
-                                                opt+bindings+body)]
-    (when-not (even? (count (:children binding-vec)))
-      (throw (ex-info "checking requires an even number of bindings" {})))
-    {:node (api/list-node
-            (list*
-             (api/token-node 'let)
-             (api/vector-node (into [(api/token-node (symbol (gensym "_checking-desc"))) desc]
-                                    (:children binding-vec)))
-             opts
-             body))}))

.clj-kondo/com.gfredericks/test.chuck/config.edn

@@ -1,4 +0,0 @@
-{:hooks
- {:analyze-call
-  {com.gfredericks.test.chuck.clojure-test/checking
-   clj-kondo.com.gfredericks.test.chuck.checking/checking}}}

.clj-kondo/com.github.camsaul/humane-are/config.edn

@@ -1,2 +0,0 @@
-{:lint-as
- {humane-are.core/are+ clojure.test/are}}

.clj-kondo/com.github.camsaul/toucan2/config.edn

@@ -1,39 +0,0 @@
-{:config-paths
- ["macros"]
-
- :lint-as
- {toucan2.core/build             clojure.core/identity
-  toucan2.core/compile           clojure.core/identity
-  toucan2.query/with-built-query clojure.core/let
-  toucan2.tools.compile/build    clojure.core/identity
-  toucan2.tools.compile/compile  clojure.core/identity}
-
- :hooks
- {:analyze-call
-  {toucan2.connection/with-connection                      hooks.toucan2.connection/with-connection
-   toucan2.connection/with-transaction                     hooks.toucan2.connection/with-transaction
-   toucan2.core/with-connection                            hooks.toucan2.connection/with-connection
-   toucan2.core/with-transaction                           hooks.toucan2.connection/with-transaction
-   toucan2.tools.simple-out-transform/define-out-transform hooks.toucan2.tools.simple-out-transform/define-out-transform
-   toucan2.tools.with-temp/with-temp                       hooks.toucan2.tools.with-temp/with-temp}
-
-  :macroexpand
-  {toucan.db/with-call-counting                       macros.toucan2.execute/with-call-count
-   toucan.models/defmodel                             macros.toucan.models/defmodel
-   toucan2.core/define-after-insert                   macros.toucan2.tools.after-insert/define-after-insert
-   toucan2.core/define-after-select                   macros.toucan2.tools.helpers/define-after-select
-   toucan2.core/define-after-update                   macros.toucan2.tools.after-update/define-after-update
-   toucan2.core/define-before-delete                  macros.toucan2.tools.helpers/define-before-delete
-   toucan2.core/define-before-insert                  macros.toucan2.tools.before-insert/define-before-insert
-   toucan2.core/define-before-select                  macros.toucan2.tools.helpers/define-before-select
-   toucan2.core/define-before-update                  macros.toucan2.tools.before-update/define-before-update
-   toucan2.execute/with-call-count                    macros.toucan2.execute/with-call-count
-   toucan2.tools.after-insert/define-after-insert     macros.toucan2.tools.after-insert/define-after-insert
-   toucan2.tools.after-select/define-after-select     macros.toucan2.tools.helpers/define-after-select
-   toucan2.tools.after-update/define-after-update     macros.toucan2.tools.after-update/define-after-update
-   toucan2.tools.before-delete/define-before-delete   macros.toucan2.tools.helpers/define-before-delete
-   toucan2.tools.before-insert/define-before-insert   macros.toucan2.tools.before-insert/define-before-insert
-   toucan2.tools.before-select/define-before-select   macros.toucan2.tools.helpers/define-before-select
-   toucan2.tools.before-update/define-before-update   macros.toucan2.tools.before-update/define-before-update
-   toucan2.tools.default-fields/define-default-fields macros.toucan2.tools.default-fields/define-default-fields
-   toucan2.tools.named-query/define-named-query       macros.toucan2.tools.named-query/define-named-query}}}

.clj-kondo/com.github.camsaul/toucan2/hooks/toucan2/connection.clj

@@ -1,14 +0,0 @@
-(ns hooks.toucan2.connection
-  (:require [clj-kondo.hooks-api :as hooks]))
-
-(defn with-connection [{{[_ bindings & body] :children} :node}]
-  (let [[conn-binding connectable] (:children bindings)]
-    {:node (hooks/list-node
-            (list*
-             (hooks/token-node 'let)
-             (hooks/vector-node [conn-binding (or connectable
-                                                  (hooks/token-node 'nil))])
-             body))}))
-
-(defn with-transaction [node]
-  (with-connection node))

.clj-kondo/com.github.camsaul/toucan2/hooks/toucan2/tools/simple_out_transform.clj

@@ -1,37 +0,0 @@
-(ns hooks.toucan2.tools.simple-out-transform
-  (:require [clj-kondo.hooks-api :as hooks]))
-
-(defn- ignore-unused-binding [x]
-  (vary-meta x assoc :clj-kondo/ignore [:unused-binding]))
-
-(defn define-out-transform
-  [{{[_define-out-transform dispatch-value {[instance-binding] :children, :as bindings} & body] :children, :as node} :node}]
-  {:node (-> (hooks/list-node
-              [(hooks/token-node 'do)
-               dispatch-value
-               (hooks/list-node
-                (list*
-                 (hooks/token-node 'fn)
-                 (-> (hooks/vector-node
-                      [(ignore-unused-binding (with-meta (hooks/token-node '&query-type)  (meta bindings)))
-                       (ignore-unused-binding (with-meta (hooks/token-node '&model)       (meta bindings)))
-                       instance-binding])
-                     (with-meta (meta bindings)))
-                 body))])
-             (with-meta (meta node)))})
-
-(comment
-  (defn test-define-out-transform []
-    (as-> '(tools.simple-out-transform/define-out-transform [:toucan.query-type/select.instances ::after-select]
-             [instance]
-             (let [wow 1000]
-               ;; don't do after-select if this select is a result of doing something like insert-returning instances
-               (if (isa? &query-type :toucan2.pipeline/select.instances-from-pks)
-                 instance
-                 (after-select instance)))) <>
-        (hooks/parse-string (pr-str <>))
-        (define-out-transform {:node <>})
-        (:node <>)
-        (hooks/sexpr <>)
-        (binding [*print-meta* false #_true]
-          (clojure.pprint/pprint <>)))))

.clj-kondo/com.github.camsaul/toucan2/hooks/toucan2/tools/with_temp.clj

@@ -1,22 +0,0 @@
-(ns hooks.toucan2.tools.with-temp
-  (:require [clj-kondo.hooks-api :as hooks]))
-
-(defn with-temp [{{[_with-temp {bindings :children} & body] :children} :node}]
-  (let [bindings* (into
-                   []
-                   (comp (partition-all 3)
-                         (mapcat (fn [[model binding attributes]]
-                                   (let [binding    (or binding (hooks/token-node '_))
-                                         attributes (or attributes (hooks/token-node 'nil))]
-                                     [binding (hooks/list-node
-                                               (list
-                                                (hooks/token-node 'do)
-                                                model
-                                                attributes))]))))
-                   bindings)
-        node*         (hooks/list-node
-                       (list*
-                        (hooks/token-node 'let)
-                        (hooks/vector-node bindings*)
-                        body))]
-    {:node node*}))

.clj-kondo/com.github.camsaul/toucan2/macros/toucan/models.clj

@@ -1,5 +0,0 @@
-(ns macros.toucan.models)
-
-(defmacro defmodel
-  [model _table-name]
-  `(def ~model "Docstring." ~(keyword (name model))))

.clj-kondo/com.github.camsaul/toucan2/macros/toucan2/common.clj

@@ -1,4 +0,0 @@
-(ns macros.toucan2.common)
-
-(defn ignore-unused [symb]
-  (vary-meta symb assoc :clj-kondo/ignore [:unused-binding]))

.clj-kondo/com.github.camsaul/toucan2/macros/toucan2/execute.clj

@@ -1,6 +0,0 @@
-(ns macros.toucan2.execute)
-
-(defmacro with-call-count
-  [[call-count-fn-binding] & body]
-  `(let [~call-count-fn-binding (fn [])]
-     ~@body))

.clj-kondo/com.github.camsaul/toucan2/macros/toucan2/tools/after_insert.clj

@@ -1,10 +0,0 @@
-(ns macros.toucan2.tools.after-insert
-  (:require [macros.toucan2.common :as common]))
-
-(defmacro define-after-insert
-  [model [instance-binding] & body]
-  `(do
-     ~model
-     (fn [~(common/ignore-unused '&model)
-          ~instance-binding]
-       ~@body)))

.clj-kondo/com.github.camsaul/toucan2/macros/toucan2/tools/after_update.clj

@@ -1,10 +0,0 @@
-(ns macros.toucan2.tools.after-update
-  (:require [macros.toucan2.common :as common]))
-
-(defmacro define-after-update
-  [model [instance-binding] & body]
-  `(do
-     ~model
-     (fn [~(common/ignore-unused '&model)
-          ~instance-binding]
-       ~@body)))

.clj-kondo/com.github.camsaul/toucan2/macros/toucan2/tools/before_insert.clj

@@ -1,10 +0,0 @@
-(ns macros.toucan2.tools.before-insert
-  (:require [macros.toucan2.common :as common]))
-
-(defmacro define-before-insert
-  [model [instance-binding] & body]
-  `(do
-     ~model
-     (fn [~(common/ignore-unused '&model)
-          ~instance-binding]
-       ~@body)))

.clj-kondo/com.github.camsaul/toucan2/macros/toucan2/tools/before_update.clj

@@ -1,10 +0,0 @@
-(ns macros.toucan2.tools.before-update
-  (:require [macros.toucan2.common :as common]))
-
-(defmacro define-before-update
-  [model [instance-binding] & body]
-  `(do
-     ~model
-     (fn [~(common/ignore-unused '&model)
-          ~instance-binding]
-       ~@body)))

.clj-kondo/com.github.camsaul/toucan2/macros/toucan2/tools/default_fields.clj

@@ -1,6 +0,0 @@
-(ns macros.toucan2.tools.default-fields
-  (:require [macros.toucan2.common :as common]))
-
-(defmacro define-default-fields [model & body]
-  `(let [~(common/ignore-unused '&model) ~model]
-     ~@body))

.clj-kondo/com.github.camsaul/toucan2/macros/toucan2/tools/helpers.clj

@@ -1,27 +0,0 @@
-(ns macros.toucan2.tools.helpers
-  (:require [macros.toucan2.common :as common]))
-
-(defmacro define-before-select [dispatch-value [args-binding] & body]
-  `(do
-     ~dispatch-value
-     (fn [~(common/ignore-unused '&query-type)
-          ~(common/ignore-unused '&model)
-          ~args-binding]
-       ~@body)))
-
-(defmacro define-after-select [model [instance-binding] & body]
-  `(do
-     ~model
-     (fn [~(common/ignore-unused '&query-type)
-          ~(common/ignore-unused '&model)
-          ~(common/ignore-unused '&parsed-args)
-          ~instance-binding]
-       ~@body)))
-
-(defmacro define-before-delete
-  [model [instance-binding] & body]
-  `(do
-     ~model
-     (fn [~(common/ignore-unused '&model)
-          ~instance-binding]
-       ~@body)))

.clj-kondo/com.github.camsaul/toucan2/macros/toucan2/tools/named_query.clj

@@ -1,22 +0,0 @@
-(ns macros.toucan2.tools.named-query
-  (:require [macros.toucan2.common :as common]))
-
-;;; separate function because recursive macroexpansion doesn't seem to work.
-(defn- define-named-query*
-  [query-name query-type model resolved-query]
-  `(do
-     ~query-name
-     ~query-type
-     ~model
-     (fn [~(common/ignore-unused '&query-type)
-          ~(common/ignore-unused '&model)
-          ~(common/ignore-unused '&parsed-args)
-          ~(common/ignore-unused '&unresolved-query)]
-       ~resolved-query)))
-
-(defmacro define-named-query
-  ([query-name resolved-query]
-   (define-named-query* query-name :default :default resolved-query))
-
-  ([query-name query-type model resolved-query]
-   (define-named-query* query-name query-type model resolved-query)))

.clj-kondo/com.github.metabase/hawk/config.edn

@@ -1,4 +0,0 @@
-{:linters
- {:unresolved-symbol
-  {:exclude
-   [(clojure.test/is [partial= re= schema= =?])]}}}

.clj-kondo/com.github.seancorfield/next.jdbc/config.edn

@@ -1,5 +0,0 @@
-{:hooks
- {:analyze-call
-  {next.jdbc/with-transaction
-   hooks.com.github.seancorfield.next-jdbc/with-transaction}}
- :lint-as {next.jdbc/on-connection clojure.core/with-open}}

.clj-kondo/com.github.seancorfield/next.jdbc/hooks/com/github/seancorfield/next_jdbc.clj

@@ -1,18 +0,0 @@
-(ns hooks.com.github.seancorfield.next-jdbc
-  (:require [clj-kondo.hooks-api :as api]))
-
-(defn with-transaction
-  "Expands (with-transaction [tx expr opts] body)
-  to (let [tx expr] opts body) pre clj-kondo examples."
-  [{:keys [:node]}]
-  (let [[binding-vec & body] (rest (:children node))
-        [sym val opts] (:children binding-vec)]
-    (when-not (and sym val)
-      (throw (ex-info "No sym and val provided" {})))
-    (let [new-node (api/list-node
-                    (list*
-                     (api/token-node 'let)
-                     (api/vector-node [sym val])
-                     opts
-                     body))]
-      {:node new-node})))

.clj-kondo/com.github.seancorfield/next.jdbc/hooks/com/github/seancorfield/next_jdbc.clj_kondo

@@ -1,18 +0,0 @@
-(ns hooks.com.github.seancorfield.next-jdbc
-  (:require [clj-kondo.hooks-api :as api]))
-
-(defn with-transaction
-  "Expands (with-transaction [tx expr opts] body)
-  to (let [tx expr] opts body) per clj-kondo examples."
-  [{:keys [:node]}]
-  (let [[binding-vec & body] (rest (:children node))
-        [sym val opts] (:children binding-vec)]
-    (when-not (and sym val)
-      (throw (ex-info "No sym and val provided" {})))
-    (let [new-node (api/list-node
-                    (list*
-                     (api/token-node 'let)
-                     (api/vector-node [sym val])
-                     opts
-                     body))]
-      {:node new-node})))

.clj-kondo/config.edn

@@ -1,14 +1,50 @@
 {:config-paths ["macros"]
  :linters
- {:unresolved-symbol
+ {:aliased-namespace-symbol     {:level :warning}
+  :invalid-arity                {:skip-args [metabase.mbql.util.match/match]} ; TODO (cam): can we fix these?
+  :keyword-binding              {:level :warning}
+  :main-without-gen-class       {:level :warning}
+  :misplaced-docstring          {:level :warning}
+  :missing-body-in-when         {:level :warning}
+  :missing-docstring            {:level :warning}
+  :missing-else-branch          {:level :warning}
+  :namespace-name-mismatch      {:level :warning}
+  :non-arg-vec-return-type-hint {:level :warning}
+  :reduce-without-init          {:level :warning}
+  :redundant-fn-wrapper         {:level :warning}
+  :refer-all                    {:level :warning, :exclude [clojure.test]}
+  :single-key-in                {:level :warning}
+  :unused-referred-var          {:exclude {compojure.core [GET DELETE POST PUT]}}
+  :use                          {:level :warning}
+  :warn-on-reflection           {:level :warning}
+
+  :metabase/defsetting-must-specify-export {:level :warning}
+
+  ;;
+  ;; disabled linters
+  ;;
+
+  :unexpected-recur         {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
+  :used-underscored-binding {:level :off} ; false positives: see https://github.com/clj-kondo/clj-kondo/issues/2152
+
+  ;;
+  ;; TODO (cam): here are some more linters we should experiment with enabling -- some might be useful.
+  ;;
+
+  ;; :docstring-leading-trailing-whitespace {:level :warning}
+  ;; :docstring-no-summary                  {:level :warning}
+  ;; :shadowed-var                          {:level :warning}
+
+  :unresolved-symbol
   {:exclude
-   [instaparse.core/transform
+   [(build.uberjar/with-duration-ms)
     (cljs.test/is [=? malli=])
     (clojure.core.logic/fresh)
     (clojure.core.logic/matcha)
     (clojure.core.logic/run)
-    (clojure.test/is [query= sql= =? malli=])
+    (clojure.test/is [query= =? malli=])
     (clojure.tools.macro/macrolet)
+    instaparse.core/transform
     (metabase.async.streaming-response/streaming-response)
     (metabase.driver.druid.query-processor-test/druid-query-returning-rows)
     (metabase.mbql.util.match/match)
@@ -25,33 +61,6 @@
     (taoensso.nippy/extend-freeze)
     (taoensso.nippy/extend-thaw)]}
 
-  :refer-all                                {:level   :warning
-                                             :exclude [clojure.test]}
-  ;; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
-  :unexpected-recur                         {:level :off}
-  ;; TODO (cam): can we fix these?
-  :unused-referred-var                      {:exclude {compojure.core [GET DELETE POST PUT]}}
-  :missing-else-branch                      {:level :warning}
-  :misplaced-docstring                      {:level :warning}
-  :non-arg-vec-return-type-hint             {:level :warning}
-  :missing-body-in-when                     {:level :warning}
-  :missing-docstring                        {:level :warning}
-  ;; TODO (braden): This is useful, but it doesn't grok eg. enterprise/backend/src
-  :namespace-name-mismatch                  {:level :off}
-  :use                                      {:level :warning}
-  :redundant-fn-wrapper                     {:level :warning}
-  :invalid-arity                            {:skip-args [metabase.mbql.util.match/match]}
-  :warn-on-reflection                       {:level :warning}
-  ;; TODO (cam): here are some more linters we should experiment with enabling -- some might be useful.
-  ;; :docstring-no-summary                  {:level :warning}
-  ;; :docstring-leading-trailing-whitespace {:level :warning}
-  ;; :reduce-without-init                   {:level :warning}
-  ;; :used-underscored-binding              {:level :warning}
-  ;; :single-key-in                         {:level :warning}
-  ;; :keyword-binding                       {:level :warning}
-  ;; :main-without-gen-class                {:level :warning}
-  ;; :shadowed-var                          {:level :warning}
-
   :deprecated-var
   {:exclude
    {metabase.cmd/dump                                                            {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
@@ -59,12 +68,6 @@
     metabase.db.data-migrations/data-migrations                                  {:namespaces ["metabase\\.db\\.data-migrations"]}
     metabase.db.data-migrations/defmigration                                     {:namespaces ["metabase\\.db\\.data-migrations"]}
     metabase.db.data-migrations/run-migration-if-needed!                         {:namespaces ["metabase\\.db\\.data-migrations"]}
-    metabase.driver.common/ThreadSafeSimpleDateFormat                            {:namespaces ["metabase\\.driver.*"]}
-    metabase.driver.common/create-db-time-formatters                             {:namespaces ["metabase\\.driver.*"]}
-    metabase.driver.common/current-db-time                                       {:namespaces ["metabase.*"]}
-    metabase.driver.common/current-db-time-date-formatters                       {:namespaces ["metabase\\.driver.*"]}
-    metabase.driver.common/current-db-time-native-query                          {:namespaces ["metabase\\.driver.*"]}
-    metabase.driver.common/first-successful-parse                                {:namespaces ["metabase\\.driver.*"]}
     metabase.driver.sql-jdbc.execute.old-impl/set-timezone-sql                   {:namespaces ["metabase\\.driver.*"]}
     metabase.driver.sql-jdbc.execute/set-time-zone-if-supported!                 {:namespaces ["metabase\\.driver.*"]}
     metabase.driver/current-db-time                                              {:namespaces ["metabase.*"]}
@@ -72,110 +75,43 @@
     metabase.public-settings.premium-features/enable-enhancements?               {:namespaces ["metabase\\.models.*"]}
     metabase.query-processor.middleware.resolve-joins/maybe-resolve-source-table {:namespaces ["metabase.*"]}
     metabase.query-processor.util/normalize-token                                {:namespaces ["metabase.*"]}
-    metabase.util.honeysql-extensions/*                                          {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/*honey-sql-version*                        {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/+                                          {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/-                                          {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/->boolean                                  {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/->date                                     {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/->datetime                                 {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/->integer                                  {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/->time                                     {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/->timestamp                                {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/->timestamp-with-time-zone                 {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions//                                          {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/IdentifierType                             {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/abs                                        {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/at-time-zone                               {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/call                                       {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/cast                                       {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/cast-unless-type-in                        {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/ceil                                       {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/concat                                     {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/database-type                              {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/day                                        {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/dec                                        {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/floor                                      {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/format                                     {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/hour                                       {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/identifier                                 {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/identifier?                                {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/inc                                        {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/is-of-type?                                {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/literal                                    {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/maybe-cast                                 {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/minute                                     {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/mod                                        {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/month                                      {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/quarter                                    {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/quoted-cast                                {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/raw                                        {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/round                                      {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/second                                     {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/type-info                                  {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/type-info->db-type                         {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/unwrap-typed-honeysql-form                 {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/week                                       {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/with-database-type-info                    {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/with-type-info                             {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
-    metabase.util.honeysql-extensions/year                                       {:namespaces ["^metabase\\.driver\\..*$" "^metabase\\.test\\.data\\..*" "^metabase\\.query-processor-test\\..*$"]}
     schema.core/both                                                             {:namespaces ["metabase.*"]}
     schema.core/either                                                           {:namespaces ["metabase.*"]}}}
 
   :discouraged-var
-  {clojure.core/print                   {:message "Use clojure.tools.logging instead of clojure.core/print"}
-   clojure.core/println                 {:message "Use clojure.tools.logging instead of clojure.core/println"}
-   clojure.core/printf                  {:message "Use clojure.tools.logging instead of clojure.core/printf"}
-   clojure.core/prn                     {:message "Use clojure.tools.logging instead of clojure.core/prn"}
-   clojure.core/pr                      {:message "Use clojure.tools.logging instead of clojure.core/pr"}
-   clojure.java.jdbc/get-connection     {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/get-connection"}
-   clojure.java.jdbc/with-db-connection {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/with-db-connection"}
-   clojure.java.jdbc/with-db-metadata   {:message "Use sql-jdbc.execute/do-with-connection-with-options + .getMetaData instead of jdbc/with-db-metadata"}
-   clojure.pprint/pprint                {:message "Use clojure.tools.logging instead of clojure.pprint/pprint"}
-   clojure.string/lower-case            {:message "Use metabase.util/lower-case-en instead of clojure.string/lower-case"}
-   clojure.string/upper-case            {:message "Use metabase.util/upper-case-en instead of clojure.string/upper-case"}
-   honeysql.core/call                   {:message "Use hx/call instead because it is Honey SQL 2 friendly"}
-   honeysql.core/raw                    {:message "Use hx/raw instead because it is Honey SQL 2 friendly"}
-   java-time/with-clock                 {:message "Use mt/with-clock"}
-   java.util.UUID/randomUUID            {:message "Use clojure.core/random-uuid instead of java.util.UUID/randomUUID"}
-   medley.core/random-uuid              {:message "Use clojure.core/random-uuid instead of medley.core/random-uuid"}
-   metabase.test/with-temp              {:message "Use t2.with-temp/with-temp instead of metabase.test/with-temp"}
-   ;; metabase.test/with-temp*             {:message "Use t2.with-temp/with-temp instead of metabase.test/with-temp*"}
-   toucan.db/select                     {:message "Use t2/select instead of toucan.db/select"}
-   toucan.db/select-one                 {:message "Use t2/select-one instead of toucan.db/select-one"}
-   toucan.db/select-one-id              {:message "Use t2/select-one-pk instead of toucan.db/select-one-id"}
-   toucan.db/select-one-field           {:message "Use t2/select-one-fn instead of toucan.db/select-one-field"}
-   toucan.db/select-ids                 {:message "Use t2/select-pks-set instead of toucan.db/select-ids"}
-   toucan.db/select-field               {:message "Use t2/select-fn instead of toucan.db/select-field"}
-   toucan.db/select-field->field        {:message "Use t2/select-fn->fn instead of toucan.db/select-field->field"}
-   toucan.db/select-field->id           {:message "Use t2/select-fn->pk instead of toucan.db/select-field->id"}
-   toucan.db/select-id->field           {:message "Use t2/select-pk->field instead of toucan.db/select-id->field"}
-   toucan.db/simple-insert!             {:message "Use t2/insert-returning-pks! with table name instead of toucan.db/simple-insert!"}
-   toucan.db/simple-insert-many!        {:message "Use t2/insert-returning-pks! with table name instead of toucan.db/simple-insert-many!"}
-   toucan.db/simple-delete!             {:message "Use t2/delete! with table name instead of toucan.db/simple-delete!"}
-   toucan.db/delete!                    {:message "Use t2/delete! instead of toucan.db/delete!"}
-   toucan.db/insert!                    {:message "Use t2/insert-returning-instances! instead of toucan.db/insert!"}
-   toucan.db/update!                    {:message "Use t2/update! instead of toucan.db/update!"}
-   toucan.db/update-where!              {:message "Use t2/update! instead of toucan.db/update-where!"}
-   toucan.db/query                      {:message "Use mdb.query/query instead of toucan.db/query"}
-   toucan.db/count                      {:message "Use t2/count instead of toucan.db/count"}
-   toucan.db/exists?                    {:message "Use t2/exists? instead of toucan.db/exists?"}
-   toucan.db/transaction                {:message "Use t2/with-transaction instead of toucan.db/transaction"}
-   toucan.db/with-call-counting         {:message "Use t2/with-call-count instead of toucan.db/with-call-counting"}
-   toucan.db/execute!                   {:message "Use t2/query-one instead of toucan.db/execute!"}
-   toucan.db/reducible-query            {:message "Use mdb.query/reducible-query instead of toucan.db/reducible-query"}
-   toucan.db/resolve-model              {:message "Use metabase.db.util/resolve-model instead of toucan.db/resolve-model"}
-   toucan.models/defmodel               {:message "Define a method for t2/table-name instead of toucan.models/defmodel"}
-   toucan.models/primary-key            {:message "Use metabase.db.util/primary-key instead of toucan.models/primary-key"}
-   toucan.models/model?                 {:message "Use mdb.u/toucan-model? instead of toucan.models/model?"}
-   toucan.hydrate/hydrate               {:message "Use t2/hydrate instead of toucan.hydrate/hydrate"}
-   toucan.util.test/with-temp-defaults  {:message "Use t2.with-temp/with-temp-defaults instead of toucan.util.test/with-temp-defaults"}
-   toucan.util.test/with-temp           {:message "Use t2.with-temp/with-temp instead of toucan.util.test/with-temp"}
-   toucan.util.test/with-temp*          {:message "Use t2.with-temp/with-temp instead of toucan.util.test/with-temp*"}}
+  {clojure.core/print                                 {:message "Use metabase.util.log instead of clojure.core/print"}
+   clojure.core/println                               {:message "Use metabase.util.log instead of clojure.core/println"}
+   clojure.core/printf                                {:message "Use metabase.util.log instead of clojure.core/printf"}
+   clojure.core/prn                                   {:message "Use metabase.util.log instead of clojure.core/prn"}
+   clojure.core/pr                                    {:message "Use metabase.util.log instead of clojure.core/pr"}
+   clojure.core/tap>                                  {:message "Don't use tap> is source code"}
+   clojure.core/time                                  {:message "Don't use time in source code"}
+   clojure.java.jdbc/get-connection                   {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/get-connection"}
+   clojure.java.jdbc/with-db-connection               {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/with-db-connection"}
+   clojure.java.jdbc/with-db-metadata                 {:message "Use sql-jdbc.execute/do-with-connection-with-options + .getMetaData instead of jdbc/with-db-metadata"}
+   clojure.pprint/pprint                              {:message "Use metabase.util.log instead of clojure.pprint/pprint"}
+   clojure.string/lower-case                          {:message "Use metabase.util/lower-case-en instead of clojure.string/lower-case"}
+   clojure.string/upper-case                          {:message "Use metabase.util/upper-case-en instead of clojure.string/upper-case"}
+   fipp.edn/pprint                                    {:message "Use metabase.util.log instead of fipp.edn/pprint"}
+   honeysql.core/call                                 {:message "Use hx/call instead because it is Honey SQL 2 friendly"}
+   honeysql.core/raw                                  {:message "Use hx/raw instead because it is Honey SQL 2 friendly"}
+   java-time/with-clock                               {:message "Use mt/with-clock"}
+   java.util.UUID/randomUUID                          {:message "Use clojure.core/random-uuid instead of java.util.UUID/randomUUID"}
+   malli.core/explainer                               {:message "Use metabase.util.malli.registry/explainer instead of malli.core/explainer"}
+   me.flowthing.pp/pprint                             {:message "Use metabase.util.log instead of me.flowthing.pp/pprint"}
+   medley.core/random-uuid                            {:message "Use clojure.core/random-uuid instead of medley.core/random-uuid"}
+   metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
+   metabase.test/with-temp*                           {:message "Use mt/with-temp instead of mt/with-temp*"}
+   toucan2.tools.with-temp                            {:message "Use mt/with-temp instead of t2.with-temp/with-temp"}}
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
    clojure.tools.logging  {:message "Use metabase.util.log instead of clojure.tools.logging directly"}
+   honeysql.core          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
+   honeysql.format        {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
+   honeysql.helpers       {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
+   honeysql.types         {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
+   honeysql.util          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
    metabase.util.jvm      {:message "All of metabase.util.jvm is re-exported from metabase.util; prefer that"}}
 
