Better tests

* dont need entities for collections methinks

* entities don't handle icons anymore

* revert url change (for now)

* fix tests

* fix verified model icon

* consistent handling of verified model icons

.claude/skills/_shared/clojure-commands.md

@@ -0,0 +1,81 @@
+## Linting and Formatting
+
+- **Lint PR:** `./bin/mage kondo-updated master` (or whatever target branch)
+  - Call the command one time at the beginning, record the results, then work through the problems one at a time.
+  - If the solution is obvious, then please apply the fix. Otherwise skip it.
+  - If you fix all the issues (and verify by rerunning the kondo-updated command):
+    - commit the change with a succinct and descriptive commit message
+- **Lint File:** `./bin/mage kondo <file or files>`
+  - Use the linter as a way to know that you are adhering to conventions in place in the codebase
+- **Lint Changes:** `./bin/mage kondo-updated HEAD`
+- **Format:** `./bin/mage cljfmt-files [path]`
+
+## Testing
+
+- **Run a test:** `./bin/mage run-tests namespace/test-name`
+- **Run all tests in a namespace:** `./bin/mage run-tests namespace`
+- **Run all tests for a module:** `./bin/mage run-tests test/metabase/notification` Because the module lives in that directory.
+
+Note: the `./bin/mage run-tests` command accepts multiple args, so you can pass
+`./bin/mage run-tests namespace/test-name namespace/other-test namespace/third-test`
+to run 3 tests, or
+`./bin/mage run-tests test/metabase/module1 test/metabase/module2` to run 2 modules.
+
+## Code Readability
+
+- **Check Code Readability:** `./bin/mage -check-readable <file> [line-number]`
+  - Run after every change to Clojure code
+  - Check specific line first, then entire file if readable
+
+## REPL Usage
+
+- **Evaluating Clojure Code:** `./bin/mage -repl '<code>'`
+  - See "Sending Code to the REPL" section for more details
+
+### Sending Code to the REPL
+
+- Send code to the metabase process REPL using: `./bin/mage -repl '(+ 1 1)'` where `(+ 1 1)` is your Clojure code.
+  - See `./bin/mage -repl -h` for more details.
+  - If the Metabase backend is not running, you'll see an error message with instructions on how to start it.
+
+#### Working with Files and Namespaces
+
+1. **Load a file and call functions with fully qualified names**:
+
+To call `your.namespace/your-function` on `arg1` and `arg2`:
+
+```
+./bin/mage -repl --namespace your.namespace '(your-function arg1 arg2)'
+```
+
+DO NOT use "require", "load-file" etc in the code string argument.
+
+#### Understanding the Response
+
+The `./bin/mage -repl` command returns three separate, independent outputs:
+
+- `value`: The return value of the last expression (best for data structures)
+- `stdout`: Any printed output from `println` etc. (best for messages)
+- `stderr`: Any error messages (best for warnings and errors)
+
+Example call:
+
+```bash
+./bin/mage -repl '(println "Hello, world!") '\''({0 1, 1 3, 2 0, 3 2} {0 2, 1 0, 2 3, 3 1})'
+```
+
+Example response:
+
+```
+ns: user
+session: 32a35206-871c-4553-9bc9-f49491173d1c
+value:  ({0 1, 1 3, 2 0, 3 2} {0 2, 1 0, 2 3, 3 1})
+stdout:  Hello, world!
+stderr:
+```
+
+For effective REPL usage:
+
+- Return data structures as function return values
+- Use `println` for human-readable messages
+- Print errors to stderr

.claude/skills/_shared/clojure-style-guide.md

@@ -0,0 +1,153 @@
+# Metabase Clojure Style Guide
+
+This guide covers Clojure and ClojureScript coding conventions for Metabase. See also: `CLOJURE_STYLE_GUIDE.adoc` for the Community Clojure Style Guide.
+
+## Naming Conventions
+
+**General Naming:**
+
+- Acceptable abbreviations: `acc`, `i`, `pred`, `coll`, `n`, `s`, `k`, `f`
+- Use `kebab-case` for all variables, functions, and constants
+
+**Function Naming:**
+
+- Pure functions should be nouns describing the value they return (e.g., `age` not `calculate-age` or `get-age`)
+- Functions with side effects must end with `!`
+- Don't repeat namespace alias in function names
+
+**Destructuring:**
+
+- Map destructuring should use kebab-case local bindings even if the map uses `snake_case` keys
+
+## Documentation Standards
+
+**Docstrings:**
+
+- Every public var in `src` or `enterprise/backend/src` must have docstring
+- Format using Markdown conventions
+- Reference other vars with `[[other-var]]` not backticks
+
+**Comments:**
+
+- `TODO` format: `;; TODO (Name M/D/YY) -- description`
+
+## Code Organization
+
+**Visibility:**
+
+- Make everything `^:private` unless it is used elsewhere
+- Try to organize namespaces to avoid `declare` (put public functions near the end)
+
+**Size and Structure:**
+
+- Break up functions > 20 lines
+- Lines ≤ 120 characters
+- No blank lines within definition forms (except pairwise `let`/`cond`)
+
+## Style Conventions
+
+**Keywords and Metadata:**
+
+- Prefer namespaced keywords for internal use: `:query-type/normal` not `:normal`
+- Tag variables with `:arglists` metadata if they're functions but wouldn't otherwise have it
+
+## Tests
+
+**Organization:**
+
+- Break large tests into separate `deftest` forms for logically separate test cases
+- Test names should end in `-test` or `-test-<number>`
+
+**Performance:**
+
+- Mark pure function tests `^:parallel`
+
+## Modules
+
+**OSS Modules:**
+
+- Follow `metabase.<module>.*` pattern
+- Source in `src/metabase/<module>/`
+
+**Enterprise Modules:**
+
+- Follow `metabase-enterprise.<module>.*` pattern
+- Source in `enterprise/backend/src/metabase_enterprise/<module>/`
+
+**Module Structure:**
+
+- REST API endpoints go in `<module>.api` or `<module>.api.*` namespaces
+- Put module public API in `<module>.core` using Potemkin imports
+- Put Toucan models in `<module>.models.*`
+- Put settings in `<module>.settings`
+- Put schemas in `<module>.schema`
+
+**Module Linters:**
+
+- Do not cheat module linters with `:clj-kondo/ignore [:metabase/modules]`
+
+## REST API Endpoints
+
+**Required Elements:**
+
+- All new endpoints must have response schemas (`:- <schema>` after route string)
+- All endpoints need Malli schemas for parameters (detailed and complete)
+- All new REST API endpoints MUST HAVE TESTS
+
+**Naming Conventions:**
+
+- Query parameters use kebab-case
+- Request bodies use `snake_case`
+- Routes use singular nouns (e.g., `/api/dashboard/:id`)
+
+**Behavior:**
+
+- `GET` endpoints should not have side effects (except analytics)
+- `defendpoint` forms should be small wrappers around Toucan model code
+
+## MBQL (Metabase Query Language)
+
+**Restrictions:**
+
+- No raw MBQL introspection outside of `lib`, `lib-be`, or `query-processor` modules
+- Use Lib and MBQL 5 in new source code; avoid legacy MBQL
+
+## Database and Models
+
+**Naming:**
+
+- Model names and table names should be singular nouns
+- Application database uses `snake_case` identifiers
+
+**Best Practices:**
+
+- Use `t2/select-one-fn` instead of fetching entire rows for one column
+- Put correct behavior in Toucan methods, not separate helper functions
+
+## Drivers
+
+**Documentation:**
+
+- New driver multimethods must be mentioned in `docs/developers-guide/driver-changelog.md`
+
+**Implementation:**
+
+- Driver implementations should pass `driver` argument to other driver multimethods
+- Don't hardcode driver names in implementations
+- Minimize logic inside `read-column-thunk` in JDBC-based drivers
+
+## Miscellaneous
+
+**Examples:**
+
+- Example data should be bird-themed if possible
+
+**Linter Suppressions:**
+
+- Use proper format for kondo suppressions
+- No `#_:clj-kondo/ignore` (keyword form)
+
+**Configurable Options:**
+
+- Don't define configurable options that can only be set with environment variables
+- Use `:internal` `defsetting` instead

.claude/skills/_shared/development-workflow.md

@@ -0,0 +1,8 @@
+# Autonomous Development Workflow
+
+- Do not attempt to read or edit files outside the project folder
+- Add failing tests first, then fix them
+- Work autonomously in small, testable increments
+- Run targeted tests, and lint continuously during development
+- Prioritize understanding existing patterns before implementing
+- Don't commit changes, leave it for the user to review and make commits

.claude/skills/_shared/metabase-style-guide.md

@@ -0,0 +1,84 @@
+# Metabase Writing Style Guide
+
+## Core Principles
+
+Write like you're talking to a colleague. Be conversational, not formal. Get people what they need quickly. Know your audience and match the complexity.
+
+## Tone and Voice
+
+**Do:**
+
+- Use contractions ("can't" not "cannot")
+- Say "people" or "companies" instead of "users"
+- Be friendly but not peppy
+- Acknowledge limitations honestly ("that's on us, not them")
+- Jokes and Easter eggs are okay (permit them, don't suggest them)
+
+**Don't:**
+
+- Use exclamation points excessively
+- Rely on tired tropes about nerdiness
+- Use corporate jargon ("utilize", "offerings", "actionable insights")
+- Tell people something is cool (show them instead)
+
+## Structure and Clarity
+
+**Lead with the important stuff:**
+
+- Most important information first
+- Lead with the ask, then provide context
+- Cut text that adds little value (when in doubt, cut it)
+- Each paragraph should have one clear purpose
+
+**Make headings do the work:**
+
+- Convey your actual point, not just the topic
+- "Use headings to highlight key points" not "How to write a good heading"
+- Use sentence case, no punctuation except question marks
+- No links in headings unless entire heading is a link
+
+## Instructions and Examples
+
+**Tell people what to do:**
+
+- Give the action before explaining why
+- Put commands in execution order
+- Provide context, steps, and reasoning
+- Don't describe tasks as "easy" or "simple"
+
+**Answer unasked questions:**
+
+- Include answers to "dumb" questions you had when learning
+- Don't literally include the question, just give the answer
+
+## Formatting
+
+**Code vs. UI elements:**
+
+- Backticks for code, variable names, parameters only
+- **Bold** for UI elements and labels (e.g., "Click the **Save** button")
+- Don't use backticks or quotes for UI elements
+
+## Writing Mechanics
+
+- Limit pronouns when introducing new terms (repeat the term to reinforce it)
+- Ampersands only in proper nouns, never as substitute for "and"
+
+## Terminology Preferences
+
+Use familiar terms from tools people already know:
+
+- "Summarize" (like Excel) instead of "aggregate"
+- "Take a look at" instead of "reference"
+- "Filter" instead of technical database terms when appropriate
+
+## Red Flags
+
+Avoid these patterns:
+
+- Multiple exclamation points
+- Linking "here"
+- Bullet lists to explain (use prose)
+- Numbers that will change (guard against change)
+- Describing things as "easy" or "simple"
+- Stock photography-worthy content

.claude/skills/_shared/typescript-commands.md

@@ -0,0 +1,21 @@
+## Linting and Formatting
+
+- **Lint:** `yarn lint-eslint-pure`
+  - Run ESLint on the codebase
+- **Format:** `yarn prettier`
+  - Format code using Prettier
+- **Type Check:** `yarn type-check-pure`
+  - Run TypeScript type checking
+
+## Testing
+
+### JavaScript/TypeScript Tests
+
+- **Test a specific file:** `yarn test-unit-keep-cljs path/to/file.unit.spec.js`
+- **Test by pattern:** `yarn test-unit-keep-cljs -t "pattern"`
+  - Runs tests matching the given pattern
+
+### ClojureScript Tests
+
+- **Test ClojureScript:** `yarn test-cljs`
+  - Run ClojureScript tests

.claude/skills/clojure-review/SKILL.md

@@ -0,0 +1,144 @@
+---
+name: clojure-review
+description: Review Clojure and ClojureScript code changes for compliance with Metabase coding standards, style violations, and code quality issues. Use when reviewing pull requests or diffs containing Clojure/ClojureScript code.
+allowed-tools: Read, Grep, Bash, Glob
+---
+
+# Clojure Code Review Skill
+
+@./../_shared/clojure-style-guide.md
+@./../_shared/clojure-commands.md
+
+## Review guidelines
+
+**What to flag:**
+
+- Check compliance with the Metabase Clojure style guide (included above)
+- If `CLOJURE_STYLE_GUIDE.adoc` exists in the working directory, also check compliance with the community Clojure style guide
+- Flag all style guide violations
+
+**What NOT to post:**
+
+- Do not post comments congratulating someone for trivial changes or for following style guidelines
+- Do not post comments confirming things "look good" or telling them they did something correctly
+- Only post comments about style violations or potential issues
+
+Example bad code review comments to avoid:
+
+> This TODO comment is properly formatted with author and date - nice work!
+
+> Good addition of limit 1 to the query - this makes the test more efficient without changing its behavior.
+
+> The kondo ignore comment is appropriately placed here
+
+> Test name properly ends with -test as required by the style guide.
+
+**Special cases:**
+
+- Do not post comments about missing parentheses (these will be caught by the linter)
+
+## Quick review checklist
+
+Use this to scan through changes efficiently:
+
+### Naming
+
+- [ ] Descriptive names (no `tbl`, `zs'`)
+- [ ] Pure functions named as nouns describing their return value
+- [ ] `kebab-case` for all variables and functions
+- [ ] Side-effect functions end with `!`
+- [ ] No namespace-alias repetition in function names
+
+### Documentation
+
+- [ ] Public vars in `src` or `enterprise/backend/src` have useful docstrings
+- [ ] Docstrings use Markdown conventions
+- [ ] References use `[[other-var]]` not backticks
+- [ ] `TODO` comments include author and date: `;; TODO (Name 1/1/25) -- description`
+
+### Code Organization
+
+- [ ] Everything `^:private` unless used elsewhere
+- [ ] No `declare` when avoidable (public functions near end)
+- [ ] Functions under 20 lines when possible
+- [ ] No blank lines within definition forms (except pairwise constructs in `let`/`cond`)
+- [ ] Lines ≤ 120 characters
+
+### Tests
+
+- [ ] Separate `deftest` forms for distinct test cases
+- [ ] Pure tests marked `^:parallel`
+- [ ] Test names end in `-test` or `-test-<number>`
+
+### Modules
+
+- [ ] Correct module patterns (OSS: `metabase.<module>.*`, EE: `metabase-enterprise.<module>.*`)
+- [ ] API endpoints in `<module>.api` namespaces
+- [ ] Public API in `<module>.core` with Potemkin
+- [ ] No cheating module linters with `:clj-kondo/ignore [:metabase/modules]`
+
+### REST API
+
+- [ ] Response schemas present (`:- <schema>`)
+- [ ] Query params use kebab-case, bodies use `snake_case`
+- [ ] Routes use singular nouns (e.g., `/api/dashboard/:id`)
+- [ ] `GET` has no side effects (except analytics)
+- [ ] Malli schemas detailed and complete
+- [ ] All new endpoints have tests
+
+### MBQL
+
+- [ ] No raw MBQL manipulation outside `lib`, `lib-be`, or `query-processor` modules
+- [ ] Uses Lib and MBQL 5, not legacy MBQL
+
+### Database
+
+- [ ] Model and table names are singular nouns
+- [ ] Uses `t2/select-one-fn` instead of selecting full rows for one column
+- [ ] Logic in Toucan methods, not helper functions
+
+### Drivers
+
+- [ ] New multimethods documented in `docs/developers-guide/driver-changelog.md`
+- [ ] Passes `driver` argument to other driver methods (no hardcoded driver names)
+- [ ] Minimal logic in `read-column-thunk`
+
+### Miscellaneous
+
+- [ ] Example data is bird-themed when possible
+- [ ] Kondo linter suppressions use proper format (not `#_:clj-kondo/ignore` keyword form)
+
+## Pattern matching table
+
+Quick scan for common issues:
+
+| Pattern                                      | Issue                                                       |
+| -------------------------------------------- | ----------------------------------------------------------- |
+| `calculate-age`, `get-user`                  | Pure functions should be nouns: `age`, `user`               |
+| `update-db`, `save-model`                    | Missing `!` for side effects: `update-db!`, `save-model!`   |
+| `snake_case_var`                             | Should use kebab-case                                       |
+| Public var without docstring                 | Add docstring explaining purpose                            |
+| `;; TODO fix this`                           | Missing author/date: `;; TODO (Name 1/1/25) -- description` |
+| `(defn foo ...)` in namespace used elsewhere | Should be `(defn ^:private foo ...)`                        |
+| Function > 20 lines                          | Consider breaking up into smaller functions                 |
+| `/api/dashboards/:id`                        | Use singular: `/api/dashboard/:id`                          |
+| Query params with `snake_case`               | Use kebab-case for query params                             |
+| New API endpoint without tests               | Add tests for the endpoint                                  |
+
+## Feedback format examples
+
+**For style violations:**
+
+> This pure function should be named as a noun describing its return value. Consider `user` instead of `get-user`.
+
+**For missing documentation:**
+
+> This public var needs a docstring explaining its purpose, inputs, and outputs.
+
+**For organization issues:**
+
+> This function is only used in this namespace, so it should be marked `^:private`.
+
+**For API conventions:**
+
+> Query parameters should use kebab-case. Change `user_id` to `user-id`.

