Fix jar splice

H2 is no longer required on the classpath. The OSS uberjar bundles the H2
JDBC JAR; the EE uberjar does not. EE users who want H2 (quick trials, the
dump-to-h2/load-from-h2 tasks, or an H2 app DB) supply the JAR themselves via
the plugins dir or `-cp`. SQLite, not H2, is the sample DB, so H2 isn't needed
by default.

Mechanics, mirroring the oracle/vertica optional-driver pattern:

- deps.edn: H2 moved from a top-level dep to the `:oss` alias only (plus `:dev`
  for the REPL); the `:ee` basis no longer includes it.
- build/uberjar.clj: exclude `metabase.driver.h2` from AOT (its ns `:import`s
  org.h2.* classes that may be absent at EE build time) and inject it into the
  jar as source, compiled lazily at runtime. Driven by a dedicated
  `core-driver-namespaces-excluded-from-aot` set.
- config.core/h2-available?: runtime check for `org.h2.Driver` on the classpath
  (re-checked at boot, so a JAR added via -cp is seen).
- driver.init: load metabase.driver.h2 only `(when (config/h2-available?))`,
  via a runtime require, instead of an unconditional ns require.
- No core (AOT-compiled) namespace references org.h2.* at compile time anymore.
  The H2-class-typed registrations (IResultSetReadColumn for JdbcClob/JdbcBlob,
  cache results-as-bytes for JdbcBlob, query-canceled?* :h2) moved into
  metabase.driver.h2; the owning multimethods were made public and exposed in
  the app-db / query-processor module :api sets. search.appdb.index detects the
  H2 syntax-error exception by class-name string instead of importing it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/agents/drivers-and-sync-backend-expert.md

@@ -22,7 +22,6 @@ You understand Metabase's driver architecture built on Clojure multimethods with
     :bigquery-cloud-sdk, :databricks, :clickhouse, :athena, :sparksql,
     :presto-jdbc / :starburst, :vertica, :sqlite, :h2
 :mongo        (non-SQL, custom protocol)
-:druid        (non-SQL, REST-based)
 ```
 
 Key driver extension points you know intimately:

.claude/commands/fix-flakey-test.md

@@ -1 +0,0 @@
-Fix flakey test $ARGUMENTS

.claude/skills/_shared/clojure-style-guide.md

@@ -44,6 +44,22 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 - Lines ≤ 120 characters
 - No blank non-comment lines within definition forms (except pairwise `let`/`cond`)
 
+**Java interop: type-hint parameters in the arglist; prefer `ex-*` helpers:**
+
+```clojure
+;; bad — reflection warning, calls Throwable methods directly
+(defn root-cause [e]
+  (if-let [cause (.getCause e)] (recur cause) e))
+
+;; good
+(defn- root-cause [^Throwable e]
+  (if-let [cause (ex-cause e)]
+    (recur cause)
+    e))
+```
+
+Use `ex-cause`/`ex-message`/`ex-data`/`ex-info` rather than `.getCause`/`.getMessage`/`(.getData ^ExceptionInfo …)` where possible.
+
 ## Style Conventions
 
 **Keywords and Metadata:**
@@ -51,6 +67,37 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 - Prefer namespaced keywords for internal use: `:query-type/normal` not `:normal`
 - Tag variables with `:arglists` metadata if they're functions but wouldn't otherwise have it
 
+**Time/date: `java-time.api :as t` and `u.date`, not `java.time.*` direct interop:**
+
+```clojure
+;; bad — Claude default, requires java.time interop
+(:import (java.time LocalDate))
+... (LocalDate/now) ...
+
+;; good
+(:require
+ [java-time.api :as t]
+ [metabase.util.date-2 :as u.date])
+... (t/local-date) ...
+... (u.date/parse "2024-01-01") ...
+```
+
+Only `(:import java.time.X)` when interop with a Java method genuinely needs the class.
+
+**Check non-emptiness with `seq`, not `count`:**
+
+```clojure
+;; bad — `count` realizes the whole seq into memory just to test emptiness
+(let [prompts (map build-prompt items)]
+  (when (pos? (count prompts))
+    (t2/insert! :model/Prompt prompts)))
+
+;; good — `seq` realizes one cell; `insert!` streams the rest
+(let [prompts (map build-prompt items)]
+  (when (seq prompts)
+    (t2/insert! :model/Prompt prompts)))
+```
+
 ## Tests
 
 **Organization:**
@@ -62,6 +109,33 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 
 - Mark pure function tests `^:parallel`
 
+**Redefining `defn`-vars under test:**
+
+Use `mt/with-dynamic-fn-redefs` instead of `with-redefs` when stubbing `defn`/`defn-` vars — plain `with-redefs` is not parallel-test-safe and a clj-kondo hook (`:metabase/prefer-with-dynamic-fn-redefs`, see `.clj-kondo/config.edn`) will warn. `with-redefs` is still fine for `def` / dynamic var rebinding.
+
+```clojure
+;; bad — flagged by the linter, not safe under :parallel tests
+(with-redefs [my.ns/some-fn (fn [_] :stub)] (do-test))
+
+;; good
+(mt/with-dynamic-fn-redefs [my.ns/some-fn (fn [_] :stub)] (do-test))
+```
+
+**Async tests: no bare `Thread/sleep` — use `deref` with a timeout sentinel:**
+
+A fixed sleep is the #1 source of CI flake. Tests should fail fast and loud when a contract is violated, not hang or sleep through the bug.
+
+```clojure
+;; bad — flaky on slow CI, silent on actual failure
+(Thread/sleep 300)
+(is (= :expected @seen))
+
+;; good — fails fast with a clear message
+(let [v (deref some-promise 1000 ::timeout)]
+  (is (not= ::timeout v) "promise never delivered")
+  (is (= :expected v)))
+```
+
 ## Modules
 
 **OSS Modules:**
@@ -86,6 +160,45 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 
 - Do not cheat module linters with `:clj-kondo/ignore [:metabase/modules]`
 
+**Enterprise/OSS split: use `defenterprise`, not protocols or runtime feature checks:**
+
+The OSS namespace defines the fallback body and names the EE namespace; the EE namespace overrides with the same fn name and a `:feature` clause naming the premium-features flag that gates the override. Both files use the same docstring shape — describe behavior on both sides.
+
+```clojure
+;; src/metabase/remote_sync/core.clj  (OSS)
+(defenterprise collection-editable?
+  "Returns whether remote-synced collections are editable.
+   Always true on OSS; EE consults the remote-sync settings."
+  metabase-enterprise.remote-sync.core
+  [_collection]
+  true)
+
+;; enterprise/backend/src/metabase_enterprise/remote_sync/core.clj  (EE)
+(defenterprise collection-editable?
+  "EE override — respects the synced-collections-editable? setting."
+  :feature :remote-sync
+  [collection]
+  (or (synced-collections-editable?) (not (synced? collection))))
+```
+
+`defenterprise-schema` is the malli-schema variant. Required from `[metabase.premium-features.core :refer [defenterprise defenterprise-schema]]`. The OSS body is what runs when the feature flag is off — never write `(when (premium/has-feature? ...) ...)` in user code; let `defenterprise` route.
+
+**Security gates fail *open* under `:feature` — use `:feature :none` and check manually.** The router (`dynamic-ee-oss-fn`) calls the EE body only when both the EE namespace is loaded *and* the token currently grants the feature; otherwise it falls back to the OSS body. For a permissive default (`collection-editable?` → `true`) that's fine. But for a *restriction* — sandboxing, impersonation, row-level filtering — the OSS fallback is the unrestricted answer, so a temporarily lost/expired token silently downgrades a sandboxed user to full access. **Fail open.** When the EE override is what *decides whether to restrict*, gate it with `:feature :none` (which always routes to the EE body once EE code is loaded) and check the feature explicitly inside, so token loss fails *closed*:
+
+```clojure
+;; enterprise/.../sandbox/api/util.clj — the gate that detects whether a user is sandboxed
+(defenterprise enforced-sandboxes-for-user
+  "..."
+  ;; :none so we can decide whether sandboxing is *configured* even when the feature
+  ;; isn't currently available — letting us BLOCK requests that would otherwise be
+  ;; sandboxed, instead of returning the permissive OSS fallback. Fail closed.
+  :feature :none
+  [user-id]
+  ...)
+```
+
+Reach for this only for the detection/enforcement decision point. Downstream functions that merely *act* on an already-made decision can keep their normal `:feature :sandboxes` gate.
+
 ## REST API Endpoints
 
 **Required Elements:**
@@ -94,6 +207,20 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 - All endpoints need Malli schemas for parameters (detailed and complete)
 - All new REST API endpoints MUST HAVE TESTS
 
+**Endpoint shape: `api.macros/defendpoint`, four positional arglist:**
+
+```clojure
+(api.macros/defendpoint :get "/:key/callback"
+  "OIDC callback for a specific provider."
+  [{provider-key :key} :- [:map [:key ProviderKey]]
+   _query-params
+   _body
+   request]
+  (oidc-integration/sso-callback provider-key request))
+```
+
+The arglist is **always 4 positional bindings** in this order: `route-params`, `query-params`, `body`, `request`. Use `_`-prefixed names for unused ones. Each one gets a Malli schema via `:- <schema>` (omit when `_`). The HTTP verb is a keyword (`:get`/`:post`/`:put`/`:delete`), not a symbol. Required as `[metabase.api.macros :as api.macros]`.
+
 **Naming Conventions:**
 
 - Query parameters use kebab-case
@@ -105,6 +232,20 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 - `GET` endpoints should not have side effects (except analytics)
 - `defendpoint` forms should be small wrappers around Toucan model code
 
+**Closed response maps:**
+
+Tag response Malli `:map` schemas with `{:closed true}` so the generated OpenAPI / TypeScript types reject extra keys. Open maps emit `additionalProperties: true`, which produces weak frontend types and makes discriminated unions ineffective. Tighten domain types in the same pass (`pos-int?` rather than `:int` when zero branches elsewhere).
+
+```clojure
+;; weak
+{:status 200 :body [:map [:status [:= :generated]] [:prompt_count :int]]}
+
+;; tight
+{:status 200 :body [:map {:closed true}
+                    [:status [:= :generated]]
+                    [:prompt_count pos-int?]]}
+```
+
 ## MBQL (Metabase Query Language)
 
 **Restrictions:**
@@ -144,10 +285,215 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 
 **Linter Suppressions:**
 
-- Use proper format for kondo suppressions
-- No `#_:clj-kondo/ignore` (keyword form)
+The right shape is a **reader-discard map** placed directly above the form being silenced, listing the rule keywords explicitly:
+
+```clojure
+#_{:clj-kondo/ignore [:metabase/validate-defendpoint-route-uses-kebab-case
+                      :metabase/validate-defendpoint-has-response-schema]}
+(api.macros/defendpoint :post "/api_key" ...)
+```
+
+For a single require entry, hang it as metadata on that entry:
+
+```clojure
+(:require
+ ^{:clj-kondo/ignore [:deprecated-namespace :discouraged-namespace]}
+ [metabase.query-processor.store :as qp.store])
+```
+
+Common Metabase-specific rules you'll see: `:metabase/modules`, `:metabase/validate-defendpoint-route-uses-kebab-case`, `:metabase/validate-defendpoint-has-response-schema`, `:metabase/prefer-with-dynamic-fn-redefs`, `:deprecated-namespace`, `:discouraged-namespace`. Don't use the keyword form (`#_:clj-kondo/ignore`); always the map form so it's grep-able by which rule(s) are suppressed.
 
 **Configurable Options:**
 
 - Don't define configurable options that can only be set with environment variables
 - Use `:internal` `defsetting` instead
+
+
+## Metabase Helpers — Quick Reference
+
+Metabase and its libraries have **many** helper functions to make code more readable. Don't hand-roll things that already exist! Reach for the right helper *the first time*.
+
+Organized by **problem you're solving**, not by namespace.
+
+## "I wrote this — use that instead" cheat sheet
+
+*Authors: prefer the right column. Reviewers: flag the left column in PRs.*
+
+| You wrote                                                            | Reach for                            | When NOT to                                                       |
+| -------------------------------------------------------------------- | ------------------------------------ | ----------------------------------------------------------------- |
+| `(vec (keep f xs))`                                                  | `(u/keepv f xs)`                     | —                                                                 |
+| `(let [x (...)] (side-effect!) x)`                                   | `(u/prog1 (...) (side-effect!))`     | — (`<>` anaphor binds the result)                                 |
+| `(into {} (map (juxt k identity)) xs)`                               | `(u/index-by k xs)`                  | —                                                                 |
+| `(into {} (map (juxt k vf)) xs)`                                     | `(u/index-by k vf xs)`               | —                                                                 |
+| `#(compare %2 %1)`                                                   | `u/reverse-compare`                  | —                                                                 |
+| `(:col (t2/select-one [Model :col] …))`                              | `(t2/select-one-fn :col Model …)`    | —                                                                 |
+| `(or (:k m) default)`                                                | `(:k m default)`                     | **The value can be present-but-nil** (hydrated DB null, etc.)     |
+| `(let [x (...)] (if x then else))`                                   | `(if-let [x (...)] then else)`       | —                                                                 |
+| `(filter #(= :a (:type %)) coll)` + same for `:b` …                  | `(group-by :type coll)` then dispatch | —                                                                 |
+| `(->> xs (map f) (remove g) (mapv h))`                               | `(into [] (comp (map f) (remove g) (map h)) xs)` | when readability of the threading wins                  |
+| nested `let` / `if` / `if-let`                                       | `b/cond` with `:let`                 | a 2-level nest may be clearer as-is                               |
+| `(let [{:keys [k]} arg] …)` as first form of body                    | destructure in the arg list           | when the destructure also references something computed in `let` |
+| `(or (:k m) (get m (name k)))` per field                             | normalize once: `(update-keys m keyword)` then plain `:k` | when you genuinely need both shapes per-field             |
+
+## `metabase.util` (commonly aliased `[metabase.util :as u]`)
+
+Sequences / collections:
+- `(u/keepv f coll)` — like `keep` but returns a vector (eager).
+- `(u/index-by kf coll)` / `(u/index-by kf vf coll)` — `{(kf x) (vf x)}` map.
+
+Strings (locale-safe):
+- `(u/lower-case-en s)`, `(u/upper-case-en s)` — DO use these instead of `clojure.string/lower-case`/`upper-case` whenever the result feeds into matching/comparison; the locale-default versions break on Turkish `i`.
+- `(u/qualified-name x)` — keyword → `"ns/name"` or `"name"`; symbol → `(name x)`; string → identity.
+
+Control flow:
+- `(u/prog1 first-form & body)` — anaphoric. Result of `first-form` is bound to `<>`. Returns first-form's value. Use for "do a thing, side-effect using its result, return the thing."
+- `(u/the-id x)` — get an entity id from an int or an instance.
+
+Comparators:
+- `(u/reverse-compare x y)` — `(compare y x)`. Pass as a sort comparator: `(sort-by f u/reverse-compare coll)`.
+
+Other:
+- `(u/conflicting-keys m1 m2)` — keys present in both with different values.
+
+The full `metabase.util.cljc` is ~1300 lines — when in doubt, grep it.
+
+## `metabase.util.namespaces` (aliased `shared.ns`)
+
+- `(shared.ns/import-fns [other-ns f1 f2] [another-ns f3])` — re-export defns from another ns through the current ns. The `:require [other-ns :as other-ns]` alias **must stay** — clj-kondo may flag it as unused but it's needed at macro expansion. Add a `;; needed for import-fns` comment so it doesn't get auto-stripped.
+
+## Toucan 2 (aliased `[toucan2.core :as t2]`)
+
+Single-field reads (avoids fetching whole rows):
+- `(t2/select-one-fn :col Model :id 123)` — projection-friendly: when `f` is a keyword, only that column is fetched. Use instead of `(:col (t2/select-one [Model :col] …))`.
+- `(t2/select-fn-set f Model & conditions)` — set of `(f row)` values.
+- `(t2/select-fn-vec f Model & conditions)` — vector of `(f row)` values.
+- `(t2/select-pks-set Model & conditions)` — set of PKs.
+
+Existence / counts:
+- `(t2/exists? Model & conditions)` → boolean.
+- `(t2/count Model & conditions)` → long.
+
+Writes:
+- `(t2/insert-returning-instances! Model row-or-rows)` — returns the rows with PKs set.
+- `(t2/insert-returning-pks! Model row-or-rows)` — just the PKs.
+- `(t2/update! Model id-or-conditions changes)`.
+- `(t2/delete! Model id-or-conditions)`.
+
+Transactions:
+- `(t2/with-transaction [t-conn] body…)` — opens a txn on the app DB conn.
+
+Hydration:
+- `(t2/hydrate instances :key1 :key2)` — invokes `:batched-hydrate` methods.
+- Define via `(methodical/defmethod t2/batched-hydrate [:model/Foo :the-key] [_ k rows] …)`.
+
+Define a model:
+- `(methodical/defmethod t2/table-name :model/Foo [_] :foo_table)`
+- `(t2/deftransforms :model/Foo {:col mi/transform-json})` — common: `transform-json`, `transform-secret-value` (encrypts), `transform-keyword`.
+
+## Better-cond (`[better-cond.core :as b]`)
+
+`(b/cond …)` like `cond` but supports interleaved `:let [bindings]` and `:when` clauses. Lets you flatten cascading `let`/`if`/`if-let`/`let` into a linear spine.
+
+```clojure
+(b/cond
+  :let [thread (load-thread id)]
+  (nil? thread) :not-found
+
+  :let [exploration (load-exploration (:exploration-id thread))
+        reason      (gate-check exploration)]
+  reason
+  (skip! reason)
+
+  :let [pool (build-pool thread)]
+  (empty? pool) :skip-no-data
+
+  :else
+  (run! thread pool))
+```
+
+Use it when a function would otherwise be a staircase of nested forms. Don't reach for it for a single `if`/`let`.
+
+## Schemas — `mr/def` for shared, inline for single-use
+
+When a schema is used in 2+ places or has a name worth documenting, extract it into the registry via `mr/def`:
+
+```clojure
+(:require [metabase.util.malli.registry :as mr])
+
+(mr/def ::options
+  "Options for Pulse channel rendering."
+  [:map
+   [:channel.render/include-buttons? {:description "default: false" :optional true} :boolean]])
+```
+
+`mr/def` keys are always `::namespaced` keywords; downstream callers reference via the fully-qualified keyword. Single-use schemas stay inline in the `mu/defn`'s `:-` annotation — no need to extract.
+
+## Malli — `metabase.util.malli`
+
+- `(mu/defn my-fn :- :string [x :- :int, y :- [:maybe :string]] …)` — inline schemas; runtime validation in dev, no-op in prod by default.
+- `(mu/disable-enforcement & body)` — wrap test/perf-sensitive blocks.
+- Common malli schemas: `:int`, `:string`, `:boolean`, `:keyword`, `:map`, `[:maybe T]`, `[:sequential T]`, `[:enum :a :b]`, `[:map [:k T]]`, `pos-int?`, `nat-int?`.
+
+## i18n — `[metabase.util.i18n :refer [tru deferred-tru]]`
+
+- `(tru "Hello {0}" name)` — translate at call time. Use in request-handling code.
+- `(deferred-tru "…")` — translate at read time. Use in static contexts: `defsetting :description`, `defn` metadata `:description`, top-level `def`s of user-visible labels.
+- ICU MessageFormat: doubled apostrophe for a literal: `(tru "it''s ready")`. Numbered placeholders: `{0}`, `{1}`.
+- **Don't translate** developer-only debug strings (REPL helper text, internal logs).
+
+## Logging — `[metabase.util.log :as log]`
+
+- Levels: `trace`, `debug`, `info`, `warn`, `error`.
+- Two flavors per level:
+    - `(log/warn "msg")` or `(log/warn e "msg")` — exception first if present.
+    - `(log/warnf "fmt %s" arg)` or `(log/warnf e "fmt %s" arg)` — printf-style.
+- Don't `(log/warn (format "fmt %s" arg))` — use `warnf`.
+
+## Map / key normalization
+
+When parsing loosely-typed external data (LLM JSON, request bodies) that may have **either** string or keyword keys:
+
+- `(update-keys m keyword)` — top-level keys → keywords (Clojure 1.11+, in `clojure.core`).
+- `(clojure.walk/keywordize-keys m)` — recursive (use sparingly; can over-keywordize value strings if they happen to be in nested maps).
+- After normalizing once, downstream code uses plain `(:k m)` — don't write `(or (:k m) (get m (name k)))` at every use site.
+
+Other useful map ops:
+- `(update-vals m f)` — Clojure 1.11+, in `clojure.core`.
+- `(medley.core/map-vals f m)`, `(m/map-keys f m)` — older alternatives. Medley pinned at **1.4** in this repo — `m/index-of` and some other newer fns are NOT available.
+
+## Comparators & sorting
+
+- `(sort-by f u/reverse-compare coll)` — descending.
+- Vector comparator: `(sort-by (juxt :primary :secondary) coll)`.
+- Use `(- x)` on a primary numeric key to invert: `(sort-by (juxt #(- (:score %)) :id) coll)` (handles ties on ascending `:id`).
+
+## Anti-patterns to avoid
+
+- **`(let [x (do-thing!)] (other-thing! x) x)`** — use `u/prog1`.
+- **`(vec (keep …))`, `(vec (map …))`** — use `u/keepv` or a transducer `(into [] (comp …) coll)`.
+- **Multiple `filter` passes over the same coll for different `:type`s** — one `(group-by :type coll)`.
+- **Per-field string/keyword dual-lookup** — normalize once with `update-keys keyword`.
+- **Reaching into another module's tables via raw `:left-join` SQL** — expose a function on the owning model namespace and call that.
+- **Snake-case keys on a massaged in-memory map** — appdb-row only. Convert at the parse boundary (e.g., when a json response becomes an internal record).
+- **`(double (:k m 0.0))` on a hydrated DB column** — present-but-nil NPEs. Use `(double (or (:k m) 0.0))`.
+- **`defmulti` with every impl on one page** — extension story is a fiction. Use a private lookup map + a private fn.
+- **`(pos? (count xs))` to test a lazy `xs` for non-emptiness** — `count` forces the whole seq into memory. Use `(seq xs)`. (Rebuilding the seq — `(map f xs)` twice — is the only thing that recomputes; a bound seq caches.)
+- **Plain `with-redefs` on a `defn` var in a test** — not parallel-safe; the kondo hook will warn. Use `mt/with-dynamic-fn-redefs`.
+- **`(Thread/sleep N)` in an async test** — flake source #1. `(deref p timeout-ms ::timeout)` and assert `not= ::timeout`.
+- **Hand-rolled `(str/split host #":")` for origin/host comparison** — mis-handles IPv6. Use `mw.security/parse-url` (or `try-parse-url` for client-controlled input).
+- **`(subs (pr-str huge) 0 N)` on a log path** — the multi-MB string is already allocated. Bind `*print-length*`/`*print-level*` around `pr-str` instead.
+- **New retry loop / new "find this column" helper / new transform-source-type predicate** — search first. `metabase.util.retry/with-retry`, `metabase.lib.equality/find-matching-column`, and `metabase.transforms.feature-gating/any-transforms-enabled?` already exist (along with many others). Reviewers ask "isn't there already an X for this?" more than any single idiom.
+- **Plain `defn` when the function has any real contract** — `mu/defn` (or `mu/defn-`) with `:- schema` on the return and each param is the house default; reserve plain `defn` for trivial dev/helper code.
+- **`(:import (java.time …))` + `(LocalDate/now)`** in new code — use `[java-time.api :as t]` + `[metabase.util.date-2 :as u.date]`. Direct `java.time` interop only when a Java API genuinely needs the class.
+- **Vanilla `defmethod`** — use `methodical/defmethod` (it takes a docstring; the codebase uses it uniformly).
+- **`(when (premium/has-feature? :flag) …)` in code** — gate via `defenterprise` so OSS/EE bodies live in their respective namespaces; never sprinkle runtime feature checks.
+- **No `(set! *warn-on-reflection* true)` after the `ns` form** in a new `.clj` file — every `.clj` source file in this repo has it (not `.cljc`).
+- **`(ns … (:require [a :as a] [b :as b]))` on one line; `(:import java.io.File java.net.URI)` bare** — both wrong shapes. Requires one per line under `:require`, imports as `(Package Class)` lists.
+- **Inventing a fresh `:as` alias for `metabase.util`, `metabase.util.malli`, `metabase.util.log`, `java-time.api`, etc.** — use the canonical alias (see the table in Style Conventions). Mixing aliases makes `grep`-based discovery worse.
+
+## When in doubt
+
+- Run `grep -n "defn " src/metabase/util.cljc | head -80` to scan helpers.
+- Run `grep -rn "defmacro\|defn-? [a-z-]*\?\b" src/metabase/util.cljc | head` for predicates.
+- Check `medley.core/` if it looks "collection-y" — but **Medley is pinned at 1.4** here; new fns aren't available.
+- Search the codebase for an existing use of the pattern you're about to write — if no one else does it, there's usually a helper.

.claude/skills/_shared/react-redux-patterns.md

@@ -0,0 +1,69 @@
+# React, Redux, and Data-Layer Patterns
+
+## API access and RTK Query
+
+- **Use RTK Query for server data.** Add typed endpoints under `metabase/api` or `metabase-enterprise/api`; don't add ad-hoc `fetch`, service wrappers, or new thunks for ordinary API access.
+- **Keep API files transport-focused.** Endpoint files should cover request/response typing, URLs, params, light response normalization, and cache tags — not feature business logic.
+- **Use canonical API types.** Prefer `metabase-types/api`; fix or derive missing types instead of casting endpoint results. Refer to API endpoint implementation in Clojure when building new endpoint connections.
+- **Tag caches deliberately.** Use `listTag`, `idTag`, `provide*Tags`, and `invalidateTags(error, tags)` where appropriate.
+- **Guard missing query inputs.** Use `skipToken` or `skip` until all required inputs exist. Build query requirements where the query is created, not in a downstream render path.
+- **Use lazy queries only for events.** Data needed to render a screen belongs in a regular query hook at the owner component/hook.
+- **Handle mutations with `unwrap()`.** Prefer `await trigger(args).unwrap()` in submit handlers; otherwise branch on `result.error` immediately.
+
+## Where data should live
+
+- **Server data:** RTK Query cache, not duplicated Redux state.
+- **Form state:** Form library or local component state, not global Redux.
+- **Transient UI state:** Component state or narrow context, not store-wide flags.
+- **Cross-route/global tasks:** Redux slice with public selectors.
+- **Derived values:** Selectors or pure helpers, not stored copies of computed data. Memoized if identity is important.
+
+## Redux state modeling
+
+- **Avoid using Redux**. Most problems can be solved with local component state or RTK Query.
+- **Use Redux only when needed.** Reach for Redux only when distant parts of the app need durable shared state.
+- **Model async status explicitly.** Use a discriminated union or explicit `status`/`isLoading`/`error`; don't infer loaded or failed state from truthy/falsy `data`.
+- **Store canonical state only.** Derive filtered lists, labels, permissions, booleans, and display variants in selectors.
+- **Read through selectors.** Name selectors after what they return (`getCurrentTask`, `getHasPendingMutation`), not how they compute it.
+- **Add missing public actions/selectors.** Don't reach into another feature's private state shape because an action or selector is missing.
+- **Use `createSelector` for derived state.** Keep selectors pure, cheap, and stable by reference when consumers depend on identity.
+
+## React hooks and components
+
+- **`useMemo` computes render values.** Side effects belong in `useEffect`; event-driven changes belong in event handlers or mutation callbacks.
+- **Keep effects narrow and idempotent.** Include all dependencies, guard inside the effect, and clean up timers/subscriptions. Complex logic should be split to multiple effects or custom hooks, also consider extracting functional pieces.
+- **Hooks can be used to encapsulate complex logic.** For example, a hook can normalize data, handle form's state and validation, or a hook can manage a table's pagination and sorting. If component's logic becomes too complex, consider extracting a hook.
+- **Hooks orchestrate behavior.** Custom hooks should return a small typed result object: data, loading/error state, and callbacks when relevant.
+- **Don't mirror props/query data into state** unless the consumer can edit that local copy. Keep derived render data as such.
+- **Use `useCallback` for stable identity needs, but deliberately.** Wrap callbacks passed to memoized children, dependency arrays, context values, or hooks that require stable identity — not every local handler.
+- **Memoize object/array props only when identity matters.** Prefer simpler plain values otherwise.
+- **Stories for presentational components**. Create Storybook stories for presentational components to test different states and props. Stories live next to the component.
+
+## Performance
+
+- **Optimize only where identity or scale matters.** Prefer clear code first, then add `memo`, `useMemo`, `useCallback`, selectors, virtualization, or split components when render cost, prop identity, or list size justifies it.
+- **Keep context values stable and avoid frequent updates.** Values updated often should be avoided in context consumed by many components, or stored by reference with a stable context value and explicit subscriptions/selectors.
+- **Read global state high in the tree.** Let parent components select context/Redux/API state, derive the view model, and pass narrow props top-down. But avoid passing props too deep (reconsider if more thatn 2 levels).
+- **Avoid unstable props in hot paths.** Don't pass fresh object/array/function literals to memoized children; memoize them or move them outside render when identity matters.
+- **Render large lists deliberately.** Use pagination, windowing/virtualization, stable keys, and row-level memoization for large or frequently updating lists.
+- **Consider memoization for leaf components.** If the source of data updates often, but the component doesn't need to re-render, consider memoizing it.
+
+## Loading, error, and empty states
+
+- **Every async operation needs loading UI.** Use `LoadingAndErrorWrapper` or `DelayedLoadingAndErrorWrapper` for full-page/panel loading; use disabled controls and inline progress for local actions.
+- **Every async operation needs an error branch.** Use wrappers or feature-specific alerts for query errors; use `getErrorMessage(error, fallback)` plus a toast/form error for mutation failures.
+- **Empty is its own state.** Render no-results, empty-list, and permission-limited states intentionally; don't let them look like unfinished loading.
+- **Combine multiple query states explicitly.** Example: `isLoading = a.isLoading || b.isLoading`; `error = a.error || b.error`.
+- **Distinguish first load from refresh.** Use `isLoading` for first-load blockers and `isFetching` for background refresh indicators.
+- **Test all async branches.** Cover loading, error, empty, and success states when adding or changing data access.
+
+## Review checklist
+
+- Server data uses a typed RTK Query endpoint with correct cache tags.
+- Query inputs are guarded with `skipToken`/`skip` until ready.
+- Global state is justified, minimal, and read through selectors.
+- Context values are stable; frequently changing values don't force broad re-renders.
+- Leaf components stay dumb and receive narrow props from parent containers.
+- Loading, error, empty, and success branches are visible and tested.
+- Hooks are pure during render; side effects are confined to effects or event handlers.
+- Mutation failures are surfaced to people using the UI.

.claude/skills/_shared/typescript-commands.md

@@ -2,8 +2,8 @@
 
 - **Lint:** `bun run lint-eslint-pure`
   - Run ESLint on the codebase
-- **Format:** `bun run prettier`
-  - Format code using Prettier
+- **Format:** `bun run format`
+  - Format code with oxfmt (`oxfmt --write`); use `bun run lint-format-pure` to check without writing
 - **Type Check:** `bun run type-check-pure`
   - Run TypeScript type checking
 

.claude/skills/e2e-test-review/SKILL.md

@@ -25,7 +25,7 @@ Before starting, determine which mode to use:
 
 ### When to hand off instead of review
 
-If the spec references an issue (`metabase#NNNNN`) and the user wants to **fix** flakiness or assess whether the test still reproduces the original bug, that's outside the review skill's scope. Point them at `/fix-flakey-test` (or the dedicated flake-fixing workflow), which knows to fetch the issue and the resolving PR's diff. The review skill stays focused on "is this test well-written and conformant" — it doesn't fetch external issue context by default.
+If the spec references an issue (`metabase#NNNNN`) and the user wants to **fix** flakiness or assess whether the test still reproduces the original bug, that's outside the review skill's scope. Point them at the dedicated flake-fixing workflow, which knows to fetch the issue and the resolving PR's diff. The review skill stays focused on "is this test well-written and conformant" — it doesn't fetch external issue context by default.
 
 ## Review checklist
 

.claude/skills/emotion-migrate/SKILL.md

@@ -20,7 +20,7 @@ For EACH styled component, go through every CSS property and ask: "Can this be a
 **Properties that ARE style props** (use these, not CSS modules):
 
 - `display` → `display` prop
-- `color` → `c` prop (`c="brand"`, `c="text-primary"`)
+- `color` → `c` prop (`c="core-brand"`, `c="text-primary"`)
 - `background-color` → `bg` prop (`bg="background-primary"`)
 - `font-size` → `fz` prop (`fz="md"`)
 - `font-weight` → `fw` prop (`fw="bold"`)
@@ -149,19 +149,19 @@ Read the `.styled.tsx` file AND every component that imports from it. Understand
 
 For each styled component, apply the Mantine-First Decision Gate above. Then determine the migration target:
 
-| Emotion Pattern                                              | Migration Target                                                                                                                                                           |
-| ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `styled.div` with only layout/spacing/color                  | `Box`, `Flex`, `Stack`, or `Group` with style props. **NO CSS module needed.**                                                                                             |
-| `styled.div` with flexbox column                             | `Stack` component with style props                                                                                                                                         |
-| `styled.div` with flexbox row                                | `Flex` or `Group` component with style props                                                                                                                               |
-| `styled.span` / `styled.p` with color/weight/size            | **`Text component="span"` with style props** (`c`, `fw`, `fz`). NO CSS module.                                                                                             |
-| `styled.div` with hover/focus/pseudo-selectors               | **Hybrid**: Mantine component with style props for expressible properties + CSS module class for pseudo-selectors only                                                     |
-| `styled.div` with media queries (simple spacing/sizing)      | **Responsive style props**: `p={{ base: "md", lg: "xl" }}`. NO CSS module.                                                                                                 |
-| `styled.div` with media queries (complex/non-spacing)        | CSS module for the media query parts, style props for the rest                                                                                                             |
-| `styled.div` with animations/keyframes                       | CSS module for animation, style props for layout                                                                                                                           |
-| `styled(SomeComponent)` with only color/spacing/flex         | **Wrap in Mantine component** with style props: `<Box c="brand" flex="0 0 auto"><Icon /></Box>`, or pass style props if the component accepts them                         |
-| `styled(SomeComponent)` with pseudo-selectors/complex styles | CSS module `className` on the component                                                                                                                                    |
-| Dynamic props `styled.div<{ isActive: boolean }>`            | Mantine style props for simple toggles (`c={active ? "brand" : "text-primary"}`), `cx()` with CSS module classes for complex state combinations involving pseudo-selectors |
+| Emotion Pattern                                              | Migration Target                                                                                                                                                                |
+| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `styled.div` with only layout/spacing/color                  | `Box`, `Flex`, `Stack`, or `Group` with style props. **NO CSS module needed.**                                                                                                  |
+| `styled.div` with flexbox column                             | `Stack` component with style props                                                                                                                                              |
+| `styled.div` with flexbox row                                | `Flex` or `Group` component with style props                                                                                                                                    |
+| `styled.span` / `styled.p` with color/weight/size            | **`Text component="span"` with style props** (`c`, `fw`, `fz`). NO CSS module.                                                                                                  |
+| `styled.div` with hover/focus/pseudo-selectors               | **Hybrid**: Mantine component with style props for expressible properties + CSS module class for pseudo-selectors only                                                          |
+| `styled.div` with media queries (simple spacing/sizing)      | **Responsive style props**: `p={{ base: "md", lg: "xl" }}`. NO CSS module.                                                                                                      |
+| `styled.div` with media queries (complex/non-spacing)        | CSS module for the media query parts, style props for the rest                                                                                                                  |
+| `styled.div` with animations/keyframes                       | CSS module for animation, style props for layout                                                                                                                                |
+| `styled(SomeComponent)` with only color/spacing/flex         | **Wrap in Mantine component** with style props: `<Box c="core-brand" flex="0 0 auto"><Icon /></Box>`, or pass style props if the component accepts them                         |
+| `styled(SomeComponent)` with pseudo-selectors/complex styles | CSS module `className` on the component                                                                                                                                         |
+| Dynamic props `styled.div<{ isActive: boolean }>`            | Mantine style props for simple toggles (`c={active ? "core-brand" : "text-primary"}`), `cx()` with CSS module classes for complex state combinations involving pseudo-selectors |
 
 ### Step 3: Create CSS Module (if needed)
 
@@ -170,14 +170,14 @@ Create `ComponentName.module.css` alongside the component file:
 ```css
 /* Use design system tokens — NEVER raw color/spacing values */
 .root {
-  border: 1px solid var(--mb-color-border);
+  border: 1px solid var(--mb-color-border-neutral);
   border-radius: var(--mantine-radius-md);
   background-color: var(--mb-color-background-primary);
 }
 
 /* Conditional states as separate classes, combined with cx() */
 .active {
-  background-color: var(--mb-color-brand);
+  background-color: var(--mb-color-core-brand);
   color: var(--mb-color-text-primary-inverse);
 }
 
@@ -191,7 +191,7 @@ Create `ComponentName.module.css` alongside the component file:
   cursor: pointer;
 
   &:hover {
-    color: var(--mb-color-brand);
+    color: var(--mb-color-core-brand);
     background-color: var(--mb-color-background-hover);
   }
 }
@@ -257,7 +257,7 @@ Remove the old styled file entirely. Remove all imports of it from other files.
 