   :unresolved-var
@@ -252,6 +188,7 @@
     metabase.api.notify                                             api.notify
     metabase.api.permission-graph                                   api.permission-graph
     metabase.api.permissions                                        api.permissions
+    metabase.api.permissions-test-util                              perm-test-util
     metabase.api.pivots                                             api.pivots
     metabase.api.premium-features                                   api.premium-features
     metabase.api.preview-embed                                      api.preview-embed
@@ -274,6 +211,7 @@
     metabase.api.util                                               api.util
     metabase.async.streaming-response.thread-pool                   thread-pool
     metabase.automagic-dashboards.core                              magic
+    metabase.automagic-dashboards.dashboard-templates               dashboard-templates
     metabase.automagic-dashboards.populate                          populate
     metabase.cmd.copy.h2                                            copy.h2
     metabase.config                                                 config
@@ -321,6 +259,7 @@
     metabase.driver.sql.parameters.substitution                     sql.params.substitution
     metabase.email-test                                             et
     metabase.email.messages                                         messages
+    metabase.formatter                                              formatter
     metabase.http-client                                            client
     metabase.lib.util                                               lib.util
     metabase.mbql.normalize                                         mbql.normalize
@@ -339,6 +278,7 @@
     metabase.models.interface                                       mi
     metabase.models.moderation-review                               moderation-review
     metabase.models.native-query-snippet                            native-query-snippet
+    metabase.models.params                                          params
     metabase.models.permissions                                     perms
     metabase.models.permissions-group                               perms-group
     metabase.models.permissions-group-membership                    perms-group-membership
@@ -358,9 +298,9 @@
     metabase.pulse.markdown                                         markdown
     metabase.pulse.render                                           render
     metabase.pulse.render.body                                      body
-    metabase.pulse.render.common                                    common
     metabase.pulse.render.style                                     style
-    metabase.pulse.parameters                                       params
+    metabase.pulse.test-util                                        pulse.test-util
+    metabase.pulse.parameters                                       pulse-params
     metabase.query-processor-test                                   qp.test
     metabase.query-processor.context                                qp.context
     metabase.query-processor.error-type                             qp.error-type
@@ -387,6 +327,9 @@
     metabase.query-processor.timezone                               qp.timezone
     metabase.query-processor.util                                   qp.util
     metabase.related                                                related
+    metabase.search.config                                          search.config
+    metabase.search.filter                                          search.filter
+    metabase.search.util                                            search.util
     metabase.search.scoring                                         scoring
     metabase.server.middleware.auth                                 mw.auth
     metabase.server.middleware.browser-cookie                       mw.browser-cookie
@@ -425,6 +368,7 @@
     metabase.test.domain-entities                                   test.de
     metabase.test.mock.util                                         mock.util
     metabase.test.sync                                              test.sync
+    metabase.test.redefs                                            test.redefs
     metabase.test.util.js                                           test.js
     metabase.test.util.timezone                                     test.tz
     metabase.timeseries-query-processor-test.util                   tqpt
@@ -439,9 +383,7 @@
     metabase.util.encryption                                        encryption
     metabase.util.encryption-test                                   encryption-test
     metabase.util.files                                             u.files
-    metabase.util.honey-sql-1                                       h1x
     metabase.util.honey-sql-2                                       h2x
-    metabase.util.honeysql-extensions                               hx
     metabase.util.i18n                                              i18n
     metabase.util.i18n.impl                                         i18n.impl
     metabase.util.jvm                                               u.jvm
@@ -465,8 +407,10 @@
     toucan.db                                                       db
     toucan.models                                                   models}}
 
-  :metabase/validate-deftest                   {:level :warning}
-  :metabase/missing-test-expr-requires-in-cljs {:level :warning}}
+  :metabase/validate-deftest                                           {:level :warning}
+  :metabase/missing-test-expr-requires-in-cljs                         {:level :warning}
+  :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests {:level :warning}
+  :metabase/warn-about-schema=                                         {:level :warning}}
 
  :lint-as
  {clojure.core.logic/defne                                                             clj-kondo.lint-as/def-catch-all
@@ -475,6 +419,7 @@
   honeysql.helpers/defhelper                                                           clj-kondo.lint-as/def-catch-all
   honeysql.util/defalias                                                               clojure.core/def
   metabase-enterprise.serialization.test-util/with-random-dump-dir                     clojure.core/let
+  metabase-enterprise.serialization.test-util/with-dbs                                 clojure.core/fn
   metabase.actions.test-util/with-actions                                              clojure.core/let
   metabase.api.common/let-404                                                          clojure.core/let
   metabase.api.search-test/do-test-users                                               clojure.core/let
@@ -487,7 +432,8 @@
   metabase.db.schema-migrations-test.impl/with-temp-empty-app-db                       clojure.core/let
   metabase.domain-entities.malli/defn                                                  schema.core/defn
   metabase.driver.mongo.query-processor/mongo-let                                      clojure.core/let
-  metabase.driver.mongo.util/with-mongo-connection                                     clojure.core/let
+  metabase.driver.mongo.connection/with-mongo-client                                   clojure.core/let
+  metabase.driver.mongo.connection/with-mongo-database                                 clojure.core/let
   metabase.driver.sql-jdbc.actions/with-jdbc-transaction                               clojure.core/let
   metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection      clojure.core/let
   metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                clojure.core/fn
@@ -514,12 +460,18 @@
   metabase.test/with-actions                                                           clojure.core/let
   metabase.test/with-open-channels                                                     clojure.core/let
   metabase.test/with-single-admin-user                                                 clojure.core/fn
+
   metabase.test/with-temp-dir                                                          clojure.core/let
+  metabase.test/with-temp-empty-app-db                                                 clojure.core/let
   metabase.test/with-temp-file                                                         clojure.core/let
   metabase.test/with-user-in-groups                                                    clojure.core/let
+  metabase.upload-test/with-upload-table!                                              clojure.core/let
   metabase.util.files/with-open-path-to-resource                                       clojure.core/let
+  metabase.util.malli.defn/defn                                                        schema.core/defn
+  metabase.util.malli.fn/fn                                                            schema.core/fn
   metabase.util.malli/defmethod                                                        schema.core/defmethod
   metabase.util.malli/defn                                                             schema.core/defn
+  metabase.util.malli/fn                                                               schema.core/fn
   metabase.util.ssh/with-ssh-tunnel                                                    clojure.core/let
   monger.operators/defoperator                                                         clojure.core/def
   potemkin.types/defprotocol+                                                          clojure.core/defprotocol
@@ -535,22 +487,24 @@
  {:analyze-call
   {cljs.test/deftest                                                                                                         hooks.clojure.test/deftest
    cljs.test/is                                                                                                              hooks.clojure.test/is
+   cljs.test/use-fixtures                                                                                                    hooks.clojure.test/use-fixtures
    clojure.test/deftest                                                                                                      hooks.clojure.test/deftest
    clojure.test/is                                                                                                           hooks.clojure.test/is
+   clojure.test/use-fixtures                                                                                                 hooks.clojure.test/use-fixtures
    metabase-enterprise.advanced-config.caching-test/with-temp-persist-models                                                 hooks.common/with-seven-bindings
    metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
-   metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan.util.test/with-temp*
+   metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
    metabase.analytics.prometheus-test/with-prometheus-system                                                                 hooks.common/with-two-bindings
+   metabase.api.automagic-dashboards-test/with-indexed-model                                                                 hooks.metabase.api.automagic-dashboards-test/with-indexed-model
    metabase.api.alert-test/with-alert-in-collection                                                                          hooks.common/with-four-bindings
    metabase.api.card-test/with-persistence-setup                                                                             hooks.common/with-one-top-level-binding
-   metabase.api.card-test/with-temp-native-card                                                                              hooks.common/with-two-bindings
-   metabase.api.card-test/with-temp-native-card-with-params                                                                  hooks.common/with-two-bindings
+   metabase.api.card-test/with-temp-native-card!                                                                             hooks.common/with-two-bindings
+   metabase.api.card-test/with-temp-native-card-with-params!                                                                 hooks.common/with-two-bindings
    metabase.api.collection-test/with-french-user-and-personal-collection                                                     hooks.common/with-two-top-level-bindings
    metabase.api.common/defendpoint                                                                                           hooks.metabase.api.common/defendpoint
    metabase.api.common/defendpoint-async                                                                                     hooks.metabase.api.common/defendpoint
    metabase.api.common/defendpoint-async-schema                                                                              hooks.metabase.api.common/defendpoint
-   metabase.api.common/defendpoint-schema                                                                                    hooks.metabase.api.common/defendpoint
    metabase.api.dashboard-test/with-chain-filter-fixtures                                                                    hooks.common/let-one-with-optional-value
    metabase.api.dashboard-test/with-simple-dashboard-with-tabs                                                               hooks.common/with-one-binding
    metabase.api.card-test/with-card-param-values-fixtures                                                                    hooks.common/let-one-with-optional-value
@@ -570,6 +524,9 @@
    metabase.db.schema-migrations-test.impl/test-migrations                                                                   hooks.metabase.db.schema-migrations-test.impl/test-migrations
    metabase.dashboard-subscription-test/with-link-card-fixture-for-dashboard                                                 hooks.common/let-second
    metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
+   metabase.lib.test-util.macros/$ids                                                                                        hooks.metabase.test.data/$ids
+   metabase.lib.test-util.macros/mbql-query                                                                                  hooks.metabase.test.data/mbql-query
+   metabase.lib.test-util.macros/with-testing-against-standard-queries                                                       hooks.metabase.lib.test-util.macros/with-testing-against-standard-queries
    metabase.mbql.schema.macros/defclause                                                                                     hooks.metabase.mbql.schemas.macros/defclause
    metabase.models.collection-test/with-collection-hierarchy                                                                 hooks.common/let-one-with-optional-value
    metabase.models.collection-test/with-personal-and-impersonal-collections                                                  hooks.common/with-two-bindings
@@ -579,7 +536,7 @@
    metabase.models.interface/define-batched-hydration-method                                                                 hooks.metabase.models.interface/define-hydration-method
    metabase.models.pulse-test/with-dashboard-subscription-in-collection                                                      hooks.common/with-four-bindings
    metabase.models.pulse-test/with-pulse-in-collection                                                                       hooks.common/with-four-bindings
-   metabase.models.setting.multi-setting/define-multi-setting                                                                hooks.metabase.models.setting/defsetting
+   metabase.models.setting.multi-setting/define-multi-setting                                                                hooks.metabase.models.setting/define-multi-setting
    metabase.models.setting/defsetting                                                                                        hooks.metabase.models.setting/defsetting
    metabase.public-settings.premium-features/defenterprise                                                                   hooks.metabase.public-settings.premium-features/defenterprise
    metabase.pulse.test-util/checkins-query-card                                                                              hooks.metabase.test.data/$ids
@@ -612,10 +569,10 @@
    metabase.test/with-log-level                                                                                              hooks.common/with-ignored-first-arg
    metabase.test/with-log-messages-for-level                                                                                 hooks.common/with-ignored-first-arg
    metabase.test/with-non-admin-groups-no-root-collection-perms                                                              hooks.common/do*
-   metabase.test/with-temp*                                                                                                  hooks.toucan.util.test/with-temp*
+   metabase.test/with-temp                                                                                                   hooks.toucan2.tools.with-temp/with-temp
    metabase.test/with-temp-file                                                                                              hooks.metabase.test.util/with-temp-file
    metabase.test/with-temporary-setting-values                                                                               hooks.metabase.test.util/with-temporary-setting-values
-   toucan.util.test/with-temp*                                                                                               hooks.toucan.util.test/with-temp*}
+   metabase.util.malli.registry/def                                                                                          hooks.metabase.util.malli.registry/def}
 
   :macroexpand
   {clojurewerkz.quartzite.jobs/build                                            macros.quartz/build-job
@@ -643,11 +600,11 @@
    metabase.related-test/with-world                                             macros.metabase.related-test/with-world
    metabase.shared.util.namespaces/import-fn                                    macros.metabase.shared.util.namespaces/import-fn
    metabase.test.data.users/with-group-for-user                                 macros.metabase.test.data.users/with-group-for-user
-   metabase.test.util/with-temp-env-var-value                                   macros.metabase.test.util/with-temp-env-var-value
+   metabase.test.util/with-temp-env-var-value!                                  macros.metabase.test.util/with-temp-env-var-value!
    metabase.test.util/with-temporary-raw-setting-values                         macros.metabase.test.util/with-temporary-raw-setting-values
    metabase.test/with-group-for-user                                            macros.metabase.test.data.users/with-group-for-user
    metabase.test/with-persistence-enabled                                       macros.metabase.test.persistence/with-persistence-enabled
-   metabase.test/with-temp-env-var-value                                        macros.metabase.test.util/with-temp-env-var-value
+   metabase.test/with-temp-env-var-value!                                       macros.metabase.test.util/with-temp-env-var-value!
    metabase.test/with-temporary-raw-setting-values                              macros.metabase.test.util/with-temporary-raw-setting-values}}
 
  :config-in-comment
@@ -669,45 +626,31 @@
    :name    test-namespaces}
   {:pattern "^(?!.*-test(?:\\..*)?$)(?!.*test-util$)(?!^metabase\\.test.*).*$"
    :name    source-namespaces}
-  {:pattern "metabase\\.cmd.*"
+  {:pattern "(?:(?:^metabase\\.cmd.*)|(?:^build.*)|(?:^metabuild-common.*)|(?:^release.*)|(?:^i18n.*)|(?:^lint-migrations-file$))"
    :name    printable-namespaces}
   {:pattern "^metabase\\.lib\\.*"
    :name    metabase-lib}
-  ;; Basically everything except `metabase.driver.` or `metabase.test-data.` except for the drivers explicitly called
-  ;; out below. Remove these drivers from the regex once we switch to Honey SQL 2.
   ;;
-  ;; This regex is way too big to easily read or write by hand, so use the [[metabase.util.regex/rx]] macro to
-  ;; generate it. It was generated from the following form:
+  ;; QP source namespaces: `metabase.query-processor.*`, `metabase-enterprise.sandbox.query-processor.*`, and
+  ;; `metabase.driver.*`, excluding `-test` namespaces.
   ;;
-  ;; (str
-  ;;  (metabase.util.regex/rx
-  ;;   #"^metabase\."
-  ;;   [:not [:and #"util\." [:or "honeysql-extensions" "honey-sql-1"]]]
-  ;;   [:not "query-processor-test"]
-  ;;   [:not [:and
-  ;;          [:or "driver" #"test\.data"]
-  ;;          #"\."
-  ;;          [:or
-  ;;           [:and "sql" [:? "-jdbc"]]
-  ;;           #"(?:sql(?:-jdbc)?)"
-  ;;           "bigquery-cloud-sdk"
-  ;;           [:and "presto" [:? [:or "-common" "-jdbc"]]]
-  ;;           "sqlserver"]
-  ;;          [:? "-test"]
-  ;;          [:or #"\." #"$"]]]
-  ;;   ".*"))
-  ;;
-  ;; Please keep this form updated when you change the generated regex! <3
-  {:pattern "^metabase\\.(?!util\\.(?:(?:honeysql-extensions)|(?:honey-sql-1)))(?!query-processor-test)(?!(?:(?:driver)|(?:test\\.data))\\.(?:(?:sql(?:-jdbc)?)|(?:(?:sql(?:-jdbc)?))|(?:bigquery-cloud-sdk)|(?:presto(?:(?:(?:-common)|(?:-jdbc)))?)|(?:sqlserver))(?:-test)?(?:(?:\\.)|(?:$))).*"
-   :name    honey-sql-2-namespaces}]
+  {:pattern "metabase(?:(?:(?:-enterprise\\.sandbox)?\\.query-processor\\.)|(?:\\.driver\\.)).*(?<!-test)$"
+   :name    qp-and-driver-source-namespaces}]
 
  :config-in-ns
  {test-namespaces
   {:linters
-   {:inline-def                                    {:level :off}
-    :missing-docstring                             {:level :off}
-    :private-call                                  {:level :off}
-    :hooks.metabase.test.data/mbql-query-first-arg {:level :error}}}
+   {:inline-def                                          {:level :off}
+    :missing-docstring                                   {:level :off}
+    :private-call                                        {:level :off}
+    :metabase/defsetting-must-specify-export             {:level :off}
+    :hooks.metabase.test.data/mbql-query-first-arg       {:level :error}
+    :metabase/test-helpers-use-non-thread-safe-functions {:level :warning}}
+   :hooks
+   {:analyze-call
+    {clojure.core/defmacro hooks.clojure.core/non-thread-safe-form-should-end-with-exclamation
+     clojure.core/defn     hooks.clojure.core/non-thread-safe-form-should-end-with-exclamation
+     clojure.core/defn-    hooks.clojure.core/non-thread-safe-form-should-end-with-exclamation}}}
 
   source-namespaces
   {:linters
@@ -717,28 +660,20 @@
 
   printable-namespaces
   {:linters
-   {:discouraged-var {:level :off}}}
-
-  honey-sql-2-namespaces
-  {:linters
-   {:discouraged-namespace
-    {clj-yaml.core                     {:message "Use metabase.util.yaml"}
-     honeysql.core                     {:message "Use Honey SQL 2"}
-     honeysql.format                   {:message "Use Honey SQL 2"}
-     honeysql.helpers                  {:message "Use Honey SQL 2"}
-     honeysql.types                    {:message "Use Honey SQL 2"}
-     honeysql.util                     {:message "Use Honey SQL 2"}
-     metabase.util.honeysql-extensions {:message "Use h2x"}
-     metabase.util.honey-sql-1         {:message "Use h2x"}}}}
+   {:main-without-gen-class {:level :off}
+    :discouraged-var        {clojure.pprint/pprint     {:level :off}
+                             clojure.core/print        {:level :off}
+                             clojure.core/printf       {:level :off}
+                             clojure.core/println      {:level :off}
+                             clojure.string/lower-case {:level :off}
+                             clojure.string/upper-case {:level :off}}}}
 
   ;; enable all the extra linters we haven't enabled in the core app yet in MLv2. It's all new code so we can adhere
   ;; to the new stricter rules from day 1
   metabase-lib
   {:linters
    {:docstring-leading-trailing-whitespace                {:level :warning}
-    :reduce-without-init                                  {:level :warning}
     :used-underscored-binding                             {:level :warning}
-    :single-key-in                                        {:level :warning}
     :keyword-binding                                      {:level :warning}
     :shadowed-var                                         {:level :warning}
     :metabase/deftest-not-marked-parallel-or-synchronized {:level :warning}
@@ -746,5 +681,24 @@
     ;; eventually we should do this for the whole codebase, but the args are in the opposite order so switching them
     ;; all at once isn't trivial, at least we can stop using it in new code.
     :discouraged-var
-    {medley.core/map-keys {:message "Use clojure.core/update-keys"}
-     medley.core/map-vals {:message "Use clojure.core/update-vals"}}}}}}
+    {medley.core/map-keys    {:message "Use clojure.core/update-keys"}
+     medley.core/map-vals    {:message "Use clojure.core/update-vals"}
+     metabase.test/with-temp {:message "Don't use application database inside MLv2 code"}}
+
+    :discouraged-namespace
+    {toucan.db        {:message "Don't use application database inside MLv2 code"}
+     toucan.models    {:message "Don't use application database inside MLv2 code"}
+     toucan.util.test {:message "Don't use application database inside MLv2 code"}
+     toucan2.core     {:message "Don't use application database inside MLv2 code"}}}}
+
+  qp-and-driver-source-namespaces
+  {:linters
+   {:discouraged-namespace
+    {toucan.db         {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     toucan.models     {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     toucan.util.test  {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     toucan2.core      {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}
+
+    :discouraged-var
+    {metabase.db.query/query           {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     metabase.db.query/reducible-query {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}}}}}

.clj-kondo/hooks/clojure/core.clj

@@ -0,0 +1,200 @@
+(ns hooks.clojure.core
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]))
+
+(defn- node->qualified-symbol [node]
+  (try
+   (when (hooks/token-node? node)
+     (let [sexpr (hooks/sexpr node)]
+       (when (symbol? sexpr)
+         (let [resolved (hooks/resolve {:name sexpr})]
+           (when-not (= :clj-kondo/unknown-namespace (:ns resolved))
+             (symbol (name (:ns resolved)) (name (:name resolved))))))))
+   ;; some symbols like `*count/Integer` aren't resolvable.
+   (catch Exception _
+     nil)))
+
+(def ^:private white-card-symbols
+  '#{;; these toucan methods might actually set global values if it's used outside of a transaction,
+     ;; but since mt/with-temp runs in a transaction, so we'll ignore them in this case.
+     toucan2.core/delete!
+     toucan2.core/update!
+     toucan2.core/insert!
+     toucan2.core/insert-returning-instance!
+     toucan2.core/insert-returning-instances!
+     toucan2.core/insert-returning-pk!
+     toucan2.core/insert-returning-pks!
+     clojure.core.async/<!!
+     clojure.core.async/>!!
+     clojure.core.async/alts!!
+     clojure.core.async/close!
+     clojure.core.async/poll!
+     clojure.core.memoize/memo-clear!
+     clojure.core/conj!
+     clojure.core/persistent!
+     clojure.core/reset!
+     clojure.core/swap!
+     clojure.core/volatile!
+     clojure.core/vreset!
+     clojure.core/vswap!
+     clojure.java.jdbc/execute!
+     methodical.core/add-aux-method-with-unique-key!
+     methodical.core/remove-aux-method-with-unique-key!
+     next.jdbc/execute!
+
+     ;; TODO: most of these symbols shouldn't be here, we should go through them and
+     ;; find the functions/macros that use them and make sure their names end with !
+     ;; best way to do this is try remove each of these and rely on kondo output to find places where it's used
+     clojure.test/grant-collection-perms!
+     clojure.test/grant-collection-perms-fn!
+     clojure.test/grant-perms-fn!
+     clojure.test/purge-old-entries!
+     clojure.test/revoke-collection-perms!
+     clojure.test/save-results!
+     metabase-enterprise.advanced-permissions.models.permissions/update-db-download-permissions!
+     metabase-enterprise.internal-user/install-internal-user!
+     metabase-enterprise.sso.integrations.saml-test/call-with-login-attributes-cleared!
+     metabase.actions/perform-action!
+     metabase.analytics.snowplow-test/fake-track-event-impl!
+     metabase.analytics.snowplow/track-event-impl!
+     metabase.api.public-test/add-card-to-dashboard!
+     metabase.cmd.dump-to-h2/dump-to-h2!
+     metabase.cmd.load-from-h2/load-from-h2!
+     metabase.core/ensure-audit-db-installed!
+     metabase.db.schema-migrations-test.impl/run-migrations-in-range!
+     metabase.db.setup/migrate!
+     metabase.db.setup/setup-db!
+     metabase.db/setup-db!
+     metabase.driver.mongo-test/create-database-from-row-maps!
+     metabase.driver.postgres-test/create-enums-db!
+     metabase.driver.postgres-test/drop-if-exists-and-create-db!
+     metabase.driver.sql-jdbc.execute/execute-statement!
+     metabase.email-test/reset-inbox!
+     metabase.email/send-email!
+     metabase.models.action/insert!
+     metabase.models.collection.graph-test/clear-graph-revisions!
+     metabase.models.collection.graph-test/do-with-n-temp-users-with-personal-collections!
+     metabase.models.field-values/create-or-update-full-field-values!
+     metabase.models.model-index/add-values!
+     metabase.models.moderation-review/create-review!
+     metabase.models.on-demand-test/add-dashcard-with-parameter-mapping!
+     metabase.models.permissions/grant-application-permissions!
+     metabase.models.permissions/grant-collection-read-permissions!
+     metabase.models.permissions/grant-collection-readwrite-permissions!
+     metabase.models.permissions/grant-full-data-permissions!
+     metabase.models.permissions/grant-native-readwrite-permissions!
+     metabase.models.permissions/grant-permissions!
+     metabase.models.permissions/revoke-application-permissions!
+     metabase.models.permissions/revoke-data-perms!
+     metabase.models.permissions/update-data-perms-graph!
+     metabase.models.permissions/update-group-permissions!
+     metabase.models.persisted-info/ready-database!
+     metabase.models.revision/revert!
+     metabase.models.setting-test/test-user-local-allowed-setting!
+     metabase.models.setting-test/test-user-local-only-setting!
+     metabase.models.setting.cache/restore-cache!
+     metabase.models.setting/set!
+     metabase.models.setting/validate-settings-formatting!
+     metabase.permissions.test-util/with-restored-perms!
+     metabase.pulse/send-notifications!
+     metabase.pulse/send-pulse!
+     metabase.query-processor.streaming.interface/begin!
+     metabase.query-processor.streaming.interface/finish!
+     metabase.query-processor.streaming.interface/write-row!
+     metabase.sample-data/try-to-extract-sample-database!
+     metabase.setup/create-token!
+     metabase.sync.sync-metadata.fields.sync-metadata/update-field-metadata-if-needed!
+     metabase.sync.sync-metadata/sync-db-metadata!
+     metabase.sync.util-test/sync-database!
+     metabase.sync.util/store-sync-summary!
+     metabase.sync/sync-database!
+     metabase.task.index-values/job-init!
+     metabase.task.persist-refresh/job-init!
+     metabase.task.persist-refresh/refresh-tables!
+     metabase.task.persist-refresh/schedule-persistence-for-database!
+     metabase.task/delete-task!
+     metabase.test.data.bigquery-cloud-sdk/execute!
+     metabase.test.data.impl/copy-db-tables-and-fields!
+     metabase.test.data.impl/get-or-create-database!
+     metabase.test.data.impl/get-or-create-test-data-db!
+     metabase.test.data.interface/create-db!
+     metabase.test.data.interface/destroy-db!
+     metabase.test.data.oracle/create-user!
+     metabase.test.data.oracle/drop-user!
+     metabase.test.data.sql-jdbc.load-data/make-insert!
+     metabase.test.data.users/clear-cached-session-tokens!
+     metabase.test.initialize/do-initialization!
+     metabase.test.initialize/initialize-if-needed!
+     metabase.test.integrations.ldap/start-ldap-server!
+     metabase.test.util.log/ensure-unique-logger!
+     metabase.test.util.log/set-ns-log-level!
+     metabase.test.util/do-with-temp-env-var-value!
+     metabase.test.util/restore-raw-setting!
+     metabase.test.util/upsert-raw-setting!
+     metabase.test/initialize-if-needed!
+     metabase.test/test-helpers-set-global-values!
+     metabase.test/with-temp-env-var-value!
+     metabase.upload-test/set-local-infile!
+     metabase.util.files/create-dir-if-not-exists!
+     metabase.util.ssh-test/start-mock-servers!
+     metabase.util.ssh-test/stop-mock-servers!})
+
+(defn- end-with-exclamation?
+  [s]
+  (str/ends-with? s "!"))
+
+(defn- non-thread-safe-form-should-end-with-exclamation*
+  [{[defn-or-defmacro form-name] :children, :as node}]
+  (when-not (and (:string-value form-name)
+                 (end-with-exclamation? (:string-value form-name)))
+    (letfn [(walk [f form]
+              (f form)
+              (doseq [child (:children form)]
+                (walk f child)))]
+      (walk (fn [form]
+              (when-let [qualified-symbol (node->qualified-symbol form)]
+                (when (and (not (contains? white-card-symbols qualified-symbol))
+                           (end-with-exclamation? qualified-symbol))
+                  (hooks/reg-finding! (assoc (meta form-name)
+                                             :message (format "The name of this %s should end with `!` because it contains calls to non thread safe form `%s`."
+                                                              (:string-value defn-or-defmacro) qualified-symbol)
+                                             :type :metabase/test-helpers-use-non-thread-safe-functions)))))
+            node))
+    node))
+
+(defn non-thread-safe-form-should-end-with-exclamation
+  "Used to ensure defn and defmacro in test namespace to have name ending with `!` if it's non-thread-safe.
+  A function or a macro can be defined as 'not thread safe' when their funciton name ends with a `!`.
+
+  Only used in tests to identify thread-safe/non-thread-safe test helpers. See #37126"
+  [{:keys [node cljc lang]}]
+  (when (or (not cljc)
+            (= lang :clj))
+    (non-thread-safe-form-should-end-with-exclamation* node))
+  {:node node})
+
+(comment
+ (require '[clj-kondo.core :as clj-kondo])
+ (def form (str '(defmacro a
+                   [x]
+                   `(fun-call x))))
+
+ (def form "(defmacro a
+           [x]
+           `(some! ~x))")
+
+ (def form "(defun f
+           [x]
+           (let [g! (fn [] 1)]
+           (g!)))")
+
+ (str (hooks/parse-string form))
+ (hooks/sexpr (hooks/parse-string form))
+
+ (binding [hooks/*reload* true]
+   (-> form
+       (with-in-str (clj-kondo/run! {:lint ["-"]}))
+       :findings))
+
+ (do (non-thread-safe-form-should-end-with-exclamation* (hooks/parse-string form)) nil))