.claude/skills/clojure-write/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: clojure-write
+description: Guide Clojure and ClojureScript development using REPL-driven workflow, coding conventions, and best practices. Use when writing, developing, or refactoring Clojure/ClojureScript code.
+---
+
+# Clojure Development Skill
+
+@./../_shared/development-workflow.md
+@./../_shared/clojure-style-guide.md
+@./../_shared/clojure-commands.md
+
+## REPL-Driven Development Workflow
+
+- Start with small, fundamental functions:
+- Identify the core features or functionalities required for your task.
+- Break each feature down into the smallest, most basic functions that can be developed and tested independently.
+- Write and test in the REPL:
+  - Write the code for each small function directly in the REPL (Read-Eval-Print Loop).
+  - Test it thoroughly with a variety of inputs, including typical use cases and relevant edge cases, to ensure it
+    behaves as expected.
+- Integrate into source code:
+  - Once a function works correctly in the REPL, move it from the REPL environment into your source code files (e.g.,
+    within appropriate namespaces).
+- Gradually increase complexity:
+  - Build upon tested, basic functions to create more complex functions or components.
+  - Compose smaller functions together, testing each new composition in the REPL to verify correctness step by step.
+- Ensure dependency testing:
+  - Make sure every function is fully tested in the REPL before it is depended upon by other functions.
+  - This ensures that each layer of your application is reliable before you build on it.
+- Use the REPL fully:
+  - Use the REPL as your primary tool to experiment with different approaches, iterate quickly, and get immediate
+    feedback on your code.
+- Follow functional programming principles:
+  - Keep functions small, focused, and composable.
+  - Use Clojure's functional programming features—like immutability, higher-order functions, and the standard
+    library—to write concise, effective code.
+
+## How to Evaluate Code
+
+### Bottom-up Dev Loop
+
+1. Write code into a file.
+2. Evaluate the file's namespace and make sure it loads correctly with:
+
+```
+./bin/mage -repl --namespace metabase.app-db.connection
+```
+
+3. Call functions in the namespace with test inputs, and observe that the outputs are correct
+   Feel free to copy these REPL session trials into actual test cases using `deftest` and `is`.
+4. Once you know these functions are good, return to 1, and compose them into the task that you need to build.
+
+## Critical Rules for Editing
+
+- Be careful with parentheses counts when editing Clojure code
+- After EVERY change to Clojure code, verify readability with `-check-readable`
+- End all files with a newline
+- When editing tabular code, where the columns line up, try to keep them aligned
+- Spaces on a line with nothing after it is not allowed

.claude/skills/docs-review/SKILL.md

@@ -0,0 +1,168 @@
+---
+name: docs-review
+description: Review documentation changes for compliance with the Metabase writing style guide. Use when reviewing pull requests, files, or diffs containing documentation markdown files.
+allowed-tools: Read, Grep, Bash, Glob
+---
+
+# Documentation Review Skill
+
+@./../_shared/metabase-style-guide.md
+
+## Review mode detection
+
+**IMPORTANT: Before starting the review, determine which mode to use:**
+
+1. **PR review mode**: If the `mcp__github__create_pending_pull_request_review` tool is available, you are reviewing a GitHub PR
+   - Use the pending review workflow to post all issues as one cohesive review
+   - Follow the workflow steps in "PR review mode format" below
+
+2. **Local review mode**: If the MCP tool is NOT available, output issues in the conversation
+   - Format all issues in a numbered markdown list (as described in "Feedback format" below)
+
+## Review process
+
+1. **Detect review mode** - Check if `mcp__github__create_pending_pull_request_review` is available
+2. Read the changes through once to understand intent
+3. Check all issues that violate style guide or significantly impact readability
+4. Only flag issues worth mentioning - if it won't make a material difference to the reader, skip it
+5. **REQUIRED: Number ALL feedback sequentially** - Start from Issue 1 and increment for each issue found
+
+## Review checklist
+
+Run through the diff looking for these issues:
+
+**Tone and voice:**
+
+- [ ] Formal/corporate language ("utilize" not "use", "offerings", etc.)
+- [ ] "Users" instead of "people" or "companies"
+- [ ] Excessive exclamation points or overly peppy tone
+- [ ] Telling readers something is cool instead of showing them
+
+**Structure and clarity:**
+
+- [ ] Important information buried instead of leading
+- [ ] Verbose text that adds little value
+- [ ] Paragraphs without clear purpose
+- [ ] Vague headings that don't convey the point
+- [ ] Instructions explain "why" before telling "what to do"
+- [ ] Tasks described as "easy" or "simple"
+
+**Links and references:**
+
+- [ ] Linking the word "here" instead of descriptive text
+- [ ] Links in headings (unless entire heading is a link)
+
+**Formatting:**
+
+- [ ] Backticks on UI elements (should use **bold**)
+- [ ] Backticks used as quotation marks
+- [ ] Ampersands as "and" substitute (except proper nouns)
+- [ ] Inconsistent list formatting
+
+**Code and examples:**
+
+- [ ] Code examples that don't work or would error
+- [ ] Commands not in execution order
+- [ ] Full-width screenshots instead of scoped UI elements
+- [ ] Excessive or unnecessary images
+
+**Sentence construction:**
+
+- [ ] Overuse of pronouns when introducing new terms
+
+## Quick scan table
+
+| Pattern                       | Issue                                         |
+| ----------------------------- | --------------------------------------------- |
+| `Button name` or `UI element` | Should use **bold** not backticks             |
+| we can do X, our feature      | Should be "Metabase" or "it"                  |
+| click here, read more here    | Need descriptive link text                    |
+| easy, simple, just            | Remove condescending qualifiers               |
+| users                         | Should be "people" or "companies" if possible |
+
+## Feedback format
+
+**MANDATORY REQUIREMENT: Every single issue MUST be numbered sequentially starting from Issue 1.**
+
+This numbered format is NON-NEGOTIABLE. It allows users to efficiently reference specific issues (e.g., "fix issues 1, 3, and 5") and track which feedback has been addressed.
+
+### Local review mode format
+
+When outputting issues in the conversation (local mode), use this format:
+
+```markdown
+## Issues
+
+**Issue 1: [Brief title]**
+Line X: Succinct description of the issue
+[code or example]
+Suggested fix or succinct explanation
+
+**Issue 2: [Brief title]**
+Line Y: Description of the issue
+Suggested fix or explanation
+
+**Issue 3: [Brief title]**
+...
+```
+
+**Examples:**
+
+> **Issue 1: Backticks on UI elements**
+> Line 42: This uses backticks for the UI element. Use **bold** instead: **Filter** not `Filter`.
+
+> **Issue 2: Formal tone**
+> Line 15: This could be more conversational. Consider: "You can't..." instead of "You cannot..."
+
+> **Issue 3: Vague heading**
+> Line 8: The heading could be more specific. Try stating the point directly: "Run migrations before upgrading" vs "Upgrade process"
+
+### PR review mode format
+
+When posting to GitHub (PR mode), use the **pending review workflow**:
+
+**Workflow steps:**
+
+1. **Start a review**: Use `mcp__github__create_pending_pull_request_review` to begin a pending review
+   - This creates a draft review that won't be visible until submitted
+
+2. **Get diff information**: Use `mcp__github__get_pull_request_diff` to understand the code changes and line numbers
+   - This helps you determine the correct file paths and line numbers for comments
+
+3. **Identify ALL issues**: Read through all changes and identify every issue worth mentioning
+   - Collect all issues before posting any comments
+   - Number them sequentially (Issue 1, Issue 2, Issue 3, etc.)
+
+4. **Add review comments**: Use `mcp__github__add_pull_request_review_comment_to_pending_review` for each issue
+   - **CRITICAL**: Post ALL comments in a SINGLE response using multiple tool calls in parallel
+   - Each comment should reference a specific file path and line number from the diff
+   - Start each comment body with `**Issue N: [Brief title]**`
+   - Include the description and suggested fix
+
+5. **Submit the review**: Use `mcp__github__submit_pending_pull_request_review` to publish all comments at once
+   - Use event type `"COMMENT"` (NOT "REQUEST_CHANGES") to make it non-blocking
+   - **Do NOT include a body message** - Leave the body empty or omit it entirely
+   - All comments will appear together as one cohesive review
+
+**Comment format example:**
+```
+**Issue 1: Backticks on UI elements**
+
+This uses backticks for the UI element. Use **bold** instead: **Filter** not `Filter`.
+```
+
+**IMPORTANT**:
+- Each issue gets its own review comment attached to the pending review
+- Number ALL comments sequentially (Issue 1, Issue 2, Issue 3, etc.)
+- Always start the comment body with `**Issue N: [Brief title]**`
+- **MUST add all comments in parallel in a single response** - Do NOT add them one after another in separate responses
+- Do NOT output a summary message to the conversation - only post GitHub review comments
+- When submitting the review, do NOT include a body parameter (or leave it empty) to avoid cluttering the PR with summary text
+- The review will appear as a single review with multiple comments when submitted
+
+## Final check
+
+1. Remove any issues from your assessment that won't make a material difference to the reader if addressed. Only flag issues worth the author's time to fix.
+2. **Verify all issues are numbered sequentially** starting from Issue 1 with no gaps in numbering.
+3. Confirm the format exactly matches: `**Issue N: [Brief title]**` where N is the issue number.
+4. **In PR mode**: Verify each issue was posted as a separate GitHub comment (not output to conversation).

.claude/skills/docs-write/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: docs-write
+description: Write documentation following Metabase's conversational, clear, and user-focused style. Use when creating or editing documentation files (markdown, MDX, etc.).
+allowed-tools: Read, Write, Grep, Bash, Glob
+---
+
+# Documentation Writing Skill
+
+@./../_shared/metabase-style-guide.md
+
+## When writing documentation
+
+### Start here
+
+1. **Who is this for?** Match complexity to audience. Don't oversimplify hard things or overcomplicate simple ones.
+2. **What do they need?** Get them to the answer fast. Nobody wants to be in docs longer than necessary.
+3. **What did you struggle with?** Those common questions you had when learning? Answer them (without literally including the question).
+
+### Writing process
+
+**Draft:**
+
+- Write out the steps/explanation as you'd tell a colleague
+- Lead with what to do, then explain why
+- Use headings that state your point: "Set SAML before adding users" not "SAML configuration timing"
+
+**Edit:**
+
+- Read aloud. Does it sound like you talking? If it's too formal, simplify.
+- Cut anything that doesn't directly help the reader
+- Check each paragraph has one clear purpose
+- Verify examples actually work (don't give examples that error)
+
+**Polish:**
+
+- Make links descriptive (never "here")
+- Backticks only for code/variables, **bold** for UI elements
+- American spelling, serial commas
+- Keep images minimal and scoped tight
+
+**Format:**
+
+- Run prettier on the file after making edits: `yarn prettier --write <file-path>`
+- This ensures consistent formatting across all documentation
+
+### Common patterns
+
+**Instructions:**
+
+```markdown
+Run:
+\`\`\`
+command-to-run
+\`\`\`
+
+Then:
+\`\`\`
+next-command
+\`\`\`
+
+This ensures you're getting the latest changes.
+```
+
+Not: "(remember to run X before Y...)" buried in a paragraph.
+
+**Headings:**
+
+- "Use environment variables for configuration" ✅
+- "Environment variables" ❌ (too vague)
+- "How to use environment variables for configuration" ❌ (too wordy)
+
+**Links:**
+
+- "Check out the [SAML documentation](link)" ✅
+- "Read the docs [here](link)" ❌
+
+### Watch out for
+
+- Describing tasks as "easy" (you don't know the reader's context)
+- Using "we" when talking about Metabase features (use "Metabase" or "it")
+- Formal language: "utilize", "reference", "offerings"
+- Too peppy: multiple exclamation points
+- Burying the action in explanation
+- Code examples that don't work
+- Numbers that will become outdated
+
+### Quick reference
+
+| Write This                 | Not This           |
+| -------------------------- | ------------------ |
+| people, companies          | users              |
+| summarize                  | aggregate          |
+| take a look at             | reference          |
+| can't, don't               | cannot, do not     |
+| **Filter** button          | \`Filter\` button  |
+| Check out [the docs](link) | Click [here](link) |

.claude/skills/typescript-review/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: typescript-review
+description: Review TypeScript and JavaScript code changes for compliance with Metabase coding standards, style violations, and code quality issues. Use when reviewing pull requests or diffs containing TypeScript/JavaScript code.
+allowed-tools: Read, Grep, Bash, Glob
+---
+
+# TypeScript/JavaScript Code Review Skill
+
+@./../_shared/typescript-commands.md
+
+## Code Review Guidelines
+
+Review pull requests with a focus on:
+
+- Compliance with project coding standards and conventions
+- Code quality and best practices
+- Clear and correct JSDoc comments
+- Type safety and proper TypeScript usage
+- React best practices (when applicable)

.claude/skills/typescript-write/SKILL.md

@@ -0,0 +1,9 @@
+---
+name: typescript-write
+description: Write TypeScript and JavaScript code following Metabase coding standards and best practices. Use when developing or refactoring TypeScript/JavaScript code.
+---
+
+# TypeScript/JavaScript Development Skill
+
+@./../_shared/development-workflow.md
+@./../_shared/typescript-commands.md

.clj-kondo/config.edn

@@ -25,6 +25,7 @@
   :reduce-without-init          {:level :warning}
   :redundant-call               {:level :warning}
   :redundant-fn-wrapper         {:level :warning}
+  :redundant-str-call           {:level :warning}
   :self-requiring-namespace     {:level :warning}
   :single-key-in                {:level :warning}
   :unsorted-imports             {:level :warning}
@@ -55,20 +56,22 @@
   ;;
   ;; globally-enabled custom linters
   ;;
-  :metabase/check-defmulti-arglists                    {:level :warning}
-  :metabase/check-me-humanize                          {:level :warning}
-  :metabase/defsetting-must-specify-export             {:level :warning}
-  :metabase/defsetting-namespace                       {:level :warning}
-  :metabase/mbql-query-first-arg                       {:level :warning}
-  :metabase/missing-test-expr-requires-in-cljs         {:level :warning}
-  :metabase/modules                                    {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
-  :metabase/namespace-name                             {:level :warning}
-  :metabase/require-shape-checker                      {:level :warning}
-  :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
-  :metabase/validate-logging                           {:level :warning}
-  :metabase/validate-mb-driver-tests                   {:level :warning}
-  :metabase/validate-mb-once                           {:level :warning}
-  :metabase/discourage-millis-duration                 {:level :warning}
+  :metabase/check-defmulti-arglists                          {:level :warning}
+  :metabase/check-me-humanize                                {:level :warning}
+  :metabase/defsetting-must-specify-export                   {:level :warning}
+  :metabase/defsetting-namespace                             {:level :warning}
+  :metabase/discourage-millis-duration                       {:level :warning}
+  :metabase/mbql-query-first-arg                             {:level :warning}
+  :metabase/missing-test-expr-requires-in-cljs               {:level :warning}
+  :metabase/modules                                          {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
+  :metabase/namespace-name                                   {:level :warning}
+  :metabase/require-shape-checker                            {:level :warning}
+  :metabase/test-helpers-use-non-thread-safe-functions       {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
+  :metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
+  :metabase/validate-defendpoint-query-params-use-kebab-case {:level :warning}
+  :metabase/validate-logging                                 {:level :warning}
+  :metabase/validate-mb-driver-tests                         {:level :warning}
+  :metabase/validate-mb-once                                 {:level :warning}
 