 - Text: `"text-primary"`, `"text-secondary"`, `"text-tertiary"`
 - Background: `"background-primary"`, `"background-secondary"`, `"background-hover"`
-- Brand: `"brand"`, `"error"`, `"success"`, `"warning"`
+- Brand: `"core-brand"`, `"error"`, `"success"`, `"warning"`
 
 **Typography** (`fz`, `fw`, `lh`, `ta`, `ff`):
 
@@ -281,8 +281,8 @@ Remove the old styled file entirely. Remove all imports of it from other files.
 
 - `--mb-color-text-primary`, `--mb-color-text-secondary`, `--mb-color-text-tertiary`
 - `--mb-color-background-primary`, `--mb-color-background-secondary`, `--mb-color-background-hover`
-- `--mb-color-border`, `--mb-color-border-strong`, `--mb-color-border-subtle`
-- `--mb-color-brand`, `--mb-color-brand-hover`
+- `--mb-color-border-neutral`, `--mb-color-border-neutral-strong`, `--mb-color-border-neutral-subtle`
+- `--mb-color-core-brand`, `--mb-color-core-brand-hover`
 - `--mb-color-error`, `--mb-color-success`, `--mb-color-warning`
 - `--mb-color-shadow`, `--mb-color-focus`
 - `--mb-color-accent0` through `--mb-color-accent7`
@@ -400,11 +400,11 @@ export const Item = styled.div<{ isSelected: boolean; disabled: boolean }>`
   color: ${(props) =>
     props.disabled ? color("text-tertiary") : color("text-primary")};
   background-color: ${(props) =>
-    props.isSelected ? color("brand") : "transparent"};
+    props.isSelected ? color("core-brand") : "transparent"};
   cursor: ${(props) => (props.disabled ? "default" : "pointer")};
 
   &:hover {
-    color: ${(props) => !props.disabled && color("brand")};
+    color: ${(props) => !props.disabled && color("core-brand")};
   }
 `;
 ```
@@ -418,12 +418,12 @@ export const Item = styled.div<{ isSelected: boolean; disabled: boolean }>`
   cursor: pointer;
 
   &:hover {
-    color: var(--mb-color-brand);
+    color: var(--mb-color-core-brand);
   }
 }
 
 .selected {
-  background-color: var(--mb-color-brand);
+  background-color: var(--mb-color-core-brand);
 }
 
 .disabled {
@@ -457,7 +457,7 @@ When a styled component wraps another component, first check if the styles can b
 export const CardIcon = styled(Icon)`
   display: block;
   flex: 0 0 auto;
-  color: var(--mb-color-brand);
+  color: var(--mb-color-core-brand);
 `;
 
 export const CardTitle = styled(Ellipsified)`
@@ -471,7 +471,7 @@ export const CardTitle = styled(Ellipsified)`
 **After — style props on Mantine wrapper (preferred when ALL properties are expressible):**
 
 ```tsx
-<Box display="block" flex="0 0 auto" c="brand">
+<Box display="block" flex="0 0 auto" c="core-brand">
   <Icon {...icon} />
 </Box>
 <Box c="text-primary" fz="md" fw="bold" ml="md">
@@ -483,13 +483,13 @@ export const CardTitle = styled(Ellipsified)`
 
 ```css
 .icon {
-  color: var(--mb-color-brand);
+  color: var(--mb-color-core-brand);
   width: 1.5rem;
   height: 1.5rem;
   cursor: pointer;
 
   &:hover {
-    color: var(--mb-color-brand-hover);
+    color: var(--mb-color-core-brand-hover);
   }
 }
 ```
@@ -570,12 +570,12 @@ export const Spinner = styled.div`
 
 ### Pattern 6: color() Function → CSS Variables
 
-| Emotion (JS)            | CSS Module                                                   | Mantine Style Prop          |
-| ----------------------- | ------------------------------------------------------------ | --------------------------- |
-| `color("brand")`        | `var(--mb-color-brand)`                                      | `c="brand"` or `bg="brand"` |
-| `color("text-primary")` | `var(--mb-color-text-primary)`                               | `c="text-primary"`          |
-| `color("border")`       | `var(--mb-color-border)`                                     | N/A (use CSS module)        |
-| `alpha("brand", 0.2)`   | `color-mix(in srgb, var(--mb-color-brand), transparent 80%)` | N/A (use CSS module)        |
+| Emotion (JS)               | CSS Module                                                        | Mantine Style Prop                    |
+| -------------------------- | ----------------------------------------------------------------- | ------------------------------------- |
+| `color("core-brand")`      | `var(--mb-color-core-brand)`                                      | `c="core-brand"` or `bg="core-brand"` |
+| `color("text-primary")`    | `var(--mb-color-text-primary)`                                    | `c="text-primary"`                    |
+| `color("border-neutral")`  | `var(--mb-color-border-neutral)`                                  | N/A (use CSS module)                  |
+| `alpha("core-brand", 0.2)` | `color-mix(in srgb, var(--mb-color-core-brand), transparent 80%)` | N/A (use CSS module)                  |
 
 ### Pattern 7: Responsive Spacing/Sizing → Responsive Style Props (NOT CSS Media Queries)
 
@@ -627,13 +627,13 @@ export const Bar = styled.div<{ width: number }>`
 
 If existing code already uses `CS` classes and you're not migrating that specific code, leave them alone. But when migrating Emotion → Mantine, replace with the proper alternative:
 
-| Instead of `CS.*`   | Use                                                     |
-| ------------------- | ------------------------------------------------------- |
-| `CS.overflowHidden` | CSS module: `overflow: hidden`                          |
-| `CS.cursorPointer`  | CSS module: `cursor: pointer`                           |
-| `CS.flex1`          | Style prop: `flex={1}`                                  |
-| `CS.flexNoShrink`   | Style prop: `flex="0 0 auto"`                           |
-| `CS.textBrandHover` | CSS module: `&:hover { color: var(--mb-color-brand); }` |
+| Instead of `CS.*`   | Use                                                          |
+| ------------------- | ------------------------------------------------------------ |
+| `CS.overflowHidden` | CSS module: `overflow: hidden`                               |
+| `CS.cursorPointer`  | CSS module: `cursor: pointer`                                |
+| `CS.flex1`          | Style prop: `flex={1}`                                       |
+| `CS.flexNoShrink`   | Style prop: `flex="0 0 auto"`                                |
+| `CS.textBrandHover` | CSS module: `&:hover { color: var(--mb-color-core-brand); }` |
 
 ### Pattern 10: Shared Emotion Styles Across Files → Shared CSS Module + cx()
 
@@ -759,7 +759,7 @@ import S from "./ComponentName.module.css"; // only if CSS module is needed
 - [ ] The `.styled.tsx` file is deleted
 - [ ] All imports of the deleted styled file are updated
 - [ ] No static inline styles — `style={{ }}` used only for truly dynamic runtime values
-- [ ] All colors use design tokens (`c="brand"`, `var(--mb-color-brand)`), not raw hex/rgb
+- [ ] All colors use design tokens (`c="core-brand"`, `var(--mb-color-core-brand)`), not raw hex/rgb
 - [ ] All spacing uses design tokens (`p="md"`, `var(--mantine-spacing-md)`), not arbitrary px values — hardcoded `rem`/`px` literals snapped to the nearest token (see mapping table above)
 - [ ] All border-radius values use radius tokens (`var(--mantine-radius-md)`), not hardcoded `0.5rem`
 - [ ] All font sizes use font-size tokens (`fz="md"`, `var(--mantine-font-size-md)`), not hardcoded `1rem`

.claude/skills/metabase-ui-component-from-figma/SKILL.md

@@ -0,0 +1,244 @@
+---
+name: metabase-ui-component-from-figma
+description: Update or build a Metabase design-system component (frontend/src/metabase/ui — Chip, Badge, Alert, Switch, etc.) to match a Figma spec described in a Linear issue. Use when a ticket asks to restyle an existing `metabase/ui` component or implement a new one from Figma. Covers: checking out the issue, mapping the component (usage/blast radius for an existing one, or scaffolding a new one), building a Storybook showcase matrix (before styling for existing components, after for new ones), styling from exact Figma tokens while iterating with the user, and committing + migrating call sites LAST.
+---
+
+# Metabase UI component from Figma
+
+End-to-end workflow for bringing a `metabase/ui` (Mantine) component in line with a Figma design, driven by a Linear ticket. 
+
+The golden rule (existing components): **build the Storybook showcase before changing any component styles.** Build it while the old styles are still in place — so the team can see the current component at a glance and get accustomed to it before the migration, then watch it light up as you restyle. You end up with a visual-regression (Loki) candidate either way. A **new** component has nothing to render until it's built, so this rule doesn't apply to create mode — there the order flips: implement and style the component first, then build its showcase to present the result.
+
+This is a frontend task — also load **typescript-write** (and **typescript-review** before handing off).
+
+## Two modes
+
+The ticket is one of two shapes; identify which up front, because Phase 2 differs:
+
+- **Update an existing component** — the component already exists with call sites, either in `metabase/ui` *or* as a legacy component elsewhere (e.g. `frontend/src/metabase/common/components/`, possibly Emotion styled-components) that this ticket also migrates into `metabase/ui`. The risk is *regression* (call sites, behavior), so you map usage and lock behavior with tests before touching it.
+- **Create a new component** — nothing equivalent exists anywhere yet. Rarer. The risk is *API design*, so you scaffold the component and its public surface first.
+
+Phases 1, 2, 5 and 6 are shared. The middle two differ in **order**: update mode builds the showcase (Phase 3) *before* styling (Phase 4); create mode does the reverse — implement and style first, then build the showcase as the last step — because there's nothing to render until the component exists.
+
+---
+
+## Phase 1 — Check out the issue
+
+1. Fetch the Linear issue with the Linear MCP `get_issue`.
+2. Pull from it:
+   - **Figma link(s)** — extract the `node-id` (`?node-id=250-13588` → `250-13588`) and `fileKey` (the `/design/<fileKey>/…` segment).
+   - **`gitBranchName`** — switch to it if not already there.
+   - **The component's intended API** — variants, sizes, and states the design system supports for this component. This defines the axes of your showcase (Phase 3).
+3. Decide the mode (see **Two modes** above): search for an existing component — in `metabase/ui` or as a legacy component elsewhere. Found → **update**; nothing equivalent anywhere → **create**. Confirm with the user when unsure.
+4. **Verify a Figma desktop MCP is connected before doing the work** — this skill depends on it for exact tokens in Phase 4 (and styling can't proceed accurately without it). Do a quick read against the issue's node (e.g. `get_metadata`/`get_variable_defs`); if it errors with "nothing selected" or the server isn't connected, prompt the user to enable it (Switch to Dev Mode → MCP section in the right sidebar) and select the relevant layer before continuing.
+
+## Phase 2 — Understand the component
+
+### Mode: update an existing component
+
+1. Locate the component dir (typically containing `Component.config.ts` or `Component.tsx`, `Component.module.css`, `Component.stories.tsx`, `index.ts`). A ticket may also be **migrating a legacy component** — if it still uses Emotion styled-components, reach for the **emotion-migrate** skill.
+2. Map every usage across `frontend/src` and `e2e` (JSX `<Component`, sub-components like `Component.Group`, and wrapper components).
+3. Write findings to **`local/<TICKET>-<component>-usage-findings.md`**, one entry per usage: code location (`file:line`), short context, and **non-standard usage** (excessive customization, inline styling, invalid/legacy props). Invalid props are a signal that call sites will need migrating in Phase 6. This doc **stays** — the user walks it at the end to verify each real usage still looks right.
+4. State the blast radius plainly: how many call sites, where, and whether they're confined.
+5. **Lock behavior with tests before changing anything — when warranted.** Only for components that have **custom interactive behavior** (their own event handlers, state, keyboard logic, controlled/uncontrolled wiring). Add unit tests covering that current API/behavior so a regression shows up as a failing test. **Skip tests for thin Mantine wrappers** — don't test built-in Mantine behavior, and a pure visual restyle is covered by the showcase/Loki, not unit tests.
+
+### Mode: create a new component
+
+1. Decide whether it wraps a Mantine primitive (most common — extend it via a `.config.ts` using `<Mantine>.extend({...})` and theme registration) or is bespoke. Prefer wrapping Mantine.
+2. Scaffold the component dir + its public surface: `Component.tsx`/`Component.config.ts`, `Component.module.css`, `Component.stories.tsx`, `index.ts`, and wire the export through the group barrel and the `metabase/ui` barrel.
+3. There are no call sites to map yet; instead note the intended usage from the ticket so the eventual showcase reflects real props.
+4. **Order note:** for a new component, implement and style it (Phase 4) first, *then* build the showcase (Phase 3) to present the finished result — there's nothing to render until it exists. The phases below are written update-first; just run 4 before 3 in create mode.
+
+## Phase 3 — Build the Storybook showcase
+
+Goal: one story that shows **every state at a glance**, themeable, suitable as a Loki visual-regression test. **Update mode: build this before Phase 4, while the old styles are still in place. Create mode: do this after Phase 4**, once the component exists to render.
+
+### Reusable showcase helpers
+
+Use the shared, Storybook-only primitives in **`frontend/src/metabase/ui/stories/showcase/`**: `StoryShowcase` (titled panel), `StorySection`, `StoryRow`, and `StoryJsx` (monospace JSX with light syntax highlighting via `tokenizeJsx`). Extend the set only when a new pattern is genuinely reusable.
+
+### Derive the matrix from the component's full state space
+
+Enumerate **all** the states the component can be in — every supported variant, size, and interaction/selection state (from its props/types and the design-system API, not merely the subset the issue happens to mention) — then cross-reference with the Figma spec and build the matrix on that. Don't omit a supported state because the ticket didn't list it; don't invent an axis Figma doesn't show (e.g. a static component has no hover/pressed).
+
+**Exclude theme from the matrix.** Figma usually models light/dark as a component *property* (because it doesn't use variable modes), but theme is **not** a real component prop in the app — it's global. So never make theme a matrix axis or column; drive light/dark with the global Storybook `theme` toggle instead (see below).
+
+Typical layout (mirrors the Figma component sheet): a `StoryShowcase` title, then a single **CSS-grid matrix** — state labels down the left column, one column per axis-combination (e.g. `variant × size`), each column headed by the real JSX usage via `StoryJsx`. Use `gridTemplateColumns: \`<labelWidth> repeat(N, max-content)\`` with a `React.Fragment` per row.
+
+### Theme: use the global toggle, render ONE copy
+
+Render the showcase once and let Storybook's global `theme` control (defined in `.storybook/preview.tsx`) switch light/dark. Do **not** render light and dark side by side: Metabase bakes per-scheme hex into `--mantine-color-*` at `:root`, and Mantine color tokens follow the global scheme — a nested scheme wrapper won't re-scope them.
+
+### Forcing hover/pressed for the matrix
+
+Use **`storybook-addon-pseudo-states`** (registered in `.storybook/main.ts`); don't add `data-force-*` hooks to component CSS. Set `parameters.pseudo` to force states per cell. Two things make or break it:
+
+1. **Aim the selector at the element the pseudo-class actually sits on**, which for a Mantine component is often an inner slot, not the root. A string/array value applies `.pseudo-<state>` to the matched element, so it must match that slot. Import the CSS-module class (`S.<Slot>`) to target it.
+2. **Land your per-cell hook on the root via the factory's root-props slot** (e.g. `wrapperProps`), because Mantine forwards top-level `data-*`/rest props to an inner element, not the root. Check the component's `.d.ts` for the right slot.
+
+The addon toolbar toggle keeps working independently (it forces every rule in the story).
+
+### Example: a finalized matrix story
+
+Illustrative — adapt the axes and states to the component you're working on. This is the shape the pieces above add up to (state labels on the left, one column per `variant × size`, forced hover/pressed via `parameters.pseudo`, the root hook on `wrapperProps`, controls scoped to the meaningful knobs):
+
+```tsx
+import type { StoryFn } from "@storybook/react";
+import { Fragment } from "react";
+
+import { Box, Chip, type ChipProps, Text } from "metabase/ui";
+import { StoryJsx, StoryShowcase } from "metabase/ui/stories/showcase";
+
+import S from "./Chip.module.css";
+
+// Axes derived from the component's API (here: variant × size).
+const COLUMNS = [
+  { variant: "light", size: "sm" },
+  { variant: "light", size: "md" },
+  { variant: "filled", size: "sm" },
+  { variant: "filled", size: "md" },
+] as const;
+
+// Every state the component supports; `id` doubles as the pseudo-state hook.
+const STATES = [
+  { id: "default", label: "Default" },
+  { id: "hover", label: "Hover" },
+  { id: "pressed", label: "Pressed" },
+  { id: "selected", label: "Selected", checked: true },
+  { id: "hover-selected", label: "Hover selected", checked: true },
+  { id: "disabled", label: "Disabled", disabled: true },
+];
+
+// Force hover/pressed by targeting the slot the pseudo-class sits on (.ChipLabel).
+const labelSelector = (id: string) => `[data-state-row="${id}"] .${S.ChipLabel}`;
+
+const Overview: StoryFn<ChipProps> = ({ children }) => (
+  <StoryShowcase title="Chip">
+    <Box
+      style={{
+        display: "grid",
+        gridTemplateColumns: `9rem repeat(${COLUMNS.length}, max-content)`,
+        columnGap: "2rem",
+        rowGap: "1rem",
+        alignItems: "center",
+      }}
+    >
+      <div />
+      {COLUMNS.map(({ variant, size }) => (
+        <StoryJsx
+          key={`${variant}-${size}`}
+        >{`<Chip variant="${variant}" size="${size}" />`}</StoryJsx>
+      ))}
+      {STATES.map((state) => (
+        <Fragment key={state.id}>
+          <Text size="sm" c="text-secondary">
+            {state.label}
+          </Text>
+          {COLUMNS.map(({ variant, size }) => (
+            <Chip
+              key={`${variant}-${size}`}
+              wrapperProps={{ "data-state-row": state.id }} // hook on the ROOT
+              variant={variant}
+              size={size}
+              checked={state.checked ?? false}
+              disabled={state.disabled ?? false}
+              onChange={() => {}}
+            >
+              {children}
+            </Chip>
+          ))}
+        </Fragment>
+      ))}
+    </Box>
+  </StoryShowcase>
+);
+
+export const OverviewStory = {
+  render: Overview,
+  parameters: {
+    pseudo: {
+      hover: ["hover", "hover-selected"].map(labelSelector),
+      active: ["pressed"].map(labelSelector),
+    },
+    controls: { include: ["children", "theme"] },
+  },
+};
+```
+
+### Story conventions
+
+- Keep an interactive default story plus the matrix story.
+- Restrict `argTypes` to the supported API (e.g. only the sizes the DS uses).
+- **Scope controls per story.** A static matrix should hide knobs it ignores: `parameters.controls = { include: [...] }` (or `{ disable: true }`). Wire any kept knob (e.g. `children`) through to the cells so it does something.
+- `loki.config.js` has a `storiesFilter`; check it before renaming a story that's already covered.
+
+Validate: `bun run lint-eslint-pure -- <files>` and `bun run type-check-pure`.
+
+### Optional: verify in the browser yourself
+
+If a browser-driving MCP is connected (e.g. **chrome-devtools-mcp** or **playwright-mcp**: `navigate_page`, `take_screenshot`, `take_snapshot`, `evaluate_script`, `resize_page`), use it to check your own work against the running Storybook (`http://localhost:6006/iframe.html?id=<story-id>`, the kebab-cased title + story). Screenshot for a visual read; `evaluate_script`/`take_snapshot` to confirm DOM facts (a hook landed on the root, pseudo classes applied, a resolved `--mb-color-*`). This is a **convenience, never a requirement** — without it, rely on the user's visual check (and you may suggest installing the plugin). Storybook is usually already running; don't start it. (Screenshot writes may be sandboxed to the repo root — save under `local/` then `mv`.)
+
+Pause here and let the user look. Iterate on layout/spacing only — **no component style changes yet.**
+
+## Phase 4 — Style the component from Figma
+
+Now change the component's `.config.ts` / `.module.css`. Get **exact tokens from Figma** — never eyeball hex from a screenshot.
+
+### Figma desktop MCP is required for tokens
+
+`get_screenshot` works by `nodeId`, but `get_variable_defs`, `get_design_context`, and `get_metadata` read the **current selection in the Figma desktop app** via the **Dev Mode MCP server**. If they error with "nothing selected" or the server isn't connected, **prompt the user** to enable the Dev Mode MCP server (Switch to Dev Mode → MCP section in right sidebar) and select the relevant layer(s). Don't pixel-sample a screenshot as a substitute.
+
+### Extract and map tokens
+
+1. `get_metadata` on the spec frame for the node id + name of each variant/size/state symbol.
+2. `get_variable_defs` per symbol for exact colors, spacing, radius, font.
+3. `get_design_context` (forceCode) on one symbol for exact CSS dimensions (padding, gap, icon size). It may ask about Code Connect — skip that.
+4. **Use the semantic token names `get_variable_defs` returns.** An up-to-date spec binds each property to a semantic token (a role like `text/hover`, `background/selected`); match it to the corresponding `--mb-color-*` key (key list: `frontend/src/metabase/ui/colors/types/color-keys.ts`) and use it directly — one definition then works in both themes. Sanity-check the resolved shade against `colors/constants/themes/light.ts` / `dark.ts` and `base-colors.ts`. Caveat: returned *values* may be the wrong mode for dark symbols — trust the variable **names**, not the dark hex.
+
+### Color rules — semantic tokens only, NO `color-mix`, NO primitives
+
+Per `docs/developers-guide/frontend.md` ("Colors"): every color must be a **semantic** `--mb-color-*` token. No literal hex, and no `color-mix` in component CSS to fake a shade/alpha.
+
+**Guardrail:** if `get_variable_defs` returns a **primitive ramp** (e.g. `Orion-Alpha/10`, `Ocean/60` — a ramp + number, not a role) bound directly to a property, do **not** translate it to a ramp, hardcode hex, or `color-mix` your way to it. **Stop and flag it to the user** with the specific property/state — it's a design-side gap (bind to a semantic token, or add one). Resume once the spec exposes a semantic token.
+
+### Non-color tokens — flag scale mismatches too
+
+The same discipline applies to **dimensional** values — radius, spacing/padding/gap, elevation/shadow, and typography (font size, line-height, weight). Prefer the codebase's existing scale variable over a literal: `--mantine-radius-*`, `--mantine-spacing-*`, `--mantine-shadow-*`, and the Mantine font tokens.
+
+But Figma's scales don't always line up with the codebase's. When a Figma value **has no matching step** in the corresponding scale — e.g. Figma `radius/md = 12px` while `--mantine-radius-md` is `8px`, or a Figma `xxxs` spacing step with no Mantine equivalent — **don't silently bake in a literal.** Flag it to the user the same way you flag primitive colors: name the property, the Figma value, and the nearest codebase token, so it can be resolved with design / the scale owners (align the value, or add a scale step). Only fall back to a literal if the user confirms it's an accepted one-off, and leave a short comment in the code explaining why.
+
+### Mantine implementation notes (reference)
+
+General gotchas when extending Mantine components — adapt per component:
+
+- **Know which slot each data-attribute lands on.** Mantine puts state attributes on specific slots (e.g. `data-variant` on the root, `data-checked`/`data-disabled` on an inner slot). Scope rules accordingly, usually through a root `classNames.root` class.
+- **Out-specify Mantine's built-in variant CSS.** It styles slots at `.m_*:not([data-disabled])` specificity; a descendant combinator through your root class wins. Avoid chained `:not()` (stylelint's `selector-not-notation: complex` rejects it, and combining lowers specificity) — gain specificity via the root class / attributes instead.
+- **Size via a `vars` resolver**, returning only Mantine's typed vars for that component (custom var names fail type-check). Map size → vars in `.config.ts`.
+- **Built-in icons use `currentColor`**, so they inherit the slot's text color.
+- For text on a brand fill, follow the existing convention (`text-primary-inverse`) unless the user wants pure white; flag the dark-theme implication.
+
+After edits: `npx stylelint <css>`, `LINT_CSS_MODULES=true bun run lint-eslint-pure -- <files>`, `bun run type-check-pure`.
+
+## Phase 5 — Iterate with the user
+
+Show the result in the running Storybook and address feedback (color, spacing, radius, shadow, missing/extra state). Surface deliberate deviations explicitly so the user can veto them. If a browser MCP is connected, screenshot the matrix in both themes to catch issues first. **Do not commit until the user is satisfied.**
+
+## Phase 6 — Commit, then migrate call sites
+
+Only after sign-off:
+
+1. Commit when the user explicitly asks; commit only relevant files (exclude build artifacts and the gitignored `local/` doc). Follow the user's commit conventions.
+2. **Update mode:** migrate the call sites flagged in Phase 2 if the restyle requires it (e.g. invalid/renamed props). Be surgical with bulk find/replace — a blanket prop rename can hit unrelated components; verify each hit is the target. **Create mode:** confirm the public export is wired through the barrels and used as the ticket intends.
+3. Leave the findings doc in place for the user's manual verification pass.
+
+---
+
+## Checklist
+
+- [ ] Linear issue fetched; Figma node/fileKey + `gitBranchName` extracted; on the right branch; mode (update vs create) decided.
+- [ ] **Update:** usage + blast radius in `local/<TICKET>-<component>-usage-findings.md`; behavior locked with unit tests **if** the component has custom interactive logic (skip for thin Mantine wrappers / pure restyles). **Create:** component scaffolded with its public surface and barrel exports.
+- [ ] Storybook showcase matrix built from the component's full state space (theme excluded — global toggle drives light/dark), single panel, hover/pressed forced via `storybook-addon-pseudo-states`, controls scoped per story; lint + type-check pass. (Update mode: built before styling, **component styles untouched**. Create mode: built after the component is implemented in Phase 4.)
+- [ ] Figma desktop MCP available; exact tokens extracted and mapped to semantic `--mb-color-*` (NO `color-mix`, NO primitives) and to existing scale vars for radius/spacing/elevation/type — any color *or* dimensional value with no matching token/scale step flagged to the user, not baked in as a literal.
+- [ ] Component styled; stylelint + eslint(+CSS modules) + type-check pass.
+- [ ] Iterated with the user until satisfied.
+- [ ] Committed (when asked); call sites migrated/verified (update) or export wired (create); findings doc handed back.

.claude/skills/typescript-review/SKILL.md

@@ -1,20 +1,33 @@
 ---
 name: typescript-review
 description: Review TypeScript and JavaScript code changes for compliance with Metabase coding standards, style violations, and code quality issues. Use when reviewing pull requests or diffs containing TypeScript/JavaScript code.
-allowed-tools: Read, Grep, Bash, Glob
+allowed-tools: Read, Grep, Bash, Glob, Skill
 ---
 
 # TypeScript/JavaScript Code Review Skill
 
 @./../_shared/typescript-commands.md
+@./../_shared/react-redux-patterns.md
 
-## Code Review Guidelines
+## Main Focus
 
-Review pull requests with a focus on:
+**Primary standard: the [`typescript-write`](../typescript-write/SKILL.md) skill.** Load it first — it defines the authoring rules this review enforces, alongside `frontend/CLAUDE.md` and `docs/developers-guide/frontend.md`.
 
-- Readability and maintainability
-- Appropriate test coverage
-- Compliance with project coding standards and conventions
-- Code quality and best practices
-- Type safety and proper TypeScript usage
-- React best practices (when applicable)
+Adherence to `typescript-write` is the **highest-priority** review dimension: rank any violation of its provisions above all other findings. Treat its **no-`any` hard rule** (no explicit *or* implicit `any` in new code) as **blocking**, and verify it with the LSP rather than by eye.
+
+Review in this priority order:
+
+1. **Violations of [`typescript-write`](../typescript-write/SKILL.md) provisions** — no-`any`, type tightening, type modeling, null/undefined handling, naming, structure, comments. Highest priority; block on the no-`any` rule.
+2. Compliance with `frontend/CLAUDE.md`.
+3. Readability and maintainability.
+4. Appropriate test coverage.
+
+## Blind spots — act as the missing reviewer
+
+These rarely surface in team reviews, so this skill should raise them. They are **additive** — raise them, but rank them below `typescript-write` violations:
+
+- **Accessibility.** Interactive elements need keyboard support, focus management, and accessible names. Flag missing `aria-label`/`aria-labelledby`, non-semantic click targets, modals without focus trap, icon-only buttons without labels, and form inputs without a linked label.
+- **Performance.** Flag areas that scale poorly and aren't memoized; inline object/array literals passed to memoized children; effects that fire on every batch of a progressive load; and new dependencies added to hot paths.
+- **Security.** Evaluate potential security issues in new code.
+- **Bundle size.** Flag new large dependencies, default imports from icon or util libs, and heavy modules imported at route-load time.
+- **Analytics.** User-facing flows should emit tracking events. If a PR adds a new flow (button, modal, navigation) without a tracking event, ask whether one is expected.