.clj-kondo/hooks/clojure/test.clj

@@ -1,20 +1,143 @@
 (ns hooks.clojure.test
-  (:require [clj-kondo.hooks-api :as hooks]))
+  (:require [clj-kondo.hooks-api :as hooks]
+            [clojure.string :as str]))
 
-(def disallowed-parallel-forms
-  '#{with-redefs
+(def ^:private disallowed-parallel-forms
+  "Things you should not be allowed to use inside parallel tests. Besides these, anything ending in `!` not whitelisted
+  in [[allowed-parallel-forms]] is not allowed."
+  '#{clojure.core/alter-var-root
      clojure.core/with-redefs
+     clojure.core/with-redefs-fn
+     metabase-enterprise.sandbox.test-util/with-gtaps
+     metabase-enterprise.sandbox.test-util/with-gtaps-for-user
+     metabase-enterprise.sandbox.test-util/with-user-attributes
+     metabase-enterprise.test/with-gtaps
+     metabase-enterprise.test/with-gtaps-for-user
+     metabase-enterprise.test/with-user-attributes
+     metabase.actions.test-util/with-actions
+     metabase.actions.test-util/with-actions-disabled
+     metabase.actions.test-util/with-actions-enabled
+     metabase.actions.test-util/with-actions-test-data
+     metabase.actions.test-util/with-actions-test-data-and-actions-enabled
+     metabase.actions.test-util/with-actions-test-data-tables
+     metabase.email-test/with-expected-messages
+     metabase.email-test/with-fake-inbox
+     metabase.test.data.users/with-group
+     metabase.test.data.users/with-group-for-user
+     metabase.test.persistence/with-persistence-enabled
+     metabase.test.util.log/with-log-level
+     metabase.test.util.log/with-log-messages-for-level
+     metabase.test.util.misc/with-single-admin-user
+     metabase.test.util.timezone/with-system-timezone-id
+     metabase.test.util/with-all-users-permission
+     metabase.test.util/with-column-remappings
+     metabase.test.util/with-discarded-collections-perms-changes
+     metabase.test.util/with-env-keys-renamed-by
+     metabase.test.util/with-locale
+     metabase.test.util/with-non-admin-groups-no-root-collection-for-namespace-perms
+     metabase.test.util/with-non-admin-groups-no-root-collection-perms
+     metabase.test.util/with-temp-env-var-value
+     metabase.test.util/with-temp-vals-in-db
+     metabase.test.util/with-temporary-raw-setting-values
+     metabase.test.util/with-temporary-setting-values
+     metabase.test.util/with-user-in-groups
+     metabase.test/with-actions
+     metabase.test/with-actions-disabled
+     metabase.test/with-actions-enabled
+     metabase.test/with-actions-test-data
+     metabase.test/with-actions-test-data-and-actions-enabled
+     metabase.test/with-actions-test-data-tables
+     metabase.test/with-all-users-permission
+     metabase.test/with-column-remappings
+     metabase.test/with-discarded-collections-perms-changes
+     metabase.test/with-env-keys-renamed-by
+     metabase.test/with-expected-messages
+     metabase.test/with-fake-inbox
+     metabase.test/with-group
+     metabase.test/with-group-for-user
+     metabase.test/with-locale
+     metabase.test/with-log-level
+     metabase.test/with-log-messages-for-level
+     metabase.test/with-non-admin-groups-no-root-collection-for-namespace-perms
+     metabase.test/with-non-admin-groups-no-root-collection-perms
+     metabase.test/with-persistence-enabled
+     metabase.test/with-single-admin-user
+     metabase.test/with-system-timezone-id
+     metabase.test/with-temp-env-var-value
+     metabase.test/with-temp-vals-in-db
+     metabase.test/with-temporary-raw-setting-values
      metabase.test/with-temporary-setting-values
-     mt/with-temporary-setting-values})
+     metabase.test/with-user-in-groups})
+
+;;; TODO -- we should disallow `metabase.test/user-http-request` with any method other than `:get`
+
+(def ^:private allowed-parallel-forms
+  "These fns are destructive, but are probably fine inside ^:parallel tests because it usually means you're doing
+  something to an atom or something like that."
+  '#{clojure.core/assoc!
+     clojure.core/compare-and-set!
+     clojure.core/conj!
+     clojure.core/disj!
+     clojure.core/dissoc!
+     clojure.core/persistent!
+     clojure.core/pop!
+     clojure.core/reset!
+     clojure.core/reset-vals!
+     clojure.core/run!
+     clojure.core/swap!
+     clojure.core/swap-vals!
+     clojure.core/volatile!
+     clojure.core/vreset!
+     clojure.core/vswap!
+     clojure.core.async/<!
+     clojure.core.async/<!!
+     clojure.core.async/>!
+     clojure.core.async/>!!
+     clojure.core.async/alt!
+     clojure.core.async/alt!!
+     clojure.core.async/alts!
+     clojure.core.async/alts!!
+     clojure.core.async/close!
+     clojure.core.async/ioc-alts!
+     clojure.core.async/offer!
+     clojure.core.async/onto-chan!
+     clojure.core.async/onto-chan!!
+     clojure.core.async/poll!
+     clojure.core.async/put!
+     clojure.core.async/take!
+     clojure.core.async/to-chan!
+     clojure.core.async/to-chan!!
+     metabase.driver.sql-jdbc.execute/execute-prepared-statement!
+     metabase.query-processor/process-query-and-save-execution!
+     metabase.query-processor/process-query-and-save-with-max-results-constraints!
+     metabase.query-processor.store/store-database!})
+
+(defn- node->qualified-symbol [node]
+  (try
+    (when (hooks/token-node? node)
+      (let [sexpr (hooks/sexpr node)]
+        (when (symbol? sexpr)
+          (when-let [resolved (hooks/resolve {:name sexpr})]
+            (symbol (name (:ns resolved)) (name (:name resolved)))))))
+    ;; some symbols like `*count/Integer` aren't resolvable.
+    (catch Exception _
+      nil)))
 
 (defn- warn-about-disallowed-parallel-forms [form]
-  (letfn [(f [form]
-            (when-let [sexpr (when (hooks/token-node? form)
-                               (hooks/sexpr form))]
-              (when (disallowed-parallel-forms sexpr)
-                (hooks/reg-finding! (assoc (meta form)
-                                           :message (format "%s is not allowed inside a ^:parallel test" sexpr)
-                                           :type :metabase/validate-deftest)))))
+  (letfn [(error! [form message]
+            (hooks/reg-finding! (assoc (meta form)
+                                       :message message
+                                       :type :metabase/validate-deftest)))
+          (f [form]
+            (when-let [qualified-symbol (node->qualified-symbol form)]
+              (cond
+                (disallowed-parallel-forms qualified-symbol)
+                (error! form (format "%s is not allowed inside a ^:parallel test or test fixture" qualified-symbol))
+
+                (and (not (allowed-parallel-forms qualified-symbol))
+                     (str/ends-with? (name qualified-symbol) "!"))
+                (error! form (format "destructive functions like %s are not allowed inside a ^:parallel test or test fixture. If this should be allowed, add it to the whitelist in .clj-kondo/hooks/clojure/test.clj"
+                                     qualified-symbol)))))
           (walk [form]
             (f form)
             (doseq [child (:children form)]
@@ -53,12 +176,28 @@
       (doseq [form body]
         (warn-about-disallowed-parallel-forms form)))))
 
+(def ^:private number-of-lines-for-a-test-to-be-considered-horrifically-long
+  200)
+
+(defn- deftest-check-not-horrifically-long
+  [node]
+  (let [{:keys [row end-row]} (meta node)]
+    (when (and row end-row)
+      (let [num-lines (- end-row row)]
+        (when (>= num-lines number-of-lines-for-a-test-to-be-considered-horrifically-long)
+          (hooks/reg-finding! (assoc (meta node)
+                                     :message (str (format "This test is horrifically long, it's %d lines! 😱 " num-lines)
+                                                   "Do you really want to try to debug it if it fails? 💀 "
+                                                   "Split it up into smaller tests! 🥰")
+                                     :type :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests)))))))
+
 (defn deftest [{:keys [node cljc lang]}]
   ;; run [[deftest-check-parallel]] only once... if this is a `.cljc` file only run it for the `:clj` analysis, no point
   ;; in running it twice.
   (when (or (not cljc)
             (= lang :clj))
     (deftest-check-parallel node))
+  (deftest-check-not-horrifically-long node)
   {:node node})
 
 ;;; this is a hacky way to determine whether these namespaces are required in the `ns` form or not... basically `:ns`
@@ -95,7 +234,20 @@
 
               nil)))))))
 
+(defn- warn-about-schema= [{[_is assertion-node] :children, :as _is-node}]
+  (let [{[assertion-symb-node] :children} assertion-node]
+    (when (and (hooks/token-node? assertion-symb-node)
+               (= (hooks/sexpr assertion-symb-node) 'schema=))
+      (hooks/reg-finding! (assoc (meta assertion-symb-node)
+                                 :message "Use =? or malli= instead of schema="
+                                 :type :metabase/warn-about-schema=)))))
+
 (defn is [{:keys [node lang]}]
   (when (= lang :cljs)
     (warn-about-missing-test-expr-requires-in-cljs node))
+  (warn-about-schema= node)
+  {:node node})
+
+(defn use-fixtures [{:keys [node]}]
+  (warn-about-disallowed-parallel-forms node)
   {:node node})

.clj-kondo/hooks/metabase/api/automagic_dashboards_test.clj

@@ -0,0 +1,28 @@
+(ns hooks.metabase.api.automagic-dashboards-test
+  (:require [clj-kondo.hooks-api :as hooks]))
+
+(comment
+
+  (def input (hooks/parse-string
+              "(with-indexed-model [{:keys [model model-index model-index-value]}
+                                    {:query :some-query}]
+                  :foo :bar :body)"))
+
+  (println (hooks/sexpr input))
+
+  (let [f (load-file ".clj-kondo/hooks/metabase/api/automagic_dashboards_test.clj")]
+    (f {:node input})))
+
+(defn with-indexed-model
+  [{node :node}]
+  (let [[_macro-call binding-and-query-info & body] (:children node)
+        [binding query-info] (:children binding-and-query-info)
+        node* (hooks/list-node
+               [(hooks/token-node 'do-with-testing-model)
+                query-info
+                (hooks/list-node
+                 (list* (hooks/token-node 'fn)
+                        (hooks/vector-node [binding])
+                        body))])]
+    #_(println (hooks/sexpr node*))
+    {:node node*}))

.clj-kondo/hooks/metabase/db/schema_migrations_test/impl.clj

@@ -8,7 +8,7 @@
                 (hooks/token-node `let)
                 (hooks/vector-node
                  [binding (hooks/list-node (list (hooks/token-node `fn)
-                                                 (hooks/vector-node [])))])
+                                                 (hooks/vector-node [(hooks/token-node '&) (hooks/token-node '_args)])))])
                 migration-range
                 body))]
     {:node node*}))

.clj-kondo/hooks/metabase/lib/test_util/macros.clj

@@ -0,0 +1,12 @@
+(ns hooks.metabase.lib.test-util.macros
+  (:require [clj-kondo.hooks-api :as hooks]))
+
+(defn with-testing-against-standard-queries [{{[_ & args] :children} :node}]
+  (let [[query-sym & body] args
+        node* (hooks/list-node
+                (list*
+                  (hooks/token-node 'let)
+                  (hooks/vector-node
+                    [query-sym (hooks/token-node 'nil)])
+                  body))]
+    {:node node*}))

.clj-kondo/hooks/metabase/models/setting.clj

@@ -3,6 +3,208 @@
    [clj-kondo.hooks-api :as hooks]
    [hooks.common :as common]))
 
+(def ^:private ignored-implicit-export?
+  '#{active-users-count
+     admin-email
+     analytics-uuid
+     anon-tracking-enabled
+     api-key
+     attachment-table-row-limit
+     audit-max-retention-days
+     bcc-enabled?
+     breakout-bin-width
+     check-for-updates
+     cloud-gateway-ips
+     config-from-file-sync-databases
+     custom-homepage
+     custom-homepage-dashboard
+     database-enable-actions
+     deprecation-notice-version
+     dismissed-custom-dashboard-toast
+     email-configured?
+     email-from-address
+     email-from-name
+     email-reply-to
+     email-smtp-host
+     email-smtp-password
+     email-smtp-port
+     email-smtp-security
+     email-smtp-username
+     embedding-app-origin
+     embedding-secret-key
+     enable-password-login
+     enable-public-sharing
+     enable-query-caching
+     engines
+     enum-cardinality-threshold
+     follow-up-email-sent
+     ga-code
+     ga-enabled
+     google-auth-auto-create-accounts-domain
+     google-auth-client-id
+     google-auth-configured
+     google-auth-enabled
+     has-sample-database?
+     has-user-setup
+     help-link
+     help-link-custom-destination
+     instance-creation
+     is-hosted?
+     is-metabot-enabled
+     jdbc-data-warehouse-max-connection-pool-size
+     jdbc-data-warehouse-unreturned-connection-timeout-seconds
+     jwt-attribute-email
+     jwt-attribute-firstname
+     jwt-attribute-groups
+     jwt-attribute-lastname
+     jwt-configured
+     jwt-enabled
+     jwt-group-mappings
+     jwt-group-sync
+     jwt-identity-provider-uri
+     jwt-user-provisioning-enabled?
+     jwt-shared-secret
+     last-acknowledged-version
+     ldap-attribute-email
+     ldap-attribute-firstname
+     ldap-attribute-lastname
+     ldap-bind-dn
+     ldap-configured?
+     ldap-enabled
+     ldap-group-base
+     ldap-group-mappings
+     ldap-group-membership-filter
+     ldap-group-sync
+     ldap-host
+     ldap-password
+     ldap-port
+     ldap-user-provisioning-enabled?
+     ldap-security
+     ldap-sync-user-attributes
+     ldap-sync-user-attributes-blacklist
+     ldap-user-base
+     ldap-user-filter
+     load-analytics-content
+     map-tile-server-url
+     metabot-default-embedding-model
+     metabot-feedback-url
+     metabot-get-prompt-templates-url
+     metabot-prompt-generator-token-limit
+     multi-setting-read-only
+     notification-link-base-url
+     num-metabot-choices
+     openai-api-key
+     openai-available-models
+     openai-model
+     openai-organization
+     other-sso-enabled?
+     password-complexity
+     persist-models-enabled
+     persisted-model-refresh-cron-schedule
+     premium-embedding-token
+     prometheus-server-port
+     query-caching-max-kb
+     query-caching-max-ttl
+     query-caching-min-ttl
+     query-caching-ttl-ratio
+     redirect-all-requests-to-https
+     reset-token-ttl-hours
+     retired-setting
+     retry-initial-interval
+     retry-max-attempts
+     retry-max-interval-millis
+     retry-multiplier
+     retry-randomization-factor
+     saml-application-name
+     saml-attribute-email
+     saml-attribute-firstname
+     saml-attribute-group
+     saml-attribute-lastname
+     saml-configured
+     saml-enabled
+     saml-group-mappings
+     saml-group-sync
+     saml-identity-provider-certificate
+     saml-identity-provider-issuer
+     saml-identity-provider-uri
+     saml-keystore-alias
+     saml-keystore-password
+     saml-keystore-path
+     saml-user-provisioning-enabled?
+     send-email-on-first-login-from-new-device
+     send-new-sso-user-admin-email?
+     session-cookie-samesite
+     session-cookies
+     session-timeout
+     setup-token
+     show-database-syncing-modal
+     show-metabase-links
+     site-url
+     site-uuid
+     site-uuid-for-premium-features-token-checks
+     site-uuid-for-unsubscribing-url
+     site-uuid-for-version-info-fetching
+     slack-app-token
+     slack-cached-channels-and-usernames
+     slack-channels-and-usernames-last-updated
+     slack-files-channel
+     slack-token
+     slack-token-valid?
+     snowplow-available
+     snowplow-enabled
+     snowplow-url
+     sql-jdbc-fetch-size
+     ssh-heartbeat-interval-sec
+     ssl-certificate-public-key
+     startup-time-millis
+     token-features
+     token-status
+     toucan-name
+     uncached-setting
+     uploads-table-prefix
+     user-visibility
+     version
+     version-info
+     version-info-last-checked})
+
+(defn- defsetting-lint [node setting-name docstring options-list]
+  (let [anon-binding (common/with-macro-meta (hooks/token-node '_) node)
+        ;; (defn my-setting [] ...)
+        getter-node (-> (list
+                         (hooks/token-node 'defn)
+                         setting-name
+                         (hooks/string-node "Docstring.")
+                         (hooks/vector-node []))
+                        hooks/list-node
+                        (with-meta (meta node)))
+        ;; (defn my-setting! [_x] ...)
+        setter-node (-> (list
+                         (hooks/token-node 'defn)
+                         (with-meta
+                           (hooks/token-node (symbol (str (hooks/sexpr setting-name) \!)))
+                           (meta setting-name))
+                         (hooks/string-node "Docstring.")
+                         (hooks/vector-node [(hooks/token-node '_value-or-nil)]))
+                        hooks/list-node
+                        (with-meta (update (meta node) :clj-kondo/ignore #(hooks/vector-node (cons :clojure-lsp/unused-public-var (:children %))))))]
+
+    (when (nil? (second (drop-while (comp not #{[:k :export?]} first) options-list)))
+      (when-not (contains? ignored-implicit-export? (:value setting-name))
+        (hooks/reg-finding! (assoc (meta node)
+                                   :message "Setting definition must provide an explicit value for :export? indicating whether the setting should be exported or not with serialization."
+                                   :type :metabase/defsetting-must-specify-export))))
+
+    {:node (-> (list
+                (hooks/token-node 'let)
+                 ;; include description and the options map so they can get validated as well.
+                (hooks/vector-node
+                 [anon-binding docstring
+                  anon-binding (hooks/map-node options-list)])
+                getter-node
+                setter-node)
+               hooks/list-node
+               (with-meta (meta node)))}))
+
 (defn defsetting
   "Rewrite a [[metabase.models.defsetting]] form like
 
@@ -11,54 +213,45 @@
   as
 
     (let [_ \"Description\"
-          _ :type
-          _ :boolean]
+          _ {:type :boolean}]
       (defn my-setting \"Docstring.\" [])
       (defn my-setting! \"Docstring.\" [_value-or-nil]))
 
   for linting purposes."
   [{:keys [node]}]
-  (let [[setting-name & args] (rest (:children node))
-        ;; (defn my-setting [] ...)
-        getter-node           (-> (list
-                                   (hooks/token-node 'defn)
-                                   setting-name
-                                   (hooks/string-node "Docstring.")
-                                   (hooks/vector-node []))
-                                  hooks/list-node
-                                  (with-meta (meta node)))
-        ;; (defn my-setting! [_x] ...)
-        setter-node           (-> (list
-                                   (hooks/token-node 'defn)
-                                   (with-meta
-                                     (hooks/token-node (symbol (str (hooks/sexpr setting-name) \!)))
-                                     (meta setting-name))
-                                   (hooks/string-node "Docstring.")
-                                   (hooks/vector-node [(hooks/token-node '_value-or-nil)]))
-                                  hooks/list-node
-                                  (with-meta (update (meta node) :clj-kondo/ignore #(hooks/vector-node (cons :clojure-lsp/unused-public-var (:children %))))))]
-    {:node (-> (list
-                (hooks/token-node 'let)
-                ;; include description and the options map so they can get validated as well.
-                (hooks/vector-node (vec (interleave (repeat (common/with-macro-meta (hooks/token-node '_) node))
-                                                    args)))
-                getter-node
-                setter-node)
-               hooks/list-node
-               (with-meta (meta node)))}))
+  (let [[setting-name docstring & options] (rest (:children node))]
+    (defsetting-lint node setting-name docstring options)))
+
+(defn define-multi-setting
+  "Rewrite a [[metabase.models.define-multi-setting]] form like
+
+    (defsetting my-setting \"Description\" :key :type :boolean)
+
+  as
+
+    (let [_ \"Description\"
+          _ {:type :boolean, :multi-thunk :key}]
+      (defn my-setting \"Docstring.\" [])
+      (defn my-setting! \"Docstring.\" [_value-or-nil]))
+
+  for linting purposes."
+  [{:keys [node]}]
+  (let [[setting-name docstring thunk & options] (rest (:children node))]
+    (defsetting-lint node setting-name docstring (concat options [(hooks/token-node :multi-thunk) thunk]))))
 
 (comment
   (defn- defsetting* [form]
     (hooks/sexpr
-     (:node
-      (defsetting
-        {:node
-         (hooks/parse-string
-          (with-out-str
-            (clojure.pprint/pprint
-             form)))}))))
+      (:node
+        (defsetting
+          {:node
+           (hooks/parse-string
+             (with-out-str
+               #_{:clj-kondo/ignore [:unresolved-namespace]}
+               (clojure.pprint/pprint
+                form)))}))))
 
-  (defn- x []
+  (defn x []
     (defsetting*
       '(defsetting active-users-count
          (deferred-tru "Cached number of active users. Refresh every 5 minutes.")

.clj-kondo/hooks/metabase/util/malli/registry.clj

@@ -0,0 +1,20 @@
+(ns hooks.metabase.util.malli.registry
+  (:refer-clojure :exclude [def])
+  (:require
+   [clj-kondo.hooks-api :as api]))
+
+(defn def
+  "Register the schema keyword so LSP can jump to it."
+  [x]
+  (letfn [(update-def-keyword [k]
+            (api/reg-keyword! k 'metabase.util.malli.registry/def))
+          (update-children [[_def k :as children]]
+            (if (api/keyword-node? k)
+              (update (vec children) 1 update-def-keyword)
+              children))
+          (update-node [node]
+            (if (api/list-node? node)
+              (-> (api/list-node (update-children (:children node)))
+                  (with-meta (meta node)))
+              node))]
+    (update x :node update-node)))

.clj-kondo/macros/metabase/test/util.clj

@@ -1,11 +1,11 @@
 (ns macros.metabase.test.util)
 
-(defmacro with-temp-env-var-value [bindings & body]
+(defmacro with-temp-env-var-value! [bindings & body]
   `((constantly nil)
     ~@(map second (partition-all 2 bindings))
     ~@body))
 
 (defmacro with-temporary-raw-setting-values [bindings & body]
   `((constantly nil)
-     ~@(map second (partition-all 2 bindings))
+    ~@(map second (partition-all 2 bindings))
      ~@body))

.clj-kondo/methodical/methodical/config.edn

@@ -1,14 +0,0 @@
-{:config-paths ["macros"]
-
- :lint-as
- {}
-
- :hooks
- {:analyze-call
-  {methodical.core/defmethod   hooks.methodical.macros/defmethod
-   methodical.core/defmulti    hooks.methodical.macros/defmulti
-   methodical.macros/defmethod hooks.methodical.macros/defmethod
-   methodical.macros/defmulti  hooks.methodical.macros/defmulti}
-
-  :macroexpand
-  {methodical.impl.combo.operator/defoperator macros.methodical.impl.combo.operator/defoperator}}}

.clj-kondo/methodical/methodical/hooks/methodical/core.clj

@@ -1,68 +0,0 @@
-(ns hooks.methodical.core
-  (:require [clj-kondo.hooks-api :as hooks]))
-
-(defn add-next-method [fn-tail]
-  (if (hooks/vector-node? (first fn-tail))
-    (let [[args & body] fn-tail]
-      (list*
-       (-> (hooks/vector-node
-            (cons (hooks/token-node 'next-method)
-                  (:children args)))
-           (with-meta (meta args)))
-       ;; so Kondo stops complaining about it being unused.
-       (hooks/token-node 'next-method)
-       body))
-    (for [list-node fn-tail]
-      (hooks/list-node (add-next-method (:children list-node))))))
-
-(defn defmethod
-  [{{[_ multimethod & [first-arg :as args]] :children, :as node} :node}]
-  #_(clojure.pprint/pprint (hooks/sexpr node))
-  (let [[aux-qualifier dispatch-value & fn-tail] (if (#{:before :after :around} (hooks/sexpr first-arg))
-                                                   (cons (hooks/sexpr first-arg) (rest args))
-                                                   (cons nil args))
-        fn-tail                                  (if (contains? #{:around nil} aux-qualifier)
-                                                   (add-next-method fn-tail)
-                                                   fn-tail)
-        result                                   (hooks/list-node
-                                                  (list* (hooks/token-node 'clojure.core/defmethod)
-                                                         multimethod
-                                                         dispatch-value
-                                                         fn-tail))]
-    #_(println "=>")
-    #_(clojure.pprint/pprint (hooks/sexpr result))
-    {:node result}))
-
-(defn defmulti
-  [{{[_ multimethod-name & args] :children, :as node} :node}]
-  #_(clojure.pprint/pprint (hooks/sexpr node))
-  (let [[docstring & args]         (if (hooks/string-node? (first args))
-                                     args
-                                     (cons nil args))
-        [attribute-map & args]     (if (hooks/map-node? (first args))
-                                     args
-                                     (cons nil args))
-        ;; if there wasn't a positional dispatch function arg passed just use (constantly nil) so Kondo won't complain
-        [dispatch-fn & kv-options] (if (odd? (count args))
-                                     args
-                                     (cons (hooks/list-node
-                                            (list
-                                             (hooks/token-node 'clojure.core/constantly)
-                                             (hooks/token-node 'nil)))
-                                           args))]
-    (let [defmulti-form (hooks/list-node
-                         (filter
-                          some?
-                          [(hooks/token-node 'clojure.core/defmulti)
-                           multimethod-name
-                           docstring
-                           attribute-map
-                           dispatch-fn]))
-          result   (hooks/list-node
-                    (list*
-                     (hooks/token-node 'do)
-                     defmulti-form
-                     kv-options))]
-      #_(println "=>")
-      #_(clojure.pprint/pprint (hooks/sexpr result))
-      {:node result})))