   :metabase/validate-deftest
   {:level :warning
@@ -173,6 +176,7 @@
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
      metabase.notification.models/create-notification!
      metabase.pulse.send/send-pulse!
+     metabase-enterprise.transforms-python.python-runner-test/execute!
      ;; Safe in tests, where we typically use a private, temporary index per thread.
      metabase.search.core/reindex!
      metabase.util/run-count!
@@ -228,7 +232,7 @@
     (clojure.core.logic/fresh)
     (clojure.core.logic/matcha)
     (clojure.core.logic/run)
-    (clojure.test/is [query= =? malli= qv=])
+    (clojure.test/is [=? malli= qv=])
     (clojure.tools.macro/macrolet)
     instaparse.core/transform
     (metabase.server.streaming-response/streaming-response)
@@ -272,6 +276,7 @@
    clojure.java.jdbc/with-db-connection               {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/with-db-connection"}
    clojure.java.jdbc/with-db-metadata                 {:message "Use sql-jdbc.execute/do-with-connection-with-options + .getMetaData instead of jdbc/with-db-metadata"}
    clojure.pprint/pprint                              {:message "Use metabase.util.log instead of clojure.pprint/pprint"}
+   clojure.pprint/print-table                         {:message "Use metabase.util.log instead of printing directly to the console"}
    clojure.string/lower-case                          {:message "Use metabase.util/lower-case-en instead of clojure.string/lower-case"}
    clojure.string/upper-case                          {:message "Use metabase.util/upper-case-en instead of clojure.string/upper-case"}
    compojure.core/context                             {:message "Use metabase.api.util.handlers/route-map-handler instead of compojure.core/context, it is much faster and supports OpenAPI spec generation"}
@@ -418,6 +423,7 @@
   metabase-enterprise.transforms.api-test/with-transform-tags                           clojure.core/let
   metabase-enterprise.transforms.api-test/with-worker-runs                              clojure.core/let
   metabase-enterprise.transforms.test-util/with-transform-cleanup!                      clojure.core/let
+  metabase-enterprise.transforms.execute/with-transform-lifecycle                       clojure.core/let
   metabase.actions.test-util/with-actions                                               clojure.core/let
   metabase.api.common/let-404                                                           clojure.core/let
   metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
@@ -486,8 +492,9 @@
   metabase.util.malli/defn-                                                             schema.core/defn
   metabase.util.malli/fn                                                                schema.core/fn
   metabase.util.namespaces/import-fns                                                   potemkin/import-vars
+  metabase.util.performance/doseq                                                       clojure.core/doseq
+  metabase.util.performance/for                                                         clojure.core/for
   metabase.util/with-timer-ms                                                           clojure.core/fn
-  metabase.xrays.domain-entities.malli/defn                                             schema.core/defn
   metabuild-common.core/with-open-jar-file-system                                       clojure.core/let
   metabuild-common.files/with-open-jar-file-system                                      clojure.core/let
   monger.operators/defoperator                                                          clojure.core/def
@@ -517,8 +524,10 @@
    metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
    metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
+   metabase-enterprise.metabot-v3.tools.dependencies-test/with-dependent-transforms!                                         hooks.common/with-two-bindings
    metabase-enterprise.semantic-search.db.connection/with-migrate-tx                                                         hooks.common/let-one-with-optional-value
    metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
+   metabase-enterprise.transforms-python.drivers-test/with-test-table                                                        hooks.common/with-two-bindings
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
    metabase.api.macros/defendpoint                                                                                           hooks.metabase.api.macros/defendpoint
    metabase.app-db.schema-migrations-test.impl/test-migrations                                                               hooks.metabase.app-db.schema-migrations-test.impl/test-migrations
@@ -527,11 +536,11 @@
    metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
    metabase.classloader.core/require                                                                                         hooks.clojure.core.require/lint-require
    metabase.classloader.impl/require                                                                                         hooks.clojure.core.require/lint-require
-   metabase.collections.api-test/with-french-user-and-personal-collection!                                                   hooks.common/with-two-top-level-bindings
+   metabase.collections-rest.api-test/with-french-user-and-personal-collection!                                              hooks.common/with-two-top-level-bindings
    metabase.collections.models.collection-test/with-collection-hierarchy!                                                    hooks.common/let-one-with-optional-value
    metabase.collections.models.collection-test/with-personal-and-impersonal-collections                                      hooks.common/with-two-bindings
-   metabase.dashboards.api-test/with-chain-filter-fixtures                                                                   hooks.common/let-one-with-optional-value
-   metabase.dashboards.api-test/with-simple-dashboard-with-tabs                                                              hooks.common/with-one-binding
+   metabase.dashboards-rest.api-test/with-chain-filter-fixtures                                                              hooks.common/let-one-with-optional-value
+   metabase.dashboards-rest.api-test/with-simple-dashboard-with-tabs                                                         hooks.common/with-one-binding
    metabase.dashboards.models.dashboard-tab-test/with-dashtab-in-personal-collection                                         hooks.common/with-one-top-level-binding
    metabase.dashboards.models.dashboard-test/with-dash-in-collection!                                                        hooks.common/with-three-bindings
    metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
@@ -539,11 +548,13 @@
    metabase.driver.oracle-test/with-temp-user                                                                                hooks.common/let-one-with-optional-value
    metabase.driver/register!                                                                                                 hooks.metabase.driver/register!
    metabase.driver-api/defenterprise                                                                                         hooks.metabase.premium-features.defenterprise/defenterprise
-   metabase.embedding.api.embed-test/do-response-formats                                                                     hooks.common/with-two-bindings
-   metabase.embedding.api.embed-test/with-chain-filter-fixtures!                                                             hooks.common/let-one-with-optional-value
-   metabase.embedding.api.embed-test/with-temp-card                                                                          hooks.common/let-one-with-optional-value
-   metabase.embedding.api.embed-test/with-temp-dashcard                                                                      hooks.common/let-one-with-optional-value
+   metabase.embedding-rest.api.embed-test/do-response-formats                                                                hooks.common/with-two-bindings
+   metabase.embedding-rest.api.embed-test/with-chain-filter-fixtures!                                                        hooks.common/let-one-with-optional-value
+   metabase.embedding-rest.api.embed-test/with-temp-card                                                                     hooks.common/let-one-with-optional-value
+   metabase.embedding-rest.api.embed-test/with-temp-dashcard                                                                 hooks.common/let-one-with-optional-value
    metabase.legacy-mbql.schema.macros/defclause                                                                              hooks.metabase.legacy-mbql.schemas.macros/defclause
+   metabase.legacy-mbql.schema.macros/defclause*                                                                             hooks.metabase.legacy-mbql.schemas.macros/defclause*
+   metabase.legacy-mbql.schema.macros/one-of                                                                                 hooks.metabase.legacy-mbql.schemas.macros/one-of
    metabase.lib.schema.mbql-clause/define-catn-mbql-clause                                                                   hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.schema.mbql-clause/define-mbql-clause                                                                        hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.schema.mbql-clause/define-tuple-mbql-clause                                                                  hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
@@ -560,18 +571,18 @@
    metabase.permissions.core/disable-perms-cache                                                                             hooks.common/do*
    metabase.premium-features.core/defenterprise                                                                              hooks.metabase.premium-features.defenterprise/defenterprise
    metabase.premium-features.defenterprise/defenterprise                                                                     hooks.metabase.premium-features.defenterprise/defenterprise
-   metabase.public-sharing.api-test/with-required-param-card!                                                                hooks.common/with-one-binding
-   metabase.public-sharing.api-test/with-temp-public-card                                                                    hooks.common/let-one-with-optional-value
-   metabase.public-sharing.api-test/with-temp-public-dashboard                                                               hooks.common/let-one-with-optional-value
-   metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                                                      hooks.common/with-three-bindings
+   metabase.public-sharing-rest.api-test/with-required-param-card!                                                           hooks.common/with-one-binding
+   metabase.public-sharing-rest.api-test/with-temp-public-card                                                               hooks.common/let-one-with-optional-value
+   metabase.public-sharing-rest.api-test/with-temp-public-dashboard                                                          hooks.common/let-one-with-optional-value
+   metabase.public-sharing-rest.api-test/with-temp-public-dashboard-and-card                                                 hooks.common/with-three-bindings
    metabase.pulse.api.alert-test/with-alert-in-collection!                                                                   hooks.common/with-four-bindings
    metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard                                           hooks.common/let-second
    metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection!                                               hooks.common/with-four-bindings
    metabase.pulse.models.pulse-test/with-pulse-in-collection!                                                                hooks.common/with-four-bindings
    metabase.pulse.test-util/checkins-query-card                                                                              hooks.metabase.test.data/$ids
    metabase.queries.api.card-test/with-card-param-values-fixtures                                                            hooks.common/let-one-with-optional-value
-   metabase.queries.api.card-test/with-temp-native-card!                                                                     hooks.common/with-two-bindings
-   metabase.queries.api.card-test/with-temp-native-card-with-params!                                                         hooks.common/with-two-bindings
+   metabase.queries.api.card-test/with-temp-native-card                                                                      hooks.common/with-two-bindings
+   metabase.queries.api.card-test/with-temp-native-card-with-params                                                          hooks.common/with-two-bindings
    metabase.query-processor-test.expressions-test/calculate-bird-scarcity                                                    hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
    metabase.query-processor-test.filter-test/count-with-filter-clause                                                        hooks.metabase.test.data/$ids
    metabase.query-processor.middleware.cache-test/with-mock-cache!                                                           hooks.common/with-two-bindings
@@ -621,10 +632,11 @@
    metabase.test/with-non-admin-groups-no-root-collection-perms                                                              hooks.common/do*
    metabase.test/with-persistence-enabled!                                                                                   hooks.metabase.model-persistence.test-util/with-persistence-enabled!
    metabase.test/with-prometheus-system!                                                                                     hooks.common/with-two-bindings
+   metabase.test/with-random-premium-token!                                                                                  hooks.common/with-one-binding
    metabase.test/with-temp                                                                                                   hooks.toucan2.tools.with-temp/with-temp
    metabase.test/with-temp-file                                                                                              hooks.metabase.test.util/with-temp-file
    metabase.test/with-temporary-setting-values                                                                               hooks.metabase.test.util/with-temporary-setting-values
-   metabase.users.api-test/with-temp-user-email!                                                                              hooks.common/with-one-binding
+   metabase.users-rest.api-test/with-temp-user-email!                                                                        hooks.common/with-one-binding
    metabase.util.i18n/deferred-trs                                                                                           hooks.metabase.util.i18n/deferred-trs
    metabase.util.i18n/deferred-tru                                                                                           hooks.metabase.util.i18n/deferred-tru
    metabase.util.i18n/trs                                                                                                    hooks.metabase.util.i18n/trs
@@ -648,44 +660,43 @@
    metabase.xrays.api.automagic-dashboards-test/with-indexed-model!                                                          hooks.metabase.xrays.api.automagic-dashboards-test/with-indexed-model!}
 
   :macroexpand
-  {clojurewerkz.quartzite.jobs/build                                                       macros.quartz/build-job
-   clojurewerkz.quartzite.schedule.calendar-interval/build                                 macros.quartz/build-job
-   clojurewerkz.quartzite.schedule.cron/schedule                                           macros.quartz/schedule
-   clojurewerkz.quartzite.schedule.simple/schedule                                         macros.quartz/simple-schedule
-   clojurewerkz.quartzite.triggers/build                                                   macros.quartz/build-trigger
-   metabase-enterprise.database-routing.e2e-test/with-temp-dbs!                            macros.metabase-enterprise.database-routing.e2e-test/with-temp-dbs!
-   metabase-enterprise.impersonation.util-test/with-impersonations!                        macros.metabase-enterprise.impersonation.util-test/with-impersonations!
-   metabase-enterprise.query-reference-validation.api-test/with-test-setup!                macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
-   metabase-enterprise.sandbox.test-util/with-gtaps!                                       macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                              macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.serialization.test-util/with-world                                  macros.metabase-enterprise.serialization.test-util/with-world
-   metabase-enterprise.test/with-gtaps!                                                    macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.test/with-gtaps-for-user!                                           macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase.collections.api-test/with-collection-hierarchy!                                macros.metabase.collections.api-test/with-collection-hierarchy!
-   metabase.collections.api-test/with-some-children-of-collection!                         macros.metabase.collections.api-test/with-some-children-of-collection!
-   metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing!     macros.metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing!
-   metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing! macros.metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
-   metabase.lib.common/defop                                                               macros.metabase.lib.common/defop
-   metabase.lib.filter/deffilter                                                           macros.metabase.lib.filter/deffilter
-   metabase.parameters.chain-filter-test/chain-filter                                      macros.metabase.parameters.chain-filter-test/chain-filter
-   metabase.parameters.chain-filter-test/chain-filter-search                               macros.metabase.parameters.chain-filter-test/chain-filter
-   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!        macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!
-   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing!    macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing!
-   metabase.queries.api.card-test/with-ordered-items                                       macros.metabase.queries.api.card-test/with-ordered-items
-   metabase.query-analysis.models.query-analysis-test/with-test-setup                      macros.metabase.query-analysis.models.query-analysis-test/with-test-setup
-   metabase.query-analysis.task.test-setup/with-test-setup!                                macros.metabase.query-analysis.task.test-setup/with-test-setup!
-   metabase.query-processor.streaming/streaming-response                                   macros.metabase.query-processor.streaming/streaming-response
-   metabase.server.statistics-handler-test/with-server                                     macros.metabase.server.statistics-handler-test/with-server
-   metabase.test.data.users/with-group-for-user                                            macros.metabase.test.data.users/with-group-for-user
-   metabase.test.util/with-temp-env-var-value!                                             macros.metabase.test.util/with-temp-env-var-value!
-   metabase.test.util/with-temporary-raw-setting-values                                    macros.metabase.test.util/with-temporary-raw-setting-values
-   metabase.test/with-group-for-user                                                       macros.metabase.test.data.users/with-group-for-user
-   metabase.test/with-temp-env-var-value!                                                  macros.metabase.test.util/with-temp-env-var-value!
-   metabase.test/with-temporary-raw-setting-values                                         macros.metabase.test.util/with-temporary-raw-setting-values
-   metabase.users.models.user-test/with-groups!                                            macros.metabase.users.models.user-test/with-groups!
-   metabase.util.namespaces/import-fn                                                      macros.metabase.util.namespaces/import-fn
-   metabase.xrays.domain-entities.malli/define-getters-and-setters                         macros.metabase.xrays.domain-entities.malli/define-getters-and-setters
-   metabase.xrays.related-test/with-world                                                  macros.metabase.xrays.related-test/with-world}}
+  {clojurewerkz.quartzite.jobs/build                                                            macros.quartz/build-job
+   clojurewerkz.quartzite.schedule.calendar-interval/build                                      macros.quartz/build-job
+   clojurewerkz.quartzite.schedule.cron/schedule                                                macros.quartz/schedule
+   clojurewerkz.quartzite.schedule.simple/schedule                                              macros.quartz/simple-schedule
+   clojurewerkz.quartzite.triggers/build                                                        macros.quartz/build-trigger
+   metabase-enterprise.database-routing.e2e-test/with-temp-dbs!                                 macros.metabase-enterprise.database-routing.e2e-test/with-temp-dbs!
+   metabase-enterprise.impersonation.util-test/with-impersonations!                             macros.metabase-enterprise.impersonation.util-test/with-impersonations!
+   metabase-enterprise.query-reference-validation.api-test/with-test-setup!                     macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
+   metabase-enterprise.sandbox.test-util/with-gtaps!                                            macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                                   macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.serialization.test-util/with-world                                       macros.metabase-enterprise.serialization.test-util/with-world
+   metabase-enterprise.test/with-gtaps!                                                         macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.test/with-gtaps-for-user!                                                macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase.collections-rest.api-test/with-collection-hierarchy!                                macros.metabase.collections-rest.api-test/with-collection-hierarchy!
+   metabase.collections-rest.api-test/with-some-children-of-collection!                         macros.metabase.collections-rest.api-test/with-some-children-of-collection!
+   metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-card-referencing!     macros.metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-card-referencing!
+   metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing! macros.metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
+   metabase.lib.common/defop                                                                    macros.metabase.lib.common/defop
+   metabase.lib.filter/deffilter                                                                macros.metabase.lib.filter/deffilter
+   metabase.parameters.chain-filter-test/chain-filter                                           macros.metabase.parameters.chain-filter-test/chain-filter
+   metabase.parameters.chain-filter-test/chain-filter-search                                    macros.metabase.parameters.chain-filter-test/chain-filter
+   metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-card-referencing!        macros.metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-card-referencing!
+   metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-dashcard-referencing!    macros.metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-dashcard-referencing!
+   metabase.queries.api.card-test/with-ordered-items                                            macros.metabase.queries.api.card-test/with-ordered-items
+   metabase.query-analysis.models.query-analysis-test/with-test-setup                           macros.metabase.query-analysis.models.query-analysis-test/with-test-setup
+   metabase.query-analysis.task.test-setup/with-test-setup!                                     macros.metabase.query-analysis.task.test-setup/with-test-setup!
+   metabase.query-processor.streaming/streaming-response                                        macros.metabase.query-processor.streaming/streaming-response
+   metabase.server.statistics-handler-test/with-server                                          macros.metabase.server.statistics-handler-test/with-server
+   metabase.test.data.users/with-group-for-user                                                 macros.metabase.test.data.users/with-group-for-user
+   metabase.test.util/with-temp-env-var-value!                                                  macros.metabase.test.util/with-temp-env-var-value!
+   metabase.test.util/with-temporary-raw-setting-values                                         macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.test/with-group-for-user                                                            macros.metabase.test.data.users/with-group-for-user
+   metabase.test/with-temp-env-var-value!                                                       macros.metabase.test.util/with-temp-env-var-value!
+   metabase.test/with-temporary-raw-setting-values                                              macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.users.models.user-test/with-groups!                                                 macros.metabase.users.models.user-test/with-groups!
+   metabase.util.namespaces/import-fn                                                           macros.metabase.util.namespaces/import-fn
+   metabase.xrays.related-test/with-world                                                       macros.metabase.xrays.related-test/with-world}}
 
  :config-in-comment
  {:linters {:unresolved-symbol {:level :off}}}
@@ -712,16 +723,23 @@
    :name    metabase-lib}
   {:pattern "^metabase\\.lib\\..*"
    :name    metabase-lib-excluding-legacy-mbql}
+  {:pattern "^metabase\\.legacy-mbql\\..*"
+   :name    legacy-mbql-namespaces}
   ;;
-  ;; QP source namespaces: `metabase.query-processor.*`, `metabase-enterprise.sandbox.query-processor.*`, and
-  ;; `metabase.driver.*`, excluding `-test` namespaces.
+  ;; QP and driver source namespaces: `metabase.query-processor.*`, `metabase-enterprise.sandbox.query-processor.*`,
+  ;; and `metabase.driver.*`, excluding `-test` namespaces.
   ;;
   {:pattern "metabase(?:(?:(?:-enterprise\\.sandbox)?\\.query-processor\\.)|(?:\\.driver\\.)).*(?<!-test)$"
    :name    qp-and-driver-source-namespaces}
   ;;
-  ;; driver namespaces
+  ;; QP source namespaces
   ;;
-  {:pattern "metabase\\.driver.*$"
+  {:pattern "metabase(?:(?:-enterprise\\.sandbox)?\\.query-processor\\.).*(?<!-test)$"
+   :name    qp-source-namespaces}
+  ;;
+  ;; driver namespaces, including tests
+  ;;
+  {:pattern "metabase\\.driver(?:-api)?.*$"
    :name    driver-namespaces}
   ;;
   ;; Perf-sensitive namespaces are currently the union of metabase.lib.*, driver namespaces, and QP (without tests).
@@ -734,7 +752,10 @@
   ;; `metabase-enterprise.sandbox.query-processor*-test`
   ;;
   {:pattern "^metabase(?:((?:-enterprise\\.sandbox)?\\.query-processor)|(?:\\.driver\\.sql(?!server)(?!ite))).*-test$"
-   :name    general-qp-and-driver-test-namespaces}]
+   :name    general-qp-and-driver-test-namespaces}
+
+  {:pattern "(?:^mage.*)"
+   :name    mage-namespaces}]
 
  :config-in-ns
  {test-namespaces
@@ -767,7 +788,14 @@
      clojure.core/eval        {:message "Don't use eval outside of tests"}}
 