.claude/skills/typescript-write/SKILL.md

@@ -7,3 +7,77 @@ description: Write TypeScript and JavaScript code following Metabase coding stan
 
 @./../_shared/development-workflow.md
 @./../_shared/typescript-commands.md
+@./../_shared/react-redux-patterns.md
+
+## No `any` — hard rule
+
+- **New code must not introduce `any`, explicit or implicit.** No `any` annotations, no `as any` / `as unknown as`, no untyped parameters or returns that infer `any`, no implicitly-`any` destructures or array/object literals.
+- **Untyped third-party / boundary values** must be typed at the boundary (a declared type, `unknown` + type guard, or a small typed wrapper) — never let `any` propagate inward.
+- **Mandatory LSP verification.** After writing or editing any TS/TSX, inspect the changed symbols with the TypeScript Language Server (hover to read inferred types; `goToDefinition` to confirm sources) and run the project type-check.
+
+## Type tightening
+
+- **Avoid type casts and loose `unknown`** — fix the signature instead.
+- **If a function only needs one field of a wide object, accept that field** — not the wide object. The cast often disappears once the signature is right.
+- **Reach for `Partial<T>`, `Pick<T, K>`, `Record<K, V>`, and generics** before reaching for a cast.
+- **Prefer making props/components generic** (`<T>`) when a value flows through unchanged and the caller knows the type.
+- **Prefer `unknown` over loose typing** and narrow before use — an `unknown` value forces a guard at the point of use.
+- **`satisfies` for object literals** that must conform without widening (config objects, lookup maps, discriminated literals) — better than `: T` (widens) or `as T` (unsafe).
+- **Avoid non-null assertions (`!`)**. Prefer a guard, early return, or `?.`. Use `!` only when non-nullness is provably true and localized, with a comment.
+- **No redundant runtime coercion** — don't wrap already-typed values in `Number()` / `String()` / `Boolean()`.
+- **Type guards belong in `frontend/src/metabase-types/guards/`**. Do not redefine them locally.
+
+## Type modeling
+
+- **Reuse existing types; don't re-declare them.** Use canonical IDs and domain entity types from `metabase-types/api` (`FieldId`, `TableId`, `ConcreteTableId`, `SchemaName`, …) and key data structures by them (`new Map<ConcreteTableId, …>()`). Don't duplicate generated/API types — compose or derive (`Pick`, `Omit`, indexed access `SomeType["field"]`, `ReturnType`).
+- **Use generics to allow TypeScript to infer correct types** when creating functions and components that need to be reusable and type-safe. Don't hesitate to introduce complex generics if they allow to derive types automatically instead of manual narrowing.
+- **Model the actual data contract; keep types narrow.** Optional `field?: T` for a key that may be absent, `field: T | undefined` only when the key is always present but the value may be undefined, `| null` for explicit API nulls. Prefer domain unions over broad `string` / `number` / loose `Record`.
+- **Refer to API implementation** when defining or refining types to ensure they match the actual data structure. When considering a type cast, first consider if the type should be refined to match the actual data structure.
+- **Discriminated unions for variant state, with exhaustive checks.** Model "one of N shapes" as a union with a literal discriminant rather than a bag of optional fields, and exhaust it with ts-pattern's `.exhaustive()` so adding a variant becomes a compile error:
+  ```ts
+  import { match } from "ts-pattern";
+
+  const result = match(status)
+    .with({ type: "loading" }, () => <Spinner />)
+    .with({ type: "error", error: P.select() }, (error) => <Error message={error.message} />)
+    .with({ type: "success", data: P.select() }, (data) => <Content data={data} />)
+    .exhaustive(); // Compile-time guarantee all cases handled
+  ```
+- **Derive union types from constants** (`as const` + `typeof`/`keyof`) so the type and the values can't drift.
+- **`readonly` / immutability where mutation isn't intended** — component props, shared constants, exported config. Prefer `readonly T[]` / `ReadonlyArray<T>` for inputs you don't mutate.
+- **Type async and error states explicitly** (a discriminated union or the data-layer's typed result) — never leave loading/error/empty implicit.
+
+## Null and undefined
+
+- **Narrow at the source**. If a value is optional only in a corner case, don't thread `undefined` through every layer — guard at the producer.
+- **Sensible defaults for optional values**. Use `?.` and `??` at the consumer.
+- **Lists should be filtered** before being used in a map or other iteration.
+- **Avoid non-strict null comparisons** (`X != null`) when `X` can never be `null` — use a strict check or narrow the type. Use `checkNotNull` where necessary.
+- **Check actual nullability against API implementation**. Find the API endpoint implementation and check if the field can actually be null.
+
+## Naming
+
+- **Names describe the entity, not the mechanism**. A name must reflect what the value holds.
+- **Align sibling concepts**: keep verb conventions consistent across a related API.
+- **No names that encode implementation history** rather than current meaning. Suffixes like `Base`, `New`, `Old`, `Initial` need a real semantic distinction, otherwise drop them.
+- **Avoid cryptic identifiers** (`v`, `n`, `$n`) for domain values; short names are fine only in tiny conventional contexts (loop index `i`, coordinates `x`/`y`, generic params `T`/`K`/`V`).
+
+## Code structure and organization
+
+- **Prioritize reusability over duplication**. The codebase already has many utility functions — leverage them. If you introduce duplicated logic, extract it to a shared utility.
+- **Generic helpers do not belong in feature folders**. Promote to a shared utility.
+- **Keep functions small and single-purpose**. A 100+ line function is hard to review — split into focused named helpers, each with one responsibility and a minimal dependency surface. When necessary, cover with unit tests.
+- **Extract distinct complex JSX into named components**. Choose same-file vs separate-file by reuse, coupling, testability, and readability.
+
+## Comments
+
+- **No comments by default**. Well-named identifiers carry the `what`.
+- **Comments should be concise**. Add a short, concise comment only when the `why` is non-obvious: a workaround, a hidden invariant, a subtle ordering constraint, a clever reduction. Never document the actual implementation, focus on the intent and the why.
+
+## TypeScript Migration
+
+**When touching existing JavaScript files, propose to convert them to TypeScript first**. Create a separate PR for the conversion, then implement the changes.
+
+## Verify before done
+
+- **Run the project type-check** when finished (see the shared TypeScript commands above).

.clj-kondo/config.edn

@@ -61,6 +61,7 @@
   :metabase/check-def-check-not-uppercase-name               {:level :warning}
   :metabase/check-def-no-underscores                         {:level :warning}
   :metabase/check-me-humanize                                {:level :warning}
+  :metabase/check-testing-not-empty                          {:level :warning}
   :metabase/defsetting-must-specify-export                   {:level :warning}
   :metabase/defsetting-namespace                             {:level :warning}
   :metabase/discourage-millis-duration                       {:level :warning}
@@ -178,6 +179,7 @@
      clojure.core.async/take!
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
+     metabase.api.macros.defendpoint.tools-manifest/assert-optional-fields-nullable!
      metabase.channel.core/send!
      metabase.warehouses.models.database/assert-not-h2!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
@@ -191,6 +193,10 @@
      metabase.lib-metric.ast.plan/validate-arithmetic-ast!
      metabase-enterprise.workspaces.isolation/ensure-database-isolation!
      metabase-enterprise.workspaces.test-util/create-ready-ws!
+     metabase-enterprise.workspaces.core/clear-instance-workspace!
+     metabase-enterprise.workspaces.core/set-instance-workspace!
+     metabase.workspaces.core/clear-instance-workspace!
+     metabase.workspaces.core/set-instance-workspace!
      ;; Safe in tests, where we typically use a private, temporary index per thread.
      metabase.search.core/reindex!
      metabase.util/run-count!
@@ -200,6 +206,16 @@
   {:level      :warning
    :max-length 150}
 
+  ;; Warn on long tests (tests over `:min-length`) that look like
+  ;;
+  ;;    (deftest my-test
+  ;;      (testing ...)
+  ;;      (testing ...)
+  ;;      (testing ...))
+  :metabase/validate-deftest-logically-separate-tests
+  {:level      :warning
+   :min-length 60}
+
   ;; this is not enabled here, it is enabled below only for specific namespaces.
   :metabase/disallow-hardcoded-driver-names-in-tests
   ;; don't include `:h2` since that will probably lead to a mountain of tests where we are specifically testing
@@ -254,7 +270,6 @@
     (metabase.util.match/match-many)
     (metabase.util.match/replace-in)
     (metabase.util.match/replace)
-    (metabase.driver-api.core/match)
     (metabase.driver-api.core/match-one)
     (metabase.driver-api.core/match-many)
     (metabase.driver-api.core/replace)
@@ -429,6 +444,8 @@
   instaparse.core/defparser                                                             clojure.core/def
   metabase-enterprise.action-v2.test-util/with-test-tables!                             clojure.core/let
   metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
+  metabase-enterprise.curated-search.reconcile-test/with-isolated-mirror                clojure.core/fn
+  metabase-enterprise.serialization.metadata-file-import.wire-format-test/with-tiny-fixture! clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
   metabase-enterprise.workspaces.test-util/with-resources!                              clojure.core/let
@@ -444,6 +461,7 @@
   metabase.channel.impl.http-test/with-captured-http-requests                           clojure.core/fn
   metabase.channel.impl.http-test/with-server                                           clojure.core/let
   metabase.collections.models.collection-test/with-collection-in-location               clojure.core/let
+  metabase.curated-search.api-test/with-test-entry                                      clojure.core/let
   metabase.driver.mongo.connection/with-mongo-client                                    clojure.core/let
   metabase.driver.mongo.connection/with-mongo-database                                  clojure.core/let
   metabase.driver.mongo.query-processor/mongo-let                                       clojure.core/let
@@ -523,6 +541,7 @@
  {:analyze-call
   {cljs.test/deftest                                                                                                         hooks.clojure.test/deftest
    cljs.test/is                                                                                                              hooks.clojure.test/is
+   cljs.test/testing                                                                                                         hooks.clojure.test/testing
    cljs.test/use-fixtures                                                                                                    hooks.clojure.test/use-fixtures
    clojure.core/def                                                                                                          hooks.clojure.core.def/lint-def
    clojure.core/definterface                                                                                                 hooks.clojure.core.def/lint-def
@@ -541,6 +560,7 @@
    clojure.core/-                                                                                                            hooks.metabase.util.timing/discourage-millis-duration
    clojure.test/deftest                                                                                                      hooks.clojure.test/deftest
    clojure.test/is                                                                                                           hooks.clojure.test/is
+   clojure.test/testing                                                                                                      hooks.clojure.test/testing
    clojure.test/use-fixtures                                                                                                 hooks.clojure.test/use-fixtures
    malli.error/humanize                                                                                                      hooks.malli.error/humanize
    metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
@@ -785,14 +805,7 @@
    :name    general-qp-and-driver-test-namespaces}
 
   {:pattern "(?:^mage.*)"
-   :name    mage-namespaces}
-  ;;
-  ;; Namespaces where `with-redefs` is still the idiom because they haven't been audited for conversion
-  ;; to `with-dynamic-fn-redefs` yet (enterprise tests, driver tests). The linter's nudge is too noisy
-  ;; here — audit can happen in follow-up PRs.
-  ;;
-  {:pattern "^(?:metabase-enterprise\\..+-test(?:\\..+)?|metabase\\.driver\\..+-test(?:\\..+)?)$"
-   :name    prefer-with-dynamic-fn-redefs-unaudited}]
+   :name    mage-namespaces}]
 
  :config-in-ns
  {test-namespaces
@@ -816,10 +829,6 @@
   metabase.util.time-test
   {:linters {:metabase/prefer-with-dynamic-fn-redefs {:level :off}}}
 
-  ;; Enterprise tests and driver tests haven't been audited yet — silence the linter so CI can ship.
-  prefer-with-dynamic-fn-redefs-unaudited
-  {:linters {:metabase/prefer-with-dynamic-fn-redefs {:level :off}}}
-
   source-namespaces
   {:linters
    {:metabase/discourage-millis-duration               {:level :warning}
@@ -914,10 +923,7 @@
 
     :deprecated-namespace
     {:exclude
-     [metabase.driver.common.parameters.dates
-      metabase.driver.common.parameters.operators
-      metabase.driver.common.parameters.values
-      metabase.legacy-mbql.normalize
+     [metabase.legacy-mbql.normalize
       metabase.legacy-mbql.schema
       metabase.legacy-mbql.schema.helpers
       metabase.legacy-mbql.schema.macros

.clj-kondo/config/modules/config.edn

@@ -109,7 +109,8 @@
            search
            settings
            util
-           warehouses}
+           warehouses
+           workspaces}
    :model-exports #{:model/Action}
    :model-imports #{:model/Card
                     :model/Collection
@@ -127,6 +128,7 @@
            analytics
            api
            collections
+           eid-translation
            lib
            permissions
            public-sharing
@@ -157,38 +159,47 @@
   {:team    "Metabot"
    :api     #{metabase.agent-api.api
               metabase.agent-api.init}
-   :uses    #{agent-lib
-              api
+   :uses    #{api
               auth-identity
+              channel
+              collections
               dashboards
               events
               lib
+              lib-be
               llm
               metabot
               queries
+              query-permissions
               query-processor
               request
               server
               settings
               util}
    :model-imports #{:model/Card
+                    :model/Collection
                     :model/Dashboard
                     :model/DashboardCard
+                    :model/Table
                     :model/User}}
 
   agent-lib
   {:team "Metabot"
-   :api  #{metabase.agent-lib.core}
+   :api  #{metabase.agent-lib.representations
+           metabase.agent-lib.representations.repair
+           metabase.agent-lib.representations.resolve}
    :uses #{lib
+           models
            util}}
 
   analytics
   {:team "UX West"
    :api  #{metabase.analytics.api
+           metabase.analytics.api.proxy
            metabase.analytics.core
+           metabase.analytics.event
            metabase.analytics.init
-           metabase.analytics.settings
-           metabase.analytics.snowplow}
+           metabase.analytics.settings}
    :uses #{analytics-interface
            api
            app-db
@@ -241,7 +252,6 @@
   {:team "Graphy"
    :api  #{metabase.analyze.core}
    :uses #{config
-           driver
            lib
            models
            query-processor
@@ -323,15 +333,18 @@
    :api  #{metabase.app-db.cluster-lock ; TODO FIXME
            metabase.app-db.core
            metabase.app-db.init
-           metabase.app-db.setup}
+           ;; exposes `query-canceled-exception?*` so the optional H2 driver can register its `:h2` method; H2 classes
+           ;; can't live in core (AOT) namespaces. See `metabase.config.core/h2-available?`.
+           metabase.app-db.query-cancelation
+           metabase.app-db.setup
+           metabase.app-db.transient-error}
    :uses #{auth-provider
            classloader
            config
            connection-pool
            task
            util}
-   :model-imports #{:model/Database
-                    :model/Field
+   :model-imports #{:model/Field
                     :model/QueryCache
                     :model/Secret
                     :model/Setting}}
@@ -347,6 +360,7 @@
   {:team "UX West"
    :api  #{metabase.audit-app.core
            metabase.audit-app.init}
+   :friends #{enterprise/memoize-monitor}
    :uses #{api
            app-db
            events
@@ -484,23 +498,29 @@
            driver
            events
            formatter
+           geojson
            lib
            lib-be
            models
            notification
            parameters
            permissions
+           pivot
            premium-features
            query-processor
+           request
            settings
            slackbot
            system
            task
+           tiles
            timeline
            types
            util}
    :model-exports #{:model/Channel :model/ChannelTemplate}
    :model-imports #{:model/Dashboard
+                    :model/DashboardCard
+                    :model/DashboardTab
                     :model/Database
                     :model/PulseChannel
                     :model/User}}
@@ -669,6 +689,18 @@
    :api  #{}
    :uses :any}
 
+  curated-search
+  {:team "Metabot"
+   :api  #{metabase.curated-search.api
+           metabase.curated-search.core}
+   :uses #{api
+           models
+           premium-features
+           request
+           util}
+   :model-exports #{:model/CuratedSearchEntry}
+   :model-imports #{:model/Card}}
+
   dashboards
   {:team "UX West"
    :api  #{metabase.dashboards.autoplace
@@ -694,8 +726,8 @@
            query-processor
            search
            settings
-           util
-           warehouse-schema}
+           sync
+           util}
    :model-exports #{:model/Dashboard
                     :model/DashboardCard
                     :model/DashboardCardSeries
@@ -808,7 +840,9 @@
            metabase.driver.common
            metabase.driver.connection
            metabase.driver.ddl.interface
-           metabase.driver.h2
+           ;; NOTE: `metabase.driver.h2` is intentionally NOT here. H2 is an optional driver loaded via a runtime
+           ;; `require` (see `metabase.driver.init` / `metabase.config.core/h2-available?`), so nothing references it
+           ;; at compile time and the module checker treats it as extraneous in `:api`.
            metabase.driver.impl
            metabase.driver.init
            metabase.driver.mysql
@@ -837,7 +871,6 @@
            config
            driver-api
            events
-           legacy-mbql
            lib
            lib-be
            premium-features
@@ -848,7 +881,10 @@
            tracing
            util
            warehouse-schema
-           warehouses}
+           warehouses
+           ;; `metabase.driver.sync/include-schema?` skips workspace iso schemas
+           ;; on parent (non-workspace-mode) instances. See GHY-3489.
+           workspaces}
    :model-imports #{:model/Database :model/Field :model/Table}}
 
   driver-api
@@ -884,6 +920,7 @@
            metabase.eid-translation.core
            metabase.eid-translation.init}
    :uses #{api
+           batch-processing
            settings
            util}
    :model-imports #{:model/Action
@@ -940,7 +977,7 @@
            request
            tiles
            util}
-   :model-imports #{:model/Card :model/Dashboard :model/EmbeddingTheme}}
+   :model-imports #{:model/Card :model/Dashboard :model/DashboardCard :model/EmbeddingTheme}}
 
   events
   {:team "DevEx"
@@ -981,7 +1018,8 @@
   geojson
   {:team "UX West"
    :api  #{metabase.geojson.api
-           metabase.geojson.init}
+           metabase.geojson.init
+           metabase.geojson.settings}
    :uses #{api
            config
            permissions
@@ -1003,6 +1041,17 @@
    :api  #{metabase.graph.core}
    :uses #{util}}
 
+  health-inspector
+  {:team "Querying Platform"
+   :api #{metabase.health-inspector.api
+          metabase.health-inspector.init}
+   :uses #{api
+           lib
+           lib-be
+           settings
+           task
+           util}}
+
   indexed-entities
   {:team "UX West"
    :api  #{metabase.indexed-entities.api
@@ -1013,6 +1062,7 @@
            legacy-mbql
            lib
            models
+           permissions
            query-processor
            search
            sync
@@ -1234,6 +1284,7 @@
               channel
               collections
               config
+              curated-search
               documents
               driver
               interestingness
@@ -1274,8 +1325,10 @@
                     :model/Database
                     :model/Field
                     :model/Glossary
+                    :model/Measure
                     :model/ModerationReview
                     :model/QueryTable
+                    :model/Segment
                     :model/Table
                     :model/Transform
                     :model/User}}
@@ -1323,7 +1376,8 @@
            task
            task-history
            tracing
-           util}
+           util
+           workspaces}
    :model-exports #{:model/PersistedInfo}
    :model-imports #{:model/Card :model/Database}}
 
@@ -1335,6 +1389,7 @@
            metabase.models.resolution
            metabase.models.serialization
            metabase.models.serialization.resolve
+           metabase.models.serialization.resolve.mp
            metabase.models.util.spec-update
            metabase.models.visualization-settings}
    :uses #{api
@@ -1350,6 +1405,7 @@
                     :model/DashboardTab
                     :model/Database
                     :model/Field
+                    :model/Measure
                     :model/NativeQuerySnippet
                     :model/Segment
                     :model/Table
@@ -1381,6 +1437,7 @@
    :uses #{analytics
            analytics-interface
            api
+           app-db
            appearance
            auth-identity
            channel
@@ -1411,14 +1468,18 @@
                     :model/Dashboard
                     :model/DashboardCard
                     :model/DashboardTab
+                    :model/TaskHistory
+                    :model/TaskRun
                     :model/User}}
 
   oauth-server
   {:team "UX West"
-   :api  #{metabase.oauth-server.api
+   :api  #{metabase.oauth-server.api       ;; Special case OAuth standard endpoints under `/`
+           metabase.oauth-server.api.admin ;; The usual Metabase internal API endpoints under `/api`
            metabase.oauth-server.core
            metabase.oauth-server.init}
    :uses #{api
+           api-scope
            appearance
            mcp
            models
@@ -1450,8 +1511,7 @@
            models
            query-processor
            util
-           warehouse-schema
-           warehouses}
+           warehouse-schema}
    :model-imports #{:model/Card
                     :model/Dashboard
                     :model/Field
@@ -1510,7 +1570,8 @@
 
   pivot
   {:team "UX West"
-   :api  #{metabase.pivot.core}
+   :api  #{metabase.pivot.core
+           metabase.pivot.postprocess}
    :uses #{models
            util}}
 
@@ -1650,6 +1711,7 @@
            dashboards
            documents
            events
+           graph
            lib
            lib-be
            metrics
@@ -1663,6 +1725,7 @@
            query-processor
            request
            search
+           sync
            util
            view-log
            warehouse-schema}
@@ -1745,10 +1808,15 @@
               metabase.query-processor.init
               metabase.query-processor.interface
               metabase.query-processor.metadata
+              ;; exposes the `results-as-bytes` multimethod so the optional H2 driver can register its `JdbcBlob`
+              ;; method; H2 classes can't live in core (AOT) namespaces. See `metabase.config.core/h2-available?`.
+              metabase.query-processor.middleware.cache-backend.db
               metabase.query-processor.middleware.constraints
+              metabase.query-processor.middleware.enterprise
               metabase.query-processor.middleware.permissions
               metabase.query-processor.parameters.dates
               metabase.query-processor.parameters.operators
+              metabase.query-processor.parameters.values
               metabase.query-processor.pipeline
               metabase.query-processor.pivot
               metabase.query-processor.preprocess
@@ -1786,15 +1854,15 @@
            premium-features
            queries
            query-permissions
+           request
            server
            settings
            system
            tracing
            users
-           util}
+           util
+           workspaces}
    :model-imports #{:model/Card
-                    :model/Dashboard
-                    :model/DashboardCard
                     :model/DashboardCardSeries
                     :model/Database
                     :model/QueryCache
@@ -1853,15 +1921,30 @@
                     :model/Segment
                     :model/Transform}}
 
+  run-tracking
+  {:team "Gadget"
+   :api  #{metabase.run-tracking.core}
+   :uses #{analytics-interface
+           app-db
+           task
+           util}}
+
   sample-data
   {:team "UX West"
    :api  #{metabase.sample-data.core
            metabase.sample-data.init}
-   :uses #{plugins
+   :uses #{config
+           models
+           plugins
            settings
            sync
            util}
-   :model-imports #{:model/Database}}
+   :model-imports #{:model/Card
+                    :model/Dashboard
+                    :model/DashboardCard
+                    :model/Database
+                    :model/Field
+                    :model/Table}}
 
   search
   {:team "UX West"
@@ -1932,6 +2015,7 @@
   {:team "UX West"
    :api  #{metabase.server.core
            metabase.server.init
+           metabase.server.middleware.security
            metabase.server.middleware.session
            metabase.server.settings
            metabase.server.streaming-response} ; TODO -- too many API namespaces
@@ -1958,6 +2042,7 @@
            tracing
            users
            util
+           enterprise/custom-viz-plugin
            enterprise/sso}
    :model-imports #{:model/Session}}
 
@@ -2122,6 +2207,7 @@
   {:team "Graphy"
    :api  #{metabase.sync.api
            metabase.sync.core
+           metabase.sync.field-values
            metabase.sync.init
            metabase.sync.schedules
            metabase.sync.task.sync-databases
@@ -2137,6 +2223,7 @@
            events
            interestingness
            lib
+           lib-be
            models
            premium-features
            query-processor
@@ -2146,7 +2233,8 @@
            tracing
            util
            warehouse-schema
-           warehouses}
+           warehouses
+           workspaces}
    :model-imports #{:model/Database
                     :model/Field
                     :model/FieldValues
@@ -2173,16 +2261,17 @@
            metabase.task-history.core
            metabase.task-history.init}
    :uses #{api
-           app-db
            config
            models
            permissions
            premium-features
            query-processor
            request
+           run-tracking
            task
            tracing
            util}
+   :model-exports #{:model/TaskHistory :model/TaskRun}
    :model-imports #{:model/Card :model/Dashboard :model/Database}}
 
   tenants
@@ -2219,7 +2308,8 @@
   tiles
   {:team "UX West"
    :api  #{metabase.tiles.api
-           metabase.tiles.init}
+           metabase.tiles.init
+           metabase.tiles.settings}
    :uses #{api
            legacy-mbql
            lib
@@ -2227,7 +2317,8 @@
            parameters
            query-processor
            settings
-           util}}
+           util}
+   :model-imports #{:model/Card :model/Dashboard :model/DashboardCard}}
 
   timeline
   {:team "UX West"
@@ -2276,6 +2367,7 @@
            query-processor
            remote-sync
            revisions
+           run-tracking
            search
            settings
            task
@@ -2287,6 +2379,7 @@
               enterprise/transforms-python}
    :model-exports #{:model/Transform
                     :model/TransformJob
+                    :model/TransformJobRun
                     :model/TransformJobTransformTag
                     :model/TransformRun
                     :model/TransformTag}
@@ -2305,6 +2398,7 @@
    ;; :model/TransformRun directly. Remove once the module is agnostic to global
    ;; versus workspace transforms. See https://linear.app/metabase/issue/BOT-1143
    :model-imports #{:model/Database
+                    :model/Field
                     :model/Table
                     :model/Transform
                     :model/TransformRun}
@@ -2313,9 +2407,11 @@
            events
            lib
            lib-be
+           premium-features
            query-processor
            sync
-           util}
+           util
+           workspaces}
    :friends #{transforms
               enterprise/transforms-python}}
 
@@ -2337,6 +2433,7 @@
            util}
    :model-imports #{:model/Transform
                     :model/TransformJob
+                    :model/TransformJobRun
                     :model/TransformJobTransformTag
                     :model/TransformRun
                     :model/TransformTag}}
@@ -2367,12 +2464,30 @@
            settings
            sync
            util
-           warehouse-schema}
+           warehouse-schema
+           workspaces}
    :model-imports #{:model/Card
                     :model/Database
                     :model/Field
                     :model/Table}}
 
+  usage-metadata
+  {:team "UX West"
+   :api  #{metabase.usage-metadata.init}
+   :model-imports #{:model/Card
+                    :model/Field
+                    :model/Query
+                    :model/QueryExecution
+                    :model/Segment
+                    :model/Table}
+   :uses #{app-db
+           lib
+           lib-be
+           models
+           settings
+           task
+           util}}
+
   user-key-value
   {:team "UX West"
    :api  #{metabase.user-key-value.api
@@ -2478,6 +2593,7 @@
   warehouse-schema
   {:team "UX West"
    :api  #{metabase.warehouse-schema.field
+           metabase.warehouse-schema.field-values.distinct-batch
            metabase.warehouse-schema.metadata-from-qp
            metabase.warehouse-schema.metadata-queries
            metabase.warehouse-schema.models.field
@@ -2601,6 +2717,13 @@
                     :model/Field
                     :model/Table}}
 
+  workspaces
+  {:team "Graphy"
+   :api #{metabase.workspaces.core
+          metabase.workspaces.table-remapping}
+   :uses #{premium-features
+           util}}
+
   xrays
   {:team "Graphy"
    :api  #{metabase.xrays.api
@@ -2645,10 +2768,11 @@
            driver
            events
            lib
+           lib-be
            models
            query-processor
-           util
-           warehouse-schema}
+           sync
+           util}
    :model-imports #{:model/Database
                     :model/Field
                     :model/FieldValues
@@ -2656,7 +2780,8 @@
 
   enterprise/advanced-config
   {:team "UX West"
-   :api  #{metabase-enterprise.advanced-config.api.logs
+   :api  #{metabase-enterprise.advanced-config.api
+           metabase-enterprise.advanced-config.api.logs
            metabase-enterprise.advanced-config.file
            metabase-enterprise.advanced-config.init
            metabase-enterprise.advanced-config.settings}
@@ -2667,11 +2792,13 @@
            lib
            permissions
            premium-features
+           sample-data
            settings
            setup
            sync
            users
-           util}
+           util
+           enterprise/workspaces}
    :model-imports #{:model/ApiKey :model/Database :model/User}}
 
   enterprise/advanced-permissions
@@ -2707,7 +2834,7 @@
            enterprise/scim
            enterprise/semantic-search
            enterprise/sso}
-   :model-imports #{:model/Database :model/Sandbox}}
+   :model-imports #{:model/Database :model/Sandbox :model/Workspace}}
 
   enterprise/api
   {:team "UX West"
@@ -2829,6 +2956,11 @@
            util
            enterprise/harbormaster}}
 
+  enterprise/connection-overlays
+  {:team "Graphy"
+   :api  #{}
+   :uses #{premium-features}}
+
   enterprise/content-translation
   {:team "UX West"
    :api  #{metabase-enterprise.content-translation.routes}
@@ -2853,10 +2985,20 @@
    :api  #{metabase-enterprise.core.init}
    :uses :any}
 
+  enterprise/curated-search
+  {:team "Metabot"
+   :api  #{metabase-enterprise.curated-search.init}
+   :uses #{premium-features
+           task
+           util
+           enterprise/semantic-search}
+   :model-imports #{:model/CuratedSearchEntry}}
+
   enterprise/custom-viz-plugin
   {:team "Gadget"
    :api  #{metabase-enterprise.custom-viz-plugin.api
-           metabase-enterprise.custom-viz-plugin.init}
+           metabase-enterprise.custom-viz-plugin.init
+           metabase-enterprise.custom-viz-plugin.settings}
    :uses #{api
            config
            events
@@ -2943,7 +3085,8 @@
            settings
            util
            warehouse-schema
-           warehouses}
+           warehouses
+           workspaces}
    :model-exports #{:model/DatabaseRouter}
    :model-imports #{:model/Database :model/Transform}}
 
@@ -2954,8 +3097,7 @@
            metabase-enterprise.dependencies.core
            metabase-enterprise.dependencies.init
            metabase-enterprise.dependencies.models.dependency}
-   :uses #{analyze
-           api
+   :uses #{api
            app-db
            collections
            database-routing
@@ -2966,7 +3108,6 @@
            lib
            lib-be
            models
-           native-query-snippets
            permissions
            premium-features
            queries
@@ -3029,6 +3170,17 @@
    ;; make token tracking a hook). Drop this dep once the relocation lands.
    :uses #{enterprise/semantic-search}}
 
+  enterprise/erd
+  {:team "Gadget"
+   :api  #{metabase-enterprise.erd.api}
+   :uses #{api
+           models
+           util
+           warehouse-schema}
+   :model-imports #{:model/Database
+                    :model/Field
+                    :model/Table}}
+
   enterprise/gsheets
   {:team "Cloud"
    :api  #{metabase-enterprise.gsheets.api
@@ -3079,6 +3231,20 @@
            premium-features}
    :model-imports #{:model/Card :model/Collection :model/Table}}
 
+  enterprise/memoize-monitor
+  {:team "Graphy"
+   :api  #{metabase-enterprise.memoize-monitor.init}
+   :uses #{analytics
+           analytics-interface
+           audit-app
+           collections
+           driver
+           models
+           util
+           warehouse-schema
+           warehouses
+           enterprise/serialization}}
+
   enterprise/metabot
   {:team    "Metabot"
    :api     #{metabase-enterprise.metabot.api
@@ -3147,6 +3313,7 @@
            events
            models
            premium-features
+           search
            settings
            startup
            task
@@ -3173,7 +3340,8 @@
   enterprise/replacement
   {:team "Graphy"
    :api  #{metabase-enterprise.replacement.api}
-   :uses #{api
+   :uses #{analytics
+           api
            app-db
            events
            lib
@@ -3283,6 +3451,8 @@
   {:team "Metabot"
    :api  #{metabase-enterprise.semantic-search.api
            metabase-enterprise.semantic-search.core
+           metabase-enterprise.semantic-search.db.datasource
+           metabase-enterprise.semantic-search.embedding
            metabase-enterprise.semantic-search.init}
    :uses #{activity-feed
            analytics
@@ -3301,14 +3471,17 @@
            task
            tracing
            util}
-   :model-imports #{:model/Card :model/Collection :model/Dashboard}}
+   :model-imports #{:model/Collection}}
 
   enterprise/serialization
   {:team "Graphy"
    :api  #{metabase-enterprise.serialization.api
            metabase-enterprise.serialization.cmd
            metabase-enterprise.serialization.core
+           metabase-enterprise.serialization.init
+           metabase-enterprise.serialization.schema
            metabase-enterprise.serialization.v2.backfill-ids}
+   :friends #{enterprise/memoize-monitor}
    :uses #{analytics
            api
            app-db
@@ -3324,7 +3497,9 @@
            search
            server
            setup
-           util}
+           sync
+           util
+           warehouse-schema}
    :model-imports :bypass}
 
   enterprise/snippet-collections
@@ -3353,6 +3528,7 @@
            settings
            sso
            system
+           task
            util
            enterprise/scim}
    :model-imports #{:model/PermissionsGroup :model/Session}}
@@ -3468,14 +3644,30 @@
    :model-imports #{:model/Database :model/Table}}
 
   enterprise/workspaces
-  {:team "Metabot"
-   :api  #{}
-   :uses #{premium-features}}
-
-  enterprise/writable-connection
   {:team "Graphy"
-   :api  #{}
-   :uses #{premium-features}}}
+   :api  #{metabase-enterprise.workspaces.api
+           metabase-enterprise.workspaces.core
+           metabase-enterprise.workspaces.init}
+   :uses #{api
+           app-db
+           cache
+           driver
+           lib
+           models
+           permissions
+           premium-features
+           query-processor
+           sample-data
+           server
+           settings
+           sql-tools
+           util
+           workspaces
+           enterprise/serialization}
+   :model-exports #{:model/Workspace}
+   :model-imports #{:model/Database
+                    :model/Table
+                    :model/User}}}
 
  ;; namespaces matching these patterns (with `re-find`) are excluded from the module linter. Since regex literals
  ;; aren't allowed in EDN just used the `(str <regex>)` version i.e. two slashes instead of one.