.clj-kondo/methodical/methodical/hooks/methodical/macros.clj

@@ -1,185 +0,0 @@
-(ns hooks.methodical.macros
-  (:refer-clojure :exclude [defmulti defmethod])
-  (:require
-   [clj-kondo.hooks-api :as hooks]))
-
-;;; The code below is basically simulating the spec for parsing defmethod args without using spec. It uses a basic
-;;; backtracking algorithm to achieve a similar result. Parsing defmethod args is kinda complicated.
-;;;
-;;; Unfortunately this is hardcoded to `:before`, `:after`, and `:around` as the only allowed qualifiers for now... at
-;;; some point in the future we'll have to figure out how to fix this and support other qualifiers too.
-
-(defn- bindings-vector? [x]
-  (and (hooks/vector-node? x)
-       (every? (some-fn hooks/token-node?
-                        hooks/map-node?
-                        hooks/vector-node?)
-               (:children x))))
-
-(defn- single-arity-fn-tail? [args]
-  (bindings-vector? (first args)))
-
-(defn- n-arity-fn-tail? [args]
-  (and (seq args)
-       (every? (fn [x]
-                 (and (hooks/list-node? x)
-                      (single-arity-fn-tail? (:children x))))
-               args)))
-
-(defn- fn-tail? [args]
-  (or (single-arity-fn-tail? args)
-      (n-arity-fn-tail? args)))
-
-(defn- qualifier? [x]
-  (and (hooks/keyword-node? x)
-       (#{:before :after :around} (hooks/sexpr x))))
-
-(defn- dispatch-value?
-  "A dispatch value can be anything except for qualifier keyword or a list that looks like part of a n-arity function tail
-  e.g. `([x] x)`."
-  [x]
-  (and (not (qualifier? x))
-       (or (not (hooks/list-node? x))
-           (not (single-arity-fn-tail? (:children x))))))
-
-(defonce ^:private backtrack (Exception.))
-
-(defn- parse-defmethod-args
-  ([unparsed]
-   (let [parses (atom [])]
-     (try
-       (parse-defmethod-args parses {} unparsed)
-       (catch Exception _
-         (when (zero? (count @parses))
-           (throw (ex-info (format "Unable to parse defmethod args: %s" (pr-str (mapv hooks/sexpr unparsed)))
-                           {:args (mapv hooks/sexpr unparsed)})))
-         (when (> (count @parses) 1)
-           (throw (ex-info (format "Ambiguous defmethod args: %s" (pr-str (mapv hooks/sexpr unparsed)))
-                           {:args (mapv hooks/sexpr unparsed)
-                            :parses @parses})))
-         (first @parses)))))
-
-  ([parses parsed unparsed]
-   (cond
-     (and (not (contains? parsed :qualifier))
-          (qualifier? (first unparsed)))
-     (try
-       (parse-defmethod-args parses (assoc parsed :qualifier (first unparsed)) (rest unparsed))
-       (catch Exception _
-         (parse-defmethod-args parses (assoc parsed :qualifier nil) unparsed)))
-
-     (and (not (contains? parsed :dispatch-value))
-          (dispatch-value? (first unparsed)))
-     (parse-defmethod-args parses (assoc parsed :dispatch-value (first unparsed)) (rest unparsed))
-
-     (not (contains? parsed :dispatch-value))
-     (throw backtrack)
-
-     (and (not (contains? parsed :unique-key))
-          (:qualifier parsed)           ; can only have unique keys for aux methods
-          (not (hooks/string-node? (first unparsed)))
-          (not (hooks/list-node? (first unparsed)))
-          (not (hooks/vector-node? (first unparsed))))
-     (try
-       (parse-defmethod-args parses (assoc parsed :unique-key (first unparsed)) (rest unparsed))
-       (catch Exception _
-         (parse-defmethod-args parses (assoc parsed :unique-key nil) unparsed)))
-
-     (and (not (contains? parsed :docstring))
-          (hooks/string-node? (first unparsed)))
-     (try
-       (parse-defmethod-args parses (assoc parsed :docstring (first unparsed)) (rest unparsed))
-       (catch Exception _
-         (parse-defmethod-args parses (assoc parsed :docstring nil) unparsed)))
-
-     (fn-tail? unparsed)
-     (do
-       (swap! parses conj (assoc parsed :fn-tail unparsed))
-       (throw backtrack))
-
-     :else
-     (throw backtrack))))
-
-(defn defmethod
-  [{{[_ multimethod & args] :children, :as node} :node}]
-  (#_println)
-  #_(clojure.pprint/pprint (hooks/sexpr node))
-  (let [parsed (parse-defmethod-args args)]
-    #_(doseq [[k v] parsed]
-        (println \newline k '=> (pr-str (some-> v hooks/sexpr))))
-    (let [fn-tail     (:fn-tail parsed)
-          other-stuff (dissoc parsed :fn-tail)
-          result      (hooks/list-node
-                       (concat
-                        [(hooks/token-node 'do)
-                         multimethod]
-                        (filter some? (vals other-stuff))
-                        [(-> (hooks/list-node
-                              (list*
-                               (hooks/token-node 'fn)
-                               (hooks/token-node (if (contains? #{nil :around} (some-> (:qualifier parsed) hooks/sexpr))
-                                                   'next-method
-                                                   '__FN__NAME__THAT__YOU__CANNOT__REFER__TO__))
-                               fn-tail))
-                             (vary-meta update :clj-kondo/ignore conj :redundant-fn-wrapper))]))]
-      #_(println "=>")
-      #_(clojure.pprint/pprint (hooks/sexpr result))
-      {:node result})))
-
-;;; this stuff is for debugging things to make sure we didn't do something dumb
-(comment
-  (defn defmethod* [form]
-    (binding [*print-meta* true]
-      (clojure.pprint/pprint
-       (hooks/sexpr (:node (defmethod {:node (hooks/parse-string (str form))}))))))
-
-  (defmethod* '(defmethod mf :second [& _] 2))
-
-  (defmethod* '(m/defmethod multi-arity :k
-                 ([x]
-                  {:x x})
-                 ([x y]
-                  {:x x, :y y})))
-
-  (defmethod* '(m/defmethod mf1 :docstring
-                 "Docstring"
-                 [_x]))
-
-  (defmethod* '(m/defmethod mf1 :around :dispatch-value
-                 "Docstring"
-                 [x]
-                 (next-method x))))
-
-(defn defmulti
-  [{{[_ multimethod-name & args] :children, :as node} :node}]
-  #_(clojure.pprint/pprint (hooks/sexpr node))
-  (let [[docstring & args]         (if (hooks/string-node? (first args))
-                                     args
-                                     (cons nil args))
-        [attribute-map & args]     (if (hooks/map-node? (first args))
-                                     args
-                                     (cons nil args))
-        ;; if there wasn't a positional dispatch function arg passed just use (constantly nil) so Kondo won't complain
-        [dispatch-fn & kv-options] (if (odd? (count args))
-                                     args
-                                     (cons (hooks/list-node
-                                            (list
-                                             (hooks/token-node 'clojure.core/constantly)
-                                             (hooks/token-node 'nil)))
-                                           args))]
-    (let [defmulti-form (hooks/list-node
-                         (filter
-                          some?
-                          [(hooks/token-node 'clojure.core/defmulti)
-                           multimethod-name
-                           docstring
-                           attribute-map
-                           dispatch-fn]))
-          result   (hooks/list-node
-                    (list*
-                     (hooks/token-node 'do)
-                     defmulti-form
-                     kv-options))]
-      #_(println "=>")
-      #_(clojure.pprint/pprint (hooks/sexpr result))
-      {:node result})))

.clj-kondo/methodical/methodical/macros/methodical/impl/combo/operator.clj

@@ -1,7 +0,0 @@
-(ns macros.methodical.impl.combo.operator)
-
-;; not exactly what actually happens but this is close enough to be able to lint it
-(defmacro defoperator [operator-name [methods-binding invoke-binding] & body]
-  `(defmethod methodical.impl.combo.operator/operator ~(keyword operator-name)
-     [~methods-binding ~invoke-binding]
-     ~@body))

.clj-kondo/metosin/malli/config.edn

@@ -1,2 +0,0 @@
-{:lint-as {malli.experimental/defn schema.core/defn}
- :linters {:unresolved-symbol {:exclude [(malli.core/=>)]}}}

.clj-kondo/potemkin/potemkin/config.edn

@@ -1,62 +0,0 @@
-{:lint-as {potemkin.collections/compile-if      clojure.core/if
-           potemkin.collections/reify-map-type  clojure.core/reify
-           potemkin.collections/def-map-type    clj-kondo.lint-as/def-catch-all
-           potemkin.collections/def-derived-map clj-kondo.lint-as/def-catch-all
-
-           potemkin.types/reify+                clojure.core/reify
-           potemkin.types/defprotocol+          clojure.core/defprotocol
-           potemkin.types/deftype+              clojure.core/deftype
-           potemkin.types/defrecord+            clojure.core/defrecord
-           potemkin.types/definterface+         clojure.core/defprotocol
-           potemkin.types/extend-protocol+      clojure.core/extend-protocol
-           potemkin.types/def-abstract-type     clj-kondo.lint-as/def-catch-all
-
-           potemkin.utils/doit                  clojure.core/doseq
-           potemkin.utils/doary                 clojure.core/doseq
-           potemkin.utils/condp-case            clojure.core/condp
-           potemkin.utils/fast-bound-fn         clojure.core/bound-fn
-
-           potemkin.walk/prewalk                clojure.walk/prewalk
-           potemkin.walk/postwalk               clojure.walk/postwalk
-           potemkin.walk/walk                   clojure.walk/walk
-
-           ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-           ;;;; top-level from import-vars
-           ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-           ;; Have hooks
-           ;;potemkin/import-fn potemkin.namespaces/import-fn
-           ;;potemkin/import-macro potemkin.namespaces/import-macro
-           ;;potemkin/import-def potemkin.namespaces/import-def
-
-           ;; Internal, not transitive
-           ;;potemkin/unify-gensyms               potemkin.macros/unify-gensyms
-           ;;potemkin/normalize-gensyms           potemkin.macros/normalize-gensyms
-           ;;potemkin/equivalent?                 potemkin.macros/equivalent?
-
-           potemkin/condp-case                  clojure.core/condp
-           potemkin/doit                        potemkin.utils/doit
-           potemkin/doary                       potemkin.utils/doary
-
-           potemkin/def-abstract-type           clj-kondo.lint-as/def-catch-all
-           potemkin/reify+                      clojure.core/reify
-           potemkin/defprotocol+                clojure.core/defprotocol
-           potemkin/deftype+                    clojure.core/deftype
-           potemkin/defrecord+                  clojure.core/defrecord
-           potemkin/definterface+               clojure.core/defprotocol
-           potemkin/extend-protocol+            clojure.core/extend-protocol
-
-           potemkin/reify-map-type              clojure.core/reify
-           potemkin/def-derived-map             clj-kondo.lint-as/def-catch-all
-           potemkin/def-map-type                clj-kondo.lint-as/def-catch-all}
-
- ;; leave import-vars alone, kondo special-cases it
- :hooks   {:macroexpand {#_#_potemkin.namespaces/import-vars potemkin.namespaces/import-vars
-                         potemkin.namespaces/import-fn    potemkin.namespaces/import-fn
-                         potemkin.namespaces/import-macro potemkin.namespaces/import-macro
-                         potemkin.namespaces/import-def   potemkin.namespaces/import-def
-
-                         #_#_potemkin/import-vars potemkin.namespaces/import-vars
-                         potemkin/import-fn               potemkin.namespaces/import-fn
-                         potemkin/import-macro            potemkin.namespaces/import-macro
-                         potemkin/import-def              potemkin.namespaces/import-def}}}

.clj-kondo/potemkin/potemkin/potemkin/namespaces.clj

@@ -1,56 +0,0 @@
-(ns potemkin.namespaces
-  (:require [clj-kondo.hooks-api :as api]))
-
-(defn import-macro*
-  ([sym]
-   `(def ~(-> sym name symbol) ~sym))
-  ([sym name]
-   `(def ~name ~sym)))
-
-(defmacro import-fn
-  ([sym]
-   (import-macro* sym))
-  ([sym name]
-   (import-macro* sym name)))
-
-(defmacro import-macro
-  ([sym]
-   (import-macro* sym))
-  ([sym name]
-   (import-macro* sym name)))
-
-(defmacro import-def
-  ([sym]
-   (import-macro* sym))
-  ([sym name]
-   (import-macro* sym name)))
-
-#_
-(defmacro import-vars
-  "Imports a list of vars from other namespaces."
-  [& syms]
-  (let [unravel (fn unravel [x]
-                  (if (sequential? x)
-                    (->> x
-                         rest
-                         (mapcat unravel)
-                         (map
-                           #(symbol
-                              (str (first x)
-                                   (when-let [n (namespace %)]
-                                     (str "." n)))
-                              (name %))))
-                    [x]))
-        syms (mapcat unravel syms)
-        result `(do
-                  ~@(map
-                      (fn [sym]
-                        (let [vr (resolve sym)
-                              m (meta vr)]
-                          (cond
-                            (nil? vr) `(throw (ex-info (format "`%s` does not exist" '~sym) {}))
-                            (:macro m) `(def ~(-> sym name symbol) ~sym)
-                            (:arglists m) `(def ~(-> sym name symbol) ~sym)
-                            :else `(def ~(-> sym name symbol) ~sym))))
-                      syms))]
-    result))

.clj-kondo/prismatic/schema/config.edn

@@ -1 +0,0 @@
-{:lint-as {schema.test/deftest clojure.test/deftest}}

.clj-kondo/test.clj

@@ -1,10 +0,0 @@
-(ns test
-  (:require [metabase.query-processor.streaming :as streaming]
-            [toucan.models :as models]))
-
-(models/defmodel Card :foo)
-
-(map->Card {:foo 1})
-(map->CardInstance {:foo 1})
-
-(streaming/streaming-response [x 1 (inc x)])

.cljfmt.edn

@@ -0,0 +1,31 @@
+;; https://github.com/weavejester/cljfmt/blob/master/cljfmt/resources/cljfmt/indents/clojure.clj
+{:extra-indents
+ {auto-parse                                                       [[:inner 0]]
+  cond->                                                           [[:inner 0]]
+  check                                                            [[:inner 0]]
+  deferred-tru                                                     [[:inner 0]]
+  defprotocol+                                                     [[:block 1] [:inner 1]]
+  potemkin/defprotocol+                                            [[:block 1] [:inner 1]]
+  let-404                                                          [[:block 1]]
+  metabase.mbql.util/match-one                                     [[:inner 0]]
+  merge-with                                                       [[:inner 0]]
+  metabase.test/dataset                                            [[:inner 0]]
+  metabase.test/formatted-rows                                     [[:inner 0]]
+  metabase.test/mbql-query                                         [[:inner 0]]
+  metabase.test/test-drivers                                       [[:inner 0]]
+  metabase.test/with-temporary-setting-values                      [[:block 1]]
+  ;; If we just treat these as functions we can ignore this, despite some files not being consistent
+  ;metabase.models.permissions/set-has-full-permissions-for-set?    [[:inner 0]]
+  ;metabase.models.permissions/set-has-full-permissions?            [[:inner 0]]
+  ;metabase.models.permissions/set-has-partial-permissions?         [[:inner 0]]
+  metabase.models.permissions/set-has-partial-permissions-for-set? [[:inner 0]]
+  publish-event!                                                   [[:block 1]]
+  metabase.query-processor.streaming/streaming-response            [[:inner 0]]
+  metabase.util/prog1                                              [[:inner 0]]
+  metabase.util/select-keys-when                                   [[:inner 0]]
+  ;; This supports a lot of existing formatting, but these are functions so the
+  ;; existing formatting is probably wrong.
+  ;toucan2.core/select                                              [[:inner 0]]
+  ;toucan2.core/update!                                             [[:inner 0]]
+  }
+ :sort-ns-references? true}

.cljfmt/indents.clj

@@ -1,2 +0,0 @@
-{metabase.api.collection/foo [[:inner 0]]
- toucan.db/insert!           [[:block 1]]}

.devcontainer/Dockerfile

@@ -2,10 +2,10 @@ FROM mcr.microsoft.com/vscode/devcontainers/java:11
 
 # Set up nodesource, install node, yarn, fontconfig for static viz, rlwrap for dev ergonomics
 
-RUN ( curl -fsSL https://deb.nodesource.com/setup_14.x | bash ) \
+RUN ( curl -fsSL https://deb.nodesource.com/setup_18.x | bash ) \
   && export DEBIAN_FRONTEND=noninteractive \
   && apt-key adv --refresh-keys --keyserver keyserver.ubuntu.com \
   && apt-get update && apt-get -y install --no-install-recommends nodejs yarn rlwrap fontconfig
 
 # install Clojure
-RUN curl https://download.clojure.org/install/linux-install-1.11.0.1100.sh | bash
+RUN curl https://download.clojure.org/install/linux-install-1.11.1.1262.sh | bash

.dir-locals.el

@@ -6,6 +6,7 @@
   ;; prefer keeping source width about ~118, GitHub seems to cut off stuff at either 119 or 120 and it's nicer
   ;; to look at code in GH when you don't have to scroll back and forth
   (fill-column . 118)
+  (whitespace-line-column . 118)
   ;; tell find-things-fast to always use this directory as project root regardless of presence of other
   ;; deps.edn files
   (ftf-project-finders . (ftf-get-top-git-dir)))
@@ -81,14 +82,11 @@
   (cider-clojure-cli-aliases . "dev:drivers:drivers-dev:ee:ee-dev:user")
   (clojure-indent-style . always-align)
   (cljr-favor-prefix-notation . nil)
+  (cljr-insert-newline-after-require . t)
   (clojure-docstring-fill-column . 118)
   (cider-preferred-build-tool . clojure-cli)
   (cider-default-cljs-repl . shadow-select)
-  (cider-shadow-default-options . "node-repl"))
-
- ("shared"
-  (clojure-mode
-   (cider-preferred-build-tool . shadow-cljs)))
+  (cider-shadow-default-options . "app"))
 
  ("bin"
   (clojure-mode

.eslintignore

@@ -1 +1,2 @@
 frontend/src/cljs
+frontend/src/cljs_release

.eslintrc

@@ -8,14 +8,30 @@
       {
         "vars": "all",
         "args": "none",
-        "varsIgnorePattern": "^_.+",
+        "varsIgnorePattern": "^_",
         "ignoreRestSiblings": true
       }
     ],
     "no-empty": [1, { "allowEmptyCatch": true }],
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          {
+            "name": "moment",
+            "message": "Moment is deprecated, please use dayjs"
+          },
+          {
+            "name": "moment-timezone",
+            "message": "Moment is deprecated, please use dayjs"
+          }
+        ]
+      }
+    ],
     "curly": [1, "all"],
     "eqeqeq": [1, "smart"],
     "import/no-default-export": 2,
+    "import/no-named-as-default": 0,
     "import/no-commonjs": 1,
     "import/order": [
       "error",
@@ -121,11 +137,16 @@
     "plugin:react/jsx-runtime",
     "plugin:react-hooks/recommended",
     "plugin:import/errors",
-    "plugin:import/warnings"
+    "plugin:import/warnings",
+    "plugin:import/typescript"
   ],
   "settings": {
     "import/internal-regex": "^metabase/|^metabase-lib/",
-    "import/resolver": "webpack",
+    "import/resolver": {
+      "webpack": {
+        "typescript": true
+      }
+    },
     "import/ignore": ["\\.css$"],
     "react": {
       "version": "detect"
@@ -137,6 +158,18 @@
     }
   },
   "overrides": [
+    {
+      "files": ["*.js", "*.jsx", "*.ts", "*.tsx"],
+      "rules": {
+        "no-unconditional-metabase-links-render": "error"
+      }
+    },
+    {
+      "files": ["*.unit.spec.*", "frontend/src/metabase/admin/**/*"],
+      "rules": {
+        "no-unconditional-metabase-links-render": "off"
+      }
+    },
     {
       "extends": ["plugin:@typescript-eslint/recommended"],
       "files": ["*.ts", "*.tsx"],
@@ -148,17 +181,18 @@
         "@typescript-eslint/no-inferrable-types": "off",
         "@typescript-eslint/no-explicit-any": "off",
         "@typescript-eslint/no-this-alias": "off",
-        "no-unused-vars": "off",
+        "@typescript-eslint/consistent-type-imports": "error",
         "@typescript-eslint/no-unused-vars": [
           "error",
           {
-            "vars": "all",
-            "args": "none",
-            "varsIgnorePattern": "^_.+",
+            "argsIgnorePattern": "^_",
+            "varsIgnorePattern": "^_",
             "ignoreRestSiblings": true,
             "destructuredArrayIgnorePattern": "^_"
           }
-        ]
+        ],
+        // This was introduced in 6.0.0
+        "@typescript-eslint/no-unsafe-declaration-merging": "off"
       }
     },
     {

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+src/metabase @camsaul
+modules @camsaul
+enterprise/backend @camsaul

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,3 +1,6 @@
+> [!IMPORTANT]
+> If you are merging into master, please add either a `backport` or a `no-backport` label to this PR. You will not be able to merge until you do this step. Refer to the section [Do I need to backport this PR?](https://www.notion.so/metabase/Metabase-Branching-Strategy-6eb577d5f61142aa960a626d6bbdfeb3?pvs=4#89f80d6f17714a0198aeb66c0efd1b71) in the Metabase Branching Strategy document for more details.
+
 > **Warning**
 >
 > If that is your first contribution to Metabase, please sign the [Contributor License Agreement](https://docs.google.com/a/metabase.com/forms/d/1oV38o7b9ONFSwuzwmERRMi9SYrhYeOrkbmNaq9pOJ_E/viewform) (unless it's a tiny documentation change). Also, if you're attempting to fix a translation issue, please submit your changes to our [POEditor project](https://poeditor.com/join/project/ynjQmwSsGh) instead of opening a PR.

.github/actions/build-e2e-matrix/action.yml

@@ -0,0 +1,66 @@
+name: Build E2E Matrix
+description: Build and output a custom matrix for E2E tests.
+
+outputs:
+  matrix:
+    description: Parameterized matrix in JSON format
+    value: ${{ steps.matrix.outputs.result }}
+
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/github-script@v7
+      id: matrix
+      with:
+        script: | # js
+          const java = 11;
+
+          const defaultRunner = "ubuntu-22.04";
+          const beefierRunner = "buildjet-2vcpu-ubuntu-2204";
+
+          const defaultOptions = {
+            "java-version": java,
+            runner: defaultRunner,
+            edition: "ee",
+            context: "folder"
+          };
+
+          const testSets = [
+            ["actions", {} ],
+            ["admin", {} ],
+            ["admin-2", {} ],
+            ["binning", {} ],
+            ["collections", {} ],
+            ["custom-column", {} ],
+            ["dashboard", {} ],
+            ["dashboard-cards", {} ],
+            ["dashboard-filters", {} ],
+            ["embedding", {} ],
+            ["filters", {} ],
+            ["joins", {} ],
+            ["models", {} ],
+            ["native", {} ],
+            ["native-filters", {} ],
+            ["onboarding", {} ],
+            ["organization", {} ],
+            ["permissions", {} ],
+            ["question", {} ],
+            ["sharing", {} ],
+            ["visualizations-charts", {} ],
+            ["visualizations-tabular", {} ],
+            ["oss-subset", { edition: 'oss', context: "special" } ],
+            ["slow", { runner: beefierRunner, context: "special" } ],
+            ["flaky", { runner: beefierRunner, context: "special" } ],
+            ["mongo", { context: "qa-database" } ],
+          ];
+
+          const config = testSets.map(([name, specialOptions]) => {
+            return {
+              ...defaultOptions,
+              ...specialOptions,
+              name,
+            }
+          });
+
+          const matrix = { include: config };
+          return matrix;

.github/actions/e2e-download-uberjar/action.yml

@@ -0,0 +1,77 @@
+name: Find and download uberjar for E2E tests
+description: Download previously built artifact from one of the previous commits.
+inputs:
+  edition:
+    description: Metabase edition.
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Download previously stored uberjar
+      uses: actions/github-script@v7
+      with:
+        script: | # js
+          const fs = require('fs');
+          const execSync = require("child_process").execSync;
+
+          const getCommit = (ref = "HEAD") => {
+            const [commit] = execSync(`git rev-parse ${ref}`, { encoding: "utf8" }).split(
+              "\n",
+            );
+            return commit;
+          };
+
+          const baseConfig = {
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+          };
+
+          async function getArtifact(commit, depth = 0) {
+            if (depth > 20) {
+              throw new Error("Couldn't find the artifact!");
+            }
+
+            const artifactName = `metabase-${{ inputs.edition }}-${commit}-uberjar`;
+
+            const {
+              data: { artifacts },
+            } = await github.rest.actions.listArtifactsForRepo({
+              ...baseConfig,
+              name: artifactName,
+              per_page: 1,
+            });
+
+            const [artifact] = artifacts;
+
+            if (!artifact) {
+              const parentCommit = getCommit(`${commit}^`);
+              console.log(`Didn't find ${artifactName}.\n`);
+              console.log(`Switching to the parent commit: ${parentCommit}`);
+              return getArtifact(parentCommit, depth + 1);
+            } else {
+              return artifact;
+            }
+          }
+
+          const currentCommit = "${{ github.event.pull_request.head.sha || github.sha }}";
+          const { id } = await getArtifact(currentCommit);
+
+          const download = await github.rest.actions.downloadArtifact({
+            ...baseConfig,
+            artifact_id: id,
+            archive_format: 'zip',
+          });
+
+          fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
+
+    - name: Unzip Metabase artifact containing an uberjar
+      run: unzip mb.zip
+      shell: bash
+
+    - name: Get the version info
+      run: |
+        jar xf target/uberjar/metabase.jar version.properties
+        cat version.properties
+        mv version.properties resources/
+      shell: bash

.github/actions/e2e-prepare-containers/action.yml

@@ -0,0 +1,87 @@
+name: Prepare Docker containers
+description: Prepare Docker containers for E2E tests.
+inputs:
+  username:
+    description: DockerHub username
+    required: true
+  password:
+    description: DockerHub password/token
+    required: true
+  maildev:
+    description: Maildev
+    required: true
+    default: 'false'
+  openldap:
+    description: Maildev
+    required: true
+    default: 'false'
+  postgres:
+    description: Maildev
+    required: true
+    default: 'false'
+  mysql:
+    description: Maildev
+    required: true
+    default: 'false'
+  mongo:
+    description: Maildev
+    required: true
+    default: 'false'
+
+
+runs:
+  using: "composite"
+  steps:
+    - name: Authenticate to prevent API rate limit
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.username }}
+        password: ${{ inputs.password }}
+
+    - name: Start Containers
+      run: |
+        Y='\033[33m'
+        G='\033[1;32m'
+
+        if ${{ inputs.maildev }}; then
+          echo -e "${Y}Starting maildev container..." &&
+          docker run -d -p 1080:1080 -p 1025:1025 maildev/maildev:2.0.5 &&
+          while ! nc -z localhost 1080; do sleep 1; done &&
+          while ! nc -z localhost 1025; do sleep 1; done &&
+          echo -e "${G}Maildev is up and running!"
+        fi
+
+        if ${{ inputs.openldap }}; then
+          echo -e "${Y}Starting openldap container..." &&
+          docker run -d -p 389:389 \
+            --env LDAP_ADMIN_PASSWORD=adminpass \
+            --env LDAP_USERS=user01@example.org,user02@example.org \
+            --env LDAP_PASSWORDS=123456,123465 \
+            --env LDAP_ROOT=dc=example,dc=org \
+            --env LDAP_PORT_NUMBER=389 \
+            bitnami/openldap:2.6.4 &&
+          while ! nc -z localhost 389; do sleep 1; done &&
+          echo -e "${G}Openldap is up and running!"
+        fi
+
+        if ${{ inputs.postgres }}; then
+          echo -e "${Y}Starting postgres container..." &&
+          docker run -d -p 5404:5432 -e TZ='US/Pacific' metabase/qa-databases:postgres-sample-12 &&
+          while ! nc -z localhost 5404; do sleep 1; done &&
+          echo -e "${G}Postgres is up and running!"
+        fi
+
+        if ${{ inputs.mysql }}; then
+          echo -e "${Y}Starting mysql container..." &&
+          docker run -d -p 3304:3306 -e TZ='US/Pacific' metabase/qa-databases:mysql-sample-8 &&
+          while ! nc -z localhost 3304; do sleep 1; done &&
+          echo -e "${G}MySQL is up and running!"
+        fi
+
+        if ${{ inputs.mongo }}; then
+          echo -e "${Y}Starting mongo container..." &&
+          docker run -d -p 27004:27017 metabase/qa-databases:mongo-sample-4.4 &&
+          while ! nc -z localhost 27004; do sleep 1; done &&
+          echo -e "${G}Mongo is up and running!"
+        fi
+      shell: bash

.github/actions/get-latest-release-branch/action.yml

@@ -7,7 +7,7 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/github-script@v6
+    - uses: actions/github-script@v7
       id: get-latest-release-branch
       with:
         result-encoding: string

.github/actions/notify-pull-request/action.yml

@@ -9,7 +9,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/github-script@v6
+    - uses: actions/github-script@v7
       id: get-latest-release-branch
       with:
         result-encoding: string
@@ -27,7 +27,7 @@ runs:
           }
 
           github.rest.issues.createComment({
-            issue_number: context.payload.number,
+            issue_number: context.payload.issue.number,
             owner: context.repo.owner,
             repo: context.repo.repo,
             body,

.github/actions/prepare-backend/action.yml

@@ -15,7 +15,7 @@ runs:
   using: "composite"
   steps:
     - name: Prepare JDK ${{ inputs.java-version }}
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         java-version: ${{ inputs.java-version }}
         distribution: 'temurin'
@@ -29,7 +29,7 @@ runs:
       run: echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
       shell: bash
     - name: Get M2 cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
       with:
         path: |