     :discouraged-namespace
-    {metabase.query-processor.store {:message "Please do not use the QP Store outside of legacy QP or driver code. Use MBQL 5/Lib or lib.metadata.jvm/applicaton-database-metadata-provider instead."}}}}
+    {metabase.legacy-mbql.jvm-util       {:message "Avoid legacy MBQL utils, use Lib instead"}
+     metabase.legacy-mbql.normalize      {:message "Avoid legacy MBQL normalization, use MBQL 5 + lib/normalize instead"}
+     metabase.legacy-mbql.predicates     {:message "Avoid legacy MBQL utils, use Lib instead"}
+     metabase.legacy-mbql.schema         {:message "Avoid the legacy MBQL schema, use MBQL 5 + lib.schema instead"}
+     metabase.legacy-mbql.schema.helpers {:message "Avoid the legacy MBQL schema, use MBQL 5 + lib.schema instead"}
+     metabase.legacy-mbql.schema.macros  {:message "Avoid the legacy MBQL schema, use MBQL 5 + lib.schema instead"}
+     metabase.legacy-mbql.util           {:message "Avoid legacy MBQL utils, use Lib instead"}
+     metabase.query-processor.store      {:message "Please do not use the QP Store outside of legacy QP or driver code. Use MBQL 5/Lib or lib.metadata.jvm/applicaton-database-metadata-provider instead."}}}}
 
   printable-namespaces
   {:linters
@@ -779,7 +807,7 @@
                              clojure.string/lower-case {:level :off}
                              clojure.string/upper-case {:level :off}}}}
 
-  ;; enable all the extra linters we haven't enabled in the core app yet in MLv2. It's all new code so we can adhere
+  ;; enable all the extra linters we haven't enabled in the core app yet in Lib. It's all new code so we can adhere
   ;; to the new stricter rules from day 1
   metabase-lib
   {:linters
@@ -799,48 +827,120 @@
      metabase.test/with-temp            {:message "Don't use application database inside Lib code"}}
 
     :discouraged-namespace
-    {metabase.driver            {:message "MLv2 code should be independent of driver code/methods"}
-     metabase.test              {:message "MLv2 tests should only use MLv2 test helpers"}
-     metabase.test.data         {:message "MLv2 tests should only use MLv2 test helpers"}
-     metabase.util.malli.schema {:message "Prefer metabase.lib.schema schemas in MLv2 code"}
-     toucan.db                  {:message "Don't use application database inside MLv2 code"}
-     toucan.models              {:message "Don't use application database inside MLv2 code"}
-     toucan.util.test           {:message "Don't use application database inside MLv2 code"}
-     toucan2.core               {:message "Don't use application database inside MLv2 code"}}}}
+    {metabase.driver            {:message "Lib code should be independent of driver code/methods"}
+     metabase.test              {:message "Lib tests should only use Lib test helpers"}
+     metabase.test.data         {:message "Lib tests should only use Lib test helpers"}
+     metabase.util.malli.schema {:message "Prefer metabase.lib.schema schemas in Lib code"}
+     toucan.db                  {:message "Don't use application database inside Lib code"}
+     toucan.models              {:message "Don't use application database inside Lib code"}
+     toucan.util.test           {:message "Don't use application database inside Lib code"}
+     toucan2.core               {:message "Don't use application database inside Lib code"}}}}
 
   metabase-lib-excluding-legacy-mbql
+  {}
+
+  legacy-mbql-namespaces
   {:linters
-   {:discouraged-var
-    {metabase.legacy-mbql.util/unique-name-generator {:message "Use metabase.lib.util/unique-name-generator or non-truncating-unique-name-generator"}}}}
+   {:discouraged-namespace
+    {metabase.legacy-mbql.jvm-util       {:level :off}
+     metabase.legacy-mbql.normalize      {:level :off}
+     metabase.legacy-mbql.predicates     {:level :off}
+     metabase.legacy-mbql.schema         {:level :off}
+     metabase.legacy-mbql.schema.helpers {:level :off}
+     metabase.legacy-mbql.schema.macros  {:level :off}
+     metabase.legacy-mbql.util           {:level :off}
+     metabase.query-processor.store      {:level :off}}
+
+    ;; the `metabase.legacy-mbql` stuff is all deprecated, so we don't need to warn inside the module about other stuff
+    ;; in the module being marked deprecated or discouraged.
+    :deprecated-namespace {:level :off}
+    :deprecated-var       {:level :off}}}
 
   driver-namespaces
   {:linters
    {:discouraged-var
-    {metabase.driver/database-supports? {:level :off}}}}
+    {metabase.driver/database-supports? {:level :off}}
+
+    ;; don't warn about the legacy MBQL namespaces being deprecated or discouraged in driver code now, we don't have a
+    ;; real alternative YET so it's not a helpful warning.
+    :discouraged-namespace
+    {metabase.legacy-mbql.jvm-util       {:level :off}
+     metabase.legacy-mbql.normalize      {:level :off}
+     metabase.legacy-mbql.predicates     {:level :off}
+     metabase.legacy-mbql.schema         {:level :off}
+     metabase.legacy-mbql.schema.helpers {:level :off}
+     metabase.legacy-mbql.schema.macros  {:level :off}
+     metabase.legacy-mbql.util           {:level :off}
+     metabase.query-processor.store      {:level :off}}
+
+    :deprecated-namespace
+    {:exclude
+     [metabase.driver.common.parameters
+      metabase.driver.common.parameters.dates
+      metabase.driver.common.parameters.operators
+      metabase.driver.common.parameters.parse
+      metabase.driver.common.parameters.values
+      metabase.legacy-mbql.jvm-util
+      metabase.legacy-mbql.normalize
+      metabase.legacy-mbql.predicates
+      metabase.legacy-mbql.schema
+      metabase.legacy-mbql.schema.helpers
+      metabase.legacy-mbql.schema.macros
+      metabase.legacy-mbql.util
+      metabase.query-processor.store]}
+
+    :deprecated-var
+    {:exclude
+     {metabase.legacy-mbql.schema.helpers/is-clause?   {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.schema.helpers/mbql-clause? {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/query->source-table-id {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/aggregation-at-index   {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/assoc-field-options    {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/expression-with-name   {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/field-options          {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/negate-filter-clause   {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/normalize-token        {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/update-field-options   {:namespaces ["metabase\\.driver.*"]}}}}}
 
   performance-sensitive
   {:linters
    {:discouraged-var
-    {clojure.core/update-keys {:message "Use metabase.util.performance/update-keys"}}}}
+    {clojure.core/empty?          {:message "Use metabase.util.performance/empty?"}
+     clojure.core/not-empty       {:message "Use metabase.util.performance/not-empty"}
+     clojure.core/every?          {:message "Use metabase.util.performance/every?"}
+     clojure.core/mapv            {:message "Use metabase.util.performance/mapv"}
+     clojure.core/run!            {:message "Use metabase.util.performance/run!"}
+     clojure.core/select-keys     {:message "Use metabase.util.performance/select-keys"}
+     clojure.core/some            {:message "Use metabase.util.performance/some"}
+     clojure.core/update-keys     {:message "Use metabase.util.performance/update-keys"}
+     clojure.walk/keywordize-keys {:message "Use metabase.util.performance/keywordize-keys"}
+     clojure.walk/postwalk        {:message "Use metabase.util.performance/postwalk"}
+     clojure.walk/prewalk         {:message "Use metabase.util.performance/prewalk"}
+     clojure.walk/walk            {:message "Use metabase.util.performance/walk"}
+     clojure.walk/for             {:message "Use metabase.util.performance/for"}
+     clojure.walk/doseq           {:message "Use metabase.util.performance/doseq"}}}}
 
   qp-and-driver-source-namespaces
   {:linters
    {:discouraged-namespace
     {metabase.query-processor.store {:level :off}
      metabase.util.malli.schema     {:message "Prefer metabase.lib.schema or metabase.legacy-mbql.schema schemas in QP/driver code"}
-     toucan.db                      {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
-     toucan.models                  {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
-     toucan.util.test               {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
-     toucan2.core                   {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}
+     toucan.db                      {:message "Don't use application database directly in QP code; use the MetadataProvider"}
+     toucan.models                  {:message "Don't use application database directly in QP code; use the MetadataProvider"}
+     toucan.util.test               {:message "Don't use application database directly in QP code; use the MetadataProvider"}
+     toucan2.core                   {:message "Don't use application database directly in QP code; use the MetadataProvider"}}
 
     :discouraged-var
     {medley.core/map-keys                 {:message "Use metabase.util.performance/update-keys"}
      medley.core/map-vals                 {:message "Use clojure.core/update-vals"}
-     metabase.app-db.core/query           {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
-     metabase.app-db.core/reducible-query {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     metabase.app-db.core/query           {:message "Don't use application database directly in QP code; use the MetadataProvider"}
+     metabase.app-db.core/reducible-query {:message "Don't use application database directly in QP code; use the MetadataProvider"}
      metabase.lib.convert/->legacy-MBQL   {:level :off}
      metabase.lib.core/->legacy-MBQL      {:level :off}}}}
 
+  qp-source-namespaces
+  {}
+
   general-qp-and-driver-test-namespaces
   {:linters
    {:discouraged-var
@@ -850,4 +950,11 @@
      toucan2.tools.with-temp/with-temp         {:message "Use lib.tu/mock-metadata-provider in QP tests. Exceptions: tests for code that doesn't use MPs or models not supported by MPs"}}
 
     :metabase/disallow-hardcoded-driver-names-in-tests
-    {:level :warning}}}}}
+    {:level :warning}}}
+
+  mage-namespaces
+  {:linters
+   {:discouraged-java-method
+    {java.lang.System {exit
+                       {:level :error
+                        :message "Don't use System/exit directly. Instead throw an ex-info with {:babashka/exit <exit-code>} (and optionally :mage/error) let the mage runner handle exiting the process"}}}}}}}

.clj-kondo/config/test-helpers/config.edn

@@ -13,7 +13,10 @@
      toucan2.core/insert-returning-pk!
      toucan2.core/insert-returning-pks!
      clojure.core.async/<!!
+     clojure.core.async/<!
      clojure.core.async/>!!
+     clojure.core.async/>!
+     clojure.core.async/alts!
      clojure.core.async/alts!!
      clojure.core.async/close!
      clojure.core.async/poll!
@@ -97,7 +100,7 @@
      metabase.permissions.models.permissions/update-data-perms-graph!
      metabase.permissions.models.permissions/update-group-permissions!
      metabase.permissions.test-util/with-restored-perms!
-     metabase.public-sharing.api-test/add-card-to-dashboard!
+     metabase.public-sharing-rest.api-test/add-card-to-dashboard!
      metabase.pulse.send/send-notifications!
      metabase.pulse.send/send-pulse!
      metabase.query-processor.streaming.interface/begin!

.clj-kondo/macros/metabase/collections_rest/api_test.clj

@@ -1,4 +1,4 @@
-(ns macros.metabase.collections.api-test)
+(ns macros.metabase.collections-rest.api-test)
 
 (defmacro with-collection-hierarchy! [bindings & body]
   `(let [~'a nil

.clj-kondo/macros/metabase/embedding/embedding_rest/embed_test.clj

@@ -1,4 +1,4 @@
-(ns macros.metabase.embedding.api.embed-test)
+(ns macros.metabase.embedding-rest.api.embed-test)
 
 (defmacro with-embedding-enabled-and-temp-card-referencing!
   [table-kw field-kw [card-binding] & body]

.clj-kondo/macros/metabase/public_sharing_rest/api_test.clj

@@ -1,4 +1,4 @@
-(ns macros.metabase.public-sharing.api-test)
+(ns macros.metabase.public-sharing-rest.api-test)
 
 (defmacro with-sharing-enabled-and-temp-card-referencing!
   [table-kw field-kw [card-binding] & body]

.clj-kondo/macros/metabase/xrays/domain_entities/malli.clj

@@ -1,16 +0,0 @@
-(ns macros.metabase.xrays.domain-entities.malli)
-
-(defmacro define-getters-and-setters [schema & defs]
-  `(do
-     (comment ~schema) ;; Reference the schema
-     ~@(for [[sym _path] (partition 2 defs)]
-         `(do
-            (defn ~(vary-meta sym
-                              assoc :export true)
-              "docs" [_x#] nil)
-            (defn ~(vary-meta (symbol (str "with-" (name sym)))
-                              assoc :export true)
-              "docs" [x# _new#] x#)
-            (defn ~(vary-meta (symbol (str (name sym) "-js"))
-                              assoc :export true)
-              "docs" [x#] x#)))))

.clj-kondo/src/hooks/clojure/core/require.clj

@@ -52,7 +52,13 @@
 
 (defn- lint-require* [node current-ns config]
   (let [[_require & args]   (:children node)
-        required-namespaces (keep unwrap-require args)]
+        required-namespaces (->> (keep unwrap-require args)
+                                 ;; `require` runs through `cc/load-libs` which allows
+                                 ;; #{:as :reload :reload-all :require :use :verbose :refer :as-alias}
+                                 ;; as args. If you use a REPL tool that applies clj-kondo linting (e.g., Clojure MCP)
+                                 ;; you may wish to `:reload` or `:reload-all` a namespace. So we shouldn't assume all
+                                 ;; args are keywords:
+                                 (remove keyword?))]
     (lint* node current-ns config required-namespaces)))
 
 (defn- lint-requiring-resolve* [node current-ns config]

.clj-kondo/src/hooks/metabase/api/macros.clj

@@ -1,7 +1,67 @@
 (ns hooks.metabase.api.macros
   (:require
    [clj-kondo.hooks-api :as api]
-   [hooks.common]))
+   [clojure.string :as str]))
+
+(defn- validate-route!
+  "Make sure the route uses kebab-case rather than snake_case."
+  [route]
+  (letfn [(validate-route-string! [route-string]
+            (when (and (api/string-node? route-string)
+                       (str/includes? (api/sexpr route-string) "_"))
+              (api/reg-finding! (assoc (meta route-string)
+                                       :message "REST API routes and query params should use kebab-case, not snake_case"
+                                       :type    :metabase/validate-defendpoint-route-uses-kebab-case))))]
+    (cond
+      (api/string-node? route)
+      (validate-route-string! route)
+      ;; otherwise route is a vector like ["/abc/:d/" :d <regex>]
+      (api/vector-node? route)
+      (validate-route-string! (first (:children route))))))
+
+(defn- validate-query-params!
+  "Make sure query params use kebab-case rather than snake_case.
+
+  This only works on inline schemas for now. If you define the schema elsewhere then we'd have to implement this
+  validation in Clojure-land since we can't resolve the schemas in Kondo. It should however still work on complicated
+  schemas like
+
+    [:merge <map-1> <map-2>]"
+  [query-param-schema-node]
+  (letfn [(map-schema? [node]
+            (and (api/vector-node? node)
+                 (when-let [first-child (first (:children node))]
+                   (and (api/keyword-node? first-child)
+                        (= (api/sexpr first-child) :map)))))
+          (map-schema-keys [{:keys [children], :as _node}]
+            (let [child-schemas (if (api/map-node? (second children))
+                                  (drop 2 children)
+                                  (drop 1 children))]
+              (keep (fn [child-schema]
+                      (when (api/vector-node? child-schema)
+                        (when-let [k (first (:children child-schema))]
+                          (when (api/keyword-node? k)
+                            k))))
+                    child-schemas)))
+          (validate-map-schema! [form]
+            ;; only warn once per endpoint -- just once on the first bad node
+            (when-let [bad-node (some (fn [key-node]
+                                        (when (str/includes? (str (api/sexpr key-node)) "_")
+                                          key-node))
+                                      (map-schema-keys form))]
+              (api/reg-finding! (assoc (meta bad-node)
+                                       :message "REST API routes and query params should use kebab-case, not snake_case"
+                                       :type    :metabase/validate-defendpoint-query-params-use-kebab-case))))
+          (validate! [node]
+            (cond
+              (and (api/vector-node? node)
+                   (map-schema? node))
+              (validate-map-schema! node)
+
+              (api/vector-node? node)
+              (doseq [child (:children node)]
+                (validate! child))))]
+    (validate! query-param-schema-node)))
 
 (defn defendpoint
   [arg]
@@ -18,16 +78,21 @@
                                       (cons nil more))
                   [params & body] more
                   [bindings schemas] (when (api/vector-node? params)
-                                       (loop [bindings [], schemas [], [x y & more] (:children params)]
+                                       (loop [bindings [], schemas [], [x y z & more] (:children params)]
                                          (cond
                                            (not x)
                                            [bindings schemas]
 
-                                           (= (api/sexpr x) :-)
-                                           (recur bindings (conj schemas y) more)
+                                           (and (api/keyword-node? y)
+                                                (= (api/sexpr y) :-))
+                                           (recur (conj bindings x) (conj schemas z) more)
 
                                            :else
-                                           (recur (conj bindings x) schemas (cons y more)))))]
+                                           (recur (conj bindings x) (conj schemas nil) (list* y z more)))))]
+              (validate-route! route)
+              (let [[_route-param-schema query-param-schema _body-param-schema] schemas]
+                (when query-param-schema
+                  (validate-query-params! query-param-schema)))
               (-> (api/list-node
                    (list
                     (api/token-node 'do)
@@ -54,3 +119,27 @@
                       body))))
                   (with-meta (meta node)))))]
     (update arg :node update-defendpoint)))
+
+(comment
+  (defn -defendpoint [form]
+    (-> {:node (-> form pr-str api/parse-string)}
+        defendpoint
+        :node
+        api/sexpr))
+
+  (defn x []
+    (-defendpoint '(api.macros/defendpoint :get "/:id/syncable_schemas" ; snake_case route should trigger a warning
+                     "Returns a list of all syncable schemas found for the database `id`."
+                     [{:keys [id]} :- [:map
+                                       [:id ms/PositiveInt]]
+                      ;; snake_case query parameter, should trigger a warning
+                      {:keys [filter_by]} :- [:map
+                                              [:filter_by {:optional true} :string]]]
+                     (let [db (get-database id)]
+                       (api/check-403 (or (:is_attached_dwh db)
+                                          (and (mi/can-write? db)
+                                               (mi/can-read? db))))
+                       (->> db
+                            (driver/syncable-schemas (:engine db))
+                            (vec)
+                            (sort)))))))