.clj-kondo/src/hooks/clojure/test.clj

@@ -21,15 +21,19 @@
                 (error! form (format "destructive functions like %s are not allowed inside a ^:parallel test or test fixture. If this should be allowed, add it to the whitelist in the Kondo config file [:metabase/validate-deftest]"
                                      qualified-symbol)))))
           (walk [form]
-            (f form)
-            (doseq [child (:children form)]
-              (walk child)))]
+            (when-not (contains? (hooks.common/ignored-linters form) :metabase/validate-deftest)
+              (f form)
+              (doseq [child (:children form)]
+                (walk child))))]
     (walk form)))
 
 (defn- deftest-check-parallel
-  "1. Check if test is marked ^:parallel / ^:synchronized correctly
-   2. Make sure disallowed forms are not used in ^:parallel tests"
-  [{[_ test-name & body] :children, :as _node} config]
+  "1. Check if test is marked ^:parallel / ^:synchronized correctly.
+   2. Make sure disallowed forms are not used in ^:parallel tests.
+   3. Disallow ^:parallel tests in namespaces marked ^:synchronous -- the
+      ns marker is the author's blanket promise that nothing inside runs
+      in parallel, so an individual ^:parallel deftest contradicts it."
+  [{[_ test-name & body] :children, :as _node} ns-sym config]
   (let [test-metadata     (:meta test-name)
         metadata-sexprs   (map hooks/sexpr test-metadata)
         combined-metadata (transduce
@@ -41,11 +45,20 @@
                            {}
                            metadata-sexprs)
         parallel?     (:parallel combined-metadata)
-        synchronized? (:synchronized combined-metadata)]
+        synchronized? (:synchronized combined-metadata)
+        ns-synchronous? (boolean (:synchronous (meta ns-sym)))]
     (when (and parallel? synchronized?)
       (hooks/reg-finding! (assoc (meta test-name)
                                  :message "Test should not be marked both ^:parallel and ^:synchronized"
                                  :type :metabase/validate-deftest)))
+    (when (and parallel? ns-synchronous?)
+      (hooks/reg-finding!
+       (assoc (meta test-name)
+              :message (str "Test should not be marked ^:parallel in a namespace marked ^:synchronous -- "
+                            "the ns marker promises no parallel execution. "
+                            "Drop ^:parallel from the deftest, or drop ^:synchronous from the ns. "
+                            "[:metabase/validate-deftest]")
+              :type :metabase/validate-deftest)))
     ;; only when the custom `:metabase/deftest-not-marked-parallel-or-synchronized` is enabled: complain if tests are
     ;; not explicitly marked `^:parallel` or `^:synchronized`. This is mostly to encourage people to mark everything
     ;; `^:parallel` in places like `metabase.lib` tests unless there is a really good reason not to.
@@ -71,6 +84,36 @@
                                                    "Split it up into smaller tests! 🥰")
                                      :type :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests)))))))
 
+(defn- every-top-level-form-in-deftest-is-testing? [{[_deftest _test-name & forms] :children, :as _node}]
+  (every? (fn [{[first-child] :children, :as form}]
+            (and (hooks/list-node? form)
+                 (= (hooks.common/node->qualified-symbol first-child)
+                    'clojure.test/testing)))
+          forms))
+
+(defn- num-top-level-forms-in-deftest [{[_deftest _test-name & forms] :children, :as _node}]
+  (count forms))
+
+(defn- deftest-check-should-not-be-multiple-separate-tests
+  "Warn on long tests (tests over `min-length`) that look like
+
+    (deftest my-test
+      (testing ...)
+      (testing ...)
+      (testing ...))"
+  [node {:keys [min-length], :as _config}]
+  (let [{:keys [row end-row]} (meta node)
+        test-length           (- end-row row)]
+    (when (and min-length
+               (> test-length min-length)
+               (every-top-level-form-in-deftest-is-testing? node)
+               (> (num-top-level-forms-in-deftest node) 1))
+      (hooks/reg-finding!
+       (assoc (meta node)
+              :message (str "This test looks like it contains several logically separate testing forms... break it"
+                            " out into separate deftests to make it easier to test and debug")
+              :type    :metabase/validate-deftest-logically-separate-tests)))))
+
 (defn- ignore? [node error-type]
   (contains? (hooks.common/ignored-linters node) error-type))
 
@@ -135,13 +178,14 @@
                                      :message (format "All tests must live in a known module; %s is not a known module" (pr-str current-module))
                                      :type    :metabase/tests-must-live-in-known-modules)))))))
 
-(defn deftest [{:keys [node cljc lang config], :as input}]
+(defn deftest [{:keys [node cljc lang config], ns-sym :ns, :as input}]
   ;; run [[deftest-check-parallel]] only once... if this is a `.cljc` file only run it for the `:clj` analysis, no point
   ;; in running it twice.
   (when (or (not cljc)
             (= lang :clj))
-    (deftest-check-parallel node (get-in config [:linters :metabase/validate-deftest])))
+    (deftest-check-parallel node ns-sym (get-in config [:linters :metabase/validate-deftest])))
   (deftest-check-not-horrifically-long node (get-in config [:linters :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests]))
+  (deftest-check-should-not-be-multiple-separate-tests node (get-in config [:linters :metabase/validate-deftest-logically-separate-tests]))
   (deftest-check-no-driver-keywords node (get-in config [:linters :metabase/disallow-hardcoded-driver-names-in-tests]))
   (deftest-check-in-valid-module input)
   input)
@@ -180,11 +224,38 @@
 
               nil)))))))
 
-(defn is [{:keys [node lang]}]
+(defn is [{:keys [node lang], :as input}]
   (when (= lang :cljs)
     (warn-about-missing-test-expr-requires-in-cljs node))
-  {:node node})
+  input)
 
-(defn use-fixtures [{:keys [node config]}]
-  (warn-about-disallowed-parallel-forms node config)
-  {:node node})
+(defn use-fixtures
+  "Flag `:parallel/unsafe` forms inside fixtures. Skipped when the surrounding
+  namespace is marked `^:synchronous` -- the ns marker is the author's
+  explicit opt-in to a single-threaded test ns where destructive setup is
+  safe. Without that opt-in, kondo can't know whether sibling deftests will
+  be `^:parallel`, so the conservative default is to flag.
+
+  Sister to [[deftest-check-parallel]]: the deftest hook rejects `^:parallel`
+  tests inside a `^:synchronous` ns, so the two checks together form a
+  coherent opt-in: either the whole ns is synchronous (fixtures can be
+  anything; no parallel tests allowed) or it isn't (fixtures must be
+  parallel-safe)."
+  [{:keys [node config], ns-sym :ns, :as input}]
+  (when-not (:synchronous (meta ns-sym))
+    (let [linter-config (get-in config [:linters :metabase/validate-deftest])]
+      (doseq [form (rest (:children node))]
+        (warn-about-disallowed-parallel-forms form linter-config))))
+  input)
+
+(defn testing
+  "Check that we don't have an empty `testing` form like
+
+    (testing \"message\")"
+  [{{[_testing _message & body] :children, :as node} :node, :as input}]
+  (when (empty? body)
+    (hooks/reg-finding!
+     (assoc (meta node)
+            :message "A `testing` form that doesn't wrap anything doesn't do anything"
+            :type    :metabase/check-testing-not-empty)))
+  input)

.clj-kondo/src/hooks/common.clj

@@ -500,8 +500,8 @@
               (and resolved (:ns resolved))
               (symbol (name (:ns resolved)) (name (:name resolved)))
 
-             ;; if it wasn't resolved but is still qualified it's probably using the full namespace name rather than an
-             ;; alias.
+              ;; if it wasn't resolved but is still qualified it's probably using the full namespace name rather than an
+              ;; alias.
               (qualified-symbol? sexpr)
               sexpr)))))
     ;; some symbols like `*count/Integer` aren't resolvable.

.clj-kondo/src/hooks/metabase/settings/models/setting.clj

@@ -95,6 +95,8 @@
      metabot-feedback-url
      metabot-get-prompt-templates-url
      metabot-prompt-generator-token-limit
+     metaplow-tracking-enabled
+     metaplow-url
      multi-setting-read-only
      notebook-native-preview-sidebar-width
      notification-link-base-url

.clj-kondo/src/hooks/metabase/test/util.clj

@@ -28,8 +28,8 @@
                                             (mapcat (fn [[setting-name v]]
                                                       (concat
                                                        [(with-meta (hooks/token-node '_) (meta setting-name)) v]
-                                                        ;; if the setting name is namespace-qualified add a `_`
-                                                        ;; entry for it too.
+                                                       ;; if the setting name is namespace-qualified add a `_`
+                                                       ;; entry for it too.
                                                        (when (namespaced-symbol-node? setting-name)
                                                          [(with-meta (hooks/token-node '_) (meta setting-name)) setting-name]))))
                                             (partition 2 (:children bindings))))

.clj-kondo/src/hooks/metabase/util/i18n.clj

@@ -1,7 +1,6 @@
 (ns hooks.metabase.util.i18n
   (:require
    [clj-kondo.hooks-api :as api]
-   [clojure.string :as str]
    [hooks.common]))
 
 (defn- valid-apostrophes?
@@ -13,23 +12,23 @@
       (let [c (first chars)]
         (if (= c \')
           (cond
-              ;; Doubled quotes: skip both
+            ;; Doubled quotes: skip both
             (and (next chars) (= (second chars) \'))
             (recur (nthrest chars 2))
 
-              ;; Placeholder escape. We allow for intentional escaping, like either '{0}` or '{{`, but not 'arbitrary
-              ;; strings' So basically, just require the *next* character to be a `{`, find the next single-quote, and
-              ;; continue on from there.
-              ;;
-              ;; Technically a string like "foo bar's happy but i'm not" is totally fine, but we'll say it's invalid
-              ;; because... that inner string literal is probably not what we actually want. So since we've never done
-              ;; this intentionally as far as I can tell, let's just remove the possibility to avoid ambiguity.
+            ;; Placeholder escape. We allow for intentional escaping, like either '{0}` or '{{`, but not 'arbitrary
+            ;; strings' So basically, just require the *next* character to be a `{`, find the next single-quote, and
+            ;; continue on from there.
+            ;;
+            ;; Technically a string like "foo bar's happy but i'm not" is totally fine, but we'll say it's invalid
+            ;; because... that inner string literal is probably not what we actually want. So since we've never done
+            ;; this intentionally as far as I can tell, let's just remove the possibility to avoid ambiguity.
             (= (second chars) \{)
             (let [at-closing (drop-while #(not= \' %) (next chars))]
               (if (seq at-closing)
                 (recur (next at-closing))
                 false))
-              ;; Unpaired single quote: invalid
+            ;; Unpaired single quote: invalid
             :else
             false)
           (recur (rest chars)))))))

.clj-kondo/test/hooks/clojure/test_test.clj

@@ -49,7 +49,10 @@
                               :deps
                               vals
                               (keep (comp keyword :local/root))
-                              (into #{}))]
+                              (into #{})
+                              ;; :h2 is intentionally excluded from the linter set (it's the default test driver, so
+                              ;; hardcoding it is fine and ubiquitous), even though it now lives in modules/drivers.
+                              (#(disj % :h2)))]
       (doseq [driver driver-modules]
         (is (contains? driver-keywords driver)
             (format "hooks.clojure.test/driver-keywords should contain %s, please add it" driver))))))

.clj-surgeon.edn

@@ -0,0 +1,27 @@
+{:aliases
+ {;; defendpoint shape: (api.macros/defendpoint METHOD URL DOCSTRING? [args] body)
+  ;; No name slot — synthesize :route [METHOD "path"] from first 2 args.
+  "defendpoint"
+  {:fields {:method (fn [z] (some-> z z/down z/right z/sexpr name str/upper-case))
+            :path   (fn [z] (-> z z/down z/right z/right z/sexpr))}}
+
+  ;; defenterprise shape:
+  ;;   (defenterprise NAME DOCSTRING? EE-NAMESPACE [args] body)
+  "defenterprise"
+  {:fields {:name         ->defn-name
+            :ee-namespace (fn [z]
+                            ;; Skip name + optional docstring; the next
+                            ;; symbol is the EE namespace.
+                            (let [name-z (-> z z/down z/right)
+                                  after-doc (z/right name-z)
+                                  candidate (if (string? (try (z/sexpr after-doc)
+                                                              (catch Exception _ nil)))
+                                              (z/right after-doc)
+                                              after-doc)]
+                              (try (let [v (z/sexpr candidate)]
+                                     (when (symbol? v) v))
+                                   (catch Exception _ nil))))
+            :arglist      ->defn-arg-list}}
+
+  "defsetting"
+  {:fields {:name ->defn-name}}}}

.cljfmt.edn

@@ -1,12 +1,10 @@
 ;; Cljfmt config. See https://github.com/weavejester/cljfmt#formatting-options
-{:sort-ns-references?
- true
-
- :function-arguments-indentation
- :community
-
- :parallel?
- true
+{:function-arguments-indentation  :community
+ :indent-line-comments?           true
+ :normalize-newlines-at-file-end? true
+ :parallel?                       true
+ :remove-blank-lines-in-forms?    true
+ :sort-ns-references?             true
 
  :paths
  ["src"
@@ -15,11 +13,63 @@
   "bin/build"
   "bin/lint-migrations-file"
   "bin/release-list"
+  #_"mage/src"
+  #_"mage/test"
   "modules/drivers"
   ".clj-kondo/src"
   ".clj-kondo/test"
   #_"dev"]
 
+ ;; a map of symbols that tell cljfmt which forms are allowed to have blank lines inside of them. The value may be
+ ;; either `:all`, which means blank lines are allowed between all elements in the form, e.g. `{cond :all}` to allow
+ ;; blank lines between any of the elements inside cond; or it may be a set of element indexes that are allowed to
+ ;; have blank lines, e.g. `{let #{0}}`, to allow blank lines in the binding of a `let` form.
+ :extra-blank-line-forms
+ {are                                                                    :all
+  case                                                                   :all
+  cond->                                                                 :all
+  cond->>                                                                :all
+  condp                                                                  :all
+  clojure.spec.alpha/or                                                  :all
+  clojure.test/are                                                       :all
+  metabase.driver-api.core/match-many                                    :all
+  metabase.driver-api.core/match-one                                     :all
+  metabase.driver-api.core/replace                                       :all
+  metabase.driver-api.core/replace-in                                    :all
+  metabase.lib.drill-thru.test-util/test-drill-variants-with-merged-args :all
+  metabase.lib.drill-thru.test-util/test-returns-drill                   :all
+  metabase.test/with-temp                                                #{0}
+  metabase.util.match/match-many                                         :all
+  metabase.util.match/match-one                                          :all
+  metabase.util.match/replace                                            :all
+  metabase.util.match/replace-in                                         :all
+  ;; TODO (Cam 2026-05-21) I'm not really sure about `defprotocol`, `deftype`, `defrecord`, `proxy`, `reify`, etc., I
+  ;; think idiomatically these should probably not have blank lines but we can worry about that later
+  defprotocol                                                            :all
+  defrecord                                                              :all
+  deftype                                                                :all
+  extend                                                                 :all
+  extend-protocol                                                        :all
+  potemkin.types/def-map-type                                            :all
+  potemkin.types/defprotocol+                                            :all
+  potemkin.types/defrecord+                                              :all
+  potemkin.types/deftype+                                                :all
+  potemkin/def-map-type                                                  :all
+  potemkin/defprotocol+                                                  :all
+  potemkin/defrecord+                                                    :all
+  potemkin/deftype+                                                      :all
+  proxy                                                                  :all
+  reify                                                                  :all
+  ;; TODO (Cam 2026-05-21) -- save these for a follow-on PR
+  defmacro                                                               :all
+  defmethod                                                              :all
+  defn                                                                   :all
+  defn-                                                                  :all
+  fn                                                                     :all
+  metabase.util.malli/defmethod                                          :all
+  metabase.util.malli/defn                                               :all
+  metabase.util.malli/defn-                                              :all}
+
  ;; See https://github.com/weavejester/cljfmt/blob/master/cljfmt/resources/cljfmt/indents/clojure.clj for the default
  ;; definitions
  ;;
@@ -37,7 +87,7 @@
  ;; `:inner` indentation is like `:defn` indentation. `[[:inner 0]]` (default for `defn`) means all arguments at depth
  ;; zero get indented 2 spaces if not on the first line regardless of number of elements on the first line.
  :extra-indents
- {;; clojure.core stuff
+ { ;; clojure.core stuff
   fn*                                                                                         [[:inner 0]]
   let*                                                                                        [[:block 1]]
   with-meta                                                                                   [[:default]]

.config/wt.toml

@@ -1,10 +0,0 @@
-# worktrunk project config — https://worktrunk.dev
-# Hooks run when switching, creating, merging, or removing worktrees.
-
-# Setup tasks for newly-created worktrees. Run once, blocking, in the
-# new worktree's cwd before post-start background tasks kick off.
-[pre-start]
-# Trust mise config so it loads the project's tool versions without prompting.
-trust-mise = "mise trust"
-# Install JS deps so husky git hooks get wired up in the new worktree.
-bun-install = "bun install"

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,5 +1,5 @@
 > [!IMPORTANT]
-> For those employed by Metabase: if you are merging into master, please add either a `backport` or a `no-backport` label to this PR. You will not be able to merge until you do this step. Refer to the section [Do I need to backport this PR?](https://www.notion.so/metabase/Metabase-Branching-Strategy-6eb577d5f61142aa960a626d6bbdfeb3?pvs=4#89f80d6f17714a0198aeb66c0efd1b71) in the Metabase Branching Strategy document for more details. If you're not employed by Metabase, this section does not apply to you, and the label will be taken care of by your reviewer.
+> For those employed by Metabase: if you are fixing a P0 or P1 issue, add a `backport` label to this PR. No action is needed otherwise. Refer to the [Backporting](https://app.notion.com/p/metabase/Branching-Strategy-and-Backports-6eb577d5f61142aa960a626d6bbdfeb3?source=copy_link#e71f6e7de2f945d99fbb2d6b764e6f36) section in the Metabase Branching Strategy document for more details. If you're not employed by Metabase, this section does not apply to you, and the label will be taken care of by your reviewer.
 
 > **Warning**
 >

.github/actions/cleanup-python-runner/action.yml

@@ -26,7 +26,7 @@ runs:
 
     - name: Upload python-runner logs
       if: ${{inputs.upload-logs == 'true' && inputs.logs-artifact-suffix != ''}}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: python-runner-logs-${{inputs.logs-artifact-suffix}}
         path: |

.github/actions/create-backport/action.yml

@@ -84,18 +84,18 @@ runs:
 
     - name: Auto approve backport PR
       if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
-      uses: juliangruber/approve-pull-request-action@v1
+      uses: juliangruber/approve-pull-request-action@68fcc9a5a73b5641cadf757cf99d73720dcb05d0 # v2.1.0
       with:
         github-token: ${{ inputs.github-token-2 }}
         number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
 
     - name: Enable Pull Request Automerge
       if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
-      uses: peter-evans/enable-pull-request-automerge@v2
-      with:
-        token: ${{ inputs.github-token }}
-        pull-request-number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
-        merge-method: squash
+      run: gh pr merge --squash --auto "$PR_NUMBER"
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        PR_NUMBER: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
 
     - uses: ./.github/actions/notify-pull-request
       if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'true' }}

.github/actions/cross-branch-migration-test/action.yml

@@ -11,7 +11,7 @@ runs:
   steps:
     ## First we deploy the base branch
     - name: Check out base branch
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ inputs.base-ref }}
 
@@ -42,7 +42,7 @@ runs:
 
     ## Then we deploy the PR branch to ensure it migrates up successfully
     - name: Check out pull request branch
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ inputs.head-ref }}
 
@@ -81,7 +81,7 @@ runs:
       shell: bash
 
     - name: Re-check out base branch
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ inputs.base-ref }}
 

.github/actions/e2e-download-uberjar/action.yml

@@ -9,7 +9,7 @@ runs:
   using: "composite"
   steps:
     - name: Download previously stored uberjar
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       with:
         script: | # js
           const fs = require('fs');

.github/actions/e2e-prepare-containers/action.yml

@@ -40,10 +40,24 @@ runs:
   using: "composite"
   steps:
     - name: Authenticate to prevent API rate limit
-      uses: docker/login-action@v3
-      with:
-        username: ${{ inputs.username }}
-        password: ${{ inputs.password }}
+      shell: bash
+      env:
+        DOCKER_USERNAME: ${{ inputs.username }}
+        DOCKER_PASSWORD: ${{ inputs.password }}
+      run: |
+        for attempt in 1 2 3; do
+          echo "Docker login attempt $attempt of 3..."
+          if echo "$DOCKER_PASSWORD" | docker login --username "$DOCKER_USERNAME" --password-stdin; then
+            echo "Docker login succeeded on attempt $attempt"
+            break
+          fi
+          if [ $attempt -eq 3 ]; then
+            echo "::error::Docker login failed after 3 attempts"
+            exit 1
+          fi
+          echo "::warning::Docker login attempt $attempt failed, retrying in 15s..."
+          sleep 15
+        done
 
     - name: Start Containers
       shell: bash
@@ -53,16 +67,29 @@ runs:
 
         cd e2e/test/scenarios/
 
-        docker compose up \
-          $([ ${{ inputs.postgres }} = true ] && echo "postgres-sample") \
-          $([ ${{ inputs.mysql }} = true ] && echo "mysql-sample") \
-          $([ ${{ inputs.mongo }} = true ] && echo "mongo-sample") \
-          $([ ${{ inputs.maildev }} = true ] && echo "maildev") \
-          $([ ${{ inputs.maildev }} = true ] && echo "maildev-ssl") \
-          $([ ${{ inputs.openldap }} = true ] && echo "ldap") \
-          $([ ${{ inputs.webhook }} = true ] && echo "webhook-tester") \
-          $([ ${{ inputs.snowplow }} = true ] && echo "snowplow-micro") \
-          -d
+        SERVICES=()
+        [ "${{ inputs.postgres }}" = true ] && SERVICES+=(postgres-sample)
+        [ "${{ inputs.mysql }}" = true ] && SERVICES+=(mysql-sample)
+        [ "${{ inputs.mongo }}" = true ] && SERVICES+=(mongo-sample)
+        [ "${{ inputs.maildev }}" = true ] && SERVICES+=(maildev maildev-ssl)
+        [ "${{ inputs.openldap }}" = true ] && SERVICES+=(ldap)
+        [ "${{ inputs.webhook }}" = true ] && SERVICES+=(webhook-tester)
+        [ "${{ inputs.snowplow }}" = true ] && SERVICES+=(snowplow-micro)
+
+        for attempt in 1 2 3; do
+          echo "Docker compose up attempt $attempt of 3..."
+          if docker compose up "${SERVICES[@]}" -d; then
+            echo "Docker compose up succeeded on attempt $attempt"
+            break
+          fi
+          if [ $attempt -eq 3 ]; then
+            echo "::error::Docker compose up failed after 3 attempts"
+            exit 1
+          fi
+          echo "::warning::Docker compose up attempt $attempt failed, retrying in 30s..."
+          docker compose down 2>/dev/null || true
+          sleep 30
+        done
 
         if ${{ inputs.maildev }}; then
           echo -e "${Y}checking maildev container..." &&

.github/actions/fetch-artifact/action.yml

@@ -26,7 +26,7 @@ runs:
   steps:
     - name: find_release_artifact
       id: find_release_artifact
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       with:
         result-encoding: string
         script: | # js

.github/actions/get-docker-info/action.yml

@@ -34,7 +34,7 @@ runs:
   steps:
     - name: Determine Docker info
       id: docker-info
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       with:
         script: | # js
           const branch = '${{ inputs.branch }}';

.github/actions/notify-pull-request/action.yml

@@ -18,7 +18,7 @@ runs:
   using: "composite"
   steps:
     - name: Remove previous pull-request comment
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       if: ${{ inputs.remove-previous-comment == 'true' && always() && github.event_name == 'pull_request' }}
       with:
         script: |
@@ -53,7 +53,7 @@ runs:
           }
 
     - name: Notify pull-request
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       if: ${{ inputs.add-new-comment == 'true' && always() && github.event_name == 'pull_request' }}
       id: notify-pull-request
       with:

.github/actions/prepare-backend/action.yml

@@ -13,7 +13,7 @@ runs:
   using: "composite"
   steps:
     - name: Prepare JDK ${{ inputs.java-version }}
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v5.2.0
       with:
         java-version: ${{ inputs.java-version }}
         distribution: "temurin"
@@ -37,14 +37,14 @@ runs:
       id: get-cache-keys
 
     - name: Install uv (for Python package installation)
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       with:
         enable-cache: false
         version: "0.10.2" # keep in sync with mise.toml
         github-token: ${{ github.token }}
 
     - name: Restore M2 cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: |
           ~/.m2

.github/actions/prepare-cypress/action.yml

@@ -16,7 +16,7 @@ runs:
   using: "composite"
   steps:
     - name: Install Chrome v144
-      uses: browser-actions/setup-chrome@v2
+      uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
       with:
         chrome-version: 144
       id: setup-chrome
@@ -26,7 +26,7 @@ runs:
       id: get-cache-keys
 
     - name: Get Cypress cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: ~/.cache/Cypress
         key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}

.github/actions/prepare-frontend/action.yml

@@ -21,7 +21,7 @@ runs:
       id: get-cache-keys
 
     - name: Restore M2 cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: |
           ~/.m2
@@ -39,7 +39,7 @@ runs:
       shell: bash
 
     - name: Restore node_modules cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       id: node-modules-cache
       with:
         path: |

.github/actions/prepare-node-bun/action.yml

@@ -8,13 +8,13 @@ runs:
   using: "composite"
   steps:
     - name: Prepare Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6.4.0
       with:
         node-version: ${{ inputs.node-version }}
         node-version-file: ".nvmrc"
 
     - name: Install bun
-      uses: oven-sh/setup-bun@v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
-        bun-version: "1.3.7"
+        bun-version: "1.3.14"
         token: ${{ github.token }}

.github/actions/prepare-release-scripts/action.yml

@@ -4,9 +4,9 @@ description: Set up bun and build release scripts
 runs:
   using: composite
   steps:
-    - uses: oven-sh/setup-bun@v2
+    - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
-        bun-version: "1.3.7"
+        bun-version: "1.3.14"
         token: ${{ github.token }}
 
     - name: Build release scripts

.github/actions/prepare-shoppy-e2e/action.yml

@@ -54,7 +54,7 @@ runs:
 
     # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
     - name: Set up Docker Compose
-      uses: docker/setup-compose-action@v1
+      uses: docker/setup-compose-action@8cccb8c14b6500aaffebff1aa49c502c34d2e5e6 # v2.1.0
       with:
         version: latest
 
@@ -67,7 +67,7 @@ runs:
         output-name: "metabase.jar"
 
     - name: Retrieve Embedding SDK dist artifact
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       with:
         name: embedding-sdk-${{ inputs.commit }}
         path: ${{ github.workspace }}/resources/embedding-sdk
@@ -95,7 +95,7 @@ runs:
 
     - name: Configure AWS credentials
       if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885
       with:
         role-to-assume: ${{ inputs.shoppy-iam-role }}
         role-session-name: GitHub_to_AWS_via_FederatedOIDC

.github/actions/prepare-uberjar-artifact/action.yml

@@ -17,7 +17,7 @@ runs:
       run: sha256sum ./target/uberjar/metabase.jar > SHA256.sum
       shell: bash
     - name: Upload JARs as artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
         path: |

.github/actions/resolve-job-id/action.yml

@@ -0,0 +1,66 @@
+name: Resolve current job id
+description: >
+  Resolve this job's GitHub workflow_jobs.id via the Actions API and export it
+  as JOB_ID (and JOB_HTML_URL) to $GITHUB_ENV, so any later step can read the
+  numeric job id without making its own API call. Best-effort: warns and
+  proceeds on failure so it can never break the run.
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve JOB_ID
+      shell: bash
+      env:
+        # Use the built-in per-job token, not a PAT: this lookup is best-effort
+        # (a miss just leaves JOB_ID unset, never breaks the run) and other jobs
+        # depend on the automation PAT's rate-limit budget — we don't want ~70
+        # e2e shards drawing it down. Worst case under heavy CI load is the
+        # occasional unresolved job_id, which is acceptable. DEV-2117.
+        GH_TOKEN: ${{ github.token }}
+        RUNNER_NAME: ${{ runner.name }}
+      run: |
+        # GitHub doesn't expose the current job's numeric id, so we look it up
+        # from the Actions API. A runner runs exactly one job at a time, so the
+        # in-progress job with this runner_name within (run_id, run_attempt) is
+        # unique. We require status == in_progress and no completed_at so a
+        # reused runner can't match a job it already finished this attempt, with
+        # max_by(.started_at) as a final tiebreaker.
+        #
+        # $GITHUB_RUN_ID is the whole CI run, whose total job count exceeds the
+        # 100-per-page cap (~185 jobs), so this shard's job is frequently NOT on
+        # the first page. --paginate --slurp pulls every page and slurps them
+        # into one array so the filter sees all jobs, not just the first 100 —
+        # without it the lookup returned null whenever this job sorted past
+        # position 100 (DEV-2117).
+        #
+        # gh rejects `--slurp` together with `--jq` ("the --slurp option is not
+        # supported with --jq"), so we slurp with gh and run the filter through a
+        # standalone `jq`. The earlier `--slurp --jq` form errored on every
+        # attempt — swallowed by 2>/dev/null — leaving JOB_ID permanently unset.
+        set +e
+        api_url="/repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/attempts/$GITHUB_RUN_ATTEMPT/jobs?per_page=100"
+        jq_filter="[.[].jobs[] | select(.runner_name == \"$RUNNER_NAME\" and .status == \"in_progress\" and .completed_at == null)] | max_by(.started_at) | \"\(.id) \(.html_url)\""
+
+        # The Actions jobs API is eventually consistent: after a runner picks
+        # up a job, it can take a few seconds for runner_name to appear in the
+        # response. Retry briefly to absorb that.
+        out=""
+        for attempt in 1 2 3 4 5; do
+          out=$(gh api --paginate --slurp "$api_url" 2>/dev/null | jq -r "$jq_filter" 2>/dev/null)
+          if [ -n "$out" ] && [ "$out" != "null null" ]; then
+            break
+          fi
+          out=""
+          echo "Attempt $attempt: job not yet visible in Actions API; retrying..."
+          sleep 3
+        done
+
+        if [ -n "$out" ]; then
+          read -r job_id job_url <<<"$out"
+          echo "JOB_ID=$job_id" >> "$GITHUB_ENV"
+          echo "JOB_HTML_URL=$job_url" >> "$GITHUB_ENV"
+          echo "Resolved JOB_ID=$job_id (runner=$RUNNER_NAME)"
+        else
+          echo "::warning::Could not resolve current job id after 5 attempts (runner=$RUNNER_NAME)"
+        fi
+        exit 0