.github/actions/prepare-cypress/action.yml

@@ -1,13 +1,19 @@
 name: Prepare cypress environment
+description: Cypress preparation steps
+
 runs:
   using: "composite"
   steps:
+    - name: Install Replay.io browser
+      run: npx @replayio/cypress install
+      shell: bash
+
     - name: Check to see if dependencies should be cached
       if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
       run: echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
       shell: bash
     - name: Get Cypress cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
       with:
         path: ~/.cache/Cypress

.github/actions/prepare-frontend/action.yml

@@ -3,10 +3,9 @@ runs:
   using: "composite"
   steps:
     - name: Prepare Node.js
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
-        node-version-file: '.nvmrc'
-        cache: 'yarn'
+        node-version-file: ".nvmrc"
     - name: Check to see if dependencies should be cached
       if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
       run: |
@@ -14,13 +13,13 @@ runs:
         yarn cache clean
       shell: bash
     - name: Get M2 cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
       with:
         path: ~/.m2
         key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}
     - name: Get node_modules cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
       with:
         path: node_modules

.github/actions/prepare-uberjar-artifact/action.yml

@@ -1,4 +1,11 @@
 name: Prepare Uberjar Artifact
+description: Prepare and upload Metabase JAR as a GitHub artifact.
+
+inputs:
+  name:
+    required: true
+    description: Artifact name
+
 runs:
   using: "composite"
   steps:
@@ -9,9 +16,9 @@ runs:
       run: sha256sum ./target/uberjar/metabase.jar > SHA256.sum
       shell: bash
     - name: Upload JARs as artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
-        name: metabase-${{ matrix.edition }}-uberjar
+        name: ${{ inputs.name }}
         path: |
           ./target/uberjar/metabase.jar
           ./COMMIT-ID

.github/actions/upload-test-results/action.yml

@@ -0,0 +1,54 @@
+name: Upload Test Results to s3
+description: Uploads test results files to s3
+
+inputs:
+  input-path:
+    required: true
+  output-name:
+    required: true
+    default: test
+  aws-access-key-id:
+    required: true
+  aws-secret-access-key:
+    required: true
+  aws-region:
+    required: true
+    default: us-east-1
+  bucket:
+    required: true
+  trunk-api-token:
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ inputs.aws-access-key-id }}
+        aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
+        aws-region: ${{ inputs.aws-region }}
+    - name: zip test results
+      env:
+        INPUT_DIR: ${{ inputs.input-path }}
+        OUTPUT_FILE: ${{ inputs.output-name }}
+      shell: bash
+      run: | # sh
+        zip ${OUTPUT_FILE}.zip $INPUT_DIR/*.xml
+    - name: Upload test results to S3
+      env:
+        BUCKET: ${{ inputs.bucket }}
+        OUTPUT_FILE: ${{ inputs.output-name }}
+      shell: bash
+      run: | # sh
+        DATE=$(date '+%Y-%m-%d')
+        aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
+
+    - name: Upload results to Trunk
+      if: ${{ always() }}
+      uses: trunk-io/analytics-uploader@main
+      with:
+        junit-paths: ${{ inputs.input-path }}
+        org-slug: metabase
+        token: ${{ inputs.trunk-api-token }}
+      continue-on-error: true

.github/actions/verify-membership/action.yml

@@ -0,0 +1,22 @@
+name: 'Verify Organization Membership'
+description: 'Check if a user is a member of a GitHub organization'
+inputs:
+  github_token:
+    description: 'Token with access to the organization'
+    required: true
+  organization_name:
+    description: 'Organization name'
+    required: true
+  username:
+    description: 'Username'
+    required: true
+outputs:
+  is_member:
+    value: ${{ steps.verify-membership.outputs.is_member }}
+    description: "Is the user a member of the organization"
+runs:
+  using: "composite"
+  steps:
+    - run: bash ${{ github.action_path }}/verify_membership.sh ${{ inputs.github_token }} ${{ inputs.organization_name }} ${{ inputs.username }}
+      id: verify-membership
+      shell: bash

.github/actions/verify-membership/verify_membership.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+TOKEN=$1
+ORG_NAME=$2
+USERNAME=$3
+
+response=$(curl -L -o /dev/null -w "%{http_code}" \
+  -H "Accept: application/vnd.github+json" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "X-GitHub-Api-Version: 2022-11-28" \
+  "https://api.github.com/orgs/$ORG_NAME/members/$USERNAME")
+
+# Github returns an empty response with 204 status if user is a member and 404 status otherwise
+# See: https://docs.github.com/en/rest/orgs/members?apiVersion=2022-11-28#check-organization-membership-for-a-user
+if [ "$response" == "204" ]; then
+    echo "The user $USERNAME is a member of $ORG_NAME"
+    echo "is_member=true" >> $GITHUB_OUTPUT
+elif [ "$response" == "404" ]; then
+    echo "The user $USERNAME is not a member of $ORG_NAME"
+    echo "is_member=false" >> $GITHUB_OUTPUT
+else
+    echo "Failed to determine the membership status for $USERNAME in $ORG_NAME"
+    echo "is_member=false" >> $GITHUB_OUTPUT
+    exit 1
+fi

.github/file-paths.yaml

@@ -1,16 +1,19 @@
 default: &default
   - "locales/**"
-  - "bin/**"
-
-ci: &ci
-  - ".github/**/!(*.md)"
+  - "bin/**/!(*.md)"
 
 shared_sources: &shared_sources
-  - "shared/src/**"
-  - "src/metabase/lib/**"
+  - "src/**/*.cljc"
+  - "src/**/*.cljs"
 
 shared_specs: &shared_specs
-  - "shared/test/**"
+  - "test/**/*.cljc"
+  - "test/**/*.cljs"
+
+frontend_ci: &frontend_ci
+  - ".github/actions/prepare-frontend/**"
+  - ".github/actions/prepare-backend/**"
+  - ".github/workflows/frontend.yml"
 
 frontend_sources: &frontend_sources
   - *shared_sources
@@ -20,6 +23,7 @@ frontend_sources: &frontend_sources
   - "**/tsconfig*.json"
   - "package.json"
   - "babel.config.json"
+  - ".eslintrc"
   - "postcss.config.js"
   - "webpack.config.js"
   - "webpack.static-viz.config.js"
@@ -29,14 +33,21 @@ frontend_specs: &frontend_specs
   - "frontend/test/**"
   - "frontend/**/tests/**"
   - "frontend/**/*.unit.*"
-  - "jest.unit.conf.json"
+  - "jest.config.json"
   - "jest.tz.unit.conf.json"
 
 frontend_all: &frontend_all
-  - *ci
+  - *frontend_ci
   - *frontend_sources
   - *frontend_specs
 
+backend_ci: &backend_ci
+  - ".github/actions/prepare-frontend/**"
+  - ".github/actions/prepare-backend/**"
+  - ".github/actions/test-driver/**"
+  - ".github/workflows/backend.yml"
+  - ".github/workflows/drivers.yml"
+
 backend_presto_kerberos:
   - "**/presto_jdbc/**"
   - "**/presto_jdbc.clj"
@@ -61,16 +72,25 @@ backend_specs: &backend_specs
 
 backend_all: &backend_all
   - *default
-  - *ci
+  - *backend_ci
   - *backend_sources
   - *backend_specs
-  - *frontend_sources # keep it here until we detect static viz changes
 
 sources: &sources
   - *shared_sources
   - *frontend_sources
   - *backend_sources
 
+e2e_ci: &e2e_ci
+  - ".github/actions/build-e2e-matrix/**"
+  - ".github/actions/prepare-frontend/**"
+  - ".github/actions/prepare-backend/**"
+  - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/actions/e2e-prepare-containers/**"
+  - ".github/actions/prepare-cypress/**"
+  - ".github/actions/run-snowplow-micro/**"
+  - ".github/workflows/e2e-tests.yml"
+
 e2e_specs: &e2e_specs
   - "**/*.cy.*.js"
   - "e2e/runner/**"
@@ -79,12 +99,12 @@ e2e_specs: &e2e_specs
 
 e2e_all:
   - *default
-  - *ci
-  - *e2e_specs
+  - *e2e_ci
   - *sources
+  - *e2e_specs
 
 snowplow:
-  - *ci
+  - ".github/workflows/snowplow.yml"
   - "snowplow/**"
 
 documentation:
@@ -101,10 +121,18 @@ codeql:
 
 i18n:
   - *default
-  - *ci
+  - ".github/actions/prepare-frontend/**"
+  - ".github/actions/prepare-backend/**"
+  - ".github/workflows/i18n.yml"
   - *sources
 
 visualizations:
   - "frontend/src/metabase/visualizations/**"
   - "frontend/src/metabase/static-viz/**"
   - "src/metabase/pulse/**"
+
+cljs:
+  - *shared_sources
+  - *shared_specs
+  - ".github/workflows/cljs.yml"
+  - "shadow-cljs.edn"

.github/scripts/write-poms.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+function pom() {
+    path=$1
+    echo "Writing ${path}/pom.xml"
+    (cd "$path" && clojure -X:deps mvn-pom)
+}
+
+pom .
+
+for k in $(ls modules/drivers/); do
+    test -d "modules/drivers/$k" && pom "modules/drivers/$k"
+done

.github/team.json

@@ -1,47 +1,74 @@
 {
   "teams": [
     {
-      "name": "Team 42",
-      "label": ".Team/42 :milky_way:",
+      "name": "Querying Components",
+      "label": ".Team/QueryingComponents",
       "members": [
         "ranquild",
+        "uladzimirdev",
+        "kamilmielnik",
+        "oleggromov",
+        "nemanjaglumac",
+        "romeovs"
+      ]
+    },
+    {
+      "name": "Embedding",
+      "label": ".Team/Embedding",
+      "members": [
         "WiNloSt",
         "deniskaber",
         "oisincoveney",
-        "uladzimirdev",
-        "tsmacdonald",
-        "qnkhuat",
-        "calherries",
-        "kamilmielnik",
         "npretto"
       ]
     },
     {
-      "name": "Query Processor",
-      "label": ".Team/QueryProcessor :hammer_and_wrench:",
+      "name": "BEC",
+      "label": ".Team/BackendComponents",
       "members": [
-        "camsaul",
-        "kulyk",
-        "snoe",
-        "bshepherdson",
-        "john-metabase",
-        "metamben"
+        "tsmacdonald",
+        "qnkhuat",
+        "calherries",
+        "piranha",
+        "crisptrutski"
       ]
     },
     {
-      "name": "Pixel Police",
-      "label": ".Team/PixelPolice :police_officer:",
+      "name": "Query Processor",
+      "label": ".Team/QueryProcessor",
+      "members": [
+        "camsaul",
+        "snoe",
+        "bshepherdson",
+        "metamben",
+        "lbrdnk"
+      ]
+    },
+    {
+      "name": "Admin Webapp",
+      "label": ".Team/AdminWebapp",
       "members": [
         "noahmoss",
         "escherize",
-        "adam-james-v",
         "qwef",
-        "alxnddr",
         "iethree",
         "npfitz",
+        "shaunlebron",
+        "johnswanson",
+        "rafpaf",
+        "sloansparger"
+      ]
+    },
+    {
+      "name": "DashViz",
+      "label": ".Team/DashViz",
+      "members": [
+        "alxnddr",
         "EmmadUsmani",
         "JesseSDevaney",
-        "shaunlebron"
+        "kulyk",
+        "markbastian",
+        "adam-james-v"
       ]
     }
   ]

.github/workflows/auto-assign.yml

@@ -10,17 +10,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: tibdex/github-app-token@v1.6.0
+      - uses: tibdex/github-app-token@v2.1.0
         id: generate-token
         with:
           app_id: ${{ secrets.METABASE_BOT_APP_ID }}
           private_key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Assign author and their team. Returns true if team exists.
         id: auto-assign
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |

.github/workflows/auto-backport.yml

@@ -8,10 +8,10 @@ jobs:
     if: github.event.pull_request.merged == true && (contains(github.event.pull_request.labels.*.name, 'backport') && github.event.action == 'closed' || github.event.label.name == 'backport')
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: tibdex/github-app-token@v1.6.0
+      - uses: tibdex/github-app-token@v2.1.0
         id: generate-token
         with:
           app_id: ${{ secrets.METABASE_BOT_APP_ID }}
@@ -35,6 +35,7 @@ jobs:
 
           BACKPORT_BRANCH="backport-$COMMIT"
 
+          # Checkout the target branch and create a new backport branch
           git checkout ${TARGET_BRANCH}
           git fetch --all
           git checkout -b ${BACKPORT_BRANCH}
@@ -42,25 +43,41 @@ jobs:
 
           CONFLICTS=$(git ls-files -u | wc -l)
           if [ "$CONFLICTS" -gt 0 ]; then
+            git cherry-pick --abort
+
             echo "Could not cherry pick because of a conflict"
             echo "has-conflicts=true" >> $GITHUB_OUTPUT
-            git cherry-pick --abort
-            git checkout master
-            exit 0
+
+            # Add a shell script for resolving conflicts
+            echo "git reset HEAD~1" > ./backport.sh
+            echo "rm ./backport.sh" >> ./backport.sh
+            echo "git cherry-pick ${COMMIT}" >> ./backport.sh
+            echo "echo 'Resolve conflicts and force push this branch'" >> ./backport.sh
+            chmod +x ./backport.sh
+            git add ./backport.sh
+            git commit -m "Add backport resolution script"
+
+            PR_BODY=$(cat <<-END
+            #${ORIGINAL_PULL_REQUEST_NUMBER}
+            > [!IMPORTANT]
+            > Manual conflict resolution is required.
+            Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking.
+          END
+            )
+          else
+            echo "has-conflicts=false" >> $GITHUB_OUTPUT
+            PR_BODY="#${ORIGINAL_PULL_REQUEST_NUMBER}"
           fi
 
-          echo "has-conflicts=false" >> $GITHUB_OUTPUT
-
-          git checkout master
           git push -u origin ${BACKPORT_BRANCH}
 
-          BACKPORT_PR_URL=$(hub pull-request -b "${TARGET_BRANCH}" -h "${BACKPORT_BRANCH}" -l "was-backported" -a "${GITHUB_ACTOR}" -F- <<<"🤖 backported \"${ORIGINAL_TITLE}\"
-
-          #${ORIGINAL_PULL_REQUEST_NUMBER}")
-
+          BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
           BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
 
           echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT
+          echo "New PR has been created"
+
+          git checkout master
         env:
           TARGET_BRANCH: ${{ steps.get_latest_release_branch.outputs.branch-name }}
           ORIGINAL_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
@@ -87,10 +104,10 @@ jobs:
         if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'true' }}
         with:
           include-log: false
-          message: could not create a backport due to conflicts
+          message: Manual conflict resolution is required
 
       - uses: ./.github/actions/notify-pull-request
         if: ${{ failure() }}
         with:
           include-log: true
-          message: something went wrong while creating a backport
+          message: Something went wrong while creating a backport

.github/workflows/backend.yml

@@ -3,8 +3,8 @@ name: Backend
 on:
   push:
     branches:
-      - 'master'
-      - 'release-**'
+      - "master"
+      - "release-**"
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
 
@@ -13,158 +13,166 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  CLJ_KONDO_VERSION: "2023.07.13"
+  CLJ_KONDO_VERSION: "2023.09.07"
 
 jobs:
   files-changed:
     name: Check which files changed
     runs-on: ubuntu-22.04
-    timeout-minutes: 3
+    timeout-minutes: 5
     outputs:
       backend_all: ${{ steps.changes.outputs.backend_all }}
+      frontend_sources: ${{ steps.changes.outputs.frontend_sources }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v2.11.1
+        uses: dorny/paths-filter@v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
           filters: .github/file-paths.yaml
 
+  static-viz-files-changed:
+    needs: files-changed
+    if: needs.files-changed.outputs.backend_all != 'true' && needs.files-changed.outputs.frontend_sources == 'true'
+    name: Check whether static-viz files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      static_viz: ${{ steps.static_viz.outputs.static_viz }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "files-changed"
+      - name: Build static-viz frontend
+        run: yarn build-static-viz
+      - name: Upload Static Viz Bundle Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: static-viz-bundle-${{ github.sha }}
+          path: resources/frontend_client/app/dist
+
+      - name: Check for static viz changes
+        uses: dorny/paths-filter@v3.0.0
+        id: static_viz
+        with:
+          token: ${{ github.token }}
+          filters: .github/static-viz-sources.yaml
+
   be-linter-cloverage:
     needs: files-changed
-    if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
+    if: github.ref_name == 'master' && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
     steps:
-    - uses: actions/checkout@v3
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'cloverage'
-    - name: Build static viz frontend
-      run: yarn build-static-viz
-    - name: Collect the test coverage
-      run: clojure -X:dev:ci:ee:ee-dev:test:cloverage
-    - name: Upload coverage to codecov.io
-      uses: codecov/codecov-action@v3
-      with:
-        files: ./target/coverage/codecov.json
-        flags: back-end
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cloverage"
+      - name: Build static viz frontend
+        run: yarn build-static-viz
+      - name: Collect the test coverage
+        run: clojure -X:dev:ci:ee:ee-dev:test:cloverage
+      - name: Upload coverage to codecov.io
+        uses: codecov/codecov-action@v3
+        with:
+          files: ./target/coverage/codecov.json
+          flags: back-end
 
   be-linter-clj-kondo:
-    needs: files-changed
-    if: needs.files-changed.outputs.backend_all == 'true'
+    needs: [files-changed, static-viz-files-changed]
+    if: |
+      !cancelled() &&
+      (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     env:
       DOWNLOAD_URL: https://github.com/clj-kondo/clj-kondo/releases/download
     steps:
-    - uses: actions/checkout@v3
-    - name: Install clj-kondo
-      run: |
-        curl -OL ${DOWNLOAD_URL}/v${CLJ_KONDO_VERSION}/clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip
-        curl -OL ${DOWNLOAD_URL}/v${CLJ_KONDO_VERSION}/clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip.sha256
-        cat clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip.sha256 >> SHA256sum.txt
-        echo " clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip" >> SHA256sum.txt
-        sha256sum -c SHA256sum.txt
-        unzip clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip
-    - run: ./clj-kondo --version
-    - name: Run clj-kondo
-      run: >-
-        ./clj-kondo
-        --config ./.clj-kondo/config.edn
-        --config-dir ./.clj-kondo
-        --parallel
-        --lint
-        ./src
-        ./test
-        ./enterprise/backend/src
-        ./enterprise/backend/test
-        ./shared/src
-        ./shared/test
-        ./modules/drivers/athena/src
-        ./modules/drivers/athena/test
-        ./modules/drivers/bigquery-cloud-sdk/src
-        ./modules/drivers/bigquery-cloud-sdk/test
-        ./modules/drivers/druid/src
-        ./modules/drivers/druid/test
-        ./modules/drivers/googleanalytics/src
-        ./modules/drivers/googleanalytics/test
-        ./modules/drivers/mongo/src
-        ./modules/drivers/mongo/test
-        ./modules/drivers/oracle/src
-        ./modules/drivers/oracle/test
-        ./modules/drivers/presto-jdbc/src
-        ./modules/drivers/presto-jdbc/test
-        ./modules/drivers/redshift/src
-        ./modules/drivers/redshift/test
-        ./modules/drivers/snowflake/src
-        ./modules/drivers/snowflake/test
-        ./modules/drivers/sparksql/src
-        ./modules/drivers/sparksql/test
-        ./modules/drivers/sqlite/src
-        ./modules/drivers/sqlite/test
-        ./modules/drivers/sqlserver/src
-        ./modules/drivers/sqlserver/test
-        ./modules/drivers/vertica/src
-        ./modules/drivers/vertica/test
-
-
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: 'kondo'
+      - name: Install clj-kondo
+        run: |
+          curl -OL ${DOWNLOAD_URL}/v${CLJ_KONDO_VERSION}/clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip
+          curl -OL ${DOWNLOAD_URL}/v${CLJ_KONDO_VERSION}/clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip.sha256
+          cat clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip.sha256 >> SHA256sum.txt
+          echo " clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip" >> SHA256sum.txt
+          sha256sum -c SHA256sum.txt
+          unzip -d /usr/local/bin clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip
+      - run: clj-kondo --version
+      - name: Run clj-kondo
+        run: ./bin/kondo.sh
 
   be-linter-eastwood:
-    needs: files-changed
-    if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
+    needs: [files-changed, static-viz-files-changed]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == false &&
+      (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
-    - uses: actions/checkout@v3
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'eastwood'
-    - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
-      name: Run Eastwood linter
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "eastwood"
+      - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
+        name: Run Eastwood linter
 
   # Because it's not possible to conditionally run only `java-11-ee` test in the draft mode,
   # we have to extract that job manually here. Backend developers have requested that this
   # test runs at all times to give them an early warning sign is something is broken.
   be-tests-java-11-ee-pre-check:
-    needs: files-changed
-    if: github.event.pull_request.draft == true && needs.files-changed.outputs.backend_all == 'true'
+    needs: [files-changed, static-viz-files-changed]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == true &&
+      (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
     name: be-tests-java-11-ee-pre-check
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v3
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: java-11-ee-pre-check
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: java-11-ee-pre-check
 
-    - run: yarn install --frozen-lockfile --prefer-offline
-    - name: Build static viz frontend
-      run: yarn build-static-viz
+      - run: yarn install --frozen-lockfile --prefer-offline
+      - name: Build static viz frontend
+        run: yarn build-static-viz
 
-    - name: Run tests
-      run: clojure -X:dev:ci:test:ee:ee-dev
+      - name: Run tests
+        run: clojure -X:dev:ci:test:ee:ee-dev
 
-    - name: Publish Test Report (JUnit)
-      uses: dorny/test-reporter@v1
-      if: failure()
-      with:
-        path: 'target/junit/**/*_test.xml'
-        name: JUnit Test Report be-tests-java-11-ee-pre-check
-        reporter: java-junit
-        list-suites: failed
-        list-tests: failed
-        fail-on-error: false
+      - name: Publish Test Report (JUnit)
+        uses: dorny/test-reporter@v1
+        if: failure()
+        with:
+          path: "target/junit/**/*_test.xml"
+          name: JUnit Test Report be-tests-java-11-ee-pre-check
+          reporter: java-junit
+          list-suites: failed
+          list-tests: failed
+          fail-on-error: false
 
   be-tests:
-    needs: files-changed
-    if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
+    needs: [files-changed, static-viz-files-changed]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == false &&
+      (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
     name: be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
     timeout-minutes: 60
@@ -172,40 +180,65 @@ jobs:
       fail-fast: false
       matrix:
         edition: [oss, ee]
-        java-version: [11, 17]
+        java-version: [11, 17, 21]
     steps:
-    - uses: actions/checkout@v3
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: be-tests
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: be-tests
+      # Depending on which files changed, we might either have to build static-viz
+      # from scratch or download the previously built artifact
+      - name: Build static-viz frontend
+        if: needs.files-changed.outputs.backend_all == 'true'
+        run: yarn build-static-viz
+      - name: Download Static Viz Bundle Artifact
+        if: needs.static-viz-files-changed.outputs.static_viz == 'true'
+        uses: actions/download-artifact@v4
+        with:
+          name: static-viz-bundle-${{ github.sha }}
+          path: resources/frontend_client/app/dist
 
-    - run: yarn install --frozen-lockfile --prefer-offline
-    - name: Build static viz frontend
-      run: yarn build-static-viz
+      - name: Run tests
+        id: run-java-tests
+        if: matrix.java-version != 21
+        run: clojure -X:dev:ci:test:${{ matrix.edition }}:${{ matrix.edition }}-dev
 
-    - name: Run tests
-      run: clojure -X:dev:ci:test:${{ matrix.edition }}:${{ matrix.edition }}-dev
+      - name: Run tests using Java 21 on `master` only
+        id: run-java-tests-21
+        if: matrix.java-version == 21 && github.ref_name == 'master'
+        run: clojure -X:dev:ci:test:${{ matrix.edition }}:${{ matrix.edition }}-dev
 
-    - name: Publish Test Report (JUnit)
-      uses: dorny/test-reporter@v1
-      if: failure()
-      with:
-        path: 'target/junit/**/*_test.xml'
-        name: JUnit Test Report be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
-        reporter: java-junit
-        list-suites: failed
-        list-tests: failed
-        fail-on-error: false
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always() && (steps.run-java-tests.conclusion != 'skipped' || steps.run-java-tests-21.conclusion != 'skipped')
+        with:
+          input-path: ./target/junit/
+          output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Publish Test Report (JUnit)
+        uses: dorny/test-reporter@v1
+        if: failure()
+        with:
+          path: "target/junit/**/*_test.xml"
+          name: JUnit Test Report be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
+          reporter: java-junit
+          list-suites: failed
+          list-tests: failed
+          fail-on-error: false
 
   be-tests-stub:
-    needs: files-changed
+    needs: [be-tests]
     if: |
-      always() &&
-      github.event.pull_request.draft == false &&
-      needs.files-changed.outputs.backend_all == 'false'
+      !cancelled() &&
+      github.event.pull_request.draft == false && needs.be-tests.result == 'skipped'
     runs-on: ubuntu-22.04
     name: be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
     timeout-minutes: 5
@@ -213,7 +246,7 @@ jobs:
       fail-fast: false
       matrix:
         edition: [oss, ee]
-        java-version: [11, 17]
+        java-version: [11, 17, 21]
     steps:
       - run: |
           echo "Didn't run due to conditional filtering"
@@ -221,16 +254,19 @@ jobs:
   # checks that all the namespaces we actually ship can be compiled, without any dependencies that we don't ship (such
   # as `:dev` dependencies). See #27009 for more context.
   be-check:
-    needs: files-changed
-    if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
+    needs: [files-changed, static-viz-files-changed]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == false &&
+      (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
     name: be-check-java-${{ matrix.java-version }}
     timeout-minutes: 10
     strategy:
       matrix:
-        java-version: [11, 17, 19]
+        java-version: [11, 17, 21]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Prepare backend
         uses: ./.github/actions/prepare-backend
         with:
@@ -239,17 +275,17 @@ jobs:
         run: clojure -M:ee:drivers:check
 
   be-check-stub:
-    needs: files-changed
+    needs: [files-changed, static-viz-files-changed, be-check]
     if: |
       always() &&
       github.event.pull_request.draft == false &&
-      needs.files-changed.outputs.backend_all == 'false'
+      needs.be-check.result == 'skipped'
     runs-on: ubuntu-22.04
     name: be-check-java-${{ matrix.java-version }}
     timeout-minutes: 10
     strategy:
       matrix:
-        java-version: [11, 17, 19]
+        java-version: [11, 17, 21]
     steps:
       - run: |
           echo "Didn't run due to conditional filtering"

.github/workflows/backport-reminder.yml

@@ -0,0 +1,18 @@
+name: Backport Reminder
+
+on:
+  pull_request:
+    types: [auto_merge_enabled, review_requested, labeled, unlabeled, synchronize]
+    branches:
+      - "master"
+
+jobs:
+  backport-reminder:
+    name: Decide whether to backport or not
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          valid-labels: 'backport, no-backport'
+          disable-reviews: true

.github/workflows/backport.yml

@@ -11,27 +11,39 @@ jobs:
     if: contains(github.event.comment.body, '@metabase-bot backport')
     runs-on: ubuntu-22.04
     steps:
-      - uses: tibdex/github-app-token@v1.6.0
+      - uses: tibdex/github-app-token@v2.1.0
         id: generate-token
         with:
           app_id: ${{ secrets.METABASE_BOT_APP_ID }}
           private_key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-      - id: is_organization_member
-        uses: JamesSingleton/is-organization-member@1.0.0
+      - uses: actions/checkout@v4
+        name: Cherry-pick commits and create PR
         with:
-          organization: metabase
-          username: ${{ github.event.issue.user.login }}
-          token: ${{ steps.generate-token.outputs.token }}
+          fetch-depth: 0
+      - name: Verify Membership
+        id: verify-membership
+        uses: ./.github/actions/verify-membership
+        with:
+          github_token: ${{ steps.generate-token.outputs.token }}
+          organization_name: metabase
+          username: ${{ github.event.comment.user.login }}
       - run: |
-          result=${{ steps.is_organization_member.outputs.result }}
+          result=${{ steps.verify-membership.outputs.is_member }}
           if [ $result == false ]; then
               echo User ${{ github.event.comment.user.login }} is not a member of Metabase organization
               exit 1
           fi
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v7
         id: branch_info
         with:
           script: |
+            await github.rest.reactions.createForIssueComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: context.payload.comment.id,
+              content: 'eyes',
+            });
+
             // Example: @metabase-bot backport release-x.40.x
             const [_botName, _command, targetBranch] = context.payload.comment.body.split(" ");
             console.log(`Target branch is ${targetBranch}`);
@@ -54,7 +66,7 @@ jobs:
               ref: `heads/${targetBranch}`,
             });
 