.clj-kondo/src/hooks/metabase/legacy_mbql/schemas/macros.clj

@@ -33,18 +33,36 @@
     (defclause [ag:var var] field-or-expression FieldOrExpressionDef)
     =>
     (def ag:var [FieldOrExpressionDef])"
-  [{:keys [node]}]
-  (let [[_defclause clause-name-form & arg-specs] (:children node)]
-    {:node (-> (hooks/list-node
-                (list
-                 (hooks/token-node 'def)
-                 (unwrap-defclause-clause-name clause-name-form)
-                 (hooks/string-node "Docstring.")
-                 (collect-defclause-body-schemas arg-specs)))
-               (with-meta (meta node)))}))
+  [{:keys [node], :as x}]
+  (let [[_defclause clause-name & arg-specs] (:children node)]
+    (assoc x :node (-> (hooks/list-node
+                        (list
+                         (hooks/token-node 'do)
+                         (-> (hooks/keyword-node (keyword "metabase.legacy-mbql.schema" (name (hooks/sexpr clause-name))))
+                             (with-meta (meta clause-name))
+                             (hooks/reg-keyword! 'metabase.legacy-mbql.schemas.macros/defclause))
+                         (collect-defclause-body-schemas arg-specs)))
+                       (with-meta (meta node))))))
+
+(defn defclause*
+  "e.g.
+
+    (defclause [ag:var var] field-or-expression FieldOrExpressionDef)
+    =>
+    (def ag:var [FieldOrExpressionDef])"
+  [{:keys [node], :as x}]
+  (let [[_defclause clause-name schema] (:children node)]
+    (assoc x :node (-> (hooks/list-node
+                        (list
+                         (hooks/token-node 'do)
+                         (-> (hooks/keyword-node (keyword "metabase.legacy-mbql.schema" (name (hooks/sexpr clause-name))))
+                             (with-meta (meta clause-name))
+                             (hooks/reg-keyword! 'metabase.legacy-mbql.schemas.macros/defclause*))
+                         schema))
+                       (with-meta (meta node))))))
 
 (comment
-  (defn- defclause* [form]
+  (defn- expand-defclause [form]
     (hooks/sexpr
      (:node
       (defclause
@@ -55,15 +73,35 @@
              form)))}))))
 
   (defn- x []
-    (defclause* '(defclause [ag:var var]
-                   field-or-expression FieldOrExpressionDef)))
+    (expand-defclause '(defclause var
+                         field-or-expression FieldOrExpressionDef)))
   ;; =>
-  (def ag:var "Docstring." [FieldOrExpressionDef])
+  (do :metabase.legacy-mbql.schema/var [FieldOrExpressionDef])
 
   (defn- y []
-    (defclause* '(defclause var
-                   x (some-list-schema)
-                   y (optional FieldOrExpressionDef)
-                   z (rest (some-other-schema)))))
+    (expand-defclause '(defclause var
+                         x (some-list-schema)
+                         y (optional FieldOrExpressionDef)
+                         z (rest (some-other-schema)))))
   ;; =>
-  (def var "Docstring." [(some-list-schema) FieldOrExpressionDef (some-other-schema)]))
+  (do :metabase.legacy-mbql.schema/var [(some-list-schema) FieldOrExpressionDef (some-other-schema)]))
+
+(defn one-of [{:keys [node], :as x}]
+  (let [[_one-of & schema-nodes] (:children node)
+        node' (-> (hooks/vector-node
+                   (mapv (fn [schema-node]
+                           (if (and (hooks/token-node? schema-node)
+                                    (simple-symbol? (hooks/sexpr schema-node)))
+                             (-> (hooks/keyword-node (keyword "mteabase.legacy-mbql.schema" (name (hooks/sexpr schema-node))))
+                                 (with-meta (meta schema-node)))
+                             schema-node))
+                         schema-nodes))
+                  (with-meta (meta node)))]
+    (assoc x :node node')))
+
+(comment
+  (defn- expand-one-of [form]
+    (hooks/sexpr (:node (one-of {:node (hooks/parse-string (with-out-str (clojure.pprint/pprint form)))}))))
+
+  (defn- z []
+    (expand-one-of '(one-of absolute-datetime relative-datetime time))))

.clj-kondo/src/hooks/metabase/test/util.clj

@@ -1,6 +1,6 @@
 (ns hooks.metabase.test.util
-  (:require [clj-kondo.hooks-api :as hooks]
-            [hooks.common :as common]))
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
 
 (defn- namespaced-symbol-node? [node]
   (when (hooks/token-node? node)

.clj-kondo/test/hooks/metabase/api/macros_test.clj

@@ -1,6 +1,7 @@
 (ns hooks.metabase.api.macros-test
   (:require
    [clj-kondo.hooks-api :as api]
+   [clj-kondo.impl.utils]
    [clojure.test :refer :all]
    [hooks.metabase.api.macros]))
 
@@ -69,3 +70,41 @@
              (respond :x)
              (catch Throwable e
                (raise e))))))))
+
+(defn- defendpoint [form]
+  (hooks.metabase.api.macros/defendpoint
+    {:node (-> form pr-str api/parse-string)}))
+
+(defn- defendpoint-warnings
+  [form]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
+                                                               :metabase/validate-defendpoint-query-params-use-kebab-case {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (defendpoint form)
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(deftest ^:parallel validate-route-kebab-case-test
+  (is (=? [{:message "REST API routes and query params should use kebab-case, not snake_case"
+            :type    :metabase/validate-defendpoint-route-uses-kebab-case
+            :row     pos-int?
+            :col     pos-int?}]
+          (defendpoint-warnings
+            '(api.macros/defendpoint :get "/:id/syncable_schemas" ; snake_case route should trigger a warning
+               "Returns a list of all syncable schemas found for the database `id`."
+               [{:keys [id]}]
+               id)))))
+
+(deftest ^:parallel validate-query-params-kebab-case-test
+  (is (=? [{:message "REST API routes and query params should use kebab-case, not snake_case",
+            :type    :metabase/validate-defendpoint-query-params-use-kebab-case
+            :row     pos-int?
+            :col     pos-int?}]
+          (defendpoint-warnings
+            '(api.macros/defendpoint :get "/:id/syncable-schemas"
+               "Returns a list of all syncable schemas found for the database `id`."
+               [{:keys [id]}
+                {:keys [filter_by]} :- [:map
+                                        [:filter_by {:optional true} :string]]]
+               id)))))