.github/actions/sdk-bundle-size-check/action.yml

@@ -39,21 +39,19 @@ runs:
     - name: Extract embedding-sdk bundles from current uberjar
       shell: bash
       run: |
-        # Try new layout first (app/embedding-sdk/legacy/), fall back to old layout (app/embedding-sdk.js)
-        unzip -j temp/current-uberjar/metabase.jar \
-          "frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" \
-          -d temp/current-bundle 2>/dev/null || \
-        unzip -j temp/current-uberjar/metabase.jar \
+        # Extract preserving the jar's internal paths under resources/ so the
+        # shared measure script sees the same layout as a source build. Both the
+        # new (embedding-sdk/legacy + chunks) and old (embedding-sdk.js) layouts
+        # are pulled; whichever exists is what gets measured.
+        mkdir -p temp/current/resources
+        unzip -o temp/current-uberjar/metabase.jar \
+          "frontend_client/app/embedding-sdk/*" \
+          -d temp/current/resources 2>/dev/null || true
+        unzip -o temp/current-uberjar/metabase.jar \
           "frontend_client/app/embedding-sdk.js" \
-          -d temp/current-bundle
-
-        # Extract chunks directory if it exists (new layout only)
-        mkdir -p temp/current-chunks
-        unzip -j temp/current-uberjar/metabase.jar \
-          "frontend_client/app/embedding-sdk/chunks/*" \
-          -d temp/current-chunks 2>/dev/null || true
+          -d temp/current/resources 2>/dev/null || true
     - name: Checkout base ref
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ inputs.base-ref-commit }}
         path: temp/base-ref-src
@@ -63,49 +61,16 @@ runs:
         cd temp/base-ref-src
         bun install
         MB_EDITION=${{ inputs.edition }} bun run build-release
+    - name: Measure current and base bundle sizes
+      shell: bash
+      env:
+        MEASURE_BUNDLES: embedding-sdk-legacy,embedding-sdk-chunked
+      run: |
+        MEASURE_ROOT=temp/current node ./.github/scripts/measure-bundle-sizes.js > temp/current-sizes.json
+        MEASURE_ROOT=temp/base-ref-src node ./.github/scripts/measure-bundle-sizes.js > temp/base-sizes.json
     - name: Compare sizes and set output
       id: compare
       shell: bash
-      run: |
-        # --- Legacy (monolithic) bundle comparison ---
-        current_size=$(wc -c < temp/current-bundle/embedding-sdk.js) || { echo "::error::Failed to read current bundle"; exit 1; }
-
-        # Base ref: try new layout first, fall back to old
-        if [ -f "temp/base-ref-src/resources/frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" ]; then
-          base_ref_size=$(wc -c < "temp/base-ref-src/resources/frontend_client/app/embedding-sdk/legacy/embedding-sdk.js")
-        else
-          base_ref_size=$(wc -c < "temp/base-ref-src/resources/frontend_client/app/embedding-sdk.js")
-        fi
-        [ "$current_size" -gt 0 ] && [ "$base_ref_size" -gt 0 ] || { echo "::error::Bundle file is empty"; exit 1; }
-
-        diff=$((current_size - base_ref_size))
-        percent=$(( diff * 100 / base_ref_size ))
-
-        echo "=== Legacy (monolithic) bundle ==="
-        echo "Current size: $current_size bytes"
-        echo "Base ref size: $base_ref_size bytes"
-        echo "Difference: $diff bytes ($percent%)"
-
-        threshold="${{ inputs.threshold-percent }}"
-        if [ "$percent" -gt "$threshold" ]; then
-          status="increased"
-        elif [ "$percent" -lt "$(( -threshold ))" ]; then
-          status="decreased"
-        else
-          status="stable"
-        fi
-
-        echo "status=$status" >> $GITHUB_OUTPUT
-        echo "size_change_percent=$percent" >> $GITHUB_OUTPUT
-
-        # --- Chunked bundle (informational) ---
-        if ls temp/current-chunks/*.js 1>/dev/null 2>&1; then
-          chunks_size=$(cat temp/current-chunks/*.js | wc -c)
-          echo ""
-          echo "=== Chunked bundle (bootstrap + chunks) ==="
-          echo "Total chunked size: $chunks_size bytes"
-          echo "chunks_size=$chunks_size" >> $GITHUB_OUTPUT
-        else
-          echo ""
-          echo "No chunked bundle found (expected on master)"
-        fi
+      env:
+        THRESHOLD: ${{ inputs.threshold-percent }}
+      run: node ./.github/actions/sdk-bundle-size-check/compare.js temp/current-sizes.json temp/base-sizes.json

.github/actions/sdk-bundle-size-check/compare.js

@@ -0,0 +1,54 @@
+/* eslint-disable import/no-commonjs */
+// Diffs the embedding SDK bundle sizes produced by measure-bundle-sizes.js for
+// the current build and the base ref. The gate is driven by the legacy
+// (monolithic) bundle's raw bytes; the chunked delivery is reported for context.
+const fs = require("fs");
+
+const [, , currentPath, basePath] = process.argv;
+const threshold = Number(process.env.THRESHOLD ?? 2);
+
+const current = JSON.parse(fs.readFileSync(currentPath, "utf8"));
+const base = JSON.parse(fs.readFileSync(basePath, "utf8"));
+
+const pick = (rows, bundle, kind) => rows.find(row => row.bundle === bundle && row.kind === kind);
+
+const setOutput = (name, value) => {
+  if (process.env.GITHUB_OUTPUT) {
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
+  }
+};
+
+const mb = bytes => (bytes / 1024 / 1024).toFixed(2);
+
+const legacyCurrent = pick(current, "embedding-sdk-legacy", "total");
+const legacyBase = pick(base, "embedding-sdk-legacy", "total");
+
+if (!legacyCurrent || !legacyBase || !legacyBase.rawBytes) {
+  console.error("::error::Could not find embedding-sdk-legacy size in both builds");
+  process.exit(1);
+}
+
+const diff = legacyCurrent.rawBytes - legacyBase.rawBytes;
+const percent = Math.trunc((diff * 100) / legacyBase.rawBytes);
+
+const status = percent > threshold ? "increased" : percent < -threshold ? "decreased" : "stable";
+
+console.log("=== Embedding SDK legacy (monolithic) bundle ===");
+console.log(`Current:  ${legacyCurrent.rawBytes} bytes raw / ${mb(legacyCurrent.gzipBytes)}MB gzip`);
+console.log(`Base ref: ${legacyBase.rawBytes} bytes raw / ${mb(legacyBase.gzipBytes)}MB gzip`);
+console.log(`Difference: ${diff} bytes (${percent}%), threshold ${threshold}%`);
+console.log(`Status: ${status}`);
+
+const chunkedCurrent = pick(current, "embedding-sdk-chunked", "total");
+const chunkedBase = pick(base, "embedding-sdk-chunked", "total");
+if (chunkedCurrent && chunkedBase) {
+  const chunkedDiff = chunkedCurrent.rawBytes - chunkedBase.rawBytes;
+  console.log("");
+  console.log("=== Embedding SDK chunked (informational) ===");
+  console.log(`Current:  ${chunkedCurrent.rawBytes} bytes raw / ${mb(chunkedCurrent.gzipBytes)}MB gzip`);
+  console.log(`Base ref: ${chunkedBase.rawBytes} bytes raw / ${mb(chunkedBase.gzipBytes)}MB gzip`);
+  console.log(`Difference: ${chunkedDiff} bytes`);
+}
+
+setOutput("status", status);
+setOutput("size_change_percent", percent);

.github/actions/test-driver/action.yml

@@ -45,7 +45,7 @@ runs:
       # whether to fail or to pass the whole job, based on the quarantine list.
       continue-on-error: true
     - name: Publish Test Report (JUnit)
-      uses: dorny/test-reporter@v1
+      uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
       # test.outcome gives us access to the result before `continue-on-error` overrides it and sets it to 'success'.
       # We want test reports even if the test step gets cancelled (e.g. times out), hence we match anything that is not a 'success'.
@@ -59,7 +59,7 @@ runs:
         fail-on-error: false
     - name: Upload Logs on Failure
       if: always() && steps.run-test.outcome != 'success'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: ${{ format('test-logs-{0}{1}', github.job, inputs.logs-artifact-suffix && format('-{0}', inputs.logs-artifact-suffix) || '') }}
         path: logs/test-log.json

.github/actions/update-cache/action.yml

@@ -17,7 +17,7 @@ runs:
   steps:
     - name: Check if the cache entry exists
       id: cache-lookup
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: ${{ inputs.path }}
         key: ${{ inputs.key }}
@@ -35,7 +35,7 @@ runs:
         GH_TOKEN: ${{ github.token }}
       shell: bash
     - name: Save the new cache entry
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         path: ${{ inputs.path }}
         key: ${{ inputs.key }}

.github/actions/upload-test-results/action.yml

@@ -21,12 +21,25 @@ inputs:
     default: ""
   previous-step-outcome:
     required: true
+  driver-status:
+    required: false
+    default: ""
+    description: >-
+      Configured status for this driver ("info", "skip", "required", or empty). When
+      "info", the job is reported as passing regardless of the real test outcome, and
+      that outcome is surfaced via a job summary and (on PRs) a comment instead.
+  report-variant:
+    required: false
+    default: ""
+    description: >-
+      Optional label disambiguating matrix legs of the same job, so the info-driver
+      job summary and PR comment stay distinct per leg.
 
 runs:
   using: "composite"
   steps:
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885
       with:
         role-to-assume: ${{ inputs.role-to-assume }}
         aws-region: ${{ inputs.aws-region }}
@@ -50,8 +63,11 @@ runs:
       # Important!
       # 1. This step must always run because it controls job's exit code.
       # 2. There's no point in running this outside the organization
+      # 3. For "info" drivers our own status takes precedence: we let this step pass so
+      #    the job is reported as passing regardless of the real outcome (still uploaded).
       if: always() && github.repository_owner == 'metabase'
-      uses: trunk-io/analytics-uploader@main
+      continue-on-error: ${{ inputs.driver-status == 'info' }}
+      uses: trunk-io/analytics-uploader@1198efcc0976501147b10a7e343c3fa069527526 # v2.0.9
       env:
         TRUNK_REPO_URL: git@github.com:metabase/metabase.git
       with:
@@ -62,3 +78,105 @@ runs:
         token: ${{ inputs.trunk-api-token }}
         use-cache: true
         previous-step-outcome: ${{ inputs.previous-step-outcome }}
+
+    # For "info" drivers the job is forced green above, so surface the real outcome here —
+    # but only when it did NOT pass, to avoid spamming summaries/comments for healthy runs.
+    # Never include logs or stack traces — only the real status and a link to the run.
+    - name: Report info-level driver result (job summary)
+      if: ${{ always() && inputs.driver-status == 'info' && inputs.previous-step-outcome == 'failure' }}
+      shell: bash
+      env:
+        OUTCOME: ${{ inputs.previous-step-outcome }}
+        LABEL: ${{ inputs.output-name }}
+        VARIANT: ${{ inputs.report-variant }}
+      run: | # sh
+        if [ "$OUTCOME" = "success" ]; then EMOJI="✅"; else EMOJI="❌"; fi
+        TITLE="$LABEL"
+        [ -n "$VARIANT" ] && TITLE="$LABEL ($VARIANT)"
+        RUN_URL="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
+        {
+          echo "### ℹ️ Info-level driver: $TITLE"
+          echo ""
+          echo "Reported as passing (non-blocking). Real result: $EMOJI \`$OUTCOME\`"
+          echo ""
+          echo "[View run]($RUN_URL)"
+        } >> "$GITHUB_STEP_SUMMARY"
+
+    # Maintain ONE PR comment per commit for all info drivers. Each leg upserts its own line
+    # (keyed by a hidden tag); a passing leg removes its line, and the comment is deleted once
+    # no failing legs remain. Comments from older commits are cleaned up. Runs on pass and fail
+    # so recoveries self-heal. Never includes logs or stack traces — only status and a run link.
+    - name: Sync info-level driver result into the PR comment
+      if: ${{ always() && inputs.driver-status == 'info' && github.event_name == 'pull_request' }}
+      uses: actions/github-script@v9
+      continue-on-error: true
+      env:
+        OUTCOME: ${{ inputs.previous-step-outcome }}
+        LABEL: ${{ inputs.output-name }}
+        VARIANT: ${{ inputs.report-variant }}
+      with:
+        script: | # js
+          const { OUTCOME, LABEL, VARIANT, GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = process.env;
+          const pr = context.payload.pull_request;
+          if (!pr) return;
+          const { owner, repo } = context.repo;
+          const sha = pr.head.sha;
+          // PREFIX matches the current per-commit marker AND the older per-leg one, so legacy
+          // comments from a previous version get cleaned up on the next sync.
+          const PREFIX = "<!-- info-driver-result";
+          const marker = `<!-- info-driver-results:${sha} -->`;
+          const header = `${marker}\nℹ️ **Info-level drivers** failed (non-blocking) on \`${sha.slice(0, 7)}\` — these do not gate:`;
+          const lineKey = `${LABEL}:${VARIANT}`;
+          const title = VARIANT ? `${LABEL} (${VARIANT})` : LABEL;
+          const runUrl = `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+          // Only real failures are reported; cancelled/skipped/success remove this leg's line.
+          // List-item line with the hidden key tag at the END so markdown (links) renders.
+          const ourLine = OUTCOME === "failure"
+            ? `- **${title}** — ❌ \`${OUTCOME}\` ([Logs](${runUrl})) <!--l:${lineKey}-->`
+            : null;
+          const linesOf = (body) => body.split("\n").filter((l) => l.includes("<!--l:"));
+
+          const sync = async () => {
+            const { data: comments } = await github.rest.issues.listComments({
+              owner, repo, issue_number: pr.number, per_page: 100,
+            });
+            const tagged = comments.filter((c) => c.body.includes(PREFIX));
+            // Drop comments left over from older commits.
+            for (const c of tagged.filter((c) => !c.body.includes(marker))) {
+              await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
+            }
+            const mine = tagged
+              .filter((c) => c.body.includes(marker))
+              .sort((a, b) => new Date(a.created_at) - new Date(b.created_at));
+            // Merge any duplicates raced into existence; latest write of each line wins.
+            const byKey = new Map();
+            for (const c of mine) {
+              for (const l of linesOf(c.body)) {
+                const m = l.match(/<!--l:(.*?)-->/);
+                if (m) byKey.set(m[1], l);
+              }
+            }
+            if (ourLine) byKey.set(lineKey, ourLine);
+            else byKey.delete(lineKey);
+            const lines = [...byKey.values()].sort();
+            const target = mine[0];
+            for (const c of mine.slice(1)) {
+              await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
+            }
+            if (lines.length === 0) {
+              if (target) await github.rest.issues.deleteComment({ owner, repo, comment_id: target.id }).catch(() => {});
+              return;
+            }
+            const body = [header, "", ...lines].join("\n");
+            if (target) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: target.id, body });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number: pr.number, body });
+            }
+          };
+
+          // Retry to shrink the window where parallel legs clobber each other's update.
+          for (let i = 0; i < 4; i++) {
+            try { await sync(); break; }
+            catch (e) { if (i === 3) throw e; await new Promise((r) => setTimeout(r, 400 * (i + 1))); }
+          }

.github/file-paths.yaml

@@ -1,3 +1,8 @@
+# Catch-all filter — emits the full changed-files list as `all_changed_files`
+# so create-test-plan in run-tests.yml can reuse dorny's diff.
+all_changed:
+  - "**"
+
 default: &default
   - "locales/**"
   - "bin/**/!(*.md)"
@@ -77,6 +82,19 @@ frontend_loki_ci: &frontend_loki_ci
   - ".loki/**"
   - ".storybook/**"
 
+frontend_unit_infra: &frontend_unit_infra
+  - *frontend_configs
+  - *frontend_ci
+  - "jest.config.js"
+  - "jest.tz.unit.conf.json"
+  - "frontend/test/**"
+  - "frontend/**/__mocks__/**"
+
+frontend_loki_infra: &frontend_loki_infra
+  - *frontend_configs
+  - *shared_ci
+  - *frontend_loki_ci
+
 backend_ci: &backend_ci
   - *shared_ci
   - ".github/actions/test-driver/**"
@@ -177,6 +195,9 @@ documentation:
   - "docs/**"
   - "**/*.md"
 
+docs:
+  - "docs/**"
+
 embedding_documentation:
   - ".typedoc/**"
   - "docs/embedding/**"

.github/scripts/affected-modules.ts

@@ -0,0 +1,116 @@
+export type ModuleDef = { type: string; pattern: string };
+export type Rule = { from: string[]; allow: string[] };
+
+type ModuleNode = { type: string; regex: RegExp };
+
+export type ModuleGraph = {
+  nodes: ModuleNode[];
+  dependents: Map<string, Set<string>>;
+};
+
+/**
+ * Compiles a glob pattern to an anchored RegExp.
+ */
+export function globToRegex(glob: string): RegExp {
+  const escapeSegment = (seg: string) =>
+    seg.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+  const body = glob.split("**").map(escapeSegment).join(".*");
+  return new RegExp(`^${body}$`);
+}
+
+export function buildModuleGraph(
+  elements: ModuleDef[],
+  rules: Rule[],
+): ModuleGraph {
+  const nodes = elements.map((el) => ({
+    type: el.type,
+    regex: globToRegex(el.pattern),
+  }));
+
+  const allTypes = elements.map((e) => e.type);
+
+  function expandPattern(pattern: string): string[] {
+    if (pattern === "*") {
+      return [...allTypes];
+    }
+    if (pattern.endsWith("/*")) {
+      const prefix = pattern.slice(0, -1);
+      return allTypes.filter((type) => type.startsWith(prefix));
+    }
+    return allTypes.includes(pattern) ? [pattern] : [];
+  }
+
+  // dependents.get(M) is the set of modules that depend on M
+  // i.e. modules that are affected when M changes
+  const dependents = new Map<string, Set<string>>(
+    allTypes.map((type) => [type, new Set()]),
+  );
+  for (const rule of rules) {
+    const fromTypes = rule.from.flatMap(expandPattern);
+    const allowTypes = rule.allow.flatMap(expandPattern);
+    for (const target of allowTypes) {
+      for (const importer of fromTypes) {
+        if (importer !== target) {
+          dependents.get(target)?.add(importer);
+        }
+      }
+    }
+  }
+
+  return { nodes, dependents };
+}
+
+/**
+ * Returns the module type that owns the given file.
+ * First match wins, so element ordering matters for nested patterns.
+ */
+export function mapFileToModule(
+  moduleGraph: ModuleGraph,
+  path: string,
+): string | null {
+  for (const el of moduleGraph.nodes) {
+    if (el.regex.test(path)) {
+      return el.type;
+    }
+  }
+  return null;
+}
+
+/**
+ * Returns the set of module types containing any of the changed files.
+ */
+export function getChangedModules(
+  moduleGraph: ModuleGraph,
+  changedFiles: string[],
+): Set<string> {
+  const direct = new Set<string>();
+  for (const file of changedFiles) {
+    const module = mapFileToModule(moduleGraph, file);
+    if (module) {
+      direct.add(module);
+    }
+  }
+  return direct;
+}
+
+/**
+ * Returns the changed modules and all modules that directly or indirectly depend on them
+ */
+export function getAffectedModules(
+  moduleGraph: ModuleGraph,
+  changedFiles: string[],
+): Set<string> {
+  const direct = getChangedModules(moduleGraph, changedFiles);
+  const affected = new Set(direct);
+  const queue = [...direct];
+  while (queue.length > 0) {
+    const module = queue.shift()!;
+    for (const dep of moduleGraph.dependents.get(module) ?? []) {
+      if (!affected.has(dep)) {
+        affected.add(dep);
+        queue.push(dep);
+      }
+    }
+  }
+  return affected;
+}

.github/scripts/affected-modules.unit.spec.ts

@@ -0,0 +1,101 @@
+import {
+  buildModuleGraph,
+  getAffectedModules,
+  getChangedModules,
+  mapFileToModule,
+} from "./affected-modules";
+
+const ELEMENTS = [
+  { type: "lib/utils", pattern: "src/utils/**" },
+  { type: "lib/types", pattern: "src/types/**" },
+  // Nested-pattern pair (mirrors mlv1-inside-mlv2): inner must come first
+  // so first-match-wins picks it up before the outer pattern.
+  { type: "lib/inner", pattern: "src/shared/v1/**" },
+  { type: "lib/outer", pattern: "src/shared/**" },
+  { type: "feature/foo", pattern: "src/foo/**" },
+  { type: "feature/bar", pattern: "src/bar/**" },
+  { type: "feature/super", pattern: "src/super/**" },
+  // Different folder root (mirrors feature/enterprise's enterprise/ path).
+  { type: "feature/external", pattern: "external/lib/**" },
+  // Same type, two patterns (mirrors app/misc per-entry-point declarations).
+  { type: "app/main", pattern: "src/app.js" },
+  { type: "app/main", pattern: "src/embed.tsx" },
+  { type: "shared/other", pattern: "src/*/**" }, // catch-all, must be last
+];
+
+const RULES = [
+  ...ELEMENTS.map((el) => ({ from: [el.type], allow: [el.type] })),
+  { from: ["lib/*"], allow: ["lib/*"] },
+  { from: ["feature/*"], allow: ["lib/*"] },
+  { from: ["feature/super"], allow: ["feature/*"] },
+  { from: ["app/*"], allow: ["lib/*", "feature/*", "app/*"] },
+];
+
+const graph = buildModuleGraph(ELEMENTS, RULES);
+
+describe("affected modules", () => {
+  describe("mapFileToModule", () => {
+    it.each([
+      ["src/utils/colors.ts", "lib/utils"],
+      ["src/types/api.ts", "lib/types"],
+      ["src/foo/foo.tsx", "feature/foo"],
+      ["src/bar/bar.tsx", "feature/bar"],
+      ["src/super/index.ts", "feature/super"],
+      ["src/app.js", "app/main"],
+      ["src/randomthing/file.ts", "shared/other"],
+      ["src/shared/v1/expr.ts", "lib/inner"],
+      ["src/shared/v2/expr.ts", "lib/outer"],
+      ["src/shared/index.ts", "lib/outer"],
+      ["external/lib/foo.ts", "feature/external"],
+      ["src/embed.tsx", "app/main"],
+    ])("should map %s to %s", (path, expected) => {
+      expect(mapFileToModule(graph, path)).toBe(expected);
+    });
+
+    it("should return null for files outside any pattern", () => {
+      expect(mapFileToModule(graph, "docs/foo.md")).toBe(null);
+      expect(mapFileToModule(graph, "README.md")).toBe(null);
+      expect(mapFileToModule(graph, "external/notlib/foo.ts")).toBe(null);
+    });
+  });
+
+  describe("getChangedModules", () => {
+    it("should return the unique set of modules whose files changed", () => {
+      const result = getChangedModules(graph, [
+        "src/utils/colors.ts",
+        "src/foo/x.ts",
+        "src/foo/y.ts",
+        "docs/unrelated.md",
+      ]);
+      expect([...result].sort()).toEqual(["feature/foo", "lib/utils"]);
+    });
+
+    it("should return an empty set when no file maps to a module", () => {
+      expect(getChangedModules(graph, ["docs/foo.md"]).size).toBe(0);
+    });
+  });
+
+  describe("getAffectedModules", () => {
+    it("should affect feature/super and app/main but not feature/bar when feature/foo changes", () => {
+      const result = getAffectedModules(graph, ["src/foo/x.ts"]);
+      expect([...result].sort()).toEqual([
+        "app/main",
+        "feature/foo",
+        "feature/super",
+      ]);
+    });
+
+    it("should affect many modules when a lib module changes", () => {
+      const result = getAffectedModules(graph, ["src/utils/colors.ts"]);
+      expect(result.has("lib/utils")).toBe(true);
+      expect(result.has("feature/foo")).toBe(true);
+      expect(result.has("feature/bar")).toBe(true);
+      expect(result.has("feature/super")).toBe(true);
+      expect(result.has("app/main")).toBe(true);
+    });
+
+    it("should return empty when no file maps to a module", () => {
+      expect(getAffectedModules(graph, ["docs/foo.md"]).size).toBe(0);
+    });
+  });
+});

.github/scripts/affected-tests.ts

@@ -0,0 +1,140 @@
+// Per-suite affected-tests logic: combines module-affected closure with
+// per-suite "infra-touched" booleans (computed by dorny/paths-filter against
+// the `frontend_unit_infra` / `frontend_loki_infra` anchors in file-paths.yaml).
+// When infra files change, the whole suite runs in full.
+
+import {
+  type ModuleDef,
+  type ModuleGraph,
+  type Rule,
+  buildModuleGraph,
+  getAffectedModules,
+  getChangedModules,
+  mapFileToModule,
+} from "./affected-modules";
+
+export type TestSuiteDef = {
+  statsPrefix: string;
+  runAllTests?: boolean;
+};
+
+export type TestPlanStats = {
+  modules_changed: number;
+  modules_affected: number;
+  modules_affected_list: string[];
+  fe_unit_specs_total: number;
+  fe_unit_specs_run: number;
+  fe_unit_specs_skipped: number;
+  loki_stories_total: number;
+  loki_stories_run: number;
+  loki_stories_skipped: number;
+  e2e_specs_total: number;
+  e2e_specs_run: number;
+  e2e_specs_skipped: number;
+};
+
+export type TestPlan = {
+  stats: TestPlanStats;
+  fe_unit_specs_to_run: string[];
+  loki_stories_to_run: string[];
+  e2e_specs_to_run: string[];
+};
+
+export const TEST_SUITES = {
+  unit: {
+    statsPrefix: "fe_unit_specs",
+  },
+  loki: {
+    statsPrefix: "loki_stories",
+  },
+  e2e: {
+    statsPrefix: "e2e_specs",
+    // We don't map changed files to e2e tests yet, so for now just run them all
+    runAllTests: true,
+  },
+} satisfies Record<string, TestSuiteDef>;
+
+export function createTestPlan({
+  elements,
+  rules,
+  testSuites,
+  changedFiles,
+  testFilesBySuite,
+  infraTouchedBySuite,
+}: {
+  elements: ModuleDef[];
+  rules: Rule[];
+  testSuites: Record<string, TestSuiteDef>;
+  changedFiles: string[];
+  testFilesBySuite: Record<string, string[]>;
+  infraTouchedBySuite: Record<string, boolean>;
+}): TestPlan {
+  const moduleGraph = buildModuleGraph(elements, rules);
+
+  const changedModules = getChangedModules(moduleGraph, changedFiles);
+  const modulesAffected = getAffectedModules(moduleGraph, changedFiles);
+  const modulesAffectedList = [...modulesAffected].sort();
+
+  const specsToRun: Record<string, string[]> = {};
+  const stats: Record<string, number | string[]> = {
+    modules_changed: changedModules.size,
+    modules_affected: modulesAffected.size,
+    modules_affected_list: modulesAffectedList,
+  };
+
+  for (const [name, testSuite] of Object.entries(testSuites)) {
+    const files = testFilesBySuite[name] ?? [];
+    const tests = createTestPlanForSuite(
+      moduleGraph,
+      testSuite,
+      infraTouchedBySuite[name] ?? false,
+      changedFiles,
+      files,
+    );
+    specsToRun[name] = tests;
+    stats[`${testSuite.statsPrefix}_total`] = files.length;
+    stats[`${testSuite.statsPrefix}_run`] = tests.length;
+    stats[`${testSuite.statsPrefix}_skipped`] = files.length - tests.length;
+  }
+
+  return {
+    stats: stats as TestPlanStats,
+    fe_unit_specs_to_run: specsToRun.unit ?? [],
+    loki_stories_to_run: specsToRun.loki ?? [],
+    e2e_specs_to_run: specsToRun.e2e ?? [],
+  };
+}
+
+/**
+ * Computes the test plan for one test suite
+ *
+ * Runs the full suite when `runAllTests` is set or `infraTouched` is true,
+ * otherwise runs the tests based on affected-modules.
+ */
+export function createTestPlanForSuite(
+  moduleGraph: ModuleGraph,
+  testSuite: TestSuiteDef,
+  infraTouched: boolean,
+  changedFiles: string[],
+  allTestFiles: string[],
+): string[] {
+  if (testSuite.runAllTests || infraTouched) {
+    return allTestFiles;
+  }
+  const affected = getAffectedModules(moduleGraph, changedFiles);
+  return filterAffectedTests(moduleGraph, affected, allTestFiles);
+}
+
+/**
+ * Filters the test-file list down to tests whose owning module is affected.
+ */
+export function filterAffectedTests(
+  moduleGraph: ModuleGraph,
+  affected: Set<string>,
+  testFiles: string[],
+): string[] {
+  return testFiles.filter((file) => {
+    const module = mapFileToModule(moduleGraph, file);
+    return module !== null && affected.has(module);
+  });
+}

.github/scripts/affected-tests.unit.spec.ts

@@ -0,0 +1,190 @@
+import { buildModuleGraph } from "./affected-modules";
+import {
+  createTestPlan,
+  createTestPlanForSuite,
+  filterAffectedTests,
+} from "./affected-tests";
+
+const ELEMENTS = [
+  { type: "lib/utils", pattern: "src/utils/**" },
+  { type: "feature/foo", pattern: "src/foo/**" },
+  { type: "feature/bar", pattern: "src/bar/**" },
+  { type: "shared/other", pattern: "src/*/**" },
+];
+
+const RULES = [
+  ...ELEMENTS.map((el) => ({ from: [el.type], allow: [el.type] })),
+  { from: ["lib/*"], allow: ["lib/*"] },
+  { from: ["feature/*"], allow: ["lib/*"] },
+];
+
+const TEST_SUITE_DEFS = {
+  unit: { statsPrefix: "fe_unit_specs" },
+  loki: { statsPrefix: "loki_stories" },
+  e2e: { statsPrefix: "e2e_specs", runAllTests: true },
+};
+
+const UNIT_FILES = [
+  "src/foo/foo.unit.spec.ts",
+  "src/foo/bar.unit.spec.ts",
+  "src/bar/bar.unit.spec.ts",
+  "src/utils/utils.unit.spec.ts",
+];
+const LOKI_FILES = ["src/foo/Foo.stories.tsx", "src/bar/Bar.stories.tsx"];
+const E2E_FILES = ["e2e/test/scenarios/a.cy.spec.ts"];
+
+const moduleGraph = buildModuleGraph(ELEMENTS, RULES);
+
+describe("affected tests", () => {
+  describe("createTestPlanForSuite", () => {
+    it("should run all tests when infra is touched", () => {
+      const result = createTestPlanForSuite(
+        moduleGraph,
+        TEST_SUITE_DEFS.unit,
+        true, // infraTouched
+        ["src/foo/x.ts"],
+        UNIT_FILES,
+      );
+      expect(result).toEqual(UNIT_FILES);
+    });
+
+    it("should fall back to affected-tests filtering when infra not touched", () => {
+      const result = createTestPlanForSuite(
+        moduleGraph,
+        TEST_SUITE_DEFS.unit,
+        false, // infraTouched
+        ["src/foo/x.ts"],
+        UNIT_FILES,
+      );
+      expect(result.sort()).toEqual([
+        "src/foo/bar.unit.spec.ts",
+        "src/foo/foo.unit.spec.ts",
+      ]);
+    });
+
+    it("should return nothing when infra not touched and no file maps to a module", () => {
+      const result = createTestPlanForSuite(
+        moduleGraph,
+        TEST_SUITE_DEFS.unit,
+        false,
+        ["docs/foo.md"],
+        UNIT_FILES,
+      );
+      expect(result).toEqual([]);
+    });
+
+    it("should run all tests for runAllTests suites regardless of inputs", () => {
+      expect(
+        createTestPlanForSuite(
+          moduleGraph,
+          TEST_SUITE_DEFS.e2e,
+          false,
+          ["docs/foo.md"],
+          E2E_FILES,
+        ),
+      ).toEqual(E2E_FILES);
+      expect(
+        createTestPlanForSuite(
+          moduleGraph,
+          TEST_SUITE_DEFS.e2e,
+          false,
+          ["src/foo/x.ts"],
+          E2E_FILES,
+        ),
+      ).toEqual(E2E_FILES);
+    });
+  });
+
+  describe("createTestPlan", () => {
+    it("should return run lists and stats together", () => {
+      const result = createTestPlan({
+        elements: ELEMENTS,
+        rules: RULES,
+        testSuites: TEST_SUITE_DEFS,
+        changedFiles: ["src/foo/x.ts"],
+        testFilesBySuite: {
+          unit: UNIT_FILES,
+          loki: LOKI_FILES,
+          e2e: E2E_FILES,
+        },
+        infraTouchedBySuite: { unit: false, loki: false, e2e: false },
+      });
+
+      expect(result.fe_unit_specs_to_run.sort()).toEqual([
+        "src/foo/bar.unit.spec.ts",
+        "src/foo/foo.unit.spec.ts",
+      ]);
+      expect(result.loki_stories_to_run).toEqual(["src/foo/Foo.stories.tsx"]);
+      expect(result.e2e_specs_to_run).toEqual(E2E_FILES);
+
+      expect(result.stats).toEqual({
+        modules_changed: 1,
+        modules_affected: 1,
+        modules_affected_list: ["feature/foo"],
+        fe_unit_specs_total: 4,
+        fe_unit_specs_run: 2,
+        fe_unit_specs_skipped: 2,
+        loki_stories_total: 2,
+        loki_stories_run: 1,
+        loki_stories_skipped: 1,
+        e2e_specs_total: 1,
+        e2e_specs_run: 1,
+        e2e_specs_skipped: 0,
+      });
+    });
+
+    it("should run all unit specs when unit infra is touched", () => {
+      const result = createTestPlan({
+        elements: ELEMENTS,
+        rules: RULES,
+        testSuites: TEST_SUITE_DEFS,
+        changedFiles: ["docs/foo.md"],
+        testFilesBySuite: {
+          unit: UNIT_FILES,
+          loki: LOKI_FILES,
+          e2e: E2E_FILES,
+        },
+        infraTouchedBySuite: { unit: true, loki: false, e2e: false },
+      });
+      expect(result.stats.fe_unit_specs_run).toBe(UNIT_FILES.length);
+      expect(result.stats.fe_unit_specs_skipped).toBe(0);
+      // Only the unit suite was triggered.
+      expect(result.stats.loki_stories_run).toBe(0);
+    });
+
+    it("should not run anything when no infra is touched and no modules affected", () => {
+      const result = createTestPlan({
+        elements: ELEMENTS,
+        rules: RULES,
+        testSuites: TEST_SUITE_DEFS,
+        changedFiles: ["docs/foo.md"],
+        testFilesBySuite: {
+          unit: UNIT_FILES,
+          loki: LOKI_FILES,
+          e2e: E2E_FILES,
+        },
+        infraTouchedBySuite: { unit: false, loki: false, e2e: false },
+      });
+      expect(result.stats.fe_unit_specs_run).toBe(0);
+      expect(result.stats.loki_stories_run).toBe(0);
+      // e2e is runAllTests, so it still reports run = total.
+      expect(result.stats.e2e_specs_run).toBe(E2E_FILES.length);
+    });
+  });
+
+  describe("filterAffectedTests", () => {
+    it("should keep only tests inside affected modules", () => {
+      const affected = new Set(["feature/foo", "lib/utils"]);
+      const tests = [
+        "src/foo/foo.unit.spec.ts",
+        "src/utils/colors.unit.spec.ts",
+        "src/bar/bar.unit.spec.ts",
+        "docs/unrelated.unit.spec.ts",
+      ];
+      expect(filterAffectedTests(moduleGraph, affected, tests)).toEqual([
+        "src/foo/foo.unit.spec.ts",
+        "src/utils/colors.unit.spec.ts",
+      ]);
+    });
+  });
+});