-            const backportBranch = `backport-${originalPullRequest.head.ref}`
+            const backportBranch = `backport-${originalPullRequest.head.ref}-${targetBranch}`
 
             try {
               await github.rest.git.getRef({
@@ -80,10 +92,6 @@ jobs:
               startSha: commits[0].sha,
               endSha: commits[commits.length - 1].sha
             }
-      - uses: actions/checkout@v3
-        name: Cherry-pick commits and create PR
-        with:
-          fetch-depth: 0
       - id: create_backport_pull_request
         name: Create backport pull request
         run: |
@@ -108,13 +116,10 @@ jobs:
 
           git push origin "${BACKPORT_BRANCH}" --force-with-lease
 
-          if [[ $(hub pr list -b "${TARGET_BRANCH}" -h "${BACKPORT_BRANCH}" -s "open") ]]; then
+          if [[ $(gh pr list --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" -s "open") ]]; then
               echo "PR already exists"
           else
-              BACKPORT_PR_URL=$(hub pull-request -b "${TARGET_BRANCH}" -h "${BACKPORT_BRANCH}" -l "was-backported" -a "${GITHUB_ACTOR}" -F- <<<"🤖 backported \"${ORIGINAL_TITLE}\"
-
-              #${ORIGINAL_PULL_REQUEST_NUMBER}")
-
+              BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "#${ORIGINAL_PULL_REQUEST_NUMBER}")
               BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
 
               echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT
@@ -150,7 +155,7 @@ jobs:
     needs: create_pull_request
     if: ${{ failure() }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/notify-pull-request
         with:
           include-log: true

.github/workflows/bugs-triage-slack-notification.yml

@@ -0,0 +1,53 @@
+name: Bugs Slack Notification
+
+on:
+  issues:
+    types:
+      - opened
+jobs:
+  on-issue-opened:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: |
+        contains(github.event.issue.labels.*.name, '.Needs Triage') &&
+        contains(github.event.issue.labels.*.name, 'Type:Bug')
+    steps:
+      - name: Setting title
+        uses: actions/github-script@v7
+        id: vars
+        with:
+          script: |
+            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
+      - name: Check for labels containing team name
+        id: check_labels
+        run: |
+          labels_json=$(sed 's/&/\$/g' <<< '${{ toJson(github.event.issue.labels) }}')
+          echo "has_team_label=false" >> "$GITHUB_OUTPUT"
+          for label in "$labels_json"
+          do
+            if [[ $label == *".Team"* ]]; then
+              echo "Label contains the team name."
+              echo "has_team_label=true" >> "$GITHUB_OUTPUT"
+              break
+            fi
+          done
+      - name: Send the issue ${{ github.event.issue.number }} to Slack
+        id: slack
+        if: steps.check_labels.outputs.has_team_label == 'false'
+        uses: slackapi/slack-github-action@v1.23.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_BUG_TRIAGE_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/build-for-release.yml

@@ -0,0 +1,216 @@
+name: Release 1 - Build Release Artifact
+run-name: Build ${{ inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.46.3)'
+        type: string
+        required: true
+      commit:
+        description: 'A full-length commit SHA-1 hash'
+        required: true
+
+jobs:
+  check-version:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      ee: ${{ fromJson(steps.canonical_version.outputs.result).ee }}
+      oss: ${{ fromJson(steps.canonical_version.outputs.result).oss }}
+    steps:
+    - name: Fail early on the incorrect version format
+      if: ${{ !(startsWith(inputs.version,'v0.') || startsWith(inputs.version,'v1.')) }}
+      run: |
+        echo "The version format is invalid!"
+        echo "It must start with either 'v0.' or 'v1.'."
+        echo "Please, try again."
+        exit 1
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get Release Version
+      uses: actions/github-script@v7
+      id: canonical_version
+      with:
+        script: | # js
+          const { isValidVersionString, getCanonicalVersion, hasBeenReleased } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          const version = '${{ inputs.version }}';
+
+          if (!isValidVersionString(version)) {
+            throw new Error("The version format is invalid! It must start with either 'v0.' or 'v1.'.");
+          }
+
+          const versions = {
+            ee: getCanonicalVersion(version, 'ee'),
+            oss: getCanonicalVersion(version, 'oss'),
+          };
+
+          const ossReleased = await hasBeenReleased({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            version: versions.oss,
+          });
+
+          const eeReleased = await hasBeenReleased({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            version: versions.ee,
+          });
+
+          if (ossReleased || eeReleased) {
+            throw new Error("This version has already been released!", version);
+          }
+
+          return versions;
+
+  check-commit:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+    - name: Check out the code to verify the release branch
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0  # IMPORTANT! to get all the branches
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get Release Branch
+      uses: actions/github-script@v7
+      id: release_branch
+      with:
+        result_encoding: string
+        script: | # js
+          const { getReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
+          const version = '${{ inputs.version }}';
+          const releaseBranch = getReleaseBranch(version);
+          return releaseBranch;
+    - name: Ensure that the specified commit exists in the ${{ steps.release_branch.outputs.result }} release branch
+      run: |
+        RELEASE_BRANCH=${{ steps.release_branch.outputs.result }}
+        git checkout $RELEASE_BRANCH
+        git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
+          && echo "Commit found in correct release branch" \
+          || (echo "Commit not found in correct release branch" && exit 1)
+
+  get-build-requirements:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+      build_process: ${{ fromJson(steps.dependencies.outputs.result).build_process }}
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get build dependencies
+      uses: actions/github-script@v7
+      id: dependencies
+      with:
+        script: | # js
+          const { getBuildRequirements, getMajorVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          const version = '${{ inputs.version }}';
+
+          const requirements = getBuildRequirements(version);
+          const build_process = getMajorVersion(version) < 46 ? 'legacy' : 'new';
+          console.log('Build process:', build_process);
+
+          return {
+            java_version: requirements.java,
+            node_version: requirements.node,
+            build_process,
+          };
+
+  build-uberjar-for-release:
+    needs: [check-version, check-commit, get-build-requirements]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 50
+    strategy:
+      matrix:
+        edition: [oss, ee]
+    env:
+      INTERACTIVE: false
+    steps:
+    - name: Get correct version number
+      run: | # bash
+        if [ '${{matrix.edition}}' == 'ee' ]; then
+          version='${{ needs.check-version.outputs.ee }}'
+        else
+          version='${{ needs.check-version.outputs.oss }}'
+        fi
+
+        echo "VERSION=$version" >> $GITHUB_ENV
+    - name: Setup Java ${{ needs.get-build-requirements.outputs.java_version }}
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: ${{ needs.get-build-requirements.outputs.java_version }}
+    - name: Setup Node.js ${{ needs.get-build-requirements.outputs.node_version }}
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ needs.get-build-requirements.outputs.node_version }}.x
+    - name: Check out the code
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.inputs.commit }}
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+
+    - name: Build Metabase
+      if: ${{ needs.get-build-requirements.outputs.build_process != 'legacy' }}
+      run: ./bin/build.sh :edition :${{ matrix.edition }} :version $VERSION
+
+    - name: Build Metabase (legacy)
+      if: ${{ needs.get-build-requirements.outputs.build_process == 'legacy' }}
+      run: cd ./bin/build-mb && clojure -X build/build! :edition :${{ matrix.edition }} :version $VERSION
+
+    - name: Store commit's SHA-1 hash
+      run:  echo ${{ inputs.commit }} > COMMIT-ID
+      shell: bash
+    - run: mv ./target/uberjar/metabase.jar ./metabase.jar
+    - name: Calculate SHA256 checksum
+      run: sha256sum ./metabase.jar > SHA256.sum
+      shell: bash
+    - name: Upload JARs as artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
+        path: |
+          ./metabase.jar
+          ./COMMIT-ID
+          ./SHA256.sum
+
+  trigger-tests:
+    needs: [build-uberjar-for-release]
+    permissions:
+      actions: write
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - name: trigger pre-release testing
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'pre-release.yml',
+              ref: '${{ github.ref }}',
+              inputs: {
+                commit: '${{ inputs.commit }}',
+                version: '${{ inputs.version }}',
+              }
+            });

.github/workflows/build-scripts.yml

@@ -12,7 +12,7 @@ jobs:
   test-build-scripts:
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Prepare back-end environment
       timeout-minutes: 5
       uses: ./.github/actions/prepare-backend

.github/workflows/check-backport-script.yml

@@ -0,0 +1,20 @@
+name: Prevent backport.sh from being merged
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  check-backport-script:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Check for backport.sh file
+        run: |
+          if [ -f "./backport.sh" ]; then
+            echo "backport.sh file exists. Please remove it before merging."
+            exit 1
+          else
+            echo "All good."
+          fi

.github/workflows/check-milestone.yml

@@ -0,0 +1,80 @@
+name: Milestone Reminder
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - "master"
+
+jobs:
+  milestone-reminder:
+    if: github.event.pull_request.merged == true
+    name: Remind to set milestone
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    permissions:
+      pull-requests: write
+      issues: read
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          script: | # js
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            const pullNumber = '${{ github.event.pull_request.number }}';
+
+            // the github API doesn't expose linked issues, so we have to parse the body ourselves
+            function getLinkedIssueId(pull) {
+              // https://regexr.com/7mjnp
+              const match = pull.data.body.match(/(\/issues\/|#)(\d+)/);
+              return match && match?.[2];
+            }
+
+            function getMilestone(pullOrIssue) {
+              // pull has pull.data.milestone, issue has issue.milestone
+              return pullOrIssue?.data?.milestone || pullOrIssue?.milestone;
+            }
+
+            const pull = await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: pullNumber,
+            });
+
+            if (getMilestone(pull)) {
+              console.log("Pull request has milestone", pull.data.milestone?.title);
+              process.exit(0);
+            }
+
+            const issueId = getLinkedIssueId(pull);
+
+            if (issueId) {
+              console.log('linked issue found', issueId);
+
+              const issue = await github.rest.issues.get({
+                owner,
+                repo,
+                issue_number: issueId,
+              });
+
+              const milestone = getMilestone(issue);
+
+              if (milestone) {
+                console.log("Linked issue has milestone", milestone.title);
+                process.exit(0);
+              }
+            }
+
+            console.log("No milestone found");
+
+            const author = pull.data.user.login;
+            const guideLink = "https://www.notion.so/metabase/Metabase-Branching-Strategy-6eb577d5f61142aa960a626d6bbdfeb3?pvs=4#3dea255ffa3b4f74942a227844e889fa";
+            const message = `@${author} Did you forget to add a milestone to the issue for this PR? _[When and where should I add a milestone?](${guideLink})_`;
+
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: pullNumber,
+              body: message,
+            });

.github/workflows/chromatic.yml

@@ -0,0 +1,54 @@
+name: Chromatic Storybook deployment
+
+on:
+  push:
+    branches:
+      - "master"
+  pull_request:
+    types: [synchronize, labeled, unlabeled]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      frontend_all: ${{ steps.changes.outputs.frontend_all }}
+      e2e_specs: ${{ steps.changes.outputs.e2e_specs }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  fe-chromatic:
+    needs: files-changed
+    if: contains(github.event.pull_request.labels.*.name, 'chromatic') || (github.ref_name == 'master' && needs.files-changed.outputs.frontend_all == 'true')
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - name: Publish to Chromatic
+        uses: chromaui/action@v10.2.0
+        env:
+          PUBLISH_CHROMATIC: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
+          STORYBOOK_BUILD_TIMEOUT: 900000
+        if: env.PUBLISH_CHROMATIC != null
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}

.github/workflows/clean-cache.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Cleanup
         run: |

.github/workflows/cljs.yml

@@ -12,12 +12,28 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      cljs: ${{ steps.changes.outputs.cljs }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
 
   shared-tests-cljs:
+    needs: files-changed
+    if: needs.files-changed.outputs.cljs == 'true'
     runs-on: ubuntu-22.04
-    timeout-minutes: 10
+    timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Prepare front-end environment
       uses: ./.github/actions/prepare-frontend
     - name: Prepare back-end environment

.github/workflows/codenotify.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-22.04
     name: Codenotify
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: sourcegraph/codenotify@v0.6.4

.github/workflows/codeql.yml

@@ -15,19 +15,20 @@ jobs:
     outputs:
       codeql: ${{ steps.changes.outputs.codeql }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v2.11.1
+        uses: dorny/paths-filter@v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
           filters: .github/file-paths.yaml
   analyze:
     needs: files-changed
+    if: needs.files-changed.outputs.codeql == 'true'
     runs-on: ubuntu-22.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v2
       with:

.github/workflows/doc-md-links.yml

@@ -11,7 +11,7 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Lint doc links

.github/workflows/drivers-stress-test.yml

@@ -0,0 +1,723 @@
+name: Driver Stress Test
+
+on:
+  workflow_dispatch:
+    inputs:
+      test:
+        description: 'The exact test name with its namespace.'
+        type: string
+        required: true
+      times:
+        description: 'How many times do you want to run this test?'
+        type: number
+        required: true
+        default: 1
+      driver:
+        description: 'The driver against which you want to run this test.'
+        required: true
+        default: 'Postgres'
+        type: choice
+        options:
+          - Athena
+          - BigQuery
+          - Druid
+          - Google Analytics
+          - Google Classpath Test
+          - Maria DB
+          - Maria DB (latest)
+          - Mongo 4
+          - Mongo 4 (SSL)
+          - Mongo 5
+          - Mongo 5 (SSL)
+          - Mongo (latest)
+          - MySQL
+          - MySQL (latest)
+          - Oracle 18
+          - Oracle 21
+          - Postgres
+          - Postgres (latest)
+          - Presto JDBC
+          - Redshift
+          - Snowflake
+          - SparkSQL
+          - SQLite
+          - SQL Server 2017
+          - SQL Server 2022
+          - Vertica
+
+jobs:
+
+  be-tests-athena-ee:
+    if: inputs.driver == 'Athena'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: athena
+      MB_ATHENA_TEST_REGION: us-east-1
+      MB_ATHENA_TEST_ACCESS_KEY: ${{ secrets.MB_ATHENA_TEST_ACCESS_KEY }}
+      MB_ATHENA_TEST_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_SECRET_KEY }}
+      MB_ATHENA_TEST_S3_STAGING_DIR: ${{ secrets.MB_ATHENA_TEST_S3_STAGING_DIR }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Athena driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-athena-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-bigquery-cloud-sdk-ee:
+    if: inputs.driver == 'BigQuery'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: bigquery-cloud-sdk
+      MB_BIGQUERY_TEST_PROJECT_ID: ${{ secrets.BIGQUERY_TEST_PROJECT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_ID: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_SECRET: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_SECRET }}
+      MB_BIGQUERY_TEST_ACCESS_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_ACCESS_TOKEN }}
+      MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test BigQuery Cloud SDK driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-bigquery-cloud-sdk-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-druid-ee:
+    if: inputs.driver == 'Druid'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: druid
+    services:
+      druid:
+        image: metabase/druid:0.20.2
+        ports:
+          - "8082:8082"
+        env:
+          CLUSTER_SIZE: nano-quickstart
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Druid driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-druid-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-googleanalytics-ee:
+    if: inputs.driver == 'Google Analytics'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: googleanalytics
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Google Analytics driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-googleanalytics-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-google-related-drivers-classpath-test:
+    if: inputs.driver == 'Google Classpath Test'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: 'googleanalytics,bigquery-cloud-sdk'
+      MB_BIGQUERY_TEST_PROJECT_ID: ${{ secrets.BIGQUERY_TEST_PROJECT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_ID: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_SECRET: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_SECRET }}
+      MB_BIGQUERY_TEST_ACCESS_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_ACCESS_TOKEN }}
+      MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Google Related Drivers Classpath
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-google-related-drivers-classpath-test'
+        test-args: ':only "[metabase.query-processor-test.expressions-test metabase.driver.google-test metabase.driver.googleanalytics-test ${{ inputs.test }}] :times ${{ inputs.times }}"'
+
+  be-tests-mariadb-10-2-ee:
+    if: inputs.driver == 'Maria DB'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mysql
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+    services:
+      mariadb:
+        image: circleci/mariadb:10.2.23
+        ports:
+          - "3306:3306"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MariaDB driver (10.2)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mariadb-10-2-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-mariadb-latest-ee:
+    if: inputs.driver == 'Maria DB (latest)'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mysql
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+    services:
+      mariadb:
+        image: circleci/mariadb:latest
+        ports:
+          - "3306:3306"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MariaDB driver (latest)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mariadb-latest-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-mongo-4-4-ee:
+    if: inputs.driver == 'Mongo 4'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mongo
+      MB_MONGO_TEST_USER: metabase
+      MB_MONGO_TEST_PASSWORD: metasample123
+    services:
+      mongodb:
+        image: metabase/qa-databases:mongo-sample-4.4
+        ports:
+          - "27017:27017"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MongoDB driver (4.4)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mongo-4-4-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-mongo-4-4-ssl-ee:
+    if: inputs.driver == 'Mongo 4 (SSL)'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mongo
+      MB_MONGO_TEST_USER: metabase
+      MB_MONGO_TEST_PASSWORD: metasample123
+      MB_TEST_MONGO_REQUIRES_SSL: true
+    steps:
+      - uses: actions/checkout@v4
+      - name: Spin up Mongo docker container
+        run: docker run -d -p 27017:27017 --name metamongo metabase/qa-databases:mongo-sample-4.4 mongod --dbpath /data/db2/ --tlsMode requireTLS --tlsCertificateKeyFile /etc/mongo/metamongo.pem --tlsCAFile /etc/mongo/metaca.crt
+      - name: Wait until the port 27017 is ready
+        run: while ! nc -z localhost 27017; do sleep 1; done
+        timeout-minutes: 5
+      - name: Make SSL certificates for Mongo available
+        run: |
+          curl https://raw.githubusercontent.com/metabase/metabase-qa/master/dbs/mongo/certificates/metabase.crt \
+          -o ./test_resources/ssl/mongo/metabase.crt
+
+          curl https://raw.githubusercontent.com/metabase/metabase-qa/master/dbs/mongo/certificates/metabase.key \
+          -o ./test_resources/ssl/mongo/metabase.key
+
+          curl https://raw.githubusercontent.com/metabase/metabase-qa/master/dbs/mongo/certificates/metaca.crt \
+          -o ./test_resources/ssl/mongo/metaca.crt
+
+      - name: Test MongoDB SSL driver (4.4)
+        uses: ./.github/actions/test-driver
+        with:
+          junit-name: 'be-tests-mongo-4-4-ee'
+          test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-mongo-5-0-ee:
+    if: inputs.driver == 'Mongo 5'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mongo
+      MB_MONGO_TEST_USER: metabase
+      MB_MONGO_TEST_PASSWORD: metasample123
+    services:
+      mongodb:
+        image: metabase/qa-databases:mongo-sample-5.0
+        ports:
+          - "27017:27017"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MongoDB driver (5.0)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mongo-5-0-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-mongo-5-0-ssl-ee:
+    if: inputs.driver == 'Mongo 5 (SSL)'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mongo
+      MB_MONGO_TEST_USER: metabase
+      MB_MONGO_TEST_PASSWORD: metasample123
+      MB_TEST_MONGO_REQUIRES_SSL: true
+    steps:
+    - uses: actions/checkout@v4
+    - name: Spin up Mongo docker container
+      run: docker run -d -p 27017:27017 --name metamongo metabase/qa-databases:mongo-sample-5.0 mongod --dbpath /data/db2/ --tlsMode requireTLS --tlsCertificateKeyFile /etc/mongo/metamongo.pem --tlsCAFile /etc/mongo/metaca.crt
+    - name: Wait until the port 27017 is ready
+      run: while ! nc -z localhost 27017; do sleep 1; done
+      timeout-minutes: 5
+    - name: Make SSL certificates for Mongo available
+      run: |
+        curl https://raw.githubusercontent.com/metabase/metabase-qa/master/dbs/mongo/certificates/metabase.crt \
+        -o ./test_resources/ssl/mongo/metabase.crt
+
+        curl https://raw.githubusercontent.com/metabase/metabase-qa/master/dbs/mongo/certificates/metabase.key \
+        -o ./test_resources/ssl/mongo/metabase.key
+
+        curl https://raw.githubusercontent.com/metabase/metabase-qa/master/dbs/mongo/certificates/metaca.crt \
+        -o ./test_resources/ssl/mongo/metaca.crt
+
+    - name: Test MongoDB SSL driver (5.0)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mongo-5-0-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-mongo-latest-ee:
+    if: inputs.driver == 'Mongo (latest)'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mongo
+      MB_MONGO_TEST_USER: metabase
+      MB_MONGO_TEST_PASSWORD: metasample123
+    services:
+      mongodb:
+        image: circleci/mongo:latest
+        ports:
+          - "27017:27017"
+        env:
+          MONGO_INITDB_ROOT_USERNAME: metabase
+          MONGO_INITDB_ROOT_PASSWORD: metasample123
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MongoDB driver (latest)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mongo-latest-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-mysql-8-0-ee:
+    if: inputs.driver == 'MySQL'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mysql
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+    services:
+      mysql:
+        image: cimg/mysql:8.0
+        ports:
+          - "3306:3306"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MySQL driver (8.0)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mysql-8-0-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-mysql-latest-ee:
+    if: inputs.driver == 'MySQL (latest)'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mysql
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+      # set up env vars for something named "MYSQL_SSL" to run MySQL SSL tests verifying connectivity with PEM cert
+      # they are deliberately given a different name to prevent them from affecting the regular test run against
+      # the configured MySQL instance, but there is one particular test (mysql-connect-with-ssl-and-pem-cert-test)
+      # that overrides the MB_MYSQL_TEST_* values with them
+      # the MYSQL_RDS_SSL_INSTANCE vars are defined as secrets and can be altered
+      MB_MYSQL_SSL_TEST_HOST: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_HOST }}
+      MB_MYSQL_SSL_TEST_SSL: true
+      MB_MYSQL_SSL_TEST_ADDITIONAL_OPTIONS: 'verifyServerCertificate=true'
+      # the contents of the ./resources/certificates/rds-combined-ca-bundle.pem file
+      MB_MYSQL_SSL_TEST_SSL_CERT: ${{ secrets.MB_MYSQL_SSL_TEST_SSL_CERT }}
+      MB_MYSQL_SSL_TEST_USER: metabase
+      MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
+    services:
+      mysql:
+        image: mysql:latest
+        ports:
+        - "3306:3306"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MySQL driver (latest)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mysql-latest-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-oracle-18-4-ee:
+    if: inputs.driver == 'Oracle 18'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: oracle
+      MB_ORACLE_TEST_HOST: localhost
+      MB_ORACLE_TEST_USER: system
+      MB_ORACLE_TEST_PASSWORD: password
+      MB_ORACLE_TEST_SERVICE_NAME: XEPDB1
+    services:
+      oracle:
+        image: gvenzl/oracle-xe:18.4.0-slim
+        env:
+          ORACLE_PASSWORD: password
+        ports:
+          - "1521:1521"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Oracle driver (18.4)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-oracle-18-4-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-oracle-21-3-ee:
+    if: inputs.driver == 'Oracle 21'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: oracle
+      MB_ORACLE_TEST_HOST: localhost
+      MB_ORACLE_TEST_PORT: 2484
+      MB_ORACLE_TEST_SERVICE_NAME: XEPDB1
+      MB_ORACLE_TEST_SSL: true
+      MB_ORACLE_TEST_SSL_USE_TRUSTSTORE: true
+      MB_ORACLE_TEST_SSL_TRUSTSTORE_PATH: './test_resources/ssl/oracle/truststore.p12'
+      MB_ORACLE_TEST_SSL_TRUSTSTORE_OPTIONS: local
+      MB_ORACLE_TEST_SSL_TRUSTSTORE_PASSWORD_VALUE: 'PassworD_#1234'
+      MB_ORACLE_TEST_SSL_USE_KEYSTORE: true
+      MB_ORACLE_TEST_SSL_KEYSTORE_PATH: './test_resources/ssl/oracle/keystore.p12'
+      MB_ORACLE_TEST_SSL_KEYSTORE_OPTIONS: local
+      MB_ORACLE_TEST_SSL_KEYSTORE_PASSWORD_VALUE: 'PassworD_#1234'
+      MB_ORACLE_SSL_TEST_SSL: true
+    services:
+      oracle:
+        image: metabase/qa-databases:oracle-xe-21.3
+        env:
+          ORACLE_PASSWORD: password
+        ports:
+          - "2484:2484"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Oracle driver (21.3)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-oracle-21-3-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-postgres-ee:
+    if: inputs.driver == 'Postgres'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: postgres
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
+      MB_POSTGRESQL_TEST_USER: mb_test
+    services:
+      postgres:
+        image: postgres:12-alpine
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Postgres driver (12)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-postgres-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-postgres-latest-ee:
+    if: inputs.driver == 'Postgres (latest)'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: postgres
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: circle_test
+      MB_POSTGRESQL_TEST_USER: circle_test
+      MB_POSTGRES_SSL_TEST_SSL: true
+      MB_POSTGRES_SSL_TEST_SSL_MODE: verify-full
+      MB_POSTGRES_SSL_TEST_SSL_ROOT_CERT_PATH: 'test-resources/certificates/us-east-2-bundle.pem'
+    services:
+      postgres:
+        image: circleci/postgres:latest
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: circle_test
+          POSTGRES_DB: circle_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Postgres driver (latest)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-postgres-latest-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-presto-jdbc-ee:
+    if: inputs.driver == 'Presto JDBC'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: presto-jdbc
+      MB_PRESTO_JDBC_TEST_CATALOG: test_data
+      MB_PRESTO_JDBC_TEST_HOST: localhost
+      MB_PRESTO_JDBC_TEST_PORT: 8443
+      MB_PRESTO_JDBC_TEST_SSL: true
+      MB_PRESTO_JDBC_TEST_USER: metabase
+      MB_PRESTO_JDBC_TEST_PASSWORD: metabase
+      MB_ENABLE_PRESTO_JDBC_DRIVER: true
+      MB_PRESTO_JDBC_TEST_ADDITIONAL_OPTIONS: 'SSLTrustStorePath=/tmp/cacerts-with-presto-ssl.jks&SSLTrustStorePassword=changeit'
+    services:
+      presto:
+        image: metabase/presto-mb-ci:latest # version 0.254
+        ports:
+          - "8443:8443"
+        env:
+          JAVA_TOOL_OPTIONS: "-Xmx2g"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Wait for port ${{ env.MB_PRESTO_JDBC_TEST_PORT }} to be ready
+      run: while ! nc -z localhost ${{ env.MB_PRESTO_JDBC_TEST_PORT }}; do sleep 0.1; done
+      timeout-minutes: 15
+    - name: Create temp cacerts file based on bundled JDK one
+      run: cp $JAVA_HOME/lib/security/cacerts /tmp/cacerts-with-presto-ssl.jks
+    - name: Capture Presto server self signed CA
+      run: |
+          while [[ ! -s /tmp/presto-ssl-ca.pem ]];
+            do echo "Waiting to capture SSL CA" \
+              && openssl s_client -connect localhost:8443 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/presto-ssl-ca.pem \
+              && sleep 1; done
+    - name: Convert Presto CA from PEM to DER
+      run: openssl x509 -outform der -in /tmp/presto-ssl-ca.pem -out /tmp/presto-ssl-ca.der
+    - name: Add write permission on cacerts file
+      run: chmod u+w /tmp/cacerts-with-presto-ssl.jks
+    - name: Import Presto CA into temp cacerts file
+      run: |
+          keytool -noprompt -import -alias presto -keystore /tmp/cacerts-with-presto-ssl.jks \
+                  -storepass changeit -file /tmp/presto-ssl-ca.der -trustcacerts
+    - name: Test Presto JDBC driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-presto-jdbc-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-redshift-ee:
+    if: inputs.driver == 'Redshift'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: redshift
+      MB_REDSHIFT_TEST_USER: metabase_ci
+      MB_REDSHIFT_TEST_DB: testdb
+      MB_REDSHIFT_TEST_HOST: ${{ secrets.MB_REDSHIFT_TEST_HOST }}
+      MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Redshift driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-redshift-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-snowflake-ee:
+    if: inputs.driver == 'Snowflake'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: snowflake
+      MB_SNOWFLAKE_TEST_USER: METABASE CI
+      MB_SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.MB_SNOWFLAKE_TEST_ACCOUNT }}
+      MB_SNOWFLAKE_TEST_PASSWORD: ${{ secrets.MB_SNOWFLAKE_TEST_PASSWORD }}
+      MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
+      MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
+      MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Snowflake driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-snowflake-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-sparksql-ee:
+    if: inputs.driver == 'SparkSQL'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: sparksql
+    services:
+      sparksql:
+        image: metabase/spark:3.2.1
+        ports:
+          - "10000:10000"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Spark driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-sparksql-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-sqlite-ee:
+    if: inputs.driver == 'SQLite'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: sqlite
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test SQLite driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-sqlite-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-sqlserver-2017-ee:
+    if: inputs.driver == 'SQL Server 2017'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: sqlserver
+      MB_SQLSERVER_TEST_HOST: localhost
+      MB_SQLSERVER_TEST_PASSWORD: 'P@ssw0rd'
+      MB_SQLSERVER_TEST_USER: SA
+    services:
+      sqlserver:
+        image: mcr.microsoft.com/mssql/server:2017-latest
+        ports:
+          - "1433:1433"
+        env:
+          ACCEPT_EULA: Y
+          SA_PASSWORD: 'P@ssw0rd'
+          MSSQL_MEMORY_LIMIT_MB: 1024
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MS SQL Server 2017 driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-sqlserver-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-sqlserver-2022-ee:
+    if: inputs.driver == 'SQL Server 2022'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: sqlserver
+      MB_SQLSERVER_TEST_HOST: localhost
+      MB_SQLSERVER_TEST_PASSWORD: 'P@ssw0rd'
+      MB_SQLSERVER_TEST_USER: SA
+    services:
+      sqlserver:
+        image: mcr.microsoft.com/mssql/server:2022-latest
+        ports:
+          - "1433:1433"
+        env:
+          ACCEPT_EULA: Y
+          SA_PASSWORD: 'P@ssw0rd'
+          MSSQL_MEMORY_LIMIT_MB: 1024
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MS SQL Server 2022 driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-sqlserver-2022-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-vertica-ee:
+    if: inputs.driver == 'Vertica'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: vertica
+    services:
+      vertica:
+        image: vertica/vertica-ce:12.0.2-0
+        ports:
+          - "5433:5433"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Make plugins directory
+      run: mkdir plugins
+    - name: Test Vertica driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-vertica-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"