.cljfmt.edn

@@ -38,323 +38,321 @@
  ;; zero get indented 2 spaces if not on the first line regardless of number of elements on the first line.
  :extra-indents
  {;; clojure.core stuff
-  fn*                                                                                  [[:inner 0]]
-  let*                                                                                 [[:block 1]]
-  with-meta                                                                            [[:default]]
+  fn*                                                                                         [[:inner 0]]
+  let*                                                                                        [[:block 1]]
+  with-meta                                                                                   [[:default]]
   ;; library stuff. Libraries that specify their own `:style/indent` specs are included in the section after this
   ;; since it is generated automatically.
-  clojure.core.logic/fresh                                                             [[:block 1]]
-  clojure.core.logic/matcha                                                            [[:block 1]]
-  clojure.core.logic/run                                                               [[:block 2]]
-  clojure.core.match/match                                                             [[:block 1]]
-  clojure.test.check.properties/for-all                                                [[:block 1]]
-  clojure.test.check.properties/for-all*                                               [[:block 1]]
-  clojure.test.check/quick-check                                                       [[:block 1]]
-  clojure.tools.macro/macrolet                                                         [[:block 1] [:inner 2 0]]
-  clojurewerkz.quartzite.jobs/build                                                    [[:default]]
-  clojurewerkz.quartzite.jobs/with-description                                         [[:default]]
-  clojurewerkz.quartzite.jobs/with-identity                                            [[:default]]
-  clojurewerkz.quartzite.schedule.cron/schedule                                        [[:default]]
-  clojurewerkz.quartzite.schedule.cron/with-misfire-handling-instruction-do-nothing    [[:default]]
-  clojurewerkz.quartzite.triggers/build                                                [[:default]]
-  clojurewerkz.quartzite.triggers/with-description                                     [[:default]]
-  clojurewerkz.quartzite.triggers/with-identity                                        [[:default]]
-  clojurewerkz.quartzite.triggers/with-priority                                        [[:default]]
-  clojurewerkz.quartzite.triggers/with-schedule                                        [[:default]]
-  def-map-type                                                                         [[:block 2] [:inner 1]]
-  defprotocol+                                                                         [[:block 1] [:inner 1]]
-  defrecord+                                                                           [[:block 2] [:inner 1]]
-  deftype+                                                                             [[:block 2] [:inner 1]]
-  net.cgrand.macrovich/case                                                            [[:block 0]]
-  potemkin.namespaces/import-vars                                                      [[:default]]
-  potemkin.types/def-map-type                                                          [[:block 2] [:inner 1]]
-  potemkin.types/defprotocol+                                                          [[:block 1] [:inner 1]]
-  potemkin.types/defrecord+                                                            [[:block 2] [:inner 1]]
-  potemkin.types/deftype+                                                              [[:block 2] [:inner 1]]
-  potemkin/def-map-type                                                                [[:block 2] [:inner 1]]
-  potemkin/defprotocol+                                                                [[:block 1] [:inner 1]]
-  potemkin/defrecord+                                                                  [[:block 2] [:inner 1]]
-  potemkin/deftype+                                                                    [[:block 2] [:inner 1]]
-  potemkin/import-vars                                                                 [[:default]]
-  taoensso.nippy/extend-freeze                                                         [[:inner 0]]
-  taoensso.nippy/extend-thaw                                                           [[:inner 0]]
-  throttle.core/with-throttling                                                        [[:block 1]]
+  clojure.core.logic/fresh                                                                    [[:block 1]]
+  clojure.core.logic/matcha                                                                   [[:block 1]]
+  clojure.core.logic/run                                                                      [[:block 2]]
+  clojure.core.match/match                                                                    [[:block 1]]
+  clojure.test.check.properties/for-all                                                       [[:block 1]]
+  clojure.test.check.properties/for-all*                                                      [[:block 1]]
+  clojure.test.check/quick-check                                                              [[:block 1]]
+  clojure.tools.macro/macrolet                                                                [[:block 1] [:inner 2 0]]
+  clojurewerkz.quartzite.jobs/build                                                           [[:default]]
+  clojurewerkz.quartzite.jobs/with-description                                                [[:default]]
+  clojurewerkz.quartzite.jobs/with-identity                                                   [[:default]]
+  clojurewerkz.quartzite.schedule.cron/schedule                                               [[:default]]
+  clojurewerkz.quartzite.schedule.cron/with-misfire-handling-instruction-do-nothing           [[:default]]
+  clojurewerkz.quartzite.triggers/build                                                       [[:default]]
+  clojurewerkz.quartzite.triggers/with-description                                            [[:default]]
+  clojurewerkz.quartzite.triggers/with-identity                                               [[:default]]
+  clojurewerkz.quartzite.triggers/with-priority                                               [[:default]]
+  clojurewerkz.quartzite.triggers/with-schedule                                               [[:default]]
+  def-map-type                                                                                [[:block 2] [:inner 1]]
+  defprotocol+                                                                                [[:block 1] [:inner 1]]
+  defrecord+                                                                                  [[:block 2] [:inner 1]]
+  deftype+                                                                                    [[:block 2] [:inner 1]]
+  net.cgrand.macrovich/case                                                                   [[:block 0]]
+  potemkin.namespaces/import-vars                                                             [[:default]]
+  potemkin.types/def-map-type                                                                 [[:block 2] [:inner 1]]
+  potemkin.types/defprotocol+                                                                 [[:block 1] [:inner 1]]
+  potemkin.types/defrecord+                                                                   [[:block 2] [:inner 1]]
+  potemkin.types/deftype+                                                                     [[:block 2] [:inner 1]]
+  potemkin/def-map-type                                                                       [[:block 2] [:inner 1]]
+  potemkin/defprotocol+                                                                       [[:block 1] [:inner 1]]
+  potemkin/defrecord+                                                                         [[:block 2] [:inner 1]]
+  potemkin/deftype+                                                                           [[:block 2] [:inner 1]]
+  potemkin/import-vars                                                                        [[:default]]
+  taoensso.nippy/extend-freeze                                                                [[:inner 0]]
+  taoensso.nippy/extend-thaw                                                                  [[:inner 0]]
+  throttle.core/with-throttling                                                               [[:block 1]]
   ;; the rest of the stuff in this list is generated automatically based on `:style/indent` specs
   ;; by running [[dev.generate-cljfmt-config/specs]]... use that code to update this list
-  metabase-enterprise.cache.config-test/with-temp-persist-models                         [[:block 1]]
-  metabase-enterprise.impersonation.util-test/with-impersonations!                       [[:inner 0]]
-  metabase-enterprise.sandbox.test-util/with-gtaps!                                      [[:inner 0]]
-  metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                             [[:inner 0]]
-  metabase-enterprise.sandbox.test-util/with-user-attributes                             [[:block 2]]
-  metabase-enterprise.serialization.test-util/with-dbs                                   [[:inner 0]]
-  metabase-enterprise.serialization.test-util/with-random-dump-dir                       [[:block 1]]
-  metabase-enterprise.serialization.test-util/with-world                                 [[:block 0]]
-  metabase-enterprise.sso.integrations.jwt-test/with-users-with-email-deleted            [[:block 1]]
-  metabase-enterprise.test/with-gtaps!                                                   [[:inner 0]]
-  metabase-enterprise.test/with-gtaps-for-user!                                          [[:inner 0]]
-  metabase-enterprise.test/with-user-attributes                                          [[:block 2]]
-  metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled  [[:block 0]]
-  metabase.actions.test-util/with-actions                                                [[:block 1]]
-  metabase.actions.test-util/with-actions-disabled                                       [[:block 0]]
-  metabase.actions.test-util/with-actions-enabled                                        [[:block 0]]
-  metabase.actions.test-util/with-actions-test-data                                      [[:inner 0]]
-  metabase.actions.test-util/with-actions-test-data-and-actions-enabled                  [[:block 0]]
-  metabase.actions.test-util/with-actions-test-data-tables                               [[:block 1]]
-  metabase.actions.test-util/with-empty-db                                               [[:inner 0]]
-  metabase.actions.test-util/with-temp-test-data                                         [[:inner 0]]
-  metabase.api.common/check                                                              [[:default]]
-  metabase.api.common/define-routes                                                      [[:block 0]]
-  metabase.api.common/let-404                                                            [[:block 1]]
-  metabase.app-db.core/with-application-db                                               [[:inner 0]]
-  metabase.app-db.liquibase/with-liquibase                                               [[:block 1]]
-  metabase.app-db.liquibase/with-scope-locked                                            [[:block 1]]
-  metabase.app-db.schema-migrations-test.impl/test-migrations                            [[:block 2]]
-  metabase.cmd.copy/step                                                                 [[:block 1]]
-  metabase.cmd.copy/with-connection-rollback-only                                        [[:block 1]]
-  metabase.cmd.copy/with-disabled-db-constraints                                         [[:block 2]]
-  metabase.collections.api-test/with-collection-hierarchy                                [[:block 1]]
-  metabase.collections.api-test/with-french-user-and-personal-collection                 [[:block 2]]
-  metabase.collections.api-test/with-some-children-of-collection                         [[:block 1]]
-  metabase.collections.models.collection-test/with-collection-hierarchy                  [[:block 1]]
-  metabase.collections.models.collection-test/with-current-user-perms-for-collections    [[:block 1]]
-  metabase.collections.models.collection-test/with-personal-and-impersonal-collections   [[:block 1]]
-  metabase.config/build-type-case                                                        [[:block 0]]
-  metabase.dashboards.models.dashboard-test/with-dash-in-collection                      [[:inner 0]]
-  metabase.driver-api.core/match                                                         [[:inner 0]]
-  metabase.driver-api.core/match-one                                                     [[:inner 0]]
-  metabase.driver-api.core/replace                                                       [[:inner 0]]
-  metabase.driver-api.core/replace-in                                                    [[:inner 0]]
-  metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                  [[:default]]
-  metabase.driver.druid.client/DELETE                                                    [[:default]]
-  metabase.driver.druid.client/GET                                                       [[:default]]
-  metabase.driver.druid.client/POST                                                      [[:default]]
-  metabase.driver.druid.query-processor-test/druid-query                                 [[:block 0]]
-  metabase.driver.druid.query-processor-test/druid-query-returning-rows                  [[:block 0]]
-  metabase.driver.mongo.query-processor/mongo-let                                        [[:block 1]]
-  metabase.driver.sql-jdbc.actions/with-jdbc-transaction                                 [[:block 1]]
-  metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection        [[:block 1]]
-  metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                  [[:block 1]]
-  metabase.driver.sql.query-processor/apply-top-level-clause                             [[:default]]
-  metabase.driver/with-driver                                                            [[:block 1]]
-  metabase.embedding.api.embed-test/do-response-formats                                  [[:block 1]]
-  metabase.embedding.api.embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
-  metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing     [[:block 3]]
-  metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing [[:block 3]]
-  metabase.embedding.api.embed-test/with-new-secret-key                                  [[:block 0]]
-  metabase.embedding.api.embed-test/with-temp-card                                       [[:block 1]]
-  metabase.embedding.api.embed-test/with-temp-dashcard                                   [[:block 1]]
-  metabase.embedding.api.preview-embed-test/with-embedding-enabled-and-new-secret-key    [[:block 0]]
-  metabase.embedding.api.preview-embed-test/with-new-secret-key                          [[:block 0]]
-  metabase.lib.binning/with-binning                                                      [[:default]]
-  metabase.lib.core/with-binning                                                         [[:default]]
-  metabase.lib.core/with-join-alias                                                      [[:default]]
-  metabase.lib.core/with-join-conditions                                                 [[:default]]
-  metabase.lib.join/with-join-alias                                                      [[:default]]
-  metabase.lib.join/with-join-conditions                                                 [[:default]]
-  metabase.lib.test-util.macros/$ids                                                     [[:inner 0]]
-  metabase.lib.test-util.macros/mbql-5-query                                             [[:inner 0]]
-  metabase.lib.test-util.macros/mbql-query                                               [[:inner 0]]
-  metabase.lib.util.match/match                                                          [[:inner 0]]
-  metabase.lib.util.match/match-one                                                      [[:inner 0]]
-  metabase.lib.util.match/match-lite                                                     [[:inner 0]]
-  metabase.lib.util.match/match-lite-recursive                                           [[:inner 0]]
-  metabase.lib.util.match/replace                                                        [[:inner 0]]
-  metabase.lib.util.match/replace-in                                                     [[:inner 0]]
-  metabase.models.interface/define-batched-hydration-method                              [[:inner 0]]
-  metabase.models.interface/define-simple-hydration-method                               [[:inner 0]]
-  metabase.parameters.chain-filter-test/with-clean-field-values-for-field                [[:block 1]]
-  metabase.parameters.chain-filter-test/with-fk-field-to-field-remapping                 [[:block 0]]
-  metabase.parameters.chain-filter-test/with-human-readable-values-remapping             [[:block 0]]
-  metabase.permissions.core/allow-changing-all-users-group-members                       [[:block 0]]
-  metabase.permissions.core/disable-perms-cache                                          [[:block 0]]
-  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing        [[:block 3]]
-  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing    [[:block 3]]
-  metabase.public-sharing.api-test/with-temp-public-card                                 [[:block 1]]
-  metabase.public-sharing.api-test/with-temp-public-dashboard                            [[:block 1]]
-  metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                   [[:block 1]]
-  metabase.pulse.api.alert-test/with-alert-in-collection                                 [[:block 1]]
-  metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard        [[:block 2]]
-  metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection             [[:block 1]]
-  metabase.pulse.models.pulse-test/with-pulse-in-collection                              [[:inner 0]]
-  metabase.queries.api.card-test/with-cards-in-readable-collection                       [[:block 1]]
-  metabase.queries.api.card-test/with-cards-in-writeable-collection                      [[:block 1]]
-  metabase.queries.api.card-test/with-ordered-items                                      [[:inner 0]]
-  metabase.queries.api.card-test/with-temp-native-card!                                  [[:block 1]]
-  metabase.queries.api.card-test/with-temp-native-card-with-params!                      [[:block 1]]
-  metabase.query-processor-test.pipeline-queries-test/pmbql-query                        [[:block 1]]
-  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                    [[:block 1]]
-  metabase.query-processor.debug/debug>                                                  [[:block 0]]
-  metabase.query-processor.error-type/deferror                                           [[:block 1]]
-  metabase.query-processor.middleware.cache-backend.interface/with-cached-results        [[:block 4]]
-  metabase.query-processor.middleware.process-userland-query-test/with-query-execution   [[:block 1]]
-  metabase.query-processor.store/cached                                                  [[:block 1]]
-  metabase.query-processor.store/with-metadata-provider                                  [[:inner 0]]
-  metabase.query-processor.streaming/streaming-response                                  [[:block 1]]
-  metabase.query-processor.test-util/format-rows-by                                      [[:default]]
-  metabase.request.core/as-admin                                                         [[:block 0]]
-  metabase.request.core/with-current-request                                             [[:inner 0]]
-  metabase.request.core/with-current-user                                                [[:inner 0]]
-  metabase.request.core/with-limit-and-offset                                            [[:inner 0]]
-  metabase.request.session/as-admin                                                      [[:block 0]]
-  metabase.request.session/with-current-user                                             [[:inner 0]]
-  metabase.sample-data.impl-test/with-temp-sample-database-db                            [[:block 1]]
-  metabase.search.api-test/do-test-users                                                 [[:block 1]]
-  metabase.server.middleware.session/as-admin                                            [[:block 0]]
-  metabase.server.middleware.session/with-current-user                                   [[:inner 0]]
-  metabase.server.streaming-response-test/with-streaming-response-thread-pool            [[:block 0]]
-  metabase.server.streaming-response-test/with-test-driver-db!                           [[:block 0]]
-  metabase.server.streaming-response/streaming-response                                  [[:block 2]]
-  metabase.session.api/http-401-on-error                                                 [[:block 0]]
-  metabase.settings.core/define-multi-setting                                            [[:inner 0]]
-  metabase.settings.core/defsetting                                                      [[:block 1]]
-  metabase.settings.models.setting.multi-setting/define-multi-setting                    [[:inner 0]]
-  metabase.settings.models.setting/defsetting                                            [[:block 1]]
-  metabase.sync.fetch-metadata/log-if-error                                              [[:block 1]]
-  metabase.sync.sync-metadata.fields-test/with-test-db                                   [[:block 0]]
-  metabase.sync.util/do-with-start-and-finish-debug-logging                              [[:default]]
-  metabase.sync.util/sum-for                                                             [[:block 1]]
-  metabase.sync.util/sync-operation                                                      [[:block 3]]
-  metabase.sync.util/with-db-logging-disabled                                            [[:default]]
-  metabase.sync.util/with-duplicate-ops-prevented                                        [[:default]]
-  metabase.sync.util/with-emoji-progress-bar                                             [[:block 1]]
-  metabase.sync.util/with-error-handling                                                 [[:block 1]]
-  metabase.sync.util/with-start-and-finish-logging                                       [[:default]]
-  metabase.sync.util/with-start-and-finish-logging*                                      [[:default]]
-  metabase.sync.util/with-sync-events                                                    [[:default]]
-  metabase.task-history.models.task-history/with-task-history                            [[:block 1]]
-  metabase.task.core/rerun-on-error                                                      [[:block 1]]
-  metabase.task.impl/rerun-on-error                                                      [[:block 1]]
-  metabase.test.data.datasets/test-driver                                                [[:inner 0]]
-  metabase.test.data.datasets/test-drivers                                               [[:inner 0]]
-  metabase.test.data.one-off-dbs/with-blank-db                                           [[:block 0]]
-  metabase.test.data.one-off-dbs/with-blueberries-db                                     [[:block 0]]
-  metabase.test.data.users/with-test-user                                                [[:inner 0]]
-  metabase.test.data/$ids                                                                [[:inner 0]]
-  metabase.test.data/dataset                                                             [[:inner 0]]
-  metabase.test.data/mbql-query                                                          [[:inner 0]]
-  metabase.test.data/native-query                                                        [[:block 0]]
-  metabase.test.data/query                                                               [[:block 1]]
-  metabase.test.data/run-mbql-query                                                      [[:inner 0]]
-  metabase.test.data/with-empty-h2-app-db!                                               [[:block 0]]
-  metabase.test.data/with-temp-copy-of-db                                                [[:block 0]]
-  metabase.test.util.public-settings/with-additional-premium-features                    [[:block 1]]
-  metabase.test.util.public-settings/with-premium-features                               [[:block 1]]
-  metabase.test.util.thread-local/test-helpers-set-global-values!                        [[:block 0]]
-  metabase.test.util/discard-setting-changes                                             [[:block 1]]
-  metabase.test.util/let-url                                                             [[:block 1]]
-  metabase.test.util/throw-if-called!                                                    [[:block 1]]
-  metabase.test.util/with-temp-scheduler                                                 [[:block 0]]
-  metabase.test.util/with-temp-vals-in-db                                                [[:block 3]]
-  metabase.test.util/with-user-in-groups                                                 [[:inner 0]]
-  metabase.test/$ids                                                                     [[:inner 0]]
-  metabase.test/as-admin                                                                 [[:inner 0]]
-  metabase.test/dataset                                                                  [[:inner 0]]
-  metabase.test/discard-setting-changes                                                  [[:block 1]]
-  metabase.test/format-rows-by                                                           [[:default]]
-  metabase.test/let-url                                                                  [[:block 1]]
-  metabase.test/mbql-query                                                               [[:inner 0]]
-  metabase.test/native-query                                                             [[:block 0]]
-  metabase.test/query                                                                    [[:block 1]]
-  metabase.test/run-mbql-query                                                           [[:inner 0]]
-  metabase.test/test-driver                                                              [[:inner 0]]
-  metabase.test/test-drivers                                                             [[:inner 0]]
-  metabase.test/test-helpers-set-global-values!                                          [[:block 0]]
-  metabase.test/throw-if-called!                                                         [[:block 1]]
-  metabase.test/with-actions                                                             [[:block 1]]
-  metabase.test/with-actions-disabled                                                    [[:block 0]]
-  metabase.test/with-actions-enabled                                                     [[:block 0]]
-  metabase.test/with-actions-test-data                                                   [[:inner 0]]
-  metabase.test/with-actions-test-data-and-actions-enabled                               [[:block 0]]
-  metabase.test/with-actions-test-data-tables                                            [[:block 1]]
-  metabase.test/with-additional-premium-features                                         [[:block 1]]
-  metabase.test/with-current-user                                                        [[:inner 0]]
-  metabase.test/with-driver                                                              [[:block 1]]
-  metabase.test/with-empty-db                                                            [[:inner 0]]
-  metabase.test/with-empty-h2-app-db!                                                    [[:block 0]]
-  metabase.test/with-metadata-provider                                                   [[:inner 0]]
-  metabase.test/with-premium-features                                                    [[:block 1]]
-  metabase.test/with-temp                                                                [[:inner 0]]
-  metabase.test/with-temp-copy-of-db                                                     [[:block 0]]
-  metabase.test/with-temp-scheduler                                                      [[:block 0]]
-  metabase.test/with-temp-test-data                                                      [[:inner 0]]
-  metabase.test/with-temp-vals-in-db                                                     [[:block 3]]
-  metabase.test/with-test-user                                                           [[:inner 0]]
-  metabase.test/with-user-in-groups                                                      [[:inner 0]]
-  metabase.timeseries-query-processor-test.util/test-timeseries-drivers                  [[:block 0]]
-  metabase.timeseries-query-processor-test/run-mbql-query                                [[:inner 0]]
-  metabase.upload.impl-test/with-upload-table!                                           [[:inner 0]]
-  metabase.upload.types/with-currency                                                    [[:default]]
-  metabase.upload.types/with-parens                                                      [[:default]]
-  metabase.util/for-map                                                                  [[:block 1]]
-  metabase.util.async/cancelable-thread                                                  [[:block 0]]
-  metabase.util.date-2/with-time-zone-same-instant                                       [[:default]]
-  metabase.util.encryption-test/with-secret-key                                          [[:block 1]]
-  metabase.util.honey-sql-2/with-database-type-info                                      [[:default]]
-  metabase.util.i18n/deferred-trs                                                        [[:default]]
-  metabase.util.i18n/deferred-tru                                                        [[:default]]
-  metabase.util.i18n/trs                                                                 [[:default]]
-  metabase.util.i18n/trsn                                                                [[:default]]
-  metabase.util.i18n/tru                                                                 [[:default]]
-  metabase.util.i18n/trun                                                                [[:default]]
-  metabase.util.jvm/auto-retry                                                           [[:block 1]]
-  metabase.util.jvm/varargs                                                              [[:block 1]]
-  metabase.util.jvm/with-us-locale                                                       [[:block 0]]
-  metabase.util.malli/disable-enforcement                                                [[:block 0]]
-  metabase.util.malli/with                                                               [[:default]]
-  metabase.util.malli/with-api-error-message                                             [[:default]]
-  metabase.util.namespaces/import-fns                                                    [[:default]]
-  metabase.util.queue-test/await-test-while                                              [[:block 1]]
-  metabase.util/auto-retry                                                               [[:block 1]]
-  metabase.util/case-enum                                                                [[:block 1]]
-  metabase.util/ignore-exceptions                                                        [[:block 0]]
-  metabase.util/or-with                                                                  [[:block 1]]
-  metabase.util/profile                                                                  [[:block 1]]
-  metabase.util/prog1                                                                    [[:inner 0]]
-  metabase.util/varargs                                                                  [[:inner 0]]
-  metabase.util/with-us-locale                                                           [[:block 0]]
-  metabuild-common.core/exit-when-finished-nonzero-on-exception                          [[:block 0]]
-  metabuild-common.core/step                                                             [[:block 1]]
-  metabuild-common.entrypoint/exit-when-finished-nonzero-on-exception                    [[:block 0]]
-  metabuild-common.steps/step                                                            [[:block 1]]
-  methodical.core/defmethod                                                              [[:inner 0]]
-  methodical.core/defmulti                                                               [[:inner 0]]
-  methodical.core/with-dispatcher                                                        [[:default]]
-  methodical.core/with-method-table                                                      [[:default]]