.github/scripts/create-test-plan.ts

@@ -0,0 +1,67 @@
+// Changed files come from dorny/paths-filter's `all_changed_files` output
+
+import { execFileSync } from "node:child_process";
+
+import { elements, rules } from "../../frontend/lint/module-boundaries.mjs";
+
+import { TEST_SUITES, createTestPlan } from "./affected-tests";
+
+const UNIT_GLOBS = [
+  "frontend/src/**/*.unit.spec.js",
+  "frontend/src/**/*.unit.spec.jsx",
+  "frontend/src/**/*.unit.spec.ts",
+  "frontend/src/**/*.unit.spec.tsx",
+  "enterprise/frontend/src/**/*.unit.spec.js",
+  "enterprise/frontend/src/**/*.unit.spec.jsx",
+  "enterprise/frontend/src/**/*.unit.spec.ts",
+  "enterprise/frontend/src/**/*.unit.spec.tsx",
+];
+
+const STORY_GLOBS = [
+  "frontend/**/*.stories.js",
+  "frontend/**/*.stories.jsx",
+  "frontend/**/*.stories.ts",
+  "frontend/**/*.stories.tsx",
+  "enterprise/frontend/**/*.stories.js",
+  "enterprise/frontend/**/*.stories.jsx",
+  "enterprise/frontend/**/*.stories.ts",
+  "enterprise/frontend/**/*.stories.tsx",
+];
+
+const E2E_GLOBS = [
+  "e2e/test/scenarios/**/*.cy.spec.js",
+  "e2e/test/scenarios/**/*.cy.spec.jsx",
+  "e2e/test/scenarios/**/*.cy.spec.ts",
+  "e2e/test/scenarios/**/*.cy.spec.tsx",
+];
+
+function listFiles(globs: string[]): string[] {
+  return execFileSync("git", ["ls-files", "--", ...globs], { encoding: "utf8" })
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+}
+
+const changedFiles = (process.env.CHANGED_FILES ?? "")
+  .split(",")
+  .map((s) => s.trim())
+  .filter(Boolean);
+
+const testPlan = createTestPlan({
+  elements,
+  rules,
+  testSuites: TEST_SUITES,
+  changedFiles,
+  testFilesBySuite: {
+    unit: listFiles(UNIT_GLOBS),
+    loki: listFiles(STORY_GLOBS),
+    e2e: listFiles(E2E_GLOBS),
+  },
+  infraTouchedBySuite: {
+    unit: process.env.UNIT_INFRA_TOUCHED === "true",
+    loki: process.env.LOKI_INFRA_TOUCHED === "true",
+    e2e: false,
+  },
+});
+
+process.stdout.write(JSON.stringify(testPlan) + "\n");

.github/scripts/csv-to-mb.js

@@ -19,23 +19,23 @@ function jsonToCsvFormData(jsonData) {
   return formData;
 }
 
-function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append' }) {
+async function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append' }) {
   const formData = jsonToCsvFormData(jsonData);
   const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
 
-  return fetch(`${baseUrl}/api/table/${tableId}/${operation}`, {
+  const response = await fetch(`${baseUrl}/api/table/${tableId}/${operation}`, {
     method: 'POST',
     headers: {
       "x-api-key": process.env.API_KEY
     },
     body: formData
-  })
-  .then(response => {
-    if (!response.ok) {
-      throw new Error(`Upload failed`);
-    }
-    return { success: true };
   });
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => '');
+    throw new Error(`Upload failed: ${response.status} ${response.statusText} ${body}`.trim());
+  }
+  return { success: true };
 }
 
 module.exports = { uploadCsvToMb };

.github/scripts/measure-bundle-sizes.js

@@ -0,0 +1,207 @@
+/* eslint-disable import/no-commonjs */
+const fs = require("fs");
+const path = require("path");
+const zlib = require("zlib");
+
+// MEASURE_ROOT lets callers point at an extracted tree (e.g. the PR bundle-size
+// check measures a current and a base-ref tree); defaults to cwd for the stats
+// workflow. MEASURE_BUNDLES restricts which bundles are measured (comma-separated).
+const baseDir = process.env.MEASURE_ROOT ? path.resolve(process.env.MEASURE_ROOT) : process.cwd();
+const resolve = (...relativeParts) => path.resolve(baseDir, ...relativeParts);
+const bundleFilter = process.env.MEASURE_BUNDLES
+  ? new Set(process.env.MEASURE_BUNDLES.split(",").map(bundle => bundle.trim()))
+  : null;
+const isBundleWanted = bundle => !bundleFilter || bundleFilter.has(bundle);
+
+const SDK_ROOT = "resources/frontend_client/app/embedding-sdk";
+
+/**
+ * Async SDK chunks are unreachable today: the bootstrap manifest lists only the
+ * chunked entry's INITIAL chunks and output.publicPath is "", so import() chunks
+ * are emitted but never fetched. So they're excluded from "total" (which equals
+ * "initial"). There's no reliable way to detect loadability from the build
+ * artifacts, so this is a manual flag: flip it to true in the same change that
+ * lands the publicPath fix, and "total" will include the lazy chunks while
+ * "initial" stays the eager first-load set.
+ */
+const SDK_ASYNC_CHUNKS_LOADABLE = false;
+
+// The chunk runtime is inlined into the bootstrap, never sent as a standalone file.
+const SDK_RUNTIME_RE = /embedding-sdk-chunk-runtime\./;
+
+/**
+ * Simple targets measured straight from emitted files.
+ * - `dir`/`file`/`altFile`: what to measure (altFile is a fallback single file).
+ * - `stats`: entrypoint whose initial assets are the "initial" download.
+ * - `optional`: skip (don't fail) when the output is absent.
+ * The hosted SDK is split into embedding-sdk-legacy (the self-contained
+ * monolith) and embedding-sdk-chunked (handled separately below).
+ */
+const simpleTargets = [
+  {
+    bundle: "app",
+    dir: "resources/frontend_client/app/dist",
+    stats: { file: "artifacts/stats-main.json", entrypoint: "app-main" },
+  },
+  {
+    bundle: "embedding-sdk-legacy",
+    dir: `${SDK_ROOT}/legacy`,
+    altFile: `${SDK_ROOT}.js`,
+    optional: true,
+  },
+  {
+    bundle: "embedding-sdk-package",
+    dir: "resources/embedding-sdk/dist",
+    optional: true,
+  },
+  {
+    bundle: "embed-js",
+    file: "resources/frontend_client/app/embed.js",
+  },
+];
+
+function sizeOf(files) {
+  let rawBytes = 0;
+  let gzipBytes = 0;
+  let brotliBytes = 0;
+  let anyBrotli = false;
+  for (const file of files) {
+    const contents = fs.readFileSync(file);
+    rawBytes += contents.length;
+    // gzip: recompressed, a proxy for the on-the-fly gzip served on every version
+    gzipBytes += zlib.gzipSync(contents).length;
+    // brotli: as-served — count the precompressed .br the build ships; files
+    // without one (static-viz, sub-threshold chunks) are served compressed on
+    // the fly, so estimate with brotli. Null when no .br shipped at all.
+    const brotliPath = `${file}.br`;
+    if (fs.existsSync(brotliPath)) {
+      anyBrotli = true;
+      brotliBytes += fs.statSync(brotliPath).size;
+    } else {
+      brotliBytes += zlib.brotliCompressSync(contents).length;
+    }
+  }
+  return {
+    fileCount: files.length,
+    rawBytes,
+    gzipBytes,
+    brotliBytes: anyBrotli ? brotliBytes : null,
+  };
+}
+
+function collectJsFiles(absolutePath) {
+  if (fs.statSync(absolutePath).isFile()) {
+    return [absolutePath];
+  }
+  return fs
+    .readdirSync(absolutePath, { withFileTypes: true })
+    .flatMap(entry => {
+      const childPath = path.join(absolutePath, entry.name);
+      if (entry.isDirectory()) {
+        return collectJsFiles(childPath);
+      }
+      return entry.name.endsWith(".js") ? [childPath] : [];
+    });
+}
+
+function readStats(statsFile) {
+  const statsPath = resolve(statsFile);
+  return fs.existsSync(statsPath) ? JSON.parse(fs.readFileSync(statsPath, "utf8")) : null;
+}
+
+function entrypointJsAssets(stats, name) {
+  const entry = stats && stats.entrypoints && stats.entrypoints[name];
+  if (!entry) {
+    return null;
+  }
+  return entry.assets.map(asset => asset.name || asset).filter(name => name.endsWith(".js"));
+}
+
+function initialJsFiles({ file: statsFile, entrypoint, root }, joinRoot) {
+  const stats = readStats(statsFile);
+  if (!stats) {
+    console.warn(`Stats file missing (${statsFile}); reporting initial == total.`);
+    return null;
+  }
+  const assets = entrypointJsAssets(stats, entrypoint);
+  if (!assets) {
+    console.warn(`Entrypoint "${entrypoint}" missing in ${statsFile}; reporting initial == total.`);
+    return null;
+  }
+  const base = root ? resolve(root) : joinRoot;
+  return assets.map(name => path.join(base, name));
+}
+
+function measureSimpleTarget({ bundle, dir, file, altFile, stats, optional }) {
+  const candidates = [dir, file, altFile].filter(Boolean);
+  const chosen = candidates.find(c => fs.existsSync(resolve(c)));
+  if (!chosen) {
+    if (optional) {
+      console.warn(`Skipping "${bundle}": output not found (${candidates.join(", ")})`);
+      return [];
+    }
+    throw new Error(`Bundle output not found for "${bundle}": ${candidates.join(", ")}`);
+  }
+
+  const root = resolve(chosen);
+  const total = sizeOf(collectJsFiles(root));
+  const initialFiles = stats ? initialJsFiles(stats, root) : null;
+  const initial = initialFiles ? sizeOf(initialFiles) : total;
+
+  return [
+    { bundle, kind: "initial", ...initial },
+    { bundle, kind: "total", ...total },
+  ];
+}
+
+/**
+ * Chunked SDK delivery. "Reachable" = what the bootstrap actually sends: the
+ * bootstrap (with its inlined runtime) + the chunked entry's initial chunks,
+ * minus the standalone runtime file. Async chunks are excluded (initial == total)
+ * unless SDK_ASYNC_CHUNKS_LOADABLE is set, at which point "total" includes them.
+ */
+function measureChunkedSdk(statsFile) {
+  const chunksDir = resolve(SDK_ROOT, "chunks");
+  if (!fs.existsSync(chunksDir)) {
+    // pre-chunked layout (monolith only) — nothing to measure here
+    return [];
+  }
+
+  const absRoot = resolve(SDK_ROOT);
+  const everything = collectJsFiles(chunksDir).filter(f => !SDK_RUNTIME_RE.test(f));
+
+  const stats = readStats(statsFile);
+  const chunked = entrypointJsAssets(stats, "embedding-sdk-chunked");
+  let reachableFiles;
+  if (chunked) {
+    const bootstrap = entrypointJsAssets(stats, "embedding-sdk-bootstrap") || [];
+    const names = [...new Set([...bootstrap, ...chunked])].filter(n => !SDK_RUNTIME_RE.test(n));
+    reachableFiles = names.map(n => path.join(absRoot, n));
+  } else {
+    console.warn(`embedding-sdk-chunked: entrypoint missing in ${statsFile}; counting whole chunks/ dir`);
+    reachableFiles = everything;
+  }
+
+  const initial = sizeOf(reachableFiles);
+  const total = SDK_ASYNC_CHUNKS_LOADABLE ? sizeOf(everything) : sizeOf(reachableFiles);
+
+  return [
+    { bundle: "embedding-sdk-chunked", kind: "initial", ...initial },
+    { bundle: "embedding-sdk-chunked", kind: "total", ...total },
+  ];
+}
+
+function measureBundleSizes() {
+  return [
+    ...simpleTargets.filter(target => isBundleWanted(target.bundle)).flatMap(measureSimpleTarget),
+    ...(isBundleWanted("embedding-sdk-chunked")
+      ? measureChunkedSdk("artifacts/stats-embedding-sdk.json")
+      : []),
+  ];
+}
+
+module.exports = { measureBundleSizes };
+
+if (require.main === module) {
+  console.log(JSON.stringify(measureBundleSizes(), null, 2));
+}

.github/scripts/upload-affected-tests-stats.js

@@ -0,0 +1,41 @@
+// This script is used in .github/workflows/run-tests.yml.
+// It uploads the test-plan stats row produced by create-test-plan.js to
+// the stats.metabase.com tracking table.
+// Reads STATS_JSON, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
+
+const { uploadCsvToMb } = require("./csv-to-mb.js");
+
+const stats = JSON.parse(process.env.STATS_JSON);
+console.log("stats", stats);
+
+const row = {
+  Date: new Date().toISOString(),
+  PR: Number(process.env.PR_NUMBER),
+  "Head SHA": process.env.HEAD_SHA,
+  "Base SHA": process.env.BASE_SHA,
+  "Modules changed": stats.modules_changed,
+  "Modules affected": stats.modules_affected,
+  "FE Unit specs total": stats.fe_unit_specs_total,
+  "FE Unit specs run": stats.fe_unit_specs_run,
+  "FE Unit specs skipped": stats.fe_unit_specs_skipped,
+  "Loki stories total": stats.loki_stories_total,
+  "Loki stories run": stats.loki_stories_run,
+  "Loki stories skipped": stats.loki_stories_skipped,
+  "E2E specs total": stats.e2e_specs_total,
+  "E2E specs run": stats.e2e_specs_run,
+  "E2E specs skipped": stats.e2e_specs_skipped,
+};
+
+uploadCsvToMb({
+  baseUrl: "https://stats.metabase.com",
+  tableId: 77008, // "Affected Tests Stats" table on stats.metabase.com
+  jsonData: [row],
+  mode: "append",
+})
+  .then(() => {
+    console.log("Data uploaded successfully");
+  })
+  .catch((error) => {
+    console.error("Error uploading data:", error);
+    process.exit(1);
+  });

.github/team.json

@@ -120,7 +120,8 @@
         "iethree",
         "bpander",
         "gantoreno",
-        "losrebellos"
+        "losrebellos",
+        "tmashara"
       ]
     }
   ]

.github/workflows/app-db.yml

@@ -103,7 +103,7 @@ jobs:
     # "be-tests-mariadb-10-6-ee (0)"
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Test ${{ matrix.version.name }}
         id: test-driver
         uses: ./.github/actions/test-driver
@@ -226,7 +226,7 @@ jobs:
     # "be-tests-mariadb-10-6-ee (0)"
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Test ${{ matrix.version.name }}
         id: test-driver
         uses: ./.github/actions/test-driver
@@ -336,7 +336,7 @@ jobs:
           POSTGRES_DB: mb_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
         id: test-driver
         uses: ./.github/actions/test-driver
@@ -369,7 +369,7 @@ jobs:
     if: always() && !cancelled()
     steps:
       - name: Check job status
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           needs: ${{ toJson(needs) }}
         with:

.github/workflows/athena.yml

@@ -24,15 +24,15 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Babashka
-        uses: turtlequeue/setup-babashka@2d4df498c7a578b4f3e906283f9af913590bdec7 # v1.7.0
+        uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
         with:
           babashka-version: 1.12.197
 
       - name: Set up AWS CLI
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ secrets.CI_MAVEN_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}

.github/workflows/auto-assign.yml

@@ -16,11 +16,11 @@ jobs:
           app_id: ${{ secrets.METABASE_BOT_APP_ID }}
           private_key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Assign author and their team. Returns true if team exists.
         id: auto-assign
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: | #js

.github/workflows/auto-backport.yml

@@ -5,24 +5,101 @@ on:
     types: [closed, labeled]
 
 jobs:
-  create-backport:
+  # --- Primary path: backport to every supported release line --------------
+  # Triggered by the plain `backport` label. `contains(array, 'backport')` is an
+  # exact element match, so this never fires for `double-backport`/`triple-backport`
+  # — those are handled by the legacy escape hatch at the end of this file.
+  prepare:
     if:
-      | # the PR must have a backport label when it's merged, or be labeled with a backport label after merge
+      | # the PR must carry the `backport` label at merge, or be labeled `backport` after merge
+      github.event.pull_request.merged == true && (
+        github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'backport') ||
+        github.event.action == 'labeled' && github.event.label.name == 'backport'
+      )
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    outputs:
+      commit: ${{ steps.find_commit.outputs.commit }}
+      targets: ${{ steps.targets.outputs.result }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+      - uses: ./.github/actions/find-squashed-commit
+        name: Find commit
+        id: find_commit
+        with:
+          pull-request-number: ${{ github.event.pull_request.number }}
+          base-ref: ${{ github.event.pull_request.base.ref }}
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Compute supported backport targets
+        id: targets
+        uses: actions/github-script@v9
+        env:
+          AWS_S3_STATIC_BUCKET: ${{ vars.AWS_S3_STATIC_BUCKET }}
+          AWS_REGION: ${{ vars.AWS_REGION }}
+        with:
+          script: | # js
+            // Backport targets are the supported major lines from version-info.json:
+            // a line is in support — and a backport target — if and only if its EoL is
+            // today or later. `getSupportedMajors` encapsulates that rule (and ignores
+            // the display-only `lts` flag); it is shared with the auto-minor scheduler.
+            const { getSupportedMajors } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const targets = await getSupportedMajors();
+            console.log('supported backport targets', targets);
+
+            return targets;
+
+  backport:
+    needs: prepare
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    strategy:
+      fail-fast: false # one conflicting branch must not block the others
+      matrix:
+        target: ${{ fromJson(needs.prepare.outputs.targets) }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - name: Backport to v${{ matrix.target }}
+        uses: ./.github/actions/create-backport
+        with:
+          target-version: ${{ matrix.target }}
+          backport-commit: ${{ needs.prepare.outputs.commit }}
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          github-token-2: ${{ secrets.GITHUB_TOKEN }}
+
+  # --- Legacy escape hatch: explicit depth backports -----------------------
+  # `single-backport`/`double-backport`/`triple-backport` keep their original behavior —
+  # backport to CURRENT_VERSION and the 0–2 lines below it — independent of
+  # `major_version_support`. `single-backport` is a fallback for when the primary path
+  # can't be used and only CURRENT_VERSION is wanted. Kept for the short term for one-off
+  # manual depth control. If a branch from the primary path above already exists,
+  # create-backport simply errors on the duplicate.
+  legacy-backport:
+    if:
+      | # triggered only by the legacy depth labels, at merge or when added afterwards
       github.event.pull_request.merged == true && (
         github.event.action == 'closed' && (
-          contains(github.event.pull_request.labels.*.name, 'backport') ||
+          contains(github.event.pull_request.labels.*.name, 'single-backport') ||
           contains(github.event.pull_request.labels.*.name, 'double-backport') ||
           contains(github.event.pull_request.labels.*.name, 'triple-backport')
         ) ||
         github.event.action == 'labeled' && (
-          github.event.label.name == 'backport' ||
+          github.event.label.name == 'single-backport' ||
           github.event.label.name == 'double-backport' ||
           github.event.label.name == 'triple-backport'
         )
       )
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
@@ -35,7 +112,7 @@ jobs:
 
       - name: how many backports?
         id: how-many-backports
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: | # js
             const labels = [
@@ -58,7 +135,7 @@ jobs:
 
       - name: get release versions
         id: get-latest-release-version
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: | # js
             const currentVersion = Number(${{ vars.CURRENT_VERSION }});

.github/workflows/backend-cloverage.yml

@@ -21,7 +21,7 @@ jobs:
     outputs:
       modules: ${{ steps.get-modules.outputs.modules }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - id: get-modules
         run: |
           modules=$(ls -1d src/metabase/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
@@ -38,7 +38,7 @@ jobs:
       matrix:
         modules: ${{ fromJson(needs.setup-oss.outputs.modules) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
@@ -57,7 +57,7 @@ jobs:
 
       - name: Upload coverage to codecov.io
         if: always()
-        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./target/coverage/codecov.json
@@ -68,7 +68,7 @@ jobs:
     outputs:
       modules: ${{ steps.get-modules.outputs.modules }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - id: get-modules
         run: |
           modules=$(ls -1d enterprise/backend/src/metabase_enterprise/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
@@ -85,7 +85,7 @@ jobs:
       matrix:
         modules: ${{ fromJson(needs.setup-ee.outputs.modules) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
@@ -104,7 +104,7 @@ jobs:
 
       - name: Upload coverage to codecov.io
         if: always()
-        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./target/coverage/codecov.json

.github/workflows/backend.yml

@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 10
     name: Clj-Kondo
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run clj-kondo
@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 20
     name: Eastwood
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
@@ -40,10 +40,10 @@ jobs:
     # Master / release safety net: lint every backend test namespace.
     if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-')) }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 30
+    timeout-minutes: 45
     name: Eastwood (tests only)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood/test
@@ -56,7 +56,7 @@ jobs:
     timeout-minutes: 15
     name: Eastwood (changed tests only)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           # Enough history for `git merge-base` on a typical PR.
           fetch-depth: 200
@@ -167,7 +167,7 @@ jobs:
           ':mb/old-migrations-test'
         }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
@@ -203,7 +203,7 @@ jobs:
           previous-step-outcome: ${{ steps.run-java-tests.outcome }}
 
       - name: Publish Test Report (JUnit)
-        uses: dorny/test-reporter@3eeb9fc888e82e8be2fb356bbeec2750231672bc # v1
+        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
         if: failure()
         with:
           path: "target/junit/**/*_test.xml"
@@ -215,7 +215,7 @@ jobs:
 
       - name: Upload Logs on Failure
         if: always() && !success()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-logs-${{ matrix.java-version }}-${{ matrix.job.edition }}-${{ github.job }}-${{ matrix.job.test-group-name }}
           path: logs/test-log.json
@@ -232,7 +232,7 @@ jobs:
         java-version: [21]
     name: "Check Java ${{ matrix.java-version }}"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare backend
         uses: ./.github/actions/prepare-backend
       # TODO -- we should probably also check WITHOUT ee -- do a check with only OSS namespaces on the classpath
@@ -245,7 +245,7 @@ jobs:
     timeout-minutes: 10
     name: Cljfmt
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run cljfmt
@@ -267,7 +267,7 @@ jobs:
       needs: ${{ toJson(needs) }}
     steps:
       - name: Check backend job status
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           needs: ${{ toJson(needs) }}
         with:

.github/workflows/backport-reminder.yml

@@ -2,19 +2,173 @@ name: Backport Reminder
 
 on:
   pull_request:
-    types: [auto_merge_enabled, review_requested, labeled, unlabeled, synchronize]
+    types: [opened, edited, auto_merge_enabled, review_requested, labeled, unlabeled, synchronize]
     branches:
       - "master"
-  merge_group:
+
+concurrency:
+  group: "backport-reminder-${{ github.event.pull_request.number }}"
+  cancel-in-progress: true
 
 jobs:
+  flags:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    outputs:
+      has_backport_label: ${{ steps.c.outputs.value }}
+    steps:
+      - id: c
+        run: |
+          echo "value=${{
+            contains(github.event.pull_request.labels.*.name, 'no-backport') ||
+            contains(github.event.pull_request.labels.*.name, 'backport') ||
+            contains(github.event.pull_request.labels.*.name, 'single-backport') ||
+            contains(github.event.pull_request.labels.*.name, 'double-backport') ||
+            contains(github.event.pull_request.labels.*.name, 'triple-backport') }}" >> "$GITHUB_OUTPUT"
+
+  files-changed:
+    name: Check which files changed
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 3
+    outputs:
+      docs: ${{ steps.changes.outputs.docs }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Test which files changed
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
   backport-reminder:
+    needs: [ files-changed, flags ]
+    if: ${{ !cancelled() }}
     name: Decide whether to backport or not
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
+    permissions: {}
     steps:
-      - uses: jesusvasquez333/verify-pr-label-action@657d111bbbe13e22bbd55870f1813c699bde1401 # v1.4.0
+      - name: Fail if backport decision label is missing
+        if: >
+          github.event_name == 'pull_request' &&
+          needs.files-changed.outputs.docs == 'true' &&
+          needs.flags.outputs.has_backport_label == 'false'
+        run: |
+          echo "::error::PR has docs changes and is missing a backport decision label. Add one of: no-backport, backport, single-backport, double-backport, or triple-backport"
+          exit 1
+
+  priority-backport-reminder:
+    name: Remind about backporting P0 + P1 fixes
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    needs: [flags]
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Add, update, or remove the high-priority backport reminder
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: actions/github-script@v9
+        env:
+          HAS_BACKPORT_LABEL: ${{ needs.flags.outputs.has_backport_label }}
         with:
-          github-token: '${{ secrets.GITHUB_TOKEN }}'
-          valid-labels: 'no-backport, backport, double-backport, triple-backport'
-          disable-reviews: true
+          script: | # js
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+
+            // A backport decision has already been made if a decision label is present.
+            const alreadyDecided = process.env.HAS_BACKPORT_LABEL === "true";
+
+            // Issues linked to this PR via closing keywords (fixes/closes/resolves #N),
+            // together with their labels.
+            const query = `
+              query($owner: String!, $repo: String!, $pr: Int!) {
+                repository(owner: $owner, name: $repo) {
+                  pullRequest(number: $pr) {
+                    closingIssuesReferences(first: 50) {
+                      nodes {
+                        number
+                        title
+                        url
+                        labels(first: 50) { nodes { name } }
+                      }
+                    }
+                  }
+                }
+              }`;
+
+            const data = await github.graphql(query, { owner, repo, pr: prNumber });
+            const linkedIssues =
+              data.repository.pullRequest.closingIssuesReferences.nodes ?? [];
+
+            const PRIORITY_LABELS = ["Priority:P0", "Priority:P1"];
+            const priorityIssues = linkedIssues.filter((issue) =>
+              issue.labels.nodes.some((l) => PRIORITY_LABELS.includes(l.name)),
+            );
+
+            // Hidden marker so we can find/update/remove our own comment idempotently.
+            const MARKER = "<!-- backport-priority-reminder -->";
+            const comments = await github.paginate(
+              github.rest.issues.listComments,
+              { owner, repo, issue_number: prNumber, per_page: 100 },
+            );
+            const existing = comments.find(
+              (c) => c.body && c.body.includes(MARKER),
+            );
+
+            // Remind only while a high-priority issue is closed AND no decision
+            // has been made yet. Once either stops being true the comment is no
+            // longer needed, so we remove any stale one below.
+            const shouldComment = priorityIssues.length > 0 && !alreadyDecided;
+
+            if (!shouldComment) {
+              if (existing) {
+                await github.rest.issues.deleteComment({
+                  owner,
+                  repo,
+                  comment_id: existing.id,
+                });
+                console.log("Removed stale backport-priority reminder.");
+              } else {
+                console.log(
+                  "Reminder not needed (no high-priority linked issues, or a backport decision label is already applied).",
+                );
+              }
+              return;
+            }
+
+            const list = priorityIssues
+              .map((i) => {
+                const tags = i.labels.nodes
+                  .map((l) => l.name)
+                  .filter((n) => PRIORITY_LABELS.includes(n))
+                  .join(", ");
+                return `- #${i.number} ${i.title} (${tags})`;
+              })
+              .join("\n");
+
+            const body = [
+              MARKER,
+              "⚠️ This PR closes one or more high-priority issues:",
+              "",
+              list,
+              "",
+              "Please apply the `backport` label unless you have a very good reason not to.",
+            ].join("\n");
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner,
+                repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: prNumber,
+                body,
+              });
+            }

.github/workflows/build-for-release.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             release
@@ -31,7 +31,7 @@ jobs:
       - name: Prepare release scripts
         uses: ./.github/actions/prepare-release-scripts
       - name: Send build start message
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
@@ -77,7 +77,7 @@ jobs:
         echo "It must start with either 'v0.' or 'v1.'."
         echo "Please, try again."
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         sparse-checkout: |
           release
@@ -85,7 +85,7 @@ jobs:
     - name: Prepare release scripts
       uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Version
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       id: canonical_version
       with:
         script: | # js
@@ -120,7 +120,7 @@ jobs:
     timeout-minutes: 10
     steps:
     - name: Check out the code to verify the release branch
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         fetch-depth: 0  # IMPORTANT! to get all the branches
         sparse-checkout: |
@@ -129,7 +129,7 @@ jobs:
     - name: Prepare release scripts
       uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Branch
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       id: release_branch
       with:
         result-encoding: string
@@ -155,7 +155,7 @@ jobs:
       node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
       build_process: ${{ fromJson(steps.dependencies.outputs.result).build_process }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         sparse-checkout: |
           release
@@ -163,7 +163,7 @@ jobs:
     - name: Prepare release scripts
       uses: ./.github/actions/prepare-release-scripts
     - name: Get build dependencies
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       id: dependencies
       with:
         script: | # js
@@ -218,16 +218,16 @@ jobs:
 
         echo "VERSION=$version" >> $GITHUB_ENV
     - name: Setup Java ${{ needs.get-build-requirements.outputs.java_version }}
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v5.2.0
       with:
         distribution: 'temurin'
         java-version: ${{ needs.get-build-requirements.outputs.java_version }}
     - name: Setup Node.js ${{ needs.get-build-requirements.outputs.node_version }}
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6.4.0
       with:
         node-version: ${{ needs.get-build-requirements.outputs.node_version }}.x
     - name: Check out the code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ github.event.inputs.commit }}
     - name: Prepare front-end environment
@@ -252,7 +252,7 @@ jobs:
       run: sha256sum ./metabase.jar > SHA256.sum
       shell: bash
     - name: Upload JARs as artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
         path: |

.github/workflows/build-scripts.yml

@@ -12,7 +12,7 @@ jobs:
   test-build-scripts:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Prepare back-end environment
       timeout-minutes: 5
       uses: ./.github/actions/prepare-backend

.github/workflows/bundle-size-stats.yml

@@ -0,0 +1,131 @@
+name: Bundle Size Stats
+
+# Reuses the uberjar built on every master merge: downloads the jar (for the
+# emitted JS) plus the bundle-stats and embedding-sdk artifacts, measures
+# initial/total bundle sizes, and appends them to stats.metabase.com.
+
+on:
+  workflow_run:
+    workflows: ["Build Uberjar"]
+    types: [completed]
+    branches: [master]
+
+concurrency:
+  group: bundle-size-stats-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  bundle-size-stats:
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 15
+    env:
+      HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+    steps:
+      - name: Check out the code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+      - name: Download EE uberjar
+        uses: ./.github/actions/fetch-artifact
+        with:
+          commit: ${{ github.event.workflow_run.head_sha }}
+          edition: ee
+          extract-path: temp/uberjar
+      - name: Extract front-end bundles from uberjar
+        run: |
+          mkdir -p resources artifacts
+          unzip -o "temp/uberjar/metabase.jar" \
+            "frontend_client/app/dist/*" \
+            "frontend_client/app/embed.js" \
+            "frontend_client/app/embedding-sdk/*" \
+            -d resources
+          unzip -o -j "temp/uberjar/metabase.jar" version.properties -d artifacts
+      - name: Download bundle stats and SDK package artifacts
+        uses: actions/github-script@v9
+        with:
+          script: | # js
+            const fs = require("fs");
+
+            async function fetchArtifact(name) {
+              const res = await github.rest.actions.listArtifactsForRepo({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name,
+                per_page: 1,
+              });
+              const artifact = res.data?.artifacts?.[0];
+              if (!artifact) {
+                console.log(`Artifact not found: ${name}`);
+                return "";
+              }
+              const download = await github.rest.actions.downloadArtifact({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                artifact_id: artifact.id,
+                archive_format: "zip",
+              });
+              fs.writeFileSync(`${name}.zip`, Buffer.from(download.data));
+              console.log(`Downloaded ${name}`);
+              return `${name}.zip`;
+            }
+
+            const sha = process.env.HEAD_SHA;
+            core.exportVariable("STATS_ZIP", await fetchArtifact(`metabase-bundle-stats-ee-${sha}`));
+            core.exportVariable("PKG_ZIP", await fetchArtifact(`embedding-sdk-${sha}`));
+      - name: Extract stats and SDK package
+        run: |
+          mkdir -p artifacts resources/embedding-sdk
+          if [ -n "$STATS_ZIP" ]; then unzip -o "$STATS_ZIP" -d artifacts; fi
+          if [ -n "$PKG_ZIP" ]; then unzip -o "$PKG_ZIP" -d resources/embedding-sdk; fi
+      - name: Measure bundle sizes
+        run: node ./.github/scripts/measure-bundle-sizes.js | tee artifacts/bundle-sizes.json
+      - name: Upload sizes to Stats
+        uses: actions/github-script@v9
+        env:
+          API_KEY: ${{ secrets.STATS_API_KEY }}
+        with:
+          script: | # js
+            const fs = require("fs");
+            const { uploadCsvToMb } = require("${{ github.workspace }}/.github/scripts/csv-to-mb.js");
+
+            const measurements = JSON.parse(
+              fs.readFileSync("${{ github.workspace }}/artifacts/bundle-sizes.json", "utf8"),
+            );
+
+            const date = new Date().toISOString().slice(0, 10); // YYYY-MM-DD
+            const commit = process.env.HEAD_SHA.slice(0, 12);
+
+            // version.properties (extracted from the uberjar) carries the build's tag.
+            // Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
+            const versionProps = "${{ github.workspace }}/artifacts/version.properties";
+            const rawVersion = fs.existsSync(versionProps)
+              ? (fs.readFileSync(versionProps, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
+              : "";
+            const version = rawVersion === "vUNKNOWN" ? "" : rawVersion;
+
+            const data = measurements.map(measurement => ({
+              "Date": date,
+              "Version": version,
+              "Commit": commit,
+              "Bundle": measurement.bundle,
+              "Kind": measurement.kind, // "initial" or "total"
+              "Raw bytes": measurement.rawBytes,
+              "Gzip bytes": measurement.gzipBytes,
+              "Brotli bytes": measurement.brotliBytes ?? "", // as-served; empty when no .br shipped
+              "File count": measurement.fileCount,
+            }));
+
+            console.table(data);
+
+            uploadCsvToMb({
+              baseUrl: "https://stats.metabase.com",
+              tableId: 79417,
+              jsonData: data,
+              mode: "append",
+            }).then(() => {
+              console.log("Bundle sizes uploaded successfully");
+            }).catch(error => {
+              console.error("Error uploading bundle sizes:", error);
+              process.exit(1);
+            });