.github/workflows/drivers.yml

@@ -20,9 +20,9 @@ jobs:
     outputs:
       backend_all: ${{ steps.changes.outputs.backend_all }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v2.11.1
+        uses: dorny/paths-filter@v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
@@ -41,12 +41,23 @@ jobs:
       MB_ATHENA_TEST_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_SECRET_KEY }}
       MB_ATHENA_TEST_S3_STAGING_DIR: ${{ secrets.MB_ATHENA_TEST_S3_STAGING_DIR }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test Athena driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-athena-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: files-changed
@@ -63,12 +74,23 @@ jobs:
       MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
       MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test BigQuery Cloud SDK driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-druid-ee:
     needs: files-changed
@@ -86,12 +108,23 @@ jobs:
         env:
           CLUSTER_SIZE: nano-quickstart
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test Druid driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-druid-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-googleanalytics-ee:
     needs: files-changed
@@ -102,12 +135,23 @@ jobs:
       CI: 'true'
       DRIVERS: googleanalytics
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test Google Analytics driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-googleanalytics-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-google-related-drivers-classpath-test:
     needs: files-changed
@@ -124,12 +168,23 @@ jobs:
       MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
       MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test Google Related Drivers Classpath
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-google-related-drivers-classpath-test'
         test-args: ':only "[metabase.query-processor-test.expressions-test metabase.driver.google-test metabase.driver.googleanalytics-test]"'
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-mariadb-10-2-ee:
     needs: files-changed
@@ -151,11 +206,22 @@ jobs:
         ports:
           - "3306:3306"
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test MariaDB driver (10.2)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mariadb-10-2-ee'
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-mariadb-latest-ee:
     needs: files-changed
@@ -177,13 +243,24 @@ jobs:
         ports:
           - "3306:3306"
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test MariaDB driver (latest)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mariadb-latest-ee'
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
-  be-tests-mongo-4-2-ee:
+  be-tests-mongo-4-4-ee:
     needs: files-changed
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
@@ -195,18 +272,29 @@ jobs:
       MB_MONGO_TEST_PASSWORD: metasample123
     services:
       mongodb:
-        image: metabase/qa-databases:mongo-sample-4.2
+        image: metabase/qa-databases:mongo-sample-4.4
         ports:
           - "27017:27017"
     steps:
-    - uses: actions/checkout@v3
-    - name: Test MongoDB driver (4.2)
+    - uses: actions/checkout@v4
+    - name: Test MongoDB driver (4.4)
       uses: ./.github/actions/test-driver
       with:
-        junit-name: 'be-tests-mongo-4-2-ee'
+        junit-name: 'be-tests-mongo-4-4-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
-  be-tests-mongo-4-2-ssl-ee:
+  be-tests-mongo-4-4-ssl-ee:
     needs: files-changed
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
@@ -218,9 +306,9 @@ jobs:
       MB_MONGO_TEST_PASSWORD: metasample123
       MB_TEST_MONGO_REQUIRES_SSL: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Spin up Mongo docker container
-        run: docker run -d -p 27017:27017 --name metamongo metabase/qa-databases:mongo-sample-4.2 mongod --dbpath /data/db2/ --tlsMode requireTLS --tlsCertificateKeyFile /etc/mongo/metamongo.pem --tlsCAFile /etc/mongo/metaca.crt
+        run: docker run -d -p 27017:27017 --name metamongo metabase/qa-databases:mongo-sample-4.4 mongod --dbpath /data/db2/ --tlsMode requireTLS --tlsCertificateKeyFile /etc/mongo/metamongo.pem --tlsCAFile /etc/mongo/metaca.crt
       - name: Wait until the port 27017 is ready
         run: while ! nc -z localhost 27017; do sleep 1; done
         timeout-minutes: 5
@@ -235,11 +323,22 @@ jobs:
           curl https://raw.githubusercontent.com/metabase/metabase-qa/master/dbs/mongo/certificates/metaca.crt \
           -o ./test_resources/ssl/mongo/metaca.crt
 
-      - name: Test MongoDB SSL driver (4.2)
+      - name: Test MongoDB SSL driver (4.4)
         uses: ./.github/actions/test-driver
         with:
-          junit-name: 'be-tests-mongo-4-2-ee'
+          junit-name: 'be-tests-mongo-4-4-ee'
           test-args: ":exclude-tags '[:mb/once]'"
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit/
+          output-name: ${{ github.job }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-mongo-5-0-ee:
     needs: files-changed
@@ -257,12 +356,23 @@ jobs:
         ports:
           - "27017:27017"
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test MongoDB driver (5.0)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-5-0-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-mongo-5-0-ssl-ee:
     needs: files-changed
@@ -276,7 +386,7 @@ jobs:
       MB_MONGO_TEST_PASSWORD: metasample123
       MB_TEST_MONGO_REQUIRES_SSL: true
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Spin up Mongo docker container
       run: docker run -d -p 27017:27017 --name metamongo metabase/qa-databases:mongo-sample-5.0 mongod --dbpath /data/db2/ --tlsMode requireTLS --tlsCertificateKeyFile /etc/mongo/metamongo.pem --tlsCAFile /etc/mongo/metaca.crt
     - name: Wait until the port 27017 is ready
@@ -298,6 +408,17 @@ jobs:
       with:
         junit-name: 'be-tests-mongo-5-0-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-mongo-latest-ee:
     needs: files-changed
@@ -318,14 +439,25 @@ jobs:
           MONGO_INITDB_ROOT_USERNAME: metabase
           MONGO_INITDB_ROOT_PASSWORD: metasample123
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test MongoDB driver (latest)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-latest-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
-  be-tests-mysql-5-7-ee:
+  be-tests-mysql-8-0-ee:
     needs: files-changed
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
@@ -341,15 +473,15 @@ jobs:
       MB_MYSQL_TEST_USER: root
     services:
       mysql:
-        image: circleci/mysql:5.7.23
+        image: cimg/mysql:8.0
         ports:
           - "3306:3306"
     steps:
-    - uses: actions/checkout@v3
-    - name: Test MySQL driver (5.7)
+    - uses: actions/checkout@v4
+    - name: Test MySQL driver (8.0)
       uses: ./.github/actions/test-driver
       with:
-        junit-name: 'be-tests-mysql-5-7-ee'
+        junit-name: 'be-tests-mysql-8-0-ee'
 
   be-tests-mysql-latest-ee:
     needs: files-changed
@@ -379,15 +511,29 @@ jobs:
       MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
     services:
       mysql:
-        image: circleci/mysql:latest
+        image: mysql:latest
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: circle_test
         ports:
         - "3306:3306"
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test MySQL driver (latest)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mysql-latest-ee'
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-oracle-18-4-ee:
     needs: files-changed
@@ -409,12 +555,23 @@ jobs:
         ports:
           - "1521:1521"
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test Oracle driver (18.4)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-oracle-18-4-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-oracle-21-3-ee:
     needs: files-changed
@@ -445,12 +602,23 @@ jobs:
         ports:
           - "2484:2484"
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test Oracle driver (21.3)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-oracle-21-3-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-postgres-ee:
     needs: files-changed
@@ -463,20 +631,21 @@ jobs:
       MB_DB_TYPE: postgres
       MB_DB_PORT: 5432
       MB_DB_HOST: localhost
-      MB_DB_DBNAME: circle_test
-      MB_DB_USER: circle_test
-      MB_POSTGRESQL_TEST_USER: circle_test
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
+      MB_POSTGRESQL_TEST_USER: mb_test
     services:
       postgres:
-        image: circleci/postgres:9.6-alpine
+        image: postgres:12-alpine
         ports:
           - "5432:5432"
         env:
-          POSTGRES_USER: circle_test
-          POSTGRES_DB: circle_test
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
     steps:
-    - uses: actions/checkout@v3
-    - name: Test Postgres driver (9.6)
+    - uses: actions/checkout@v4
+    - name: Test Postgres driver (12)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-postgres-ee'
@@ -508,11 +677,22 @@ jobs:
           POSTGRES_DB: circle_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test Postgres driver (latest)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-postgres-latest-ee'
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-presto-jdbc-ee:
     needs: files-changed
@@ -538,7 +718,7 @@ jobs:
         env:
           JAVA_TOOL_OPTIONS: "-Xmx2g"
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Wait for port ${{ env.MB_PRESTO_JDBC_TEST_PORT }} to be ready
       run: while ! nc -z localhost ${{ env.MB_PRESTO_JDBC_TEST_PORT }}; do sleep 0.1; done
       timeout-minutes: 15
@@ -563,6 +743,17 @@ jobs:
       with:
         junit-name: 'be-tests-presto-jdbc-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-redshift-ee:
     needs: files-changed
@@ -577,12 +768,23 @@ jobs:
       MB_REDSHIFT_TEST_HOST: ${{ secrets.MB_REDSHIFT_TEST_HOST }}
       MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test Redshift driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-redshift-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-snowflake-ee:
     needs: files-changed
@@ -599,12 +801,23 @@ jobs:
       MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
       MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test Snowflake driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-snowflake-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-sparksql-ee:
     needs: files-changed
@@ -620,12 +833,23 @@ jobs:
         ports:
           - "10000:10000"
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test Spark driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sparksql-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-sqlite-ee:
     needs: files-changed
@@ -636,14 +860,25 @@ jobs:
       CI: 'true'
       DRIVERS: sqlite
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Test SQLite driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlite-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
-  be-tests-sqlserver-ee:
+  be-tests-sqlserver-2017-ee:
     needs: files-changed
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
@@ -664,12 +899,62 @@ jobs:
           SA_PASSWORD: 'P@ssw0rd'
           MSSQL_MEMORY_LIMIT_MB: 1024
     steps:
-    - uses: actions/checkout@v3
-    - name: Test MS SQL Server driver
+    - uses: actions/checkout@v4
+    - name: Test MS SQL Server 2017 driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlserver-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  be-tests-sqlserver-2022-ee:
+    needs: files-changed
+    if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: sqlserver
+      MB_SQLSERVER_TEST_HOST: localhost
+      MB_SQLSERVER_TEST_PASSWORD: 'P@ssw0rd'
+      MB_SQLSERVER_TEST_USER: SA
+    services:
+      sqlserver:
+        image: mcr.microsoft.com/mssql/server:2022-latest
+        ports:
+          - "1433:1433"
+        env:
+          ACCEPT_EULA: Y
+          SA_PASSWORD: 'P@ssw0rd'
+          MSSQL_MEMORY_LIMIT_MB: 1024
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MS SQL Server 2022 driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-sqlserver-2022-ee'
+        test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-vertica-ee:
     needs: files-changed
@@ -685,7 +970,7 @@ jobs:
         ports:
           - "5433:5433"
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Make plugins directory
       run: mkdir plugins
     - name: Test Vertica driver
@@ -693,3 +978,14 @@ jobs:
       with:
         junit-name: 'be-tests-vertica-ee'
         test-args: ":exclude-tags '[:mb/once]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}

.github/workflows/e2e-cross-version.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Set source Docker image to OSS
       run: |
         echo "DOCKER_SOURCE_IMAGE=metabase/metabase:${{ matrix.version.source }}" >> $GITHUB_ENV
@@ -86,7 +86,7 @@ jobs:
           --config-file e2e/test/scenarios/cross-version/target/shared/cross-version-target.config.js \
           --spec e2e/test/scenarios/cross-version/target/**/*.cy.spec.js
     - name: Upload Cypress Artifacts upon failure
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       if: failure()
       with:
         name: cypress-artifacts-${{ matrix.version.source}}-to-${{ matrix.version.target }}

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -3,10 +3,6 @@ name: E2E Stress Test Flake Fix
 on:
   workflow_dispatch:
     inputs:
-      artifact:
-        description: 'Artifact ID'
-        type: string
-        required: true
       spec:
         description: 'Relative path of the target spec'
         type: string
@@ -15,8 +11,33 @@ on:
         description: 'Number of times to run the test (e.g. 20)'
         type: string
         required: true
+      grep:
+        description: 'Grep and filter tests to run in isolation'
+        type: string
+        required: false
+      mb_edition:
+        description: 'Set MB_EDITION env var to "ee" (enteprise) or "oss" (open-source)'
+        type: string
+        required: false
+        default: "ee"
 
 jobs:
+  workflow-summary:
+    name: Stress test inputs
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - name: Generate workflow summary
+        run: |
+          echo '**Inputs:**' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `spec`: ${{ inputs.spec }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
+
   stress-test-flake-fix:
     runs-on: ubuntu-22.04
     timeout-minutes: 60
@@ -24,73 +45,40 @@ jobs:
     env:
       DISPLAY: ""
       QA_DB_ENABLED: true
+      CYPRESS_REPLAYIO_ENABLED: 1
       CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
       CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
+      MB_EDITION: ${{ inputs.mb_edition }}
+      TERM: xterm
       TZ: US/Pacific # to make node match the instance tz
-    services:
-      maildev:
-        image: maildev/maildev:2.0.5
-        ports:
-          - "1080:1080"
-          - "1025:1025"
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      openldap:
-        image: bitnami/openldap:2.6.4
-        ports:
-          - 389:389
-        env:
-          LDAP_ADMIN_PASSWORD: adminpass
-          LDAP_USERS: user01@example.org,user02@example.org
-          LDAP_PASSWORDS: 123456,123465
-          LDAP_ROOT: dc=example,dc=org
-          LDAP_PORT_NUMBER: 389
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      postgres-sample:
-        image: metabase/qa-databases:postgres-sample-12
-        ports:
-          - "5404:5432"
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      mongo-sample:
-        image: metabase/qa-databases:mongo-sample-4.4
-        ports:
-          - 27004:27017
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      mysql-sample:
-        image: metabase/qa-databases:mysql-sample-8
-        ports:
-          - 3304:3306
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v3
-      - name: Download Metabase uberjar from a previously stored artifact
-        run: |
-          curl -L \
-            -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer $GITHUB_TOKEN" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            https://api.github.com/repos/metabase/metabase/actions/artifacts/$ARTIFACT_ID/zip \
-            -o mb.zip
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ARTIFACT_ID: ${{ github.event.inputs.artifact }}
-      - name: Unzip Metabase artifact containing an uberjar
-        run: unzip mb.zip
+      - uses: actions/checkout@v4
+        with:
+          # Important because we need previous commits hashes to find and download the uberjar!
+          fetch-depth: 20
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
+          openldap: true
+          postgres: true
+          mysql: true
+          mongo: true
+
+      - name: Download Metabase ${{ matrix.edition }} uberjar
+        uses: ./.github/actions/e2e-download-uberjar
+        with:
+          edition: 'ee'
+
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare JDK 11
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           java-version: 11
           distribution: "temurin"
@@ -98,20 +86,19 @@ jobs:
         uses: ./.github/actions/prepare-cypress
       - name: Run Snowplow micro
         uses: ./.github/actions/run-snowplow-micro
-      - name: Get Metabase version info
-        run: |
-          jar xf target/uberjar/metabase.jar version.properties
-          mv version.properties resources/
+
+      # For all options and fine-grained control, take a look at the documentation
+      # https://github.com/cypress-io/cypress/tree/develop/npm/grep
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
         run: |
           yarn run test-cypress-run \
           --spec '${{ github.event.inputs.spec }}' \
-          --env burn=${{ github.event.inputs.burn_in }} \
-          --config-file e2e/support/cypress-stress-test.config.js
-        env:
-          TERM: xterm
+          --env burn=${{ github.event.inputs.burn_in }},grep='${{ github.event.inputs.grep }}' \
+          --config-file e2e/support/cypress-stress-test.config.js \
+          --browser 'replay-chromium'
+
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: cypress-failed-tests-recording

.github/workflows/e2e-tests.yml

@@ -1,9 +1,6 @@
 name: E2E Tests
 
 on:
-  # We'll record runs using Replay.io and their browser on a schedule as an experiment
-  schedule:
-    - cron: '0 22 * * 0'
   push:
     branches:
       - "master"
@@ -16,13 +13,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  test-run-id:
-    runs-on: ubuntu-22.04
-    outputs:
-      testRunId: ${{ steps.testRunId.outputs.testRunId }}
-    steps:
-      - id: testRunId
-        run: echo testRunId=$(npx uuid) >> "$GITHUB_OUTPUT"
   files-changed:
     name: Check which files changed
     runs-on: ubuntu-22.04
@@ -30,17 +20,32 @@ jobs:
     outputs:
       e2e_all: ${{ steps.changes.outputs.e2e_all }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v2.11.1
+        uses: dorny/paths-filter@v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
           filters: .github/file-paths.yaml
 
+  e2e-matrix-builder:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.e2e-matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate matrix for E2E tests
+        id: e2e-matrix
+        uses: ./.github/actions/build-e2e-matrix
+
   build:
-    needs: files-changed
-    if: github.event.pull_request.draft == false && needs.files-changed.outputs.e2e_all == 'true'
+    needs: [files-changed, e2e-matrix-builder]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == false &&
+      needs.e2e-matrix-builder.result == 'success' &&
+      needs.files-changed.outputs.e2e_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 25
     strategy:
@@ -50,7 +55,7 @@ jobs:
       MB_EDITION: ${{ matrix.edition }}
       INTERACTIVE: false
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
@@ -63,16 +68,16 @@ jobs:
 
       - name: Prepare uberjar artifact
         uses: ./.github/actions/prepare-uberjar-artifact
+        with:
+          name: metabase-${{ matrix.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
 
   e2e-tests:
-    needs: [build, files-changed, test-run-id]
+    needs: [build, e2e-matrix-builder]
     if: |
-      always() &&
-      needs.files-changed.outputs.e2e_all == 'true' &&
-      needs.build.result == 'success'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 90
-    name: e2e-tests-${{ matrix.folder }}${{ matrix.context }}-${{ matrix.edition }}
+      !cancelled() && needs.build.result == 'success'
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    name: e2e-tests-${{ matrix.name }}-${{ matrix.edition }}
     env:
       MB_EDITION: ${{ matrix.edition }}
       DISPLAY: ""
@@ -81,228 +86,133 @@ jobs:
       # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
       CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
       CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      COMMIT_INFO_MESSAGE : ${{ github.event.pull_request.title || github.event.head_commit.message || github.even.head.sha }}
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
-      ELECTRON_EXTRA_LAUNCH_ARGS: "--remote-debugging-port=40500" # deploysentinel
+      CYPRESS_REPLAYIO_ENABLED: 1
+      RECORD_REPLAY_METADATA_FILE: /tmp/replay-metadata.json
+      RECORD_REPLAY_METADATA_TEST_RUN_ID: ${{ github.run_id }}
+      REPLAY_API_KEY: ${{ secrets.REPLAY_IO_TOKEN }}
       TZ: US/Pacific # to make node match the instance tz
     strategy:
       fail-fast: false
-      matrix:
-        java-version: [11]
-        edition: [ee]
-        folder:
-          - "auditing"
-          - "actions"
-          - "admin"
-          - "binning"
-          - "collections"
-          - "custom-column"
-          - "dashboard"
-          - "dashboard-filters"
-          - "embedding"
-          - "filters"
-          - "joins"
-          - "models"
-          - "native"
-          - "native-filters"
-          - "onboarding"
-          - "organization"
-          - "permissions"
-          - "question"
-          - "sharing"
-          - "visualizations"
-        include:
-          - edition: oss
-            context: grep
-            java-version: 11
-    services:
-      maildev:
-        image: maildev/maildev:2.0.5
-        ports:
-          - "1080:1080"
-          - "1025:1025"
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      openldap:
-        image: bitnami/openldap:2.6.4
-        ports:
-          - 389:389
-        env:
-          LDAP_ADMIN_PASSWORD: adminpass
-          LDAP_USERS: user01@example.org,user02@example.org
-          LDAP_PASSWORDS: 123456,123465
-          LDAP_ROOT: dc=example,dc=org
-          LDAP_PORT_NUMBER: 389
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      postgres-sample:
-        image: metabase/qa-databases:postgres-sample-12
-        ports:
-          - "5404:5432"
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      mongo-sample:
-        image: metabase/qa-databases:mongo-sample-4.4
-        ports:
-          - 27004:27017
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      mysql-sample:
-        image: metabase/qa-databases:mysql-sample-8
-        ports:
-          - 3304:3306
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      matrix: ${{ fromJSON(needs.e2e-matrix-builder.outputs.matrix) }}
+
     steps:
-      - uses: actions/checkout@v3
-      - name: Record runs using Deploysentinel except for the release branch
-        if: ${{ github.ref == 'refs/heads/master' || !(startsWith(github.event.pull_request.base.ref, 'release')) }}
-        run: |
-          echo "CYPRESS_DEPLOYSENTINEL_KEY=${{ secrets.CYPRESS_DEPLOYSENTINEL_KEY }}" >> $GITHUB_ENV
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare JDK ${{ matrix.java-version }}
-        uses: actions/setup-java@v3
-        with:
-          java-version: ${{ matrix.java-version }}
-          distribution: "temurin"
-      - name: Prepare Cypress environment
-        uses: ./.github/actions/prepare-cypress
-      - name: Run Snowplow micro
-        uses: ./.github/actions/run-snowplow-micro
+      - uses: actions/checkout@v4
 
-      - name: Install Chrome v114
-        uses: browser-actions/setup-chrome@v1
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
         with:
-          # https://chromium.cypress.io/linux/stable/114.0.5735.133
-          # https://www.googleapis.com/download/storage/v1/b/chromium-browser-snapshots/o/Linux_x64%2F1135580%2Fchrome-linux.zip
-          chrome-version: 1135580
-        id: setup-chrome
-      - run: |
-          echo Installed chromium version: ${{ steps.setup-chrome.outputs.chrome-version }}
-          ${{ steps.setup-chrome.outputs.chrome-path }} --version
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
+          openldap: ${{ startsWith(matrix.name, 'admin') }}
+          postgres: ${{ matrix.name != 'mongo'}}
+          mysql: ${{ matrix.name != 'mongo'}}
+          mongo: ${{ matrix.name == 'mongo'}}
 
-      - uses: actions/download-artifact@v3
-        name: Retrieve uberjar artifact for ${{ matrix.edition }}
+      - name: Retrieve uberjar artifact for ${{ matrix.edition }}
+        uses: actions/download-artifact@v4
         with:
-          name: metabase-${{ matrix.edition }}-uberjar
+          name: metabase-${{ matrix.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
       - name: Get the version info
         run: |
           jar xf target/uberjar/metabase.jar version.properties
           mv version.properties resources/
 
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK ${{ matrix.java-version }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ matrix.java-version }}
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Run Snowplow micro
+        uses: ./.github/actions/run-snowplow-micro
+
       - name: Run OSS-specific Cypress tests
         if: matrix.edition == 'oss' && github.event_name != 'schedule'
         run: |
           yarn run test-cypress-run \
-          --env grepTags=@OSS \
+          --env grepTags=@OSS,grepOmitFiltered=true \
           --spec './e2e/test/scenarios/**/*.cy.spec.js' \
-          --browser ${{ steps.setup-chrome.outputs.chrome-path }}
-        env:
-          TERM: xterm
+          --browser 'replay-chromium'
 
-      - name: Run EE Cypress tests on ${{ matrix.folder }}
-        if: matrix.edition == 'ee' && github.event_name != 'schedule'
+      - name: Run slow and resource-intensive Cypress tests
+        if: matrix.name == 'slow' && github.event_name != 'schedule'
         run: |
           yarn run test-cypress-run \
-          --env grepTags="-@quarantine" \
-          --folder ${{ matrix.folder }} \
-          --browser ${{ steps.setup-chrome.outputs.chrome-path }}
-        env:
-          TERM: xterm
-
-      # REPLAY.IO specific jobs
-      - name: Install Replay.io browser
-        if: ${{ github.event_name == 'schedule' }}
-        run: npx @replayio/cypress install
-
-      - name: Run OSS-specific Cypress tests using Replay.io browser
-        if: matrix.edition == 'oss' && github.event_name == 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags=@OSS \
+          --env grepTags="@slow",grepOmitFiltered=true \
           --spec './e2e/test/scenarios/**/*.cy.spec.js' \
-          --browser "replay-chromium"
-        env:
-          TERM: xterm
-          CYPRESS_REPLAYIO_ENABLED: 1
-          RECORD_REPLAY_METADATA_FILE: /tmp/replay-metadata.json
-          RECORD_REPLAY_METADATA_TEST_RUN_ID: ${{ needs.test-run-id.outputs.testRunId }}
+          --browser 'replay-chromium'
 
-      - name: Run EE Cypress tests on ${{ matrix.folder }} using Replay.io browser
-        if: matrix.edition == 'ee' && github.event_name == 'schedule'
+      - name: Run Flaky Cypress tests
+        if: matrix.name == 'flaky' && github.event_name != 'schedule'
         run: |
           yarn run test-cypress-run \
-          --env grepTags="-@quarantine" \
-          --folder ${{ matrix.folder }} \
-          --browser "replay-chromium"
-        env:
-          TERM: xterm
-          CYPRESS_REPLAYIO_ENABLED: 1
-          RECORD_REPLAY_METADATA_FILE: /tmp/replay-metadata.json
-          RECORD_REPLAY_METADATA_TEST_RUN_ID: ${{ needs.test-run-id.outputs.testRunId }}
+          --env grepTags="@flaky",grepOmitFiltered=true \
+          --spec './e2e/test/scenarios/**/*.cy.spec.js' \
+          --browser 'replay-chromium'
 