-  methodical.core/with-prefers                                                           [[:default]]
-  methodical.interface/with-dispatcher                                                   [[:default]]
-  methodical.interface/with-method-table                                                 [[:default]]
-  methodical.interface/with-prefers                                                      [[:default]]
-  methodical.macros/defmethod                                                            [[:inner 0]]
-  methodical.macros/defmulti                                                             [[:inner 0]]
-  saml20-clj.sp.response/validate-confirmation-datas                                     [[:block 1]]
-  toucan2.connection/with-transaction                                                    [[:block 1]]
-  toucan2.core/build                                                                     [[:block 0]]
-  toucan2.core/compile                                                                   [[:block 0]]
-  toucan2.core/debug                                                                     [[:block 0]]
-  toucan2.core/define-after-insert                                                       [[:inner 0]]
-  toucan2.core/define-after-select                                                       [[:inner 0]]
-  toucan2.core/define-after-update                                                       [[:inner 0]]
-  toucan2.core/define-before-delete                                                      [[:inner 0]]
-  toucan2.core/define-before-insert                                                      [[:inner 0]]
-  toucan2.core/define-before-select                                                      [[:inner 0]]
-  toucan2.core/define-default-fields                                                     [[:inner 0]]
-  toucan2.core/define-named-query                                                        [[:block 1]]
-  toucan2.core/deftransforms                                                             [[:block 1]]
-  toucan2.core/with-transaction                                                          [[:block 1]]
-  toucan2.tools.after-insert/define-after-insert                                         [[:inner 0]]
-  toucan2.tools.after-select/define-after-select                                         [[:inner 0]]
-  toucan2.tools.after-update/define-after-update                                         [[:inner 0]]
-  toucan2.tools.after/define-after-impl                                                  [[:default]]
-  toucan2.tools.before-delete/define-before-delete                                       [[:inner 0]]
-  toucan2.tools.before-insert/define-before-insert                                       [[:inner 0]]
-  toucan2.tools.before-select/define-before-select                                       [[:inner 0]]
-  toucan2.tools.compile/build                                                            [[:block 0]]
-  toucan2.tools.compile/compile                                                          [[:block 0]]
-  toucan2.tools.compile/resolved                                                         [[:block 0]]
-  toucan2.tools.debug/debug                                                              [[:block 0]]
-  toucan2.tools.default-fields/define-default-fields                                     [[:inner 0]]
-  toucan2.tools.named-query/define-named-query                                           [[:block 1]]
-  toucan2.tools.simple-out-transform/define-out-transform                                [[:inner 0]]
-  toucan2.tools.transformed/deftransforms                                                [[:block 1]]
-  toucan2.tools.with-temp/with-temp                                                      [[:inner 0]]
-  toucan2.util/try-with-error-context                                                    [[:inner 0]]}}
+  metabase-enterprise.cache.config-test/with-temp-persist-models                              [[:block 1]]
+  metabase-enterprise.impersonation.util-test/with-impersonations!                            [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-gtaps!                                           [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                                  [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-user-attributes                                  [[:block 2]]
+  metabase-enterprise.serialization.test-util/with-dbs                                        [[:inner 0]]
+  metabase-enterprise.serialization.test-util/with-random-dump-dir                            [[:block 1]]
+  metabase-enterprise.serialization.test-util/with-world                                      [[:block 0]]
+  metabase-enterprise.sso.integrations.jwt-test/with-users-with-email-deleted                 [[:block 1]]
+  metabase-enterprise.test/with-gtaps!                                                        [[:inner 0]]
+  metabase-enterprise.test/with-gtaps-for-user!                                               [[:inner 0]]
+  metabase-enterprise.test/with-user-attributes                                               [[:block 2]]
+  metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled       [[:block 0]]
+  metabase.actions.test-util/with-actions                                                     [[:block 1]]
+  metabase.actions.test-util/with-actions-disabled                                            [[:block 0]]
+  metabase.actions.test-util/with-actions-enabled                                             [[:block 0]]
+  metabase.actions.test-util/with-actions-test-data                                           [[:inner 0]]
+  metabase.actions.test-util/with-actions-test-data-and-actions-enabled                       [[:block 0]]
+  metabase.actions.test-util/with-actions-test-data-tables                                    [[:block 1]]
+  metabase.actions.test-util/with-empty-db                                                    [[:inner 0]]
+  metabase.actions.test-util/with-temp-test-data                                              [[:inner 0]]
+  metabase.api.common/check                                                                   [[:default]]
+  metabase.api.common/define-routes                                                           [[:block 0]]
+  metabase.api.common/let-404                                                                 [[:block 1]]
+  metabase.app-db.core/with-application-db                                                    [[:inner 0]]
+  metabase.app-db.liquibase/with-liquibase                                                    [[:block 1]]
+  metabase.app-db.liquibase/with-scope-locked                                                 [[:block 1]]
+  metabase.app-db.schema-migrations-test.impl/test-migrations                                 [[:block 2]]
+  metabase.cmd.copy/step                                                                      [[:block 1]]
+  metabase.cmd.copy/with-connection-rollback-only                                             [[:block 1]]
+  metabase.cmd.copy/with-disabled-db-constraints                                              [[:block 2]]
+  metabase.collections-rest.api-test/with-collection-hierarchy                                [[:block 1]]
+  metabase.collections-rest.api-test/with-french-user-and-personal-collection                 [[:block 2]]
+  metabase.collections-rest.api-test/with-some-children-of-collection                         [[:block 1]]
+  metabase.collections.models.collection-test/with-collection-hierarchy                       [[:block 1]]
+  metabase.collections.models.collection-test/with-current-user-perms-for-collections         [[:block 1]]
+  metabase.collections.models.collection-test/with-personal-and-impersonal-collections        [[:block 1]]
+  metabase.config/build-type-case                                                             [[:block 0]]
+  metabase.dashboards.models.dashboard-test/with-dash-in-collection                           [[:inner 0]]
+  metabase.driver-api.core/match                                                              [[:inner 0]]
+  metabase.driver-api.core/match-one                                                          [[:inner 0]]
+  metabase.driver-api.core/replace                                                            [[:inner 0]]
+  metabase.driver-api.core/replace-in                                                         [[:inner 0]]
+  metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                       [[:default]]
+  metabase.driver.druid.client/DELETE                                                         [[:default]]
+  metabase.driver.druid.client/GET                                                            [[:default]]
+  metabase.driver.druid.client/POST                                                           [[:default]]
+  metabase.driver.druid.query-processor-test/druid-query                                      [[:block 0]]
+  metabase.driver.druid.query-processor-test/druid-query-returning-rows                       [[:block 0]]
+  metabase.driver.mongo.query-processor/mongo-let                                             [[:block 1]]
+  metabase.driver.sql-jdbc.actions/with-jdbc-transaction                                      [[:block 1]]
+  metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection             [[:block 1]]
+  metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                       [[:block 1]]
+  metabase.driver.sql.query-processor/apply-top-level-clause                                  [[:default]]
+  metabase.driver/with-driver                                                                 [[:block 1]]
+  metabase.embedding-rest.api.embed-test/do-response-formats                                  [[:block 1]]
+  metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
+  metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-card-referencing     [[:block 3]]
+  metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing [[:block 3]]
+  metabase.embedding-rest.api.embed-test/with-new-secret-key                                  [[:block 0]]
+  metabase.embedding-rest.api.embed-test/with-temp-card                                       [[:block 1]]
+  metabase.embedding-rest.api.embed-test/with-temp-dashcard                                   [[:block 1]]
+  metabase.embedding-rest.api.preview-embed-test/with-embedding-enabled-and-new-secret-key    [[:block 0]]
+  metabase.embedding-rest.api.preview-embed-test/with-new-secret-key                          [[:block 0]]
+  metabase.lib.binning/with-binning                                                           [[:default]]
+  metabase.lib.core/with-binning                                                              [[:default]]
+  metabase.lib.core/with-join-alias                                                           [[:default]]
+  metabase.lib.core/with-join-conditions                                                      [[:default]]
+  metabase.lib.join/with-join-alias                                                           [[:default]]
+  metabase.lib.join/with-join-conditions                                                      [[:default]]
+  metabase.lib.test-util.macros/$ids                                                          [[:inner 0]]
+  metabase.lib.test-util.macros/mbql-5-query                                                  [[:inner 0]]
+  metabase.lib.test-util.macros/mbql-query                                                    [[:inner 0]]
+  metabase.lib.util.match/match                                                               [[:inner 0]]
+  metabase.lib.util.match/match-one                                                           [[:inner 0]]
+  metabase.lib.util.match/match-lite                                                          [[:inner 0]]
+  metabase.lib.util.match/match-lite-recursive                                                [[:inner 0]]
+  metabase.lib.util.match/replace                                                             [[:inner 0]]
+  metabase.lib.util.match/replace-in                                                          [[:inner 0]]
+  metabase.models.interface/define-batched-hydration-method                                   [[:inner 0]]
+  metabase.models.interface/define-simple-hydration-method                                    [[:inner 0]]
+  metabase.parameters.chain-filter-test/with-clean-field-values-for-field                     [[:block 1]]
+  metabase.parameters.chain-filter-test/with-fk-field-to-field-remapping!                     [[:block 0]]
+  metabase.parameters.chain-filter-test/with-human-readable-values-remapping!                 [[:block 0]]
+  metabase.permissions.core/allow-changing-all-users-group-members                            [[:block 0]]
+  metabase.permissions.core/disable-perms-cache                                               [[:block 0]]
+  metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-card-referencing        [[:block 3]]
+  metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-dashcard-referencing    [[:block 3]]
+  metabase.public-sharing-rest.api-test/with-temp-public-card                                 [[:block 1]]
+  metabase.public-sharing-rest.api-test/with-temp-public-dashboard                            [[:block 1]]
+  metabase.public-sharing-rest.api-test/with-temp-public-dashboard-and-card                   [[:block 1]]
+  metabase.pulse.api.alert-test/with-alert-in-collection                                      [[:block 1]]
+  metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard             [[:block 2]]
+  metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection                  [[:block 1]]
+  metabase.pulse.models.pulse-test/with-pulse-in-collection                                   [[:inner 0]]
+  metabase.queries.api.card-test/with-cards-in-readable-collection                            [[:block 1]]
+  metabase.queries.api.card-test/with-cards-in-writeable-collection                           [[:block 1]]
+  metabase.queries.api.card-test/with-ordered-items                                           [[:inner 0]]
+  metabase.queries.api.card-test/with-temp-native-card                                        [[:block 1]]
+  metabase.queries.api.card-test/with-temp-native-card-with-params                            [[:block 1]]
+  metabase.query-processor-test.pipeline-queries-test/pmbql-query                             [[:block 1]]
+  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                         [[:block 1]]
+  metabase.query-processor.debug/debug>                                                       [[:block 0]]
+  metabase.query-processor.error-type/deferror                                                [[:block 1]]
+  metabase.query-processor.middleware.cache-backend.interface/with-cached-results             [[:block 4]]
+  metabase.query-processor.middleware.process-userland-query-test/with-query-execution        [[:block 1]]
+  metabase.query-processor.store/cached                                                       [[:block 1]]
+  metabase.query-processor.store/with-metadata-provider                                       [[:inner 0]]
+  metabase.query-processor.streaming/streaming-response                                       [[:block 1]]
+  metabase.query-processor.test-util/format-rows-by                                           [[:default]]
+  metabase.request.core/as-admin                                                              [[:block 0]]
+  metabase.request.core/with-current-request                                                  [[:inner 0]]
+  metabase.request.core/with-current-user                                                     [[:inner 0]]
+  metabase.request.core/with-limit-and-offset                                                 [[:inner 0]]
+  metabase.request.session/as-admin                                                           [[:block 0]]
+  metabase.request.session/with-current-user                                                  [[:inner 0]]
+  metabase.sample-data.impl-test/with-temp-sample-database-db                                 [[:block 1]]
+  metabase.search.api-test/do-test-users                                                      [[:block 1]]
+  metabase.server.middleware.session/as-admin                                                 [[:block 0]]
+  metabase.server.middleware.session/with-current-user                                        [[:inner 0]]
+  metabase.server.streaming-response-test/with-streaming-response-thread-pool                 [[:block 0]]
+  metabase.server.streaming-response-test/with-test-driver-db!                                [[:block 0]]
+  metabase.server.streaming-response/streaming-response                                       [[:block 2]]
+  metabase.session.api/http-401-on-error                                                      [[:block 0]]
+  metabase.settings.core/define-multi-setting                                                 [[:inner 0]]
+  metabase.settings.core/defsetting                                                           [[:block 1]]
+  metabase.settings.models.setting.multi-setting/define-multi-setting                         [[:inner 0]]
+  metabase.settings.models.setting/defsetting                                                 [[:block 1]]
+  metabase.sync.fetch-metadata/log-if-error                                                   [[:block 1]]
+  metabase.sync.sync-metadata.fields-test/with-test-db                                        [[:block 0]]
+  metabase.sync.util/do-with-start-and-finish-debug-logging                                   [[:default]]
+  metabase.sync.util/sum-for                                                                  [[:block 1]]
+  metabase.sync.util/sync-operation                                                           [[:block 3]]
+  metabase.sync.util/with-db-logging-disabled                                                 [[:default]]
+  metabase.sync.util/with-duplicate-ops-prevented                                             [[:default]]
+  metabase.sync.util/with-emoji-progress-bar                                                  [[:block 1]]
+  metabase.sync.util/with-error-handling                                                      [[:block 1]]
+  metabase.sync.util/with-start-and-finish-logging                                            [[:default]]
+  metabase.sync.util/with-start-and-finish-logging*                                           [[:default]]
+  metabase.sync.util/with-sync-events                                                         [[:default]]
+  metabase.task-history.models.task-history/with-task-history                                 [[:block 1]]
+  metabase.task.core/rerun-on-error                                                           [[:block 1]]
+  metabase.task.impl/rerun-on-error                                                           [[:block 1]]
+  metabase.test.data.datasets/test-driver                                                     [[:inner 0]]
+  metabase.test.data.datasets/test-drivers                                                    [[:inner 0]]
+  metabase.test.data.one-off-dbs/with-blank-db                                                [[:block 0]]
+  metabase.test.data.one-off-dbs/with-blueberries-db                                          [[:block 0]]
+  metabase.test.data.users/with-test-user                                                     [[:inner 0]]
+  metabase.test.data/$ids                                                                     [[:inner 0]]
+  metabase.test.data/dataset                                                                  [[:inner 0]]
+  metabase.test.data/mbql-query                                                               [[:inner 0]]
+  metabase.test.data/query                                                                    [[:block 1]]
+  metabase.test.data/run-mbql-query                                                           [[:inner 0]]
+  metabase.test.data/with-empty-h2-app-db!                                                    [[:block 0]]
+  metabase.test.data/with-temp-copy-of-db                                                     [[:block 0]]
+  metabase.test.util.public-settings/with-additional-premium-features                         [[:block 1]]
+  metabase.test.util.public-settings/with-premium-features                                    [[:block 1]]
+  metabase.test.util.thread-local/test-helpers-set-global-values!                             [[:block 0]]
+  metabase.test.util/discard-setting-changes                                                  [[:block 1]]
+  metabase.test.util/let-url                                                                  [[:block 1]]
+  metabase.test.util/throw-if-called!                                                         [[:block 1]]
+  metabase.test.util/with-temp-scheduler                                                      [[:block 0]]
+  metabase.test.util/with-temp-vals-in-db                                                     [[:block 3]]
+  metabase.test.util/with-user-in-groups                                                      [[:inner 0]]
+  metabase.test/$ids                                                                          [[:inner 0]]
+  metabase.test/as-admin                                                                      [[:inner 0]]
+  metabase.test/dataset                                                                       [[:inner 0]]
+  metabase.test/discard-setting-changes                                                       [[:block 1]]
+  metabase.test/format-rows-by                                                                [[:default]]
+  metabase.test/let-url                                                                       [[:block 1]]
+  metabase.test/mbql-query                                                                    [[:inner 0]]
+  metabase.test/query                                                                         [[:block 1]]
+  metabase.test/run-mbql-query                                                                [[:inner 0]]
+  metabase.test/test-driver                                                                   [[:inner 0]]
+  metabase.test/test-drivers                                                                  [[:inner 0]]
+  metabase.test/test-helpers-set-global-values!                                               [[:block 0]]
+  metabase.test/throw-if-called!                                                              [[:block 1]]
+  metabase.test/with-actions                                                                  [[:block 1]]
+  metabase.test/with-actions-disabled                                                         [[:block 0]]
+  metabase.test/with-actions-enabled                                                          [[:block 0]]
+  metabase.test/with-actions-test-data                                                        [[:inner 0]]
+  metabase.test/with-actions-test-data-and-actions-enabled                                    [[:block 0]]
+  metabase.test/with-actions-test-data-tables                                                 [[:block 1]]
+  metabase.test/with-additional-premium-features                                              [[:block 1]]
+  metabase.test/with-current-user                                                             [[:inner 0]]
+  metabase.test/with-driver                                                                   [[:block 1]]
+  metabase.test/with-empty-db                                                                 [[:inner 0]]
+  metabase.test/with-empty-h2-app-db!                                                         [[:block 0]]
+  metabase.test/with-metadata-provider                                                        [[:inner 0]]
+  metabase.test/with-premium-features                                                         [[:block 1]]
+  metabase.test/with-temp                                                                     [[:inner 0]]
+  metabase.test/with-temp-copy-of-db                                                          [[:block 0]]
+  metabase.test/with-temp-scheduler                                                           [[:block 0]]
+  metabase.test/with-temp-test-data                                                           [[:inner 0]]
+  metabase.test/with-temp-vals-in-db                                                          [[:block 3]]
+  metabase.test/with-test-user                                                                [[:inner 0]]
+  metabase.test/with-user-in-groups                                                           [[:inner 0]]
+  metabase.timeseries-query-processor-test.util/test-timeseries-drivers                       [[:block 0]]
+  metabase.timeseries-query-processor-test/run-mbql-query                                     [[:inner 0]]
+  metabase.upload.impl-test/with-upload-table!                                                [[:inner 0]]
+  metabase.upload.types/with-currency                                                         [[:default]]
+  metabase.upload.types/with-parens                                                           [[:default]]
+  metabase.util/for-map                                                                       [[:block 1]]
+  metabase.util.async/cancelable-thread                                                       [[:block 0]]
+  metabase.util.date-2/with-time-zone-same-instant                                            [[:default]]
+  metabase.util.encryption-test/with-secret-key                                               [[:block 1]]
+  metabase.util.honey-sql-2/with-database-type-info                                           [[:default]]
+  metabase.util.i18n/deferred-trs                                                             [[:default]]
+  metabase.util.i18n/deferred-tru                                                             [[:default]]
+  metabase.util.i18n/trs                                                                      [[:default]]
+  metabase.util.i18n/trsn                                                                     [[:default]]
+  metabase.util.i18n/tru                                                                      [[:default]]
+  metabase.util.i18n/trun                                                                     [[:default]]
+  metabase.util.jvm/auto-retry                                                                [[:block 1]]
+  metabase.util.jvm/varargs                                                                   [[:block 1]]
+  metabase.util.jvm/with-us-locale                                                            [[:block 0]]
+  metabase.util.malli/disable-enforcement                                                     [[:block 0]]
+  metabase.util.malli/with                                                                    [[:default]]
+  metabase.util.malli/with-api-error-message                                                  [[:default]]
+  metabase.util.namespaces/import-fns                                                         [[:default]]
+  metabase.util.queue-test/await-test-while                                                   [[:block 1]]
+  metabase.util/auto-retry                                                                    [[:block 1]]
+  metabase.util/case-enum                                                                     [[:block 1]]
+  metabase.util/ignore-exceptions                                                             [[:block 0]]
+  metabase.util/or-with                                                                       [[:block 1]]
+  metabase.util/profile                                                                       [[:block 1]]
+  metabase.util/prog1                                                                         [[:inner 0]]
+  metabase.util/varargs                                                                       [[:inner 0]]
+  metabase.util/with-us-locale                                                                [[:block 0]]
+  metabuild-common.core/exit-when-finished-nonzero-on-exception                               [[:block 0]]
+  metabuild-common.core/step                                                                  [[:block 1]]
+  metabuild-common.entrypoint/exit-when-finished-nonzero-on-exception                         [[:block 0]]
+  metabuild-common.steps/step                                                                 [[:block 1]]
+  methodical.core/defmethod                                                                   [[:inner 0]]
+  methodical.core/defmulti                                                                    [[:inner 0]]
+  methodical.core/with-dispatcher                                                             [[:default]]
+  methodical.core/with-method-table                                                           [[:default]]
+  methodical.core/with-prefers                                                                [[:default]]
+  methodical.interface/with-dispatcher                                                        [[:default]]
+  methodical.interface/with-method-table                                                      [[:default]]
+  methodical.interface/with-prefers                                                           [[:default]]
+  methodical.macros/defmethod                                                                 [[:inner 0]]
+  methodical.macros/defmulti                                                                  [[:inner 0]]
+  saml20-clj.sp.response/validate-confirmation-datas                                          [[:block 1]]
+  toucan2.connection/with-transaction                                                         [[:block 1]]
+  toucan2.core/build                                                                          [[:block 0]]
+  toucan2.core/compile                                                                        [[:block 0]]
+  toucan2.core/debug                                                                          [[:block 0]]
+  toucan2.core/define-after-insert                                                            [[:inner 0]]
+  toucan2.core/define-after-select                                                            [[:inner 0]]
+  toucan2.core/define-after-update                                                            [[:inner 0]]
+  toucan2.core/define-before-delete                                                           [[:inner 0]]
+  toucan2.core/define-before-insert                                                           [[:inner 0]]
+  toucan2.core/define-before-select                                                           [[:inner 0]]
+  toucan2.core/define-default-fields                                                          [[:inner 0]]
+  toucan2.core/define-named-query                                                             [[:block 1]]
+  toucan2.core/deftransforms                                                                  [[:block 1]]
+  toucan2.core/with-transaction                                                               [[:block 1]]
+  toucan2.tools.after-insert/define-after-insert                                              [[:inner 0]]
+  toucan2.tools.after-select/define-after-select                                              [[:inner 0]]
+  toucan2.tools.after-update/define-after-update                                              [[:inner 0]]
+  toucan2.tools.after/define-after-impl                                                       [[:default]]
+  toucan2.tools.before-delete/define-before-delete                                            [[:inner 0]]
+  toucan2.tools.before-insert/define-before-insert                                            [[:inner 0]]
+  toucan2.tools.before-select/define-before-select                                            [[:inner 0]]
+  toucan2.tools.compile/build                                                                 [[:block 0]]
+  toucan2.tools.compile/compile                                                               [[:block 0]]
+  toucan2.tools.compile/resolved                                                              [[:block 0]]
+  toucan2.tools.debug/debug                                                                   [[:block 0]]
+  toucan2.tools.default-fields/define-default-fields                                          [[:inner 0]]
+  toucan2.tools.named-query/define-named-query                                                [[:block 1]]
+  toucan2.tools.simple-out-transform/define-out-transform                                     [[:inner 0]]
+  toucan2.tools.transformed/deftransforms                                                     [[:block 1]]
+  toucan2.tools.with-temp/with-temp                                                           [[:inner 0]]
+  toucan2.util/try-with-error-context                                                         [[:inner 0]]}}