.github/workflows/cache-generator.yml

@@ -2,7 +2,7 @@
 # It sets the fresh cache each Monday but provides a manual trigger to update it on-demand.
 #
 # All other jobs only restore from this cache; *they never update it*!
-# They should always use `actions/cache/restore@v4` because `actions/cache@v4` would attempt to save the cache.
+# They should always use `actions/cache/restore@vX` because `actions/cache@vX` would attempt to save the cache.
 #
 # Our agreed-upon strategy is to use a deterministic cache key based on the week of the year.
 # Jobs can utilize the prior week's cache if the current week's cache is not found.
@@ -42,7 +42,7 @@ jobs:
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Get cache keys
         uses: ./.github/actions/get-cache-keys
         id: get-cache-keys
@@ -62,16 +62,53 @@ jobs:
       CYPRESS_CACHE_KEY: ${{ needs.get-cache-keys.outputs.cypress-cache-key }}
       ESLINT_CACHE_KEY: ${{ needs.get-cache-keys.outputs.eslint-cache-key }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       # Backend preparation and cache
       - name: Prepare backend
         uses: ./.github/actions/prepare-backend
 
-      # Add or remove aliases to affect the cache size and its contents.
-      # Adjust to taste, then redeploy this workflow.
+      # Pre-resolve every Clojure dependency classpath CI actually uses, so the
+      # saved cache is a SUPERSET of what each job resolves at runtime.
+      #
+      # Why a single `-P` is not enough: tools.deps selects dependency *versions*
+      # globally per classpath, so different alias combinations can resolve the
+      # same transitive lib to different versions (e.g. `org.clojure/data.json`
+      # 2.4.0 vs 2.5.x, `org.ow2.asm/asm` 9.2 vs newer). Resolving only one combo
+      # leaves the others to fetch their version-deltas straight from Maven
+      # Central / Clojars on every run -> intermittent 403s. See DEV-2094.
+      #
+      # Keep this list in sync with the `clojure` invocations across .github/.
+      # Each entry notes its consumer. We resolve the FULL alias strings (not a
+      # hand-reduced set) on purpose: if a currently dep-less alias later gains a
+      # dependency, this still covers it instead of silently drifting back into a
+      # cache gap.
       - name: Pre-resolve Clojure dependencies
-        run: clojure -A:build:dev:ee:ee-dev:drivers:drivers-dev:cljs -P
+        shell: bash
+        run: |
+          set -euo pipefail
+          combos=(
+            ":build:dev:ee:ee-dev:drivers:drivers-dev:cljs"     # build + uberjar (combined classpath)
+            ":cljs"                                             # shadow-cljs (build:cljs); resolves :cljs alone -> covers asm:9.2
+            ":dev:ee:ee-dev:drivers:drivers-dev:test:eastwood"  # backend.yml (eastwood + eastwood/test)
+            ":dev:ci:ee:ee-dev:drivers:drivers-dev:test"        # test-driver.yml (ee) -> covers data.json:2.4.0
+            ":dev:ci:oss:oss-dev:drivers:drivers-dev:test"      # test-driver.yml (oss)
+            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee) + generative-query-test.yml
+            ":dev:ci:test:oss:oss-dev"                          # backend.yml matrix (oss)
+            ":dev:ci:ee:ee-dev:test:cloverage"                  # backend-cloverage.yml
+            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml + presto script
+            ":dev:drivers:build:build-dev:build-test:ci"        # build-scripts.yml
+            ":ee:drivers:check"                                 # backend.yml (check; git dep athos/clj-check)
+            ":ee:doc"                                           # docs-generate-base.yml
+            ":kondo"                                            # resolve-backport-conflicts.yml (replace-deps)
+            ":run:ee"                                           # cross-branch-migration-test
+            ":dev:ee:migrate"                                   # cross-branch-migration-test
+          )
+          for combo in "${combos[@]}"; do
+            echo "::group::clojure -P -A${combo}"
+            clojure -P -A"${combo}"
+            echo "::endgroup::"
+          done
 
       - name: Update M2 cache
         uses: ./.github/actions/update-cache

.github/workflows/check-backport-script.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Check for backport.sh file
         run: |
           if [ -f "./backport.sh" ]; then

.github/workflows/chromatic.yml

@@ -19,9 +19,9 @@ jobs:
     outputs:
       frontend_all: ${{ steps.changes.outputs.frontend_all }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Test which files changed
-        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           token: ${{ github.token }}
@@ -33,7 +33,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Prepare front-end environment
@@ -43,7 +43,7 @@ jobs:
       - name: Compile CLJS
         run: NODE_ENV=development bun run build-pure:cljs
       - name: Publish to Chromatic
-        uses: chromaui/action@c03d144dc72e609acbb960489fdd1e1a4a23b34f # v10.2.0
+        uses: chromaui/action@0b8c883861c1663076150cf1f4592b19d1ff6a54 # v17.0.1
         env:
           PUBLISH_CHROMATIC: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
           STORYBOOK_BUILD_TIMEOUT: 900000

.github/workflows/cljs.yml

@@ -19,9 +19,9 @@ jobs:
     outputs:
       cljs: ${{ steps.changes.outputs.cljs }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Test which files changed
-        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           token: ${{ github.token }}
@@ -33,7 +33,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Prepare front-end environment
       uses: ./.github/actions/prepare-frontend
     - name: Prepare back-end environment

.github/workflows/codeql.yml

@@ -15,9 +15,9 @@ jobs:
     outputs:
       codeql: ${{ steps.changes.outputs.codeql }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Test which files changed
-        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           token: ${{ github.token }}
@@ -28,7 +28,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4
       with:

.github/workflows/codespell.yml

@@ -15,7 +15,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install codespell
         run: pip install codespell
@@ -68,7 +68,7 @@ jobs:
 
       - name: Fix spelling errors with Claude Code
         if: steps.codespell_check.outcome == 'failure'
-        uses: anthropics/claude-code-action@3ac52d0da9f8ec9ca7b4dc23bb477e36ef9c77a9 # v1
+        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ steps.claude-app-token.outputs.token }}
@@ -83,7 +83,7 @@ jobs:
 
       - name: Create Pull Request
         if: steps.codespell_check.outcome == 'failure'
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: claude-fix/codespell-${{ steps.date.outputs.date }}

.github/workflows/containerize-jar.yml

@@ -53,7 +53,7 @@ jobs:
     outputs:
       platforms: ${{ steps.platforms.outputs.result }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 1
       # we want the dockerfile from the commit we're building
@@ -70,7 +70,7 @@ jobs:
       uses: ./.github/actions/prepare-release-scripts
     - name: Get platforms
       id: platforms
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       with:
         result-encoding: string
         script: | # js
@@ -86,19 +86,19 @@ jobs:
     - name: Move the Uberjar to the context dir
       run: mv ./metabase.jar bin/docker/.
     - name: Login to Docker Hub
-      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
         username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
         password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
     - name: Set up QEMU
       if: contains(steps.platforms.outputs.result, 'arm')
-      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
     - name: Set up Docker Buildx
       if: contains(steps.platforms.outputs.result, 'arm')
-      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
     - name: Build multi-arch container
       if: contains(steps.platforms.outputs.result, 'arm')
-      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
       with:
         context: bin/docker/.
         platforms: ${{ steps.platforms.outputs.result }}
@@ -124,7 +124,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - name: Login to Docker Hub
-      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
         username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
         password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
@@ -144,7 +144,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - name: Login to Docker Hub
-      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
         username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
         password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}

.github/workflows/containerize-uberjar.yml

@@ -15,7 +15,7 @@ jobs:
       oss: ${{ toJson(fromJson(steps.build-matrix.outputs.result).oss) }}
     steps:
       - name: Check out the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Get EE Docker info
         id: ee-info
         uses: ./.github/actions/get-docker-info
@@ -28,7 +28,7 @@ jobs:
           edition: oss
       - name: Build matrix info
         id: build-matrix
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: | # js
             const editions = JSON.parse('${{ steps.ee-info.outputs.editions }}');
@@ -72,11 +72,11 @@ jobs:
     name: Run Trivy vulnerability scanner
     steps:
       - name: Check out the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         env:
           TRIVY_OFFLINE_SCAN: true
           repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
@@ -97,7 +97,7 @@ jobs:
     name: Post PR comment
     steps:
       - name: Check out the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Get Docker info for comment
         id: docker-info
         uses: ./.github/actions/get-docker-info
@@ -106,7 +106,7 @@ jobs:
           edition: ee
 
       - name: Post PR comment
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
         with:
           header: docker-build-status
           message: |

.github/workflows/conventional-commit-pr-title-reminder.yml

@@ -13,9 +13,9 @@ jobs:
     outputs:
       frontend_embedding_sources: ${{ steps.changes.outputs.frontend_embedding_sources }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Test which files changed
-        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           token: ${{ github.token }}
@@ -31,12 +31,12 @@ jobs:
       !cancelled() &&
       needs.files-changed.outputs.frontend_embedding_sources == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.head_ref }}
 
       - name: Check if the PR title is already following Conventional Commits style
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         id: is-conventional-commit
         with:
           result-encoding: string
@@ -48,7 +48,7 @@ jobs:
 
       - name: Remind PR authors to use conventional commit in the title
         if: ${{ steps.is-conventional-commit.outputs.result != 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: | #js
             const { updateCommentForEmbedding } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")

.github/workflows/coverage.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
@@ -23,7 +23,7 @@ jobs:
             --coverage \
             --testTimeout=60000
       - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           files: ./coverage/lcov.info
           flags: front-end

.github/workflows/cross-branch-migrations.yml

@@ -32,7 +32,7 @@ jobs:
       MB_DB_TYPE: h2
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/cross-branch-migration-test
         with:
           base-ref: ${{ env.BASE_REF }}
@@ -58,7 +58,7 @@ jobs:
           POSTGRES_DB: mb_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/cross-branch-migration-test
         with:
           base-ref: ${{ env.BASE_REF }}
@@ -84,7 +84,7 @@ jobs:
           POSTGRES_DB: mb_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/cross-branch-migration-test
         with:
           base-ref: ${{ env.BASE_REF }}
@@ -109,7 +109,7 @@ jobs:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/cross-branch-migration-test
         with:
           base-ref: ${{ env.BASE_REF }}
@@ -135,7 +135,7 @@ jobs:
         ports:
           - "3306:3306"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/cross-branch-migration-test
         with:
           base-ref: ${{ env.BASE_REF }}
@@ -160,7 +160,7 @@ jobs:
           MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
           MARIADB_DATABASE: mb_test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/cross-branch-migration-test
         with:
           base-ref: ${{ env.BASE_REF }}
@@ -185,7 +185,7 @@ jobs:
           MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
           MARIADB_DATABASE: mb_test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/cross-branch-migration-test
         with:
           base-ref: ${{ env.BASE_REF }}

.github/workflows/cross-version.yml

@@ -30,13 +30,13 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: .github
 
       - name: Generate version matrix
         id: set-matrix
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const { buildCrossVersionMatrix } = require('${{ github.workspace }}/.github/scripts/build-cross-version-matrix');
@@ -56,7 +56,7 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Prepare release scripts
         uses: ./.github/actions/prepare-release-scripts
@@ -76,7 +76,7 @@ jobs:
           ./test.sh --source "${{ matrix.source }}" --target "${{ matrix.target }}"
 
       - name: Upload failure result
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: failure-result-${{ matrix.source }}-${{ matrix.target }}
@@ -84,7 +84,7 @@ jobs:
           if-no-files-found: ignore
 
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: cypress-recording-${{ matrix.source }}-${{ matrix.target }}
@@ -111,7 +111,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             release
@@ -121,7 +121,7 @@ jobs:
         uses: ./.github/actions/prepare-release-scripts
 
       - name: Download failure results
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         continue-on-error: true
         with:
           pattern: failure-result-*
@@ -130,7 +130,7 @@ jobs:
 
       - name: Notify Slack
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         with:
@@ -189,7 +189,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Prepare release scripts
         uses: ./.github/actions/prepare-release-scripts
@@ -208,7 +208,7 @@ jobs:
           ./test.sh --source "${{ inputs.source_version }}" --target "${{ inputs.target_version }}"
 
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: cypress-recording-${{ inputs.source_version }}-${{ inputs.target_version }}

.github/workflows/cut-release-branch.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: master
           sparse-checkout: |
@@ -22,7 +22,7 @@ jobs:
 
       - name: Preflight
         id: preflight
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: | # js
             const { versionRequirements } = require('${{ github.workspace }}/release/dist/index.cjs');
@@ -70,6 +70,10 @@ jobs:
           git push -u origin "$BRANCH"
           echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
+      # CURRENT_VERSION is an org-level variable — that's the canonical one,
+      # shared across repos. A repo-level variable of the same name would
+      # shadow it (repo vars override org vars), so we deliberately update
+      # the org-level value here and rely on no repo-level override existing.
       - name: Bump vars.CURRENT_VERSION
         id: bump
         continue-on-error: true
@@ -78,7 +82,7 @@ jobs:
         run: |
           gh variable set CURRENT_VERSION \
             --body "${{ steps.preflight.outputs.next }}" \
-            --repo "${{ github.repository }}"
+            --org "${{ github.repository_owner }}"
 
       # Pre-create the milestone for the version AFTER this cut, so it's
       # already open when next time's backfill needs somewhere to assign
@@ -87,7 +91,7 @@ jobs:
       - name: Create 0.${{ steps.preflight.outputs.nextMilestone }} milestone
         id: milestone
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           script: | # js
@@ -113,7 +117,7 @@ jobs:
       - name: Create Bug:v${{ steps.preflight.outputs.nextMilestone }} label
         id: label
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           script: | # js
@@ -145,7 +149,7 @@ jobs:
         continue-on-error: true
         env:
           STATS_API_KEY: ${{ secrets.STATS_API_KEY }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: | # js
             const next = '${{ steps.preflight.outputs.next }}';
@@ -178,7 +182,7 @@ jobs:
             console.log(`Created timeline event ${name}`);
 
       - name: Notify Slack
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         with:
@@ -204,7 +208,7 @@ jobs:
 
             const notes = [
               bumpFailed
-                ? `:warning: Auto-bump of \`CURRENT_VERSION\` to *${next}* failed — please update it manually: <https://github.com/${owner}/${repo}/settings/variables/actions|Actions variables>`
+                ? `:warning: Auto-bump of \`CURRENT_VERSION\` to *${next}* failed — please update it manually: <https://github.com/organizations/${owner}/settings/variables/actions|Org Actions variables>`
                 : `\`CURRENT_VERSION\` bumped to *${next}*.`,
               milestoneFailed
                 ? `:warning: Pre-creating milestone \`0.${{ steps.preflight.outputs.nextMilestone }}\` (for the next cut) failed — please create it manually: <https://github.com/${owner}/${repo}/milestones|Repository milestones>`
@@ -233,7 +237,7 @@ jobs:
 
       # Heads-up to the broader eng audience about where backports go now.
       - name: Notify the engineering team
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         with:
@@ -262,7 +266,7 @@ jobs:
       # the happy-path message above.
       - name: Notify Slack on cut failure
         if: failure()
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         with:

.github/workflows/disabled-drivers-slack-notification.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6.4.0
         with:
           node-version: lts/Jod
 
@@ -19,7 +19,7 @@ jobs:
         run: npm install @slack/web-api
 
       - name: Check disabled drivers and notify Slack
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         with:
@@ -30,15 +30,23 @@ jobs:
             const response = await fetch('https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json');
             const config = await response.json();
 
-            const drivers = config.ignored?.drivers || [];
+            const drivers = config.drivers || [];
             const lastUpdated = config.metadata?.last_updated || 'unknown';
             const reason = config.metadata?.reason || 'No reason provided';
 
-            if (drivers.length === 0) {
-              console.log('No drivers are currently disabled. Skipping Slack notification.');
+            const skipped = drivers.filter(d => d.status === 'skip').map(d => d.name);
+            const info = drivers.filter(d => d.status === 'info').map(d => d.name);
+
+            if (skipped.length === 0 && info.length === 0) {
+              console.log('No drivers are disabled or collecting data. Skipping Slack notification.');
               return;
             }
 
+            const list = (names) => names.map(d => `\`${d}\``).join('  ');
+            const lines = [];
+            if (skipped.length) lines.push(`:no_entry: *Disabled (not run):* ${list(skipped)}`);
+            if (info.length) lines.push(`:information_source: *Collecting data (non-blocking):* ${list(info)}`);
+
             if (!process.env.SLACK_BOT_TOKEN) {
               throw new Error('SLACK_BOT_TOKEN is required');
             }
@@ -47,13 +55,13 @@ jobs:
 
             await slack.chat.postMessage({
               channel: 'engineering-ci',
-              text: 'CI Disabled Drivers Report',
+              text: 'CI Driver Status Report',
               blocks: [
                 {
                   type: 'section',
                   text: {
                     type: 'mrkdwn',
-                    text: `:no_entry: *CI Disabled Drivers*\n${drivers.map(d => `\`${d}\``).join('  ')}`
+                    text: `*CI Driver Status*\n${lines.join('\n')}`
                   },
                   accessory: {
                     type: 'button',

.github/workflows/docs-generate-base.yml

@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           token: ${{ secrets.automation_token }}
@@ -34,7 +34,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Set up Babashka
-        uses: turtlequeue/setup-babashka@2d4df498c7a578b4f3e906283f9af913590bdec7 # v1.7.0
+        uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
         with:
           babashka-version: 1.12.197
 

.github/workflows/docs-links.yml

@@ -13,21 +13,21 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           sparse-checkout: |
             docs
             .lychee
 
       - name: Cache lychee
-        uses: actions/cache@v3
+        uses: actions/cache@v5
         with:
           path: ~/.cache/lychee
           key: lychee-${{ runner.os }}-${{ hashFiles('.lychee/config.toml') }}
 
       - name: Run link checker
         id: link-check
-        uses: lycheeverse/lychee-action@f613c4a64e50d792e0b31ec34bbcbba12263c6a6 # v2.3.0
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
         with:
           fail: true
           args: docs --config ./.lychee/config.toml --offline

.github/workflows/docs-release-generate.yml

@@ -8,7 +8,7 @@ on:
       target_branch:
         description: "Target branch for documentation update"
         required: false
-        default: "release-x.60.x"
+        default: "release-x.62.x"
         type: string
 
 jobs:
@@ -17,6 +17,6 @@ jobs:
     name: Call documentation update for release branch
     uses: ./.github/workflows/docs-generate-base.yml
     with:
-      target_branch: ${{ inputs.target_branch || 'release-x.60.x' }}
+      target_branch: ${{ inputs.target_branch || 'release-x.62.x' }}
     secrets:
       automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers-stress-test.yml

@@ -4,6 +4,10 @@ on:
   workflow_dispatch:
     inputs:
       test:
+        # Technically this accepts anything that is accepted by Hawk:
+        # https://github.com/metabase/hawk/#leiningen-style-test-selection
+        # For example, to run everything in the tests/ dir you can do
+        # $ gh workflow run .github/workflows/drivers-stress-test.yml --field 'test=\"test/\" :only-tags [:mb/driver-tests]' --field times=2 --field driver=Snowflake
         description: 'The exact test name with its namespace.'
         type: string
         required: true
@@ -59,7 +63,7 @@ jobs:
       MB_ATHENA_TEST_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_SECRET_KEY }}
       MB_ATHENA_TEST_S3_STAGING_DIR: ${{ secrets.MB_ATHENA_TEST_S3_STAGING_DIR }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Athena driver
       uses: ./.github/actions/test-driver
       with:
@@ -79,8 +83,9 @@ jobs:
       MB_BIGQUERY_TEST_ACCESS_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_ACCESS_TOKEN }}
       MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
       MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test BigQuery Cloud SDK driver
       uses: ./.github/actions/test-driver
       with:
@@ -102,7 +107,7 @@ jobs:
         env:
           CLUSTER_SIZE: nano-quickstart
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Druid driver
       uses: ./.github/actions/test-driver
       with:
@@ -131,7 +136,7 @@ jobs:
           MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
           MARIADB_DATABASE: mb_test
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test MariaDB driver (10.6)
       uses: ./.github/actions/test-driver
       with:
@@ -160,7 +165,7 @@ jobs:
           MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
           MARIADB_DATABASE: mb_test
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test MariaDB driver (latest)
       uses: ./.github/actions/test-driver
       with:
@@ -182,7 +187,7 @@ jobs:
         ports:
           - "27017:27017"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test MongoDB driver (4.4)
       uses: ./.github/actions/test-driver
       with:
@@ -200,7 +205,7 @@ jobs:
       MB_MONGO_TEST_PASSWORD: metasample123
       MB_TEST_MONGO_REQUIRES_SSL: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Spin up Mongo docker container
         run: docker run -d -p 27017:27017 --name metamongo metabase/qa-databases:mongo-sample-4.4 mongod --dbpath /data/db2/ --tlsMode requireTLS --tlsCertificateKeyFile /etc/mongo/metamongo.pem --tlsCAFile /etc/mongo/metaca.crt
       - name: Wait until the port 27017 is ready
@@ -238,7 +243,7 @@ jobs:
         ports:
           - "27017:27017"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test MongoDB driver (5.0)
       uses: ./.github/actions/test-driver
       with:
@@ -256,7 +261,7 @@ jobs:
       MB_MONGO_TEST_PASSWORD: metasample123
       MB_TEST_MONGO_REQUIRES_SSL: true
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Spin up Mongo docker container
       run: docker run -d -p 27017:27017 --name metamongo metabase/qa-databases:mongo-sample-5.0 mongod --dbpath /data/db2/ --tlsMode requireTLS --tlsCertificateKeyFile /etc/mongo/metamongo.pem --tlsCAFile /etc/mongo/metaca.crt
     - name: Wait until the port 27017 is ready
@@ -297,7 +302,7 @@ jobs:
           MONGO_INITDB_ROOT_USERNAME: metabase
           MONGO_INITDB_ROOT_PASSWORD: metasample123
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test MongoDB driver (latest)
       uses: ./.github/actions/test-driver
       with:
@@ -326,7 +331,7 @@ jobs:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test MySQL driver (8.0)
       uses: ./.github/actions/test-driver
       with:
@@ -364,7 +369,7 @@ jobs:
         ports:
         - "3306:3306"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test MySQL driver (latest)
       uses: ./.github/actions/test-driver
       with:
@@ -390,7 +395,7 @@ jobs:
         ports:
           - "1521:1521"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Oracle driver (18.4)
       uses: ./.github/actions/test-driver
       with:
@@ -425,7 +430,7 @@ jobs:
         ports:
           - "2484:2484"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Oracle driver (21.3)
       uses: ./.github/actions/test-driver
       with:
@@ -455,7 +460,7 @@ jobs:
           POSTGRES_DB: mb_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Postgres driver (14)
       uses: ./.github/actions/test-driver
       with:
@@ -488,7 +493,7 @@ jobs:
           POSTGRES_DB: mb_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Postgres driver (latest)
       uses: ./.github/actions/test-driver
       with:
@@ -518,7 +523,7 @@ jobs:
         env:
           JAVA_TOOL_OPTIONS: "-Xmx2g"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Wait for port ${{ env.MB_PRESTO_JDBC_TEST_PORT }} to be ready
       run: while ! nc -z localhost ${{ env.MB_PRESTO_JDBC_TEST_PORT }}; do sleep 0.1; done
       timeout-minutes: 15
@@ -556,7 +561,7 @@ jobs:
       MB_REDSHIFT_TEST_HOST: ${{ secrets.MB_REDSHIFT_TEST_HOST }}
       MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Redshift driver
       uses: ./.github/actions/test-driver
       with:
@@ -573,11 +578,21 @@ jobs:
       MB_SNOWFLAKE_TEST_USER: METABASE CI
       MB_SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.MB_SNOWFLAKE_TEST_ACCOUNT }}
       MB_SNOWFLAKE_TEST_PASSWORD: ${{ secrets.MB_SNOWFLAKE_TEST_PASSWORD }}
+      MB_SNOWFLAKE_TEST_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PRIVATE_KEY }}
       MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
       MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
       MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
+      MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2 }}
+      MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY }}
+      MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2 }}
+
+      # RSA Role testing:
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DEFAULT_USER: RSA_ROLE_TEST_DEFAULT_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_CUSTOM_USER: RSA_ROLE_TEST_CUSTOM_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_ROLE: RSA_ROLE_TEST_ROLE
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Snowflake driver
       uses: ./.github/actions/test-driver
       with:
@@ -597,7 +612,7 @@ jobs:
         ports:
           - "10000:10000"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Spark driver
       uses: ./.github/actions/test-driver
       with:
@@ -612,7 +627,7 @@ jobs:
       CI: 'true'
       DRIVERS: sqlite
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test SQLite driver
       uses: ./.github/actions/test-driver
       with:
@@ -639,7 +654,7 @@ jobs:
           SA_PASSWORD: 'P@ssw0rd'
           MSSQL_MEMORY_LIMIT_MB: 1024
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test MS SQL Server 2017 driver
       uses: ./.github/actions/test-driver
       with:
@@ -666,7 +681,7 @@ jobs:
           SA_PASSWORD: 'P@ssw0rd'
           MSSQL_MEMORY_LIMIT_MB: 1024
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test MS SQL Server 2022 driver
       uses: ./.github/actions/test-driver
       with:
@@ -689,7 +704,7 @@ jobs:
           - "8080:8080"
     name: Starburst
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Make plugins directory
       run: mkdir plugins
     - name: Test Starburst driver
@@ -707,7 +722,7 @@ jobs:
       contents: read
     steps:
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
       with:
         role-to-assume: ${{ secrets.CI_IAM_ROLE }}
         role-session-name: GitHub_to_AWS_via_FederatedOIDC
@@ -744,7 +759,7 @@ jobs:
           username: ${{ needs.login-to-ecr.outputs.docker_username }}
           password: ${{ needs.login-to-ecr.outputs.docker_password }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Make plugins directory
       run: mkdir plugins
     - name: Test Vertica driver

.github/workflows/drivers.yml

@@ -38,6 +38,24 @@ jobs:
       sqlite-should-run: ${{ steps.driver-decisions.outputs.sqlite-should-run }}
       sqlserver-should-run: ${{ steps.driver-decisions.outputs.sqlserver-should-run }}
       vertica-should-run: ${{ steps.driver-decisions.outputs.vertica-should-run }}
+      # Per-driver configured status from ci-test-config (skip | info | required)
+      athena-status: ${{ steps.driver-decisions.outputs.athena-status }}
+      bigquery-status: ${{ steps.driver-decisions.outputs.bigquery-status }}
+      clickhouse-status: ${{ steps.driver-decisions.outputs.clickhouse-status }}
+      databricks-status: ${{ steps.driver-decisions.outputs.databricks-status }}
+      druid-jdbc-status: ${{ steps.driver-decisions.outputs.druid-jdbc-status }}
+      mongo-status: ${{ steps.driver-decisions.outputs.mongo-status }}
+      mongo-ssl-status: ${{ steps.driver-decisions.outputs.mongo-ssl-status }}
+      mongo-sharded-cluster-status: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-status }}
+      mysql-mariadb-status: ${{ steps.driver-decisions.outputs.mysql-mariadb-status }}
+      oracle-status: ${{ steps.driver-decisions.outputs.oracle-status }}
+      presto-jdbc-status: ${{ steps.driver-decisions.outputs.presto-jdbc-status }}
+      redshift-status: ${{ steps.driver-decisions.outputs.redshift-status }}
+      snowflake-status: ${{ steps.driver-decisions.outputs.snowflake-status }}
+      sparksql-status: ${{ steps.driver-decisions.outputs.sparksql-status }}
+      sqlite-status: ${{ steps.driver-decisions.outputs.sqlite-status }}
+      sqlserver-status: ${{ steps.driver-decisions.outputs.sqlserver-status }}
+      vertica-status: ${{ steps.driver-decisions.outputs.vertica-status }}
       # Per-driver quarantine conflict flags (set when driver is quarantined but has file changes)
       athena-quarantine-conflict: ${{ steps.driver-decisions.outputs.athena-quarantine-conflict }}
       bigquery-quarantine-conflict: ${{ steps.driver-decisions.outputs.bigquery-quarantine-conflict }}
@@ -59,8 +77,30 @@ jobs:
       sqlserver-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlserver-quarantine-conflict }}
       vertica-quarantine-conflict: ${{ steps.driver-decisions.outputs.vertica-quarantine-conflict }}
     steps:
+      # Up front (before any driver job), drop info-driver comments from older commits so a
+      # superseded comment disappears immediately rather than waiting for this run's drivers.
+      # Keeps this commit's comment (if any) so a re-run doesn't flicker.
+      - name: Remove stale info-driver comments
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: actions/github-script@v9
+        continue-on-error: true
+        with:
+          script: | # js
+            const pr = context.payload.pull_request;
+            if (!pr) return;
+            const { owner, repo } = context.repo;
+            const PREFIX = "<!-- info-driver-result";
+            const keep = `<!-- info-driver-results:${pr.head.sha} -->`;
+            const { data: comments } = await github.rest.issues.listComments({
+              owner, repo, issue_number: pr.number, per_page: 100,
+            });
+            for (const c of comments) {
+              if (c.body.includes(PREFIX) && !c.body.includes(keep)) {
+                await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
+              }
+            }
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Fetch base branch
         if: github.event_name == 'pull_request' && github.event.pull_request.base.ref != ''
         run: |
@@ -121,7 +161,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the Athena driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Athena driver
       id: test-driver
       uses: ./.github/actions/test-driver
@@ -141,6 +181,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
+        report-variant: ${{ matrix.job.name }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
@@ -151,11 +193,20 @@ jobs:
       fail-fast: false
       matrix:
         job:
-          - name: Driver Tests
+          - name: Driver Tests Part 1
             test-args: >-
               :only-tags [:mb/driver-tests]
               :exclude-tags [:mb/transforms-python-test]
               :fail-fast? true
+              :partition/total 2
+              :partition/index 0
+          - name: Driver Tests Part 2
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 2
+              :partition/index 1
           - name: Transforms Python Tests
             test-args: >-
               :only-tags [:mb/transforms-python-test]
@@ -182,7 +233,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the BigQuery driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/setup-python-runner
@@ -206,6 +257,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.bigquery-status }}
+        report-variant: ${{ matrix.job.name }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -249,7 +302,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the ClickHouse driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/setup-python-runner
@@ -259,7 +312,7 @@ jobs:
       run: |
         sudo echo "127.0.0.1 server.clickhouseconnect.test" | sudo tee -a /etc/hosts
     - name: Start ClickHouse in Docker
-      uses: hoverkraft-tech/compose-action@802a148945af6399a338c7906c267331b39a71af # v2.0.0
+      uses: hoverkraft-tech/compose-action@d2bee4f07e8ca410d6b196d00f90c12e7d48c33a # v2.6.0
       with:
         compose-file: "modules/drivers/clickhouse/docker-compose.yml"
         down-flags: "--volumes"
@@ -296,54 +349,6 @@ jobs:
         upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
         logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
 