-      - name: Upload Replay.io recordings
-        if: github.event_name == 'schedule' && always()
-        uses: replayio/action-upload@v0.4.7
+      - name: Run EE Cypress tests on ${{ matrix.name }}
+        if: matrix.context == 'folder' && github.event_name != 'schedule'
+        run: |
+          yarn run test-cypress-run \
+          --env grepTags="-@slow+-@mongo+-@flaky --@quarantine",grepOmitFiltered=true \
+          --folder ${{ matrix.name }} \
+          --browser 'replay-chromium'
+
+      - name: Run E2E tests that depend on Mongo
+        if: matrix.name == 'mongo'
+        run: |
+          yarn run test-cypress-run \
+          --env grepTags="@mongo --@quarantine",grepOmitFiltered=true \
+          --spec './e2e/test/scenarios/**/*.cy.spec.js' \
+          --browser 'replay-chromium'
+        env:
+          CYPRESS_QA_DB_MONGO: true
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
         with:
-          api-key: rwk_gXbvYctIcR6RZyEzUvby3gtkO4esrB2L321lkY8FSuQ
-          public: true
+          input-path: ./target/junit
+          output-name: e2e-${{ matrix.name }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         if: failure()
         with:
-          name: cypress-recording-${{ matrix.folder }}${{ matrix.context }}-${{ matrix.edition }}
+          name: cypress-recording-${{ matrix.name }}-${{ matrix.edition }}
           path: |
             ./cypress
             ./logs/test.log
           if-no-files-found: ignore
 
   e2e-tests-skipped-stub:
-    needs: [build, files-changed]
+    needs: [e2e-tests, e2e-matrix-builder]
     if: |
-      always() &&
-      needs.files-changed.outputs.e2e_all == 'false' &&
-      needs.build.result == 'skipped'
-    runs-on: ubuntu-22.04
+      !cancelled() &&
+      needs.e2e-tests.result == 'skipped'
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 5
-    name: e2e-tests-${{ matrix.folder }}${{ matrix.context }}-${{ matrix.edition }}
+    name: e2e-tests-${{ matrix.name }}-${{ matrix.edition }}
     strategy:
       fail-fast: false
-      matrix:
-        java-version: [11]
-        edition: [ee]
-        folder:
-          - "auditing"
-          - "actions"
-          - "admin"
-          - "binning"
-          - "collections"
-          - "custom-column"
-          - "dashboard"
-          - "dashboard-filters"
-          - "embedding"
-          - "filters"
-          - "joins"
-          - "models"
-          - "native"
-          - "native-filters"
-          - "onboarding"
-          - "organization"
-          - "permissions"
-          - "question"
-          - "sharing"
-          - "visualizations"
-        include:
-          - edition: oss
-            context: grep
-            java-version: 11
+      matrix: ${{ fromJSON(needs.e2e-matrix-builder.outputs.matrix) }}
     steps:
       - run: |
           echo "Didn't run due to conditional filtering"
@@ -310,45 +220,43 @@ jobs:
   visual-regression-tests:
     runs-on: ubuntu-22.04
     timeout-minutes: 60
-    needs: build
-    if: ${{ github.event_name != 'schedule' }}
+    needs: [build]
+    if: |
+      !cancelled() && needs.build.result == 'success'
     name: percy-visual-regression-tests
-    env:
-      MB_EDITION: ${{ matrix.edition }}
-    services:
-      maildev:
-        image: maildev/maildev:2.0.5
-        ports:
-          - "1080:1080"
-          - "1025:1025"
-        credentials:
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v3
-      - name: Enable Percy recording on master only
-        if: github.ref == 'refs/heads/master'
-        run: |
-          echo "PERCY_TOKEN=${{ secrets.PERCY_TOKEN }}" >> $GITHUB_ENV
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare JDK 11
-        uses: actions/setup-java@v3
-        with:
-          java-version: 11
-          distribution: 'temurin'
-      - name: Prepare Cypress environment
-        uses: ./.github/actions/prepare-cypress
+          maildev: true
 
-      - uses: actions/download-artifact@v3
-        name: Retrieve uberjar artifact for ee
+      - name: Retrieve uberjar artifact for ${{ matrix.edition }}
+        uses: actions/download-artifact@v4
         with:
-          name: metabase-ee-uberjar
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
       - name: Get the version info
         run: |
           jar xf target/uberjar/metabase.jar version.properties
           mv version.properties resources/
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK 11
+        uses: actions/setup-java@v4
+        with:
+          java-version: 11
+          distribution: 'temurin'
+
+      - name: Prepare Cypress environment
+        uses: ./.github/actions/prepare-cypress
+
       - name: Percy Test
         run: yarn run test-visual-run
         env:
-          PERCY_TOKEN: ${{ env.PERCY_TOKEN }}
+          PERCY_TOKEN: ${{ github.ref == 'refs/heads/master' && secrets.PERCY_TOKEN || ''}}

.github/workflows/escalation-slack-notification.yml

@@ -11,7 +11,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Format issue title (escape quotes)
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         id: vars
         with:
           script: |

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -0,0 +1,57 @@
+name: Frontend Unit Test Stress Test Flake Fix
+
+on:
+  workflow_dispatch:
+    inputs:
+      spec:
+        description: 'Relative path of the target spec'
+        type: string
+        required: true
+      burn_in:
+        description: 'Number of times to run the test (e.g. 20)'
+        type: string
+        required: true
+      grep:
+        description: 'Grep and filter tests to run in isolation'
+        type: string
+        required: false
+
+jobs:
+  workflow-summary:
+    name: Stress test inputs
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - name: Generate workflow summary
+        run: |
+          echo '**Inputs:**' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `spec`: ${{ inputs.spec }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
+
+  frontend-unit-test-stress-test-flake-fix:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    name: Stress test frontend unit test flake fix
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
+        run: |
+          for i in {1..${{ github.event.inputs.burn_in }}}; do
+            yarn test-unit \
+              --testPathPattern '${{ github.event.inputs.spec }}' \
+              --testNamePattern '${{ github.event.inputs.grep }}'
+            if [[ "$?" != 0 ]]; then
+              echo "Failed after $i attempts" && break;
+            fi
+          done

.github/workflows/frontend.yml

@@ -3,8 +3,8 @@ name: Frontend
 on:
   push:
     branches:
-      - 'master'
-      - 'release-**'
+      - "master"
+      - "release-**"
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
 
@@ -21,41 +21,33 @@ jobs:
       frontend_all: ${{ steps.changes.outputs.frontend_all }}
       e2e_specs: ${{ steps.changes.outputs.e2e_specs }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v2.11.1
+        uses: dorny/paths-filter@v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
           filters: .github/file-paths.yaml
 
-  fe-linter-prettier:
-    needs: files-changed
-    if: needs.files-changed.outputs.frontend_all == 'true' || needs.files-changed.outputs.e2e_specs == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v3
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - run: yarn run lint-prettier
-      name: Run Prettier formatting linter
-
-  fe-linter-eslint:
+  fe-lint:
     needs: files-changed
     if: needs.files-changed.outputs.frontend_all == 'true' || needs.files-changed.outputs.e2e_specs == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
-    - uses: actions/checkout@v3
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'cljs'
-    - run: yarn run lint-eslint
-      name: Run ESLint linter
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+      - name: Run Prettier formatting linter
+        run: yarn run lint-prettier-pure
+      - name: Run ESLint linter
+        run: yarn run lint-eslint-pure
 
   fe-type-check:
     needs: files-changed
@@ -63,38 +55,57 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v3
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'cljs'
-    - run: yarn build:cljs
-      name: Compile CLJS
-    - run: yarn type-check
-      name: Check types
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - run: yarn build-pure:cljs
+        name: Compile CLJS
+      - run: yarn type-check-pure
+        name: Check types
 
   fe-tests-unit:
     needs: files-changed
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.frontend_all == 'true'
     runs-on: buildjet-2vcpu-ubuntu-2204
     timeout-minutes: 60
+    env:
+      JEST_JUNIT_OUTPUT_DIR: ./target/junit
+      JEST_JUNIT_OUTPUT_NAME: test-report-frontend-unit.xml
     steps:
-    - uses: actions/checkout@v3
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'cljs'
-    - run: yarn run test-unit --coverage --silent
-      name: Run frontend unit tests
-    - name: Upload coverage to codecov.io
-      uses: codecov/codecov-action@v3
-      with:
-        files: ./coverage/lcov.info
-        flags: front-end
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - name: Run frontend unit tests and collect the code coverage information
+        if: github.ref_name == 'master'
+        run: yarn run test-unit --coverage --silent
+      - name: Run frontend unit tests
+        if: github.ref_name != 'master'
+        run: yarn run test-unit --silent
+      - name: Upload coverage to codecov.io
+        if: github.ref_name == 'master'
+        uses: codecov/codecov-action@v3
+        with:
+          files: ./coverage/lcov.info
+          flags: front-end
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: frontend-unit
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   fe-tests-timezones:
     needs: files-changed
@@ -102,37 +113,12 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
-    - uses: actions/checkout@v3
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'cljs'
-    - run: yarn run test-timezones
-      name: Run frontend timezones tests
-
-  fe-chromatic:
-    needs: files-changed
-    if: github.event.pull_request.draft == false && needs.files-changed.outputs.frontend_all == 'true'
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
+      - uses: actions/checkout@v4
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
-          m2-cache-key: 'cljs'
-      - name: Publish to Chromatic
-        uses: chromaui/action@v1
-        env:
-          PUBLISH_CHROMATIC: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
-          STORYBOOK_BUILD_TIMEOUT: 900000
-        if: env.PUBLISH_CHROMATIC != null
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
+          m2-cache-key: "cljs"
+      - name: Run frontend timezones tests
+        run: yarn run test-timezones

.github/workflows/fuzzing.yml

@@ -1,21 +1,23 @@
 name: Fuzzing
 
 on:
+  workflow_dispatch:
   push:
     branches:
       - 'master'
       - 'release-**'
+    paths:
+      - 'frontend/src/metabase-lib/expressions/**'
   pull_request:
-    paths-ignore:
-    - 'docs/**'
+    paths:
+      - 'frontend/src/metabase-lib/expressions/**'
 
 jobs:
-
   fe-fuzz-tokenizer:
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Prepare front-end environment
       uses: ./.github/actions/prepare-frontend
     - name: Prepare back-end environment
@@ -31,7 +33,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Prepare front-end environment
       uses: ./.github/actions/prepare-frontend
     - name: Prepare back-end environment

.github/workflows/i18n.yml

@@ -12,12 +12,28 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      i18n: ${{ steps.changes.outputs.i18n }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
 
   verify-i18n-files:
+    needs: files-changed
+    if: needs.files-changed.outputs.i18n == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Prepare front-end environment
       uses: ./.github/actions/prepare-frontend
     - name: Prepare back-end environment

.github/workflows/migrations.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
       with:

.github/workflows/percy-issue-comment.yml

@@ -14,19 +14,24 @@ jobs:
       branch_name: ${{ fromJson(steps.fetch_pr.outputs.data).head.ref }}
       commit_sha: ${{ fromJson(steps.fetch_pr.outputs.data).head.sha }}
     steps:
-      - uses: tibdex/github-app-token@v1.6.0
+      - uses: tibdex/github-app-token@v2.1.0
         id: generate-token
         with:
           app_id: ${{ secrets.METABASE_BOT_APP_ID }}
           private_key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-      - id: is_organization_member
-        uses: JamesSingleton/is-organization-member@1.0.0
+      - uses: actions/checkout@v4
         with:
-          organization: metabase
-          username: ${{ github.event.issue.user.login }}
-          token: ${{ steps.generate-token.outputs.token }}
+          ref: ${{ needs.pr_info.outputs.branch_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify Membership
+        id: verify-membership
+        uses: ./.github/actions/verify-membership
+        with:
+          github_token: ${{ steps.generate-token.outputs.token }}
+          organization_name: metabase
+          username: ${{ github.event.comment.user.login }}
       - run: |
-          result=${{ steps.is_organization_member.outputs.result }}
+          result=${{ steps.verify-membership.outputs.is_member }}
           if [ $result == false ]; then
               echo User ${{ github.event.comment.user.login }} is not a member of Metabase organization
               exit 1
@@ -57,7 +62,7 @@ jobs:
       CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
       CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ needs.pr_info.outputs.branch_name }}
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/percy-visual-label.yml

@@ -17,7 +17,7 @@ jobs:
       CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
       CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment

.github/workflows/pre-release.yml

@@ -1,132 +1,90 @@
-name: Pre-release [WIP]
+name: Release 2 - Pre-release testing
+run-name: Pre-release testing of ${{ inputs.version }}
 
 on:
   workflow_dispatch:
     inputs:
+      version:
+        description: 'Metabase version (e.g. v0.46.3)'
+        type: string
+        required: true
       commit:
         description: 'A full-length commit SHA-1 hash'
         required: true
-      version:
-        description: 'Intended version (e.g. v0.46.3)'
-        required: true
-
-env:
-  MAX_HASH_LENGTH: 8
-  CUSTOM_REPO: ${{ secrets.CUSTOM_RELEASE_REPO }}
 
 jobs:
-  check-commit:
+  release-artifact:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
-    steps:
-    - name: Ensure that the intended version (${{ github.event.inputs.version }}) was never released before
-      run: |
-        if [[ "${{ github.event.inputs.version }}" = v* ]]; then
-          echo "Checking if ${{ github.event.inputs.version }} conflicts with a past release..."
-        else
-          echo "ERROR: the intended version must start with 'v', e.g. 'v0.46.3."
-          echo "ABORT!"
-          exit -1
-        fi
-        CANONICAL_REFS=https://github.com/metabase/metabase/archive/refs
-        URL=${CANONICAL_REFS}/tags/${{ github.event.inputs.version }}.zip
-        HTTP_CODE=$(curl -s -L -o /dev/null --head -w "%{HTTP_CODE}" ${URL})
-        if [[ $HTTP_CODE =~ "200" ]]; then
-          echo "ERROR: that version was already released in the past."
-          echo "ABORT!"
-          exit -1
-        else
-          if [[ $HTTP_CODE =~ "404" ]]; then
-            echo "That version has not been released yet."
-            echo "Proceeding to the next step..."
-            exit 0
-          else
-            echo "ERROR: Unhandled case of HTTP $HTTP_CODE while checking ${URL}"
-            echo "ABORT!"
-            exit -1
-          fi
-        fi
-
-    - name: Check out the code to verify the release branch
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 0  # IMPORTANT! to get all the branches
-    - name: Ensure that the specified commit exists in the latest release branch
-      run: |
-        echo "Checking if the specified commit is in a release branch..."
-        COMMIT=${{ github.event.inputs.commit }}
-        git branch -a --contains $COMMIT > branches.txt
-        if [[ $(grep -c master branches.txt) =~ 1 ]]; then
-          echo "Found in master branch. ABORT!"
-          exit -1
-        fi
-        if [[ $(grep -c 'release-x' branches.txt) =~ 1 ]]; then
-          echo "Found the commit $COMMIT in:"
-          git branch -a --contains $COMMIT
-          echo "Proceeding to the next step..."
-          exit 0
-        else
-          echo "Commit $COMMIT is not found in a single release branch"
-          echo "ABORT!."
-          exit -1
-        fi
-
-  build:
-    if: ${{ github.repository }} != 'metabase/metabase'
-    runs-on: ubuntu-22.04
-    needs: check-commit
-    name: Build Metabase ${{ matrix.edition }} @${{ github.event.inputs.commit }}
-    timeout-minutes: 40
     strategy:
       matrix:
         edition: [oss, ee]
-    env:
-      MB_EDITION: ${{ matrix.edition }}
-      INTERACTIVE: false
+    outputs:
+      ee_version: ${{ steps.version-properties.outputs.ee_version }}
+      oss_version: ${{ steps.version-properties.outputs.oss_version }}
+      commit: ${{ steps.version-properties.outputs.commit }}
     steps:
-    - name: Fail early if custom docker release repo is missing
-      if: ${{ env.CUSTOM_REPO == null }}
-      run: exit 1
-    - name: Check out the code
-      uses: actions/checkout@v3
-      with:
-        ref: ${{ github.event.inputs.commit }}
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: pre-release-build
+      - name: find_release_artifact
+        id: find_release_artifact
+        uses: actions/github-script@v7
+        with:
+          result-encoding: string
+          script: | # js
+            const fs = require('fs');
 
-    - name: Determine the canonical version ## EE is always v1.x.y, OSS is always v0.x.y
-      uses: actions/github-script@v6
-      id: canonical_version
-      env:
-        INTENDED_VERSION: ${{ github.event.inputs.version }}
-        EDITION: ${{ matrix.edition }}
-      with:
-        result-encoding: string
-        script: |
-          var canonical_version;
-          const ver = process.env.INTENDED_VERSION;
-          if (process.env.EDITION === "ee") {
-            canonical_version = ver.replace(/^v0\./, "v1."); // always e.g. v1.47.2
-          } else {
-            canonical_version = ver.replace(/^v1\./, "v0."); // always e.g. v0.45.6
-          }
-          console.log("The canonical version of this", process.env.EDITION, "edition is", canonical_version);
-          return canonical_version;
+            const artifacts = await github.rest.actions.listArtifactsForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: `metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar`,
+              per_page: 1,
+            });
 
-    - name: Build
-      run: ./bin/build.sh :edition :${{ matrix.edition }} :version ${{ steps.canonical_version.outputs.result }}
+            if (!artifacts.data?.artifacts?.[0]?.id) {
+              throw new Error(`No artifacts found for ${{ inputs.commit }}`);
+            }
 
-    - name: Prepare uberjar artifact
-      uses: ./.github/actions/prepare-uberjar-artifact
+            const artifact_id = artifacts.data.artifacts[0].id;
+
+            const download = await github.rest.actions.downloadArtifact({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              artifact_id: artifact_id,
+              archive_format: 'zip',
+            });
+
+            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
+      - name: Unzip Metabase artifact containing an uberjar
+        run: unzip mb.zip
+      - name: Extract the version.properties file from the JAR
+        run: |
+          jar xf metabase.jar version.properties
+      - name: Reveal Metabase ${{ matrix.edition }} properties
+        id: version-properties
+        run: |
+          cat version.properties
+          echo "commit=$(cat ./COMMIT-ID)" >> $GITHUB_OUTPUT
+
+          version=$(grep -o '^tag=.*' version.properties | cut -d'=' -f2)
+
+          if [[ "${{ matrix.edition }}" == "ee" ]]; then
+            echo "ee_version=$version" >> $GITHUB_OUTPUT
+          else
+            echo "oss_version=$version" >> $GITHUB_OUTPUT
+          fi
+        shell: bash
+      - name: Upload Metabase ${{ matrix.edition }} JAR as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: metabase-${{ matrix.edition }}-uberjar
+          path: |
+            ./metabase.jar
+            ./COMMIT-ID
+            ./SHA256.sum
 
   check-uberjar-health:
+    needs: [release-artifact]
     runs-on: ubuntu-22.04
     name: Is ${{ matrix.edition }} (java ${{ matrix.java-version }}) healthy?
-    needs: build
     timeout-minutes: 10
     strategy:
       matrix:
@@ -134,25 +92,25 @@ jobs:
         java-version: [11, 17]
     steps:
     - name: Prepare JRE (Java Run-time Environment)
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         java-package: jre
         java-version: ${{ matrix.java-version }}
         distribution: 'temurin'
     - run: java -version
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@v4
       name: Retrieve uberjar artifact
       with:
         name: metabase-${{ matrix.edition }}-uberjar
     - name: Launch uberjar (and keep it running)
-      run: java -jar ./target/uberjar/metabase.jar &
+      run: java -jar ./metabase.jar &
     - name: Wait for Metabase to start
       run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
 
   run-sanity-check:
     runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    needs: check-uberjar-health
+    timeout-minutes: 30
+    needs: [release-artifact, check-uberjar-health]
     strategy:
       matrix:
         edition: [oss, ee]
@@ -163,6 +121,7 @@ jobs:
       CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
+      TERM: xterm
     services:
       maildev:
         image: maildev/maildev:2.0.5
@@ -174,13 +133,13 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
     steps:
     - name: Check out the code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
-        ref: ${{ github.event.inputs.commit }}
+        ref: ${{ needs.release-artifact.outputs.commit }}
     - name: Prepare front-end environment
       uses: ./.github/actions/prepare-frontend
     - name: Prepare JDK 11
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         java-version: 11
         distribution: "temurin"
@@ -188,20 +147,21 @@ jobs:
       uses: ./.github/actions/prepare-cypress
     - name: Run Snowplow micro
       uses: ./.github/actions/run-snowplow-micro
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@v4
       name: Retrieve uberjar artifact for ${{ matrix.edition }}
       with:
         name: metabase-${{ matrix.edition }}-uberjar
     - name: Get the version info
       run: |
-        jar xf target/uberjar/metabase.jar version.properties
+        jar xf metabase.jar version.properties
         mv version.properties resources/
     - name: Run a few important Cypress tests as sanity check
-      run: yarn test-cypress-run --folder onboarding
-      env:
-        TERM: xterm
+      run: |
+        mkdir -p ./target/uberjar && cp metabase.jar ./target/uberjar/metabase.jar
+        yarn test-cypress-run --folder onboarding
+
     - name: Upload Cypress Artifacts upon failure
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       if: failure()
       with:
         name: cypress-failed-tests-recording
@@ -211,8 +171,8 @@ jobs:
         if-no-files-found: ignore
 
   containerize:
+    needs: [release-artifact, run-sanity-check]
     runs-on: ubuntu-22.04
-    needs: run-sanity-check
     timeout-minutes: 15
     strategy:
       matrix:
@@ -222,24 +182,26 @@ jobs:
         image: registry:2
         ports:
           - 5000:5000
+    outputs:
+      image_tag: ${{ steps.target.outputs.image_tag }}
     steps:
-    - name: Check out the code
-      uses: actions/checkout@v3
-      with:
-        ref: ${{ github.event.inputs.commit }}
-    - name: Truncate commit hash
+    - name: Get the version
       run: |
-        commit_id=${{ github.event.inputs.commit }}
-        truncated_hash=${commit_id:0:${{ env.MAX_HASH_LENGTH }}}
-
-        echo "COMMIT_IDENTIFIER=$truncated_hash" >> $GITHUB_ENV
-      shell: bash
-    - uses: actions/download-artifact@v3
+        if [[ "${{ matrix.edition }}" == "ee" ]]; then
+          echo "VERSION=${{ needs.release-artifact.outputs.ee_version }}" >> $GITHUB_ENV
+        else
+          echo "VERSION=${{ needs.release-artifact.outputs.oss_version }}" >> $GITHUB_ENV
+        fi
+    - name: Check out the code
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ needs.release-artifact.outputs.commit }}
+    - uses: actions/download-artifact@v4
       name: Retrieve uberjar artifact
       with:
         name: metabase-${{ matrix.edition }}-uberjar
     - name: Move the Uberjar to the context dir
-      run: mv ./target/uberjar/metabase.jar bin/docker/.
+      run: mv metabase.jar bin/docker/.
     - name: Set up Docker Buildx
       id: buildx
       uses: docker/setup-buildx-action@v2
@@ -251,12 +213,12 @@ jobs:
         context: bin/docker/.
         platforms: linux/amd64
         network: host
-        tags: localhost:5000/local-metabase:${{ env.COMMIT_IDENTIFIER }}-${{ matrix.edition }}
+        tags: localhost:5000/local-metabase:${{ env.VERSION }}
         no-cache: true
         push: true
 
     - name: Launch container
-      run: docker run --rm -dp 3000:3000 localhost:5000/local-metabase:${{ env.COMMIT_IDENTIFIER }}-${{ matrix.edition }}
+      run: docker run --rm -dp 3000:3000 localhost:5000/local-metabase:${{ env.VERSION }}
       timeout-minutes: 5
     - name: Wait for Metabase to start
       run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
@@ -267,48 +229,53 @@ jobs:
       with:
         username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
         password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
-    - name: Determine the target Docker Hub repository
+    - name: Retag and push container image to ${{ vars.DOCKERHUB_OWNER }} staging Docker Hub repo
+      id: target
       run: |
-          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/${{ env.CUSTOM_REPO }}" >> $GITHUB_ENV
-          echo "IMAGE_NAME=${{ env.COMMIT_IDENTIFIER }}-${{ matrix.edition }}" >> $GITHUB_ENV
-    - name: Retag and push container image to Docker Hub
-      run: |
-        echo "Pushing container image ${{ env.IMAGE_NAME}} to ${{ env.DOCKERHUB_REPO }} ..."
-        docker tag localhost:5000/local-metabase:${{ env.IMAGE_NAME }} ${{ env.DOCKERHUB_REPO }}:${{ env.IMAGE_NAME }}
-        docker push ${{ env.DOCKERHUB_REPO }}:${{ env.IMAGE_NAME }}
+        # SHA-1 truncated to 7 digits should be enough
+        SHORT_HASH=${COMMIT:0:7}
+
+        IMAGE_TAG=$VERSION-$SHORT_HASH
+        CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
+
+        echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+
+        echo "Retag local image for staging"
+        docker tag localhost:5000/local-metabase:$VERSION $CONTAINER_IMAGE
+
+        echo "Pushing container image $CONTAINER_IMAGE ..."
+        docker push $CONTAINER_IMAGE
+
         echo "Finished!"
+      shell: bash
+      env:
+        COMMIT: ${{ needs.release-artifact.outputs.commit }}
 
   verify-docker-pull:
     runs-on: ubuntu-22.04
-    needs: containerize
+    needs: [release-artifact, containerize]
     timeout-minutes: 15
     strategy:
       matrix:
         edition: [oss, ee]
+    env:
+      IMAGE_TAG: ${{ needs.containerize.outputs.image_tag }}
     steps:
-    - name: Truncate commit hash
-      run: |
-        commit_id=${{ github.event.inputs.commit }}
-        truncated_hash=${commit_id:0:${{ env.MAX_HASH_LENGTH }}}
-
-        echo "COMMIT_IDENTIFIER=$truncated_hash" >> $GITHUB_ENV
-      shell: bash
     - name: Login to Docker Hub # authenticated, to avoid being rate-throttled
       uses: docker/login-action@v2
       with:
         username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
         password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
-    - name: Determine the container image to pull
-      run: |
-          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/${{ env.CUSTOM_REPO }}" >> $GITHUB_ENV
-          echo "IMAGE_NAME=${{ env.COMMIT_IDENTIFIER }}-${{ matrix.edition }}" >> $GITHUB_ENV
     - name: Pull the container image
       run: |
-        echo "Pulling container image ${{ env.DOCKERHUB_REPO }}:${{ env.IMAGE_NAME }} ..."
-        docker pull ${{ env.DOCKERHUB_REPO }}:${{ env.IMAGE_NAME }}
+        CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
+        echo "Pulling container image $CONTAINER_IMAGE ..."
+        docker pull $CONTAINER_IMAGE
         echo "Successful!"
     - name: Launch container
-      run: docker run --rm -dp 3000:3000 ${{ env.DOCKERHUB_REPO }}:${{ env.IMAGE_NAME }}
+      run: |
+        CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
+        docker run --rm -dp 3000:3000 $CONTAINER_IMAGE
       timeout-minutes: 5
     - name: Wait for Metabase to start
       run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done

.github/workflows/presto-kerberos-integration-test.yml

@@ -18,9 +18,9 @@ jobs:
     outputs:
       backend_presto_kerberos: ${{ steps.changes.outputs.backend_presto_kerberos }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v2.11.1
+        uses: dorny/paths-filter@v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
@@ -41,11 +41,11 @@ jobs:
             && sudo ./install \
             && cd -
       - name: Checkout Metabase repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Check out Presto Kerberos Docker Compose
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           repository: metabase/presto-kerberos-docker
           ref: master
@@ -64,7 +64,7 @@ jobs:
       - name: Copy client.keytab file to resources
         run: docker cp presto-kerberos:/home/presto/client.keytab resources
       - name: Checkout mba
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           repository: metabase/mba
           ref: master

.github/workflows/pull-request-reminders.yml

@@ -0,0 +1,45 @@
+name: Pull Request Reminders
+
+on:
+  pull_request:
+    types: [opened]
+    branches:
+      - "master"
+
+jobs:
+  external-reminder:
+    name: External PR Helper
+    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    permissions:
+      pull-requests: write
+      issues: read
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          script: | # js
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            const pullNumber = '${{ github.event.pull_request.number }}';
+            const author = '${{ github.event.pull_request.user.login }}';
+
+            await github.rest.issues.addLabels({
+              owner,
+              repo,
+              issue_number: pullNumber,
+              labels: ["External"],
+            });
+
+            const guideLink = "https://www.notion.so/metabase/Third-Party-PRs-External-contributions-5954061854424c1ea6391d98746646e0";
+            const message = `@${author} Thanks for your contribution! ❤️  We'll try to review it as soon as we can.\n\n
+              Reviewers, make sure to check out our [External PR Review Guide](${guideLink}) when reviewing.
+            `;
+
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: pullNumber,
+              body: message,
+            });

.github/workflows/release-status.yml

@@ -0,0 +1,40 @@
+name: Release Status Check
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 13 * * *' # every day at 8am US eastern time
+
+jobs:
+  check-release-status:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
+    - name: Check release status and post to Slack
+      uses: actions/github-script@v7
+      env:
+        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+      with:
+        script: | # js
+          const { checkReleaseStatus } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          if (!process.env.SLACK_BOT_TOKEN) {
+            throw new Error('SLACK_BOT_TOKEN is required');
+          }
+
+          if (!process.env.SLACK_RELEASE_CHANNEL) {
+            throw new Error('SLACK_RELEASE_CHANNEL is required');
+          }
+
+          const ossReleased = await checkReleaseStatus({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            channelName: process.env.SLACK_RELEASE_CHANNEL,
+          });