-  be-tests-druid-ee:
-    needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.druid-should-run == 'true' || needs.determine-driver-skips.outputs.druid-quarantine-conflict == 'true' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
-    env:
-      CI: 'true'
-      DRIVERS: druid
-    services:
-      druid:
-        image: metabase/druid:0.20.2
-        ports:
-          - "8082:8082"
-        env:
-          CLUSTER_SIZE: nano-quickstart
-    name: Druid (Legacy)
-    steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.druid-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Druid driver is quarantined but you changed files in modules/drivers/druid/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Druid tests, add the label: break-quarantine-druid"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Druid driver!"
-        exit 1
-    - uses: actions/checkout@v4
-    - name: Test Druid driver
-      id: test-driver
-      uses: ./.github/actions/test-driver
-      with:
-        junit-name: 'be-tests-druid-ee'
-        test-args: >-
-          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
@@ -371,7 +376,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the Druid JDBC driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Druid JDBC driver
       id: test-driver
       uses: ./.github/actions/test-driver
@@ -419,7 +424,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the Databricks driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Databricks driver
       id: test-driver
       uses: ./.github/actions/test-driver
@@ -439,6 +444,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
+        report-variant: ${{ matrix.job.name }}
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
@@ -468,7 +475,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the Databricks driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Databricks driver with multi-catalog
       id: test-driver
       uses: ./.github/actions/test-driver
@@ -488,6 +495,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
+        report-variant: ${{ matrix.job.name }}
 
   be-tests-h2:
     needs: determine-driver-skips
@@ -498,7 +507,7 @@ jobs:
       CI: 'true'
     name: H2
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test H2 driver
       id: test-driver
       uses: ./.github/actions/test-driver
@@ -528,7 +537,7 @@ jobs:
       CI: 'true'
     name: H2 (OSS)
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test H2 driver (OSS)
       id: test-driver
       uses: ./.github/actions/test-driver
@@ -653,7 +662,7 @@ jobs:
     # "be-tests-mariadb-10-2-ee (0)"
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Setup python-runner
         if: ${{ matrix.job.needs-python-runner == true }}
         uses: ./.github/actions/setup-python-runner
@@ -735,7 +744,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the MongoDB driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/setup-python-runner
@@ -796,7 +805,7 @@ jobs:
           echo ""
           echo "If you merge without testing, you risk breaking the MongoDB SSL driver!"
           exit 1
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Spin up Mongo docker container
         run: >-
           docker run -d
@@ -867,7 +876,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the MongoDB Sharded Cluster driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test MongoDB driver (Sharded cluster)
       id: test-driver
       uses: ./.github/actions/test-driver
@@ -950,7 +959,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the Oracle driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test ${{ matrix.version.name }}
       id: test-driver
       uses: ./.github/actions/test-driver
@@ -1049,7 +1058,7 @@ jobs:
           POSTGRES_DB: mb_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Setup python-runner
         if: ${{ matrix.job.needs-python-runner == true }}
         uses: ./.github/actions/setup-python-runner
@@ -1117,7 +1126,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the Presto JDBC driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - uses: ./.github/actions/await-port
       with:
          port: ${{ env.MB_PRESTO_JDBC_TEST_PORT }}
@@ -1220,7 +1229,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the Redshift driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/setup-python-runner
@@ -1246,6 +1255,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.redshift-status }}
+        report-variant: ${{ matrix.job.name }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1302,7 +1313,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the Snowflake driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/setup-python-runner
@@ -1326,6 +1337,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.snowflake-status }}
+        report-variant: ${{ matrix.job.name }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1358,7 +1371,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the SparkSQL driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test Spark driver
       id: test-driver
       uses: ./.github/actions/test-driver
@@ -1392,14 +1405,14 @@ jobs:
     - name: Fail on quarantine conflict
       if: ${{ needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
       run: |
-        echo "::error::SQLite driver is quarantined but you changed files in modules/drivers/sqlite/"
+        echo "::error::SQLite driver is quarantined but you changed files that affect it"
         echo ""
         echo "Your changes will NOT be tested because the driver is currently quarantined."
         echo "To run SQLite tests, add the label: break-quarantine-sqlite"
         echo ""
         echo "If you merge without testing, you risk breaking the SQLite driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Test SQLite driver
       id: test-driver
       uses: ./.github/actions/test-driver
@@ -1471,7 +1484,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the SQL Server driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/setup-python-runner
@@ -1520,7 +1533,7 @@ jobs:
   #         - "8080:8080"
   #   name: Starburst
   #   steps:
-  #   - uses: actions/checkout@v4
+  #   - uses: actions/checkout@v6
   #   - name: Make plugins directory
   #     run: mkdir plugins
   #   - name: Test Starburst driver
@@ -1550,7 +1563,7 @@ jobs:
       contents: read
     steps:
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
       with:
         role-to-assume: ${{ secrets.CI_IAM_ROLE }}
         role-session-name: GitHub_to_AWS_via_FederatedOIDC
@@ -1598,7 +1611,7 @@ jobs:
         echo ""
         echo "If you merge without testing, you risk breaking the Vertica driver!"
         exit 1
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Make plugins directory
       run: mkdir plugins
     - name: Test Vertica driver
@@ -1623,11 +1636,19 @@ jobs:
 
   drivers-tests-result:
     needs:
+      # Supplies each driver's configured status (info/skip/required) so this gate can ignore
+      # "info" drivers regardless of their result -- including cancelled or timed-out runs, which
+      # the per-job continue-on-error cannot force green because the controlling step never
+      # completes. Not a driver job; it is filtered out of the pass/fail check below.
+      - determine-driver-skips
       # if you add a driver job, you must add it to this list for it to be a required check
       - be-tests-h2
       - be-tests-athena-ee
+      # Listed unconditionally; ci-test-config controls their effect via per-driver status.
+      # An "info" driver is reported as passing, so it never blocks this check; flip it to
+      # "required" in the config to make a real failure gate, with no change here.
+      - be-tests-snowflake-ee
       - be-tests-bigquery-cloud-sdk-ee
-      - be-tests-druid-ee
       - be-tests-databricks-ee
       - be-tests-druid-jdbc-ee
       - be-tests-mysql-mariadb
@@ -1638,7 +1659,6 @@ jobs:
       - be-tests-postgres
       - be-tests-presto-jdbc-ee
       - be-tests-redshift-ee
-      - be-tests-snowflake-ee
       - be-tests-sparksql-ee
       - be-tests-sqlite-ee
       - be-tests-sqlserver
@@ -1652,21 +1672,50 @@ jobs:
     if: always() && !cancelled()
     steps:
       - name: Check job status
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           needs: ${{ toJson(needs) }}
+          # Job name -> configured driver status, from determine-driver-skips. An "info" driver is
+          # data-collection only and must never gate; a cancelled/timed-out info job lands here as
+          # cancelled/failure (its own continue-on-error can't force it green), so we drop info jobs
+          # from the gate entirely. Empty/unknown status falls back to "required" (gates as before).
+          statuses: |
+            {
+              "be-tests-athena-ee": "${{ needs.determine-driver-skips.outputs.athena-status }}",
+              "be-tests-bigquery-cloud-sdk-ee": "${{ needs.determine-driver-skips.outputs.bigquery-status }}",
+              "be-tests-clickhouse-ee": "${{ needs.determine-driver-skips.outputs.clickhouse-status }}",
+              "be-tests-databricks-ee": "${{ needs.determine-driver-skips.outputs.databricks-status }}",
+              "be-tests-druid-jdbc-ee": "${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}",
+              "be-tests-mongo": "${{ needs.determine-driver-skips.outputs.mongo-status }}",
+              "be-tests-mongo-ssl": "${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}",
+              "be-tests-mongo-sharded-cluster-ee": "${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}",
+              "be-tests-mysql-mariadb": "${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}",
+              "be-tests-oracle": "${{ needs.determine-driver-skips.outputs.oracle-status }}",
+              "be-tests-presto-jdbc-ee": "${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}",
+              "be-tests-redshift-ee": "${{ needs.determine-driver-skips.outputs.redshift-status }}",
+              "be-tests-snowflake-ee": "${{ needs.determine-driver-skips.outputs.snowflake-status }}",
+              "be-tests-sparksql-ee": "${{ needs.determine-driver-skips.outputs.sparksql-status }}",
+              "be-tests-sqlite-ee": "${{ needs.determine-driver-skips.outputs.sqlite-status }}",
+              "be-tests-sqlserver": "${{ needs.determine-driver-skips.outputs.sqlserver-status }}"
+            }
         with:
           script: | # js
             const needs = JSON.parse(process.env.needs);
+            const statuses = JSON.parse(process.env.statuses);
 
-            const jobs = Object.entries(needs).map(
-              ([jobName, jobValues]) => ({
+            // Drop the determine-driver-skips bookkeeping job, then drop "info" drivers: they are
+            // non-gating, so their result (including cancelled/timed-out) must not fail this check.
+            const jobs = Object.entries(needs)
+              .filter(([jobName]) => jobName !== 'determine-driver-skips')
+              .map(([jobName, jobValues]) => ({
                 name: jobName,
-                result: jobValues.result
-              }));
+                result: jobValues.result,
+                status: statuses[jobName] || 'required'
+              }))
+              .filter(job => job.status !== 'info');
 
             // are all jobs skipped or successful?
-            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success' || job.name == 'be-tests-starburst-ee'))) {
+            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
                 console.log("");
                 console.log("        _------.        ");
                 console.log("       /  ,     \_      ");

.github/workflows/e2e-matrix-builder.yml

@@ -28,16 +28,16 @@ jobs:
       regularChunks: ${{ steps.matrix.outputs.regularChunks }}
       isDefaultSpecPattern: ${{ steps.matrix.outputs.isDefaultSpecPattern }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             .github
           sparse-checkout-cone-mode: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6.4.0
         with:
           node-version: lts/Jod # 22.x.x
       - name: Build e2e matrix
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         id: matrix
         env:
           chunks: ${{ inputs.chunks }}

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -36,6 +36,54 @@ on:
         type: boolean
         required: false
         default: false
+      build_jar:
+        description: "Build the uberjar from this branch (required to test frontend fixes) instead of downloading a prebuilt one"
+        type: boolean
+        required: false
+        default: false
+  # Reusable form so other workflows (e.g. the flaky-test-fix PR auto-runner) can fan a
+  # matrix of changed specs into individual stress runs. Inputs mirror workflow_dispatch;
+  # both triggers read them via the `inputs` context.
+  workflow_call:
+    inputs:
+      spec:
+        description: "Relative path of the target spec"
+        type: string
+        required: true
+      burn_in:
+        description: "Number of times to run the test (e.g. 20)"
+        type: string
+        required: false
+        default: "20"
+      grep:
+        description: "Grep and filter tests to run in isolation"
+        type: string
+        required: false
+      mb_edition:
+        description: 'Set MB_EDITION env var to "ee" (enterprise) or "oss" (open-source)'
+        type: string
+        required: false
+        default: "ee"
+      qa_db:
+        description: "Whether to set up and include external QA databases"
+        type: boolean
+        required: false
+        default: false
+      enable_network_throttling:
+        description: "Enable network throttling simulation (4g slow like in chrome dev tools)"
+        type: boolean
+        required: false
+        default: true
+      fail_fast:
+        description: "Stop running remaining tests after the first failure"
+        type: boolean
+        required: false
+        default: false
+      build_jar:
+        description: "Build the uberjar from this branch (required to test frontend fixes) instead of downloading a prebuilt one"
+        type: boolean
+        required: false
+        default: false
 
 jobs:
   determine-test-type:
@@ -73,6 +121,7 @@ jobs:
           echo '- `qa_db`: "${{ inputs.qa_db }}"' >> $GITHUB_STEP_SUMMARY
           echo '- `enable_network_throttling`: "${{ inputs.enable_network_throttling }}"' >> $GITHUB_STEP_SUMMARY
           echo '- `fail_fast`: "${{ inputs.fail_fast }}"' >> $GITHUB_STEP_SUMMARY
+          echo '- `build_jar`: "${{ inputs.build_jar }}"' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
           echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
 
@@ -92,7 +141,7 @@ jobs:
       MB_EDITION: ${{ inputs.mb_edition }}
       CYPRESS_ENABLE_NETWORK_THROTTLING: ${{ inputs.enable_network_throttling }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           # Important because we need previous commits hashes to find and download the uberjar!
           fetch-depth: 20
@@ -109,16 +158,24 @@ jobs:
           mysql: ${{ inputs.qa_db }}
           mongo: ${{ inputs.qa_db }}
 
-      - name: Download Metabase ${{ matrix.edition }} uberjar
+      - name: Download Metabase ${{ inputs.mb_edition }} uberjar
+        if: ${{ !inputs.build_jar }}
         uses: ./.github/actions/e2e-download-uberjar
         with:
-          edition: "ee"
+          edition: ${{ inputs.mb_edition }}
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
 
+      - name: Build Metabase ${{ inputs.mb_edition }} uberjar from this branch
+        if: ${{ inputs.build_jar }}
+        run: ./bin/build.sh
+        env:
+          # license check is irrelevant for ephemeral e2e jars and slows the build down
+          SKIP_LICENSES: true
+
       - name: Build Embedding SDK package
         if: ${{ needs.determine-test-type.outputs.type == 'component' }}
         run: bun run build-embedding-sdk-package
@@ -146,13 +203,13 @@ jobs:
 
       # For all options and fine-grained control, take a look at the documentation
       # https://github.com/cypress-io/cypress/tree/develop/npm/grep
-      - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
+      - name: Stress-test ${{ inputs.spec }} ${{ inputs.burn_in }} times
         env:
-          GREP: ${{ github.event.inputs.grep }}
+          GREP: ${{ inputs.grep }}
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
           FAIL_FAST: ${{ inputs.fail_fast }}
-          SPEC: ${{ github.event.inputs.spec }}
-          BURN_IN: ${{ github.event.inputs.burn_in }}
+          SPEC: ${{ inputs.spec }}
+          BURN_IN: ${{ inputs.burn_in }}
         run: |
           node e2e/runner/run_cypress_ci.js ${{ needs.determine-test-type.outputs.type }} \
           --spec "${SPEC}" \
@@ -160,7 +217,7 @@ jobs:
           --config-file e2e/support/cypress-stress-test.config.js
 
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: cypress-failed-tests-recording

.github/workflows/e2e-stress-test-flaky-pr.yml

@@ -0,0 +1,88 @@
+name: E2E Stress Test (flaky-test-fix PR)
+
+# Auto-runs the e2e stress test on every changed Cypress spec in a PR
+
+on:
+  pull_request:
+    # `opened`/`reopened` catch PRs created already labelled; `labeled` catches the label
+    # being added later; `synchronize` re-burns after new commits while the label is set.
+    types: [opened, reopened, synchronize, labeled]
+
+concurrency:
+  # One in-flight set of stress runs per PR branch — new commits cancel the previous burn.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  detect-changed-specs:
+    name: Detect changed e2e specs
+    if: contains(github.event.pull_request.labels.*.name, 'flaky-test-fix')
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    outputs:
+      # JSON array of spec paths, consumed by the matrix below.
+      specs: ${{ steps.detect.outputs.specs }}
+      should_run: ${{ steps.detect.outputs.should_run }}
+      # burn-50 / burn-100 labels bump the burn-in past 20
+      burn_in: >-
+        ${{ contains(github.event.pull_request.labels.*.name, 'burn-100') && '100'
+            || contains(github.event.pull_request.labels.*.name, 'burn-50') && '50'
+            || '20' }}
+    steps:
+      - name: Detect changed Cypress spec files
+        id: detect
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: | # sh
+          # List every file in the PR, drop deletions, then keep only regular e2e Cypress
+          # specs: paths under e2e/ ending in .cy.spec.{js,ts,tsx}, excluding the
+          # embedding-SDK component specs under e2e/test-component/ (those use a different
+          # runner and are out of scope here). The greps are guarded with `|| true` so an
+          # empty match doesn't trip `pipefail`.
+          FILES=$(
+            gh api "repos/${REPO}/pulls/${PR_NUMBER}/files" \
+              --paginate \
+              --jq '.[] | select(.status != "removed") | .filename' \
+            | { grep -E '^e2e/.*\.cy\.spec\.(js|ts|tsx)$' || true; } \
+            | { grep -v '^e2e/test-component/' || true; } \
+            | sort -u
+          )
+
+          if [[ -z "$FILES" ]]; then
+            echo "No changed e2e Cypress spec files found — nothing to stress test."
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Changed e2e Cypress specs:"
+          echo "$FILES" | sed 's/^/  - /'
+
+          # Compact JSON array for the matrix, e.g. ["e2e/test/scenarios/a.cy.spec.js"].
+          SPECS_JSON=$(echo "$FILES" | jq -R . | jq -cs .)
+          echo "specs=${SPECS_JSON}" >> "$GITHUB_OUTPUT"
+          echo "should_run=true" >> "$GITHUB_OUTPUT"
+
+          echo "Note: you can use the burn-50 or burn-100 labels to increase the burn-in count from the default of 20." >> $GITHUB_STEP_SUMMARY
+
+  stress-test:
+    name: Stress test
+    needs: detect-changed-specs
+    if: needs.detect-changed-specs.outputs.should_run == 'true'
+    strategy:
+      # Don't let one flaky spec (or one throttling regime) cancel the burn-in of the others.
+      fail-fast: false
+      matrix:
+        spec: ${{ fromJson(needs.detect-changed-specs.outputs.specs) }}
+        # Burn each spec with and without throttle
+        enable_network_throttling: [true, false]
+    uses: ./.github/workflows/e2e-stress-test-flake-fix.yml
+    secrets: inherit
+    with:
+      spec: ${{ matrix.spec }}
+      burn_in: ${{ needs.detect-changed-specs.outputs.burn_in }}
+      qa_db: true
+      mb_edition: ee
+      build_jar: true
+      enable_network_throttling: ${{ matrix.enable_network_throttling }}

.github/workflows/e2e-test.yml

@@ -37,6 +37,20 @@ env:
   HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
   PR_NUMBER: ${{ github.event.pull_request.number || '' }}
   JOB_NAME: ${{ inputs.name }}
+  # ci-conductor reporting (DEV-1999). Secret holds the base origin
+  # (e.g. "https://conductor.<host>"); each consumer appends the path it needs
+  # (the reporter POSTs to "/webhooks/failed-tests"). Callers pass
+  # `secrets: inherit`; reporting no-ops when it's unset.
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  # Shared secret sent as the `x-internal-secret` header to authenticate.
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  REPO_ID: ${{ github.event.repository.id }}
+  # Commit + PR target branch under test, so conductor can tie failures to the
+  # right code. On PRs the ambient GITHUB_SHA is the synthetic merge commit and
+  # GITHUB_BASE_REF the target, so we pass the PR head sha / base ref explicitly
+  # (falling back to push-event values). The reporter reads these. DEV-1999.
+  COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+  TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
 
 jobs:
   e2e-tests:
@@ -45,6 +59,11 @@ jobs:
     name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
     env:
       MB_EDITION: ${{ inputs.edition }}
+      # Absolute path for the quarantine failures file (DEV-2082). The after:spec
+      # recorder runs in Cypress' plugins process, whose cwd differs from the
+      # workspace where the gate step runs; an absolute path anchored to the
+      # workspace makes both agree regardless of cwd.
+      QUARANTINE_FAILURES_FILE: ${{ github.workspace }}/target/quarantine-failures.jsonl
       # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
       # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
       # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
@@ -53,7 +72,7 @@ jobs:
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: true
           token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
@@ -95,7 +114,7 @@ jobs:
         uses: ./.github/actions/prepare-cypress
 
       - name: Download failed test artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         if: github.run_attempt != '1'
         continue-on-error: true
         id: failed-specs
@@ -112,6 +131,15 @@ jobs:
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
+      # Export this job's numeric GitHub job id as $JOB_ID for the Cypress runs
+      # below (ci-conductor failed-tests reporting reads it in after:spec).
+      # Snapshot generation is itself a Cypress run that fires after:spec, so
+      # this must precede it. Placed late, not after checkout: the Actions jobs
+      # API is eventually consistent, so the longer the job has been alive the
+      # more reliably the lookup resolves. JOB_ID exported here persists to the
+      # steps below. DEV-1999.
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Generate database snapshots
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
@@ -158,6 +186,19 @@ jobs:
         # whether to fail or to pass the whole job, based on the quarantine list.
         continue-on-error: true
 
+      - name: Rewrite JUnit hook failures
+        if: always()
+        continue-on-error: true
+        timeout-minutes: 1
+        shell: bash
+        run: |
+          if [ -d ./target/junit ]; then
+            echo "fix-junit-hooks: invoking bun"
+            bun e2e/support/fix-junit-hooks.ts ./target/junit
+          else
+            echo "No ./target/junit directory; nothing to process."
+          fi
+
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -173,8 +214,23 @@ jobs:
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ inputs.specs && steps.tagged-e2e.outcome || steps.split-e2e.outcome }}
 
+      # Quarantine gate (DEV-2082). Compare this job's ultimate test failures
+      # (recorded by after:spec into ./target/quarantine-failures.jsonl) against
+      # ci-conductor's quarantine list and decide whether the job should pass:
+      # pass if every failure is quarantined, fail if any isn't. This mirrors
+      # what Trunk's analytics-uploader does for us today. Runs in dry-run mode
+      # for now (QUARANTINE_DRY_RUN defaults to true) — it only prints the
+      # verdict and never fails the job. `continue-on-error` is belt-and-braces
+      # while it's observational; drop both it and the dry run to enforce.
+      - name: Quarantine gate (dry run)
+        if: always()
+        continue-on-error: true
+        timeout-minutes: 2
+        shell: bash
+        run: bun e2e/support/check-quarantine.ts
+
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: |
           !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure')
         with:
@@ -185,7 +241,7 @@ jobs:
           if-no-files-found: ignore
 
       - name: Upload Failed Tests
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: |
           !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure')
         with:
@@ -197,7 +253,7 @@ jobs:
         id: extract-timings
         if: inputs.split_index >= 0 && github.ref == 'refs/heads/master'
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
@@ -231,7 +287,7 @@ jobs:
             }
 
       - name: Upload Timing Data
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: steps.extract-timings.outcome == 'success' && steps.extract-timings.outputs.has-changes == 'true'
         with:
           name: timing-data-${{ inputs.name }}
@@ -240,7 +296,7 @@ jobs:
 
       - name: Publish Summary
         if: failure()
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: | #js
             const {

.github/workflows/e2e-tests.yml

@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Remove test results comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: | # js
             const { owner, repo } = context.repo;
@@ -80,7 +80,7 @@ jobs:
     needs: e2e-tests
     if: always() && !cancelled() && github.ref == 'refs/heads/master'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             .github
@@ -88,7 +88,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Download all timing artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: timing-data-*
           path: timing-files
@@ -98,7 +98,7 @@ jobs:
       - name: Merge split timings
         id: merge
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
@@ -129,7 +129,7 @@ jobs:
 
       - name: Upload merged timing files
         if: steps.merge.outcome == 'success'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: merged-e2e-timings
           path: e2e/support/runTimings.json

.github/workflows/embedding-sdk-component-tests.yml

@@ -28,7 +28,7 @@ jobs:
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Prepare Docker containers
         uses: ./.github/actions/e2e-prepare-containers
@@ -38,7 +38,7 @@ jobs:
           maildev: true
           openldap: false
           webhook: false
-          snowplow: false
+          snowplow: true
           postgres: false
           mysql: false
           mongo: false
@@ -52,7 +52,7 @@ jobs:
           output-name: "metabase.jar"
 
       - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
@@ -87,6 +87,19 @@ jobs:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: node e2e/runner/run_cypress_ci.js component
 
+      - name: Rewrite JUnit hook failures
+        if: always()
+        continue-on-error: true
+        timeout-minutes: 1
+        shell: bash
+        run: |
+          if [ -d ./target/junit ]; then
+            echo "fix-junit-hooks: invoking bun"
+            bun e2e/support/fix-junit-hooks.ts ./target/junit
+          else
+            echo "No ./target/junit directory; nothing to process."
+          fi
+
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -100,7 +113,7 @@ jobs:
           previous-step-outcome: ${{ steps.run-tests.outcome }}
 
       - name: "SDK component tests > Upload Cypress Artifacts upon failure"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: cypress-recording-embedding-sdk-react-${{ matrix.react-version }}
@@ -111,7 +124,7 @@ jobs:
 
       - name: "SDK component tests > Publish Summary"
         if: failure()
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: | #js
             const {
@@ -131,7 +144,7 @@ jobs:
     outputs:
       target-ref: ${{ steps.get-target-ref.outputs.value }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 2
 
@@ -165,7 +178,7 @@ jobs:
 
     steps:
       - name: Check out the code from the previous commit
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ needs.decide-target-ref.outputs.target-ref }}
 
@@ -177,7 +190,7 @@ jobs:
           maildev: true
           openldap: false
           webhook: false
-          snowplow: false
+          snowplow: true
           postgres: false
           mysql: false
           mongo: false
@@ -212,7 +225,7 @@ jobs:
         run: ./bin/build.sh
 
       - name: Retrieve Embedding SDK dist artifact built from the current commit N
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
@@ -240,6 +253,19 @@ jobs:
           node e2e/runner/run_cypress_ci.js component \
             --expose grepTags="-@skip-backward-compatibility"
 
+      - name: Rewrite JUnit hook failures
+        if: always()
+        continue-on-error: true
+        timeout-minutes: 1
+        shell: bash
+        run: |
+          if [ -d ./target/junit ]; then
+            echo "fix-junit-hooks: invoking bun"
+            bun e2e/support/fix-junit-hooks.ts ./target/junit
+          else
+            echo "No ./target/junit directory; nothing to process."
+          fi
+
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -253,7 +279,7 @@ jobs:
           previous-step-outcome: ${{ steps.run-tests.outcome }}
 
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: cypress-recording-embedding-sdk-cross-version
@@ -264,7 +290,7 @@ jobs:
 
       - name: Publish Summary
         if: failure()
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: | #js
             const {

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -28,13 +28,13 @@ jobs:
       branch_name: ${{ fromJson(steps.build-sample-apps-data.outputs.result).branch_name }}
       matrix: ${{ toJSON(fromJson(steps.build-sample-apps-data.outputs.result).matrix) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Prepare release scripts
         uses: ./.github/actions/prepare-release-scripts
 
       - name: Build sample app compatibility data
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         id: build-sample-apps-data
         with:
           script: | # js
@@ -110,13 +110,13 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: ./.github/actions/maximize-disk-space
 
       # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
       - name: Set up Docker Compose
-        uses: docker/setup-compose-action@2fe291b7677a45ee1269ec56a42604c143505e7e # v1
+        uses: docker/setup-compose-action@8cccb8c14b6500aaffebff1aa49c502c34d2e5e6 # v2.1.0
         with:
           version: latest
 
@@ -136,7 +136,7 @@ jobs:
           output-name: "metabase.jar"
 
       - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
@@ -180,7 +180,7 @@ jobs:
         run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }}
 
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
         with:
           name: cypress-recording-sample-app-${{ matrix.test_suite }}-${{ matrix.environment }}-latest
@@ -219,7 +219,7 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Prepare Shoppy E2E environment
         uses: ./.github/actions/prepare-shoppy-e2e
@@ -247,7 +247,7 @@ jobs:
         run: node e2e/runner/run_cypress_ci.js shoppy-e2e
 
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
         with:
           name: cypress-recording-sample-app-shoppy-e2e-${{ matrix.environment }}-latest
@@ -284,7 +284,7 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Prepare Shoppy E2E environment
         uses: ./.github/actions/prepare-shoppy-e2e
@@ -327,7 +327,7 @@ jobs:
         run: node e2e/runner/run_cypress_ci.js shoppy-e2e
 
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
         with:
           name: cypress-recording-shoppy-synthetic-tests-latest
@@ -371,7 +371,7 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
@@ -382,7 +382,7 @@ jobs:
           output-name: "metabase.jar"
 
       - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
@@ -415,7 +415,7 @@ jobs:
         run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }}
 
       - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ steps.run-e2e-tests.outcome != 'success' }}
         with:
           name: cypress-recording-host-app-${{ matrix.test_suite }}-${{ matrix.environment }}-latest

.github/workflows/embedding-sdk-labels-reminder.yml

@@ -15,9 +15,9 @@ jobs:
     outputs:
       frontend_embedding_sdk_package_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_package_sources }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Test which files changed
-        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           token: ${{ github.token }}
@@ -32,7 +32,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: jesusvasquez333/verify-pr-label-action@657d111bbbe13e22bbd55870f1813c699bde1401 # v1.4.0
         id: verify-release-notes-labels
         with:

.github/workflows/embedding-sdk-package-build.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
@@ -25,7 +25,7 @@ jobs:
           echo "::remove-matcher owner=tsc::"
           bun run build-embedding-sdk-package
       - name: Prepare Embedding SDK artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: resources/embedding-sdk

.github/workflows/embedding-sdk-tag-latest.yml

@@ -0,0 +1,45 @@
+name: Tag Embedding SDK npm release as latest
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "npm version to tag as latest, e.g. 0.61.5"
+        type: string
+        required: true
+  workflow_call:
+    inputs:
+      version:
+        description: "npm version to tag as latest, e.g. 0.61.5"
+        type: string
+        required: true
+
+concurrency:
+  group: npm-dist-tag-latest
+  cancel-in-progress: false
+
+permissions: {}
+
+jobs:
+  tag-latest:
+    name: Tag npm release as latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    env:
+      VERSION: ${{ inputs.version }}
+    steps:
+      - name: Setup Node.js
+        uses: actions/setup-node@v6.4.0
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - name: Verify version exists on npm
+        run: npm view "@metabase/embedding-sdk-react@$VERSION" version
+
+      - name: Add `latest` dist-tag to npm release
+        run: |
+          npm dist-tag add "@metabase/embedding-sdk-react@$VERSION" latest
+          echo "Tagged @metabase/embedding-sdk-react@$VERSION as latest" >> "$GITHUB_STEP_SUMMARY"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_RELEASE_TOKEN }}

.github/workflows/embedding-sdk.yml

@@ -42,11 +42,11 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
@@ -58,11 +58,11 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
@@ -74,13 +74,13 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
@@ -136,7 +136,7 @@ jobs:
     env:
       BUNDLE_SIZE_THRESHOLD_PERCENT: 2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/sdk-bundle-size-check
         id: compare
         with:
@@ -192,7 +192,7 @@ jobs:
       needs: ${{ toJson(needs) }}
     steps:
       - name: Check embedding SDK job status
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           needs: ${{ toJson(needs) }}
         with:

.github/workflows/emotion-stats-update.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Get Emotion file count
         id: get-emotion-file-count
         run: |
@@ -44,7 +44,7 @@ jobs:
 
           echo "EMOTION_FILES=$(($oss+$ee))" >> $GITHUB_OUTPUT
       - name: Upload count to Stats
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           EMOTION_FILES: ${{ steps.get-emotion-file-count.outputs.EMOTION_FILES }}
           API_KEY: ${{ secrets.STATS_API_KEY }}

.github/workflows/escalation-slack-notification.yml

@@ -11,15 +11,17 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Format issue title (escape quotes)
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         id: vars
         with:
           script: |
             core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
       - name: Send escalated issue ${{ github.event.issue.number }} to Slack
         id: slack
-        uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
+          webhook: ${{ secrets.SLACK_ESCALATIONS_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
           payload: |
             {
               "blocks": [
@@ -32,6 +34,3 @@ jobs:
                 }
               ]
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_ESCALATIONS_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -38,7 +38,7 @@ jobs:
     timeout-minutes: 60
     name: Stress test frontend unit test flake fix
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment

.github/workflows/frontend.yml

@@ -37,7 +37,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
@@ -47,7 +47,7 @@ jobs:
         uses: ./.github/actions/get-cache-keys
         id: get-cache-keys
       - name: Restore ESLint cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: ${{ github.workspace}}/.eslintcache
           key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
@@ -68,7 +68,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
@@ -91,7 +91,7 @@ jobs:
       JEST_JUNIT_OUTPUT_DIR: ./target/junit
       JEST_JUNIT_OUTPUT_NAME: test-report-frontend-unit.xml
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
@@ -120,7 +120,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Run frontend timezones tests
@@ -136,7 +136,7 @@ jobs:
       run:
         working-directory: enterprise/frontend/src/custom-viz
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare Node + Bun environment
         uses: ./.github/actions/prepare-node-bun
       - name: Install dependencies
@@ -164,7 +164,7 @@ jobs:
       needs: ${{ toJson(needs) }}
     steps:
       - name: Check frontend job status
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           needs: ${{ toJson(needs) }}
         with:

.github/workflows/generative-query-test.yml

@@ -35,7 +35,7 @@ jobs:
       MB_GENTEST_LIMIT_SECONDS: ${{ inputs.seconds }}
       MB_GENTEST_RUN: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ inputs.ref }}
       - name: Prepare back-end environment
@@ -47,7 +47,7 @@ jobs:
         run: clojure -X:dev:ci:test:ee:ee-dev :only '${{ inputs.test }}'
 
       - name: Publish Test Report (JUnit)
-        uses: dorny/test-reporter@3eeb9fc888e82e8be2fb356bbeec2750231672bc # v1
+        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
         if: failure()
         with:
           path: "target/junit/**/*_test.xml"

.github/workflows/i18n.yml

@@ -19,9 +19,9 @@ jobs:
     outputs:
       i18n: ${{ steps.changes.outputs.i18n }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Test which files changed
-        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           token: ${{ github.token }}
@@ -33,7 +33,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment

.github/workflows/js-stats-update.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: get JS file count
         id: get-js-file-count
         run: |
@@ -22,7 +22,7 @@ jobs:
 
           echo "JS_FILES=$(($oss+$ee))" >> $GITHUB_OUTPUT
       - name: Upload count to Stats
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           JS_FILES: ${{ steps.get-js-file-count.outputs.JS_FILES }}
           API_KEY: ${{ secrets.STATS_API_KEY }}