.codespellignore

@@ -0,0 +1,23 @@
+Brite
+afterAll
+ags
+altho
+cancelation
+cancelations
+datas
+edn
+eduction
+hasTables
+horizontalX
+horizontalY
+juxt
+methodd
+notIn
+pass-thru
+ser
+serieses
+sortings
+trs
+trsn
+tru
+trun

.codespellrc

@@ -0,0 +1,3 @@
+[codespell]
+skip = *.csv,*.edn,*.geojson,*.json,*.tsv,*.xml,docs/developers-guide/drivers/driver-tests.md,docs/developers-guide/e2e-tests.md,docs/questions/query-builder/expressions-list.md,docs/questions/visualizations/country-codes.md,e2e/test/scenarios/admin/i18n/content-translation/constants.ts,frontend/src/cljs,frontend/src/metabase/querying/expressions/tokenizer/lezer.js,frontend/src/metabase/static-viz/constants/char-sizes.ts,frontend/src/metabase/visualizations/lib/mapping_codes.ts,modules/drivers/mongo/src/metabase/driver/mongo/operators.clj
+ignore-words = .codespellignore

.devcontainer/Dockerfile

@@ -4,7 +4,6 @@ FROM mcr.microsoft.com/vscode/devcontainers/java:21
 
 RUN ( curl -fsSL https://deb.nodesource.com/setup_22.x | bash ) \
   && export DEBIAN_FRONTEND=noninteractive \
-  && apt-key adv --refresh-keys --keyserver keyserver.ubuntu.com \
   && apt-get update && apt-get -y install --no-install-recommends nodejs yarn rlwrap fontconfig
 
 # install Clojure

.dockerignore

@@ -1,5 +1,4 @@
 .babel_cache
-docs/*
 target/*
 .circleci
 .cpcache

.eslintignore

@@ -2,3 +2,4 @@ frontend/src/cljs
 frontend/src/cljs_release
 e2e/support/cypress_sample_database.js
 e2e/support/cypress_sample_instance_data.js
+e2e/embedding-sdk-host-apps

.eslintrc.js

@@ -94,10 +94,7 @@ module.exports = {
     "react/jsx-no-target-blank": 2,
     "react/jsx-key": 2,
     "react/forbid-component-props": [2, { forbid: ["sx"] }],
-    "react-hooks/exhaustive-deps": [
-      "warn",
-      { additionalHooks: "(useSafeAsyncFunction)" },
-    ],
+    "react-hooks/exhaustive-deps": ["warn"],
     "prefer-const": [1, { destructuring: "all" }],
     "no-restricted-globals": ["error", "close"],
     "no-useless-escape": 0,
@@ -118,7 +115,6 @@ module.exports = {
           "And",
           "When",
           "Then",
-          "describeWithSnowplow",
         ],
       },
     ],
@@ -136,7 +132,7 @@ module.exports = {
   },
   env: {
     browser: true,
-    es6: true,
+    es2020: true,
     commonjs: true,
     jest: true,
     "jest/globals": true,
@@ -184,6 +180,7 @@ module.exports = {
         "no-unconditional-metabase-links-render": "error",
         "no-color-literals": "error",
         "no-literal-metabase-strings": "error",
+        "no-oss-reinitialize-import": "error",
         "depend/ban-dependencies": [
           "error",
           {
@@ -203,6 +200,7 @@ module.exports = {
         "frontend/src/metabase/admin/**/*",
         "frontend/src/metabase/setup/**/*",
         "enterprise/frontend/src/metabase-enterprise/whitelabel/**/*",
+        "enterprise/frontend/src/metabase-enterprise/embedding/**/*",
         "frontend/lint/**/*",
         "*.stories.*",
         "**/.storybook/*",
@@ -243,6 +241,7 @@ module.exports = {
       plugins: ["@typescript-eslint"],
       rules: {
         "prefer-rest-params": "off",
+        "react/prop-types": "off", // TypeScript handles prop validation
         "@typescript-eslint/explicit-module-boundary-types": "off",
         "@typescript-eslint/no-inferrable-types": "off",
         "@typescript-eslint/no-explicit-any": "off",
@@ -347,5 +346,11 @@ module.exports = {
         "import/no-commonjs": "off",
       },
     },
+    {
+      files: ["**/*.stories.tsx", "**/preview.tsx"],
+      rules: {
+        "import/no-default-export": "off",
+      },
+    },
   ],
 };

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,7 +3,7 @@
 
 > **Warning**
 >
-> If that is your first contribution to Metabase, please sign the [Contributor License Agreement](https://docs.google.com/a/metabase.com/forms/d/1oV38o7b9ONFSwuzwmERRMi9SYrhYeOrkbmNaq9pOJ_E/viewform) (unless it's a tiny documentation change). Also, if you're attempting to fix a translation issue, please submit your changes to our [Crowdin project](https://crowdin.com/project/metabase-i18n) instead of opening a PR.
+> If that is your first contribution to Metabase, please sign the [Contributor License Agreement](https://docs.google.com/a/metabase.com/forms/d/1oV38o7b9ONFSwuzwmERRMi9SYrhYeOrkbmNaq9pOJ_E/viewform). Also, if you're attempting to fix a translation issue, please submit your changes to our [Crowdin project](https://crowdin.com/project/metabase-i18n) instead of opening a PR.
 
 Closes https://github.com/metabase/metabase/issues/[issue_number]
 

.github/actions/cleanup-python-runner/action.yml

@@ -0,0 +1,36 @@
+name: Cleanup Python Runner
+description: Cleanup python-runner services and upload logs as artifacts
+
+inputs:
+  upload-logs:
+    description: 'Whether to upload logs (typically on failure)'
+    required: false
+    default: 'false'
+  logs-artifact-suffix:
+    description: 'The unique name of the .zip artifact containing the logs'
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Cleanup python-runner services
+      if: always()
+      run: |
+        echo "Stopping python-runner services..."
+        if [ -d "python-runner" ]; then
+          cd python-runner
+          make stop || echo "WARNING: Failed to stop python runner"
+        fi
+      shell: bash
+
+    - name: Upload python-runner logs
+      if: ${{inputs.upload-logs == 'true' && inputs.logs-artifact-suffix != ''}}
+      uses: actions/upload-artifact@v4
+      with:
+        name: python-runner-logs-${{inputs.logs-artifact-suffix}}
+        path: |
+          python-runner.out.log
+          python-runner.err.log
+        retention-days: 1
+        if-no-files-found: warn

.github/actions/create-backport/action.yml

@@ -74,7 +74,7 @@ runs:
 
         git push -u origin ${BACKPORT_BRANCH}
 
-        BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
+        BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${{ github.event.pull_request.user.login }}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
         BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
 
         echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT

.github/actions/cross-branch-migration-test/action.yml

@@ -17,8 +17,6 @@ runs:
 
     - name: Prepare backend environment
       uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: cross-branch-migrations
 
     - name: Run backend on base branch
       run: |

.github/actions/get-cache-keys/action.yml

@@ -0,0 +1,37 @@
+name: Get cache keys
+description: |
+  Get deterministic cache keys for Maven and Node.js caches based on the centrally controlled cache prefix,
+  and the suffix based on the runner OS and the current week of the year.
+
+outputs:
+  m2-cache-key:
+    description: "The cache key for the Maven cache."
+    value: ${{ steps.keys-factory.outputs.m2-cache-key }}
+  node-cache-key:
+    description: "The cache key for the Node.js cache."
+    value: ${{ steps.keys-factory.outputs.node-cache-key }}
+  eslint-cache-key:
+    description: "The cache key for Eslint cache"
+    value: ${{ steps.keys-factory.outputs.eslint-cache-key }}
+  cypress-cache-key:
+    description: "The cache key for Cypress cache"
+    value: ${{ steps.keys-factory.outputs.cypress-cache-key }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Generate and output cache keys
+      id: keys-factory
+      run: |
+        M2_CACHE_PREFIX='M2'
+        NODE_CACHE_PREFIX='node-modules'
+        ESLINT_CACHE_PREFIX='eslint'
+        CYPRESS_CACHE_PREFIX='cypress'
+        WEEK_OF_YEAR=$(/bin/date "+%G-%V")
+        CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
+
+        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+      shell: bash

.github/actions/prepare-backend/action.yml

@@ -1,7 +1,7 @@
 name: Prepare back-end environment
 description: |
-  Prepare the backend. Installs jdk, Clojure, and fetches the cache for m2. The CI config fetchs `ci-test-config.json`
-  from master and lets us ignore tests at the var level if they are flaking.
+  Prepare the backend. Installs jdk, Clojure, and fetches the cache for m2.
+  The CI config fetches `ci-test-config.json` from master and lets us ignore tests at the var level if they are flaking.
 inputs:
   java-version:
     required: true
@@ -9,10 +9,6 @@ inputs:
   clojure-version:
     required: true
     default: '1.12.0.1488'
-  m2-cache-key:
-    description: 'Key to cache M2 packages from Maven Central'
-    required: true
-    default: 'm2'
 
 runs:
   using: "composite"
@@ -28,21 +24,15 @@ runs:
       run: |
         curl -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh &&
         sudo bash ./linux-install-${{ inputs.clojure-version }}.sh
-    - name: Fetch CI config
-      shell: bash
-      run: |
-        curl -o ci-test-config.json https://raw.githubusercontent.com/metabase/metabase/refs/heads/master/ci-test-config.json
-    - name: Check to see if dependencies should be cached
-      if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
-      run: echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
-      shell: bash
-    - name: Get M2 cache
-      uses: actions/cache@v4
-      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
+
+    - name: Get M2 cache key
+      uses: ./.github/actions/get-cache-keys
+      id: get-cache-keys
+
+    - name: Restore M2 cache
+      uses: actions/cache/restore@v4
       with:
         path: |
           ~/.m2
           ~/.gitlibs
-        key: ${{ runner.os }}-${{ inputs.m2-cache-key }}-${{ hashFiles('**/deps.edn') }}
-        restore-keys: |
-          ${{ runner.os }}-${{ inputs.m2-cache-key }}-
+        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}

.github/actions/prepare-cypress/action.yml

@@ -22,16 +22,16 @@ runs:
         chrome-version: 1097615
       id: setup-chrome
 
-    - name: Check to see if dependencies should be cached
-      if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
-      run: echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
-      shell: bash
+    - name: Get cache keys
+      uses: ./.github/actions/get-cache-keys
+      id: get-cache-keys
+
     - name: Get Cypress cache
-      uses: actions/cache@v4
-      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
+      uses: actions/cache/restore@v4
       with:
         path: ~/.cache/Cypress
-        key: ${{ runner.os }}-Cypress-${{ hashFiles('**/yarn.lock') }}
+        key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
+
     - name: Ensure that Cypress executable is ready
       run: |
         yarn cypress install

.github/actions/prepare-frontend/action.yml

@@ -3,6 +3,10 @@ inputs:
   node-version:
     description: "The version of Node.js to use, overriding .nvmrc"
     required: false
+  apply-patches:
+    description: "Whether to patch frontend dependencies with patch-package."
+    required: true
+    default: "true"
 runs:
   using: "composite"
   steps:
@@ -12,26 +16,42 @@ runs:
         node-version: ${{ inputs.node-version }} # this overrides, if present
         node-version-file: ".nvmrc"
 
-    - name: Check to see if dependencies should be cached
-      if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
+    - name: Get cache keys
+      uses: ./.github/actions/get-cache-keys
+      id: get-cache-keys
+
+    - name: Restore M2 cache
+      uses: actions/cache/restore@v4
+      with:
+        path: |
+          ~/.m2
+          ~/.gitlibs
+        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+
+    - name: Get yarn cache directory
+      id: yarn-cache-dir
       run: |
-        echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
-        yarn cache clean
+        YARN_CACHE_DIR=$(yarn cache dir)
+        echo "Yarn cache directory: $YARN_CACHE_DIR"
+        echo "dir=$YARN_CACHE_DIR" >> $GITHUB_OUTPUT
       shell: bash
-    - name: Get M2 cache
-      uses: actions/cache@v4
-      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
-      with:
-        path: ~/.m2
-        key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}
 
-    - name: Get node_modules cache
-      uses: actions/cache@v4
+    - name: Restore node_modules cache
+      uses: actions/cache/restore@v4
       id: node-modules-cache
-      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
       with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock', '**/patches/*.patch') }}
+        path: |
+          ${{ steps.yarn-cache-dir.outputs.dir }}
+          node_modules
+        key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
 
-    - run: yarn install --frozen-lockfile --prefer-offline
+    # postinstall lifecycle hook can be dangerous in CI so we only run it locally (see package.json)
+    # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
+    # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
+    - name: Clean install
+      run: yarn install --frozen-lockfile --prefer-offline
+      shell: bash
+    - name: Patch frontend dependencies
+      if: inputs.apply-patches == 'true'
+      run: yarn patch-package
       shell: bash

.github/actions/run-embedding-sdk-storybook/action.yml

@@ -1,33 +0,0 @@
-name: Run Embedding SDK Storybook
-runs:
-  using: "composite"
-  steps:
-    - name: Prepare frontend environment
-      uses: ./.github/actions/prepare-frontend
-
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: "cljs"
-
-    - name: Compile CLJS
-      run: yarn build-pure:cljs
-      shell: bash
-
-    - name: Build Storybook
-      run: yarn build-storybook-embedding-sdk
-      shell: bash
-
-    - name: Serve Storybook
-      run: yarn http-server storybook-static -p 6006 &
-      shell: bash
-
-    - name: Wait for Storybook to become available
-      run: |
-        echo "Waiting for Storybook to be served..."
-        while ! curl --silent --fail http://localhost:6006; do
-          sleep 5
-          echo "Retrying..."
-        done
-        echo "Storybook is being served!"
-      shell: bash

.github/actions/setup-python-runner/action.yml

@@ -0,0 +1,14 @@
+name: Setup Python Runner
+description: Setup python-runner for tests
+inputs:
+  metabase-automation-token:
+    description: Token for accessing the python-runner repository
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Setup python-runner
+      run: ./.github/scripts/setup-python-runner.sh
+      shell: bash
+      env:
+        METABASE_AUTOMATION_USER_TOKEN: ${{ inputs.metabase-automation-token }}

.github/actions/test-driver/action.yml

@@ -10,28 +10,67 @@ inputs:
     required: true
     default: false
 
+outputs:
+  quarantine-skipped:
+    description: Whether the driver test was skipped due to quarantine
+    value: ${{ steps.check-driver.outputs.skip }}
+
 runs:
   using: "composite"
   steps:
+    - name: Check if driver is ignored
+      id: check-driver
+      shell: bash
+      run: |
+        # If DRIVERS env var is not set, proceed with tests
+        if [ -z "$DRIVERS" ]; then
+          echo "No DRIVERS env var set. Proceeding with tests."
+          echo "skip=false" >> $GITHUB_OUTPUT
+          exit 0
+        fi
+
+        # Fetch CI config and check if driver should be skipped
+        curl -sSf -o ci-test-config.json https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json || true
+
+        # Check if the driver is in the ignored list (gracefully handle missing/invalid config)
+        IS_IGNORED=$(jq --arg driver "$DRIVERS" '.ignored.drivers // [] | contains([$driver])' ci-test-config.json 2>/dev/null || echo "false")
+
+        if [ "$IS_IGNORED" = "true" ]; then
+          echo "⚠️  Driver '$DRIVERS' is in the ignored list. Skipping tests."
+          echo "View the ignored list here: https://github.com/metabase/ci-test-config/blob/master/ci-test-config.json"
+          echo "skip=true" >> $GITHUB_OUTPUT
+        else
+          echo "Driver '$DRIVERS' is not ignored. Proceeding with tests."
+          echo "skip=false" >> $GITHUB_OUTPUT
+        fi
+
     - name: Prepare back-end environment
+      if: steps.check-driver.outputs.skip != 'true'
       uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: driver
     - name: Prepare front-end environment
+      if: ${{ steps.check-driver.outputs.skip != 'true' && inputs.build-static-viz == 'true' }}
       uses: ./.github/actions/prepare-frontend
-      if: ${{ inputs.build-static-viz == 'true' }}
     - name: Build static viz frontend
+      if: ${{ steps.check-driver.outputs.skip != 'true' && inputs.build-static-viz == 'true' }}
       run: yarn build-static-viz
       shell: bash
-      if: ${{ inputs.build-static-viz == 'true' }}
       env:
         MB_EDITION: ee
     - name: Test database driver
+      if: steps.check-driver.outputs.skip != 'true'
       run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash
+      id: run-test
+      # Trunk Quarantine controls the final state of the run in the CI!
+      # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+      # whether to fail or to pass the whole job, based on the quarantine list.
+      continue-on-error: true
     - name: Publish Test Report (JUnit)
       uses: dorny/test-reporter@v1
-      if: failure()
+      # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
+      # test.outcome gives us access to the result before `continue-on-error` overrides it and sets it to 'success'.
+      # We want test reports even if the test step gets cancelled (e.g. times out), hence we match anything that is not a 'success'.
+      if: ${{ steps.run-test.outcome != 'success' && steps.check-driver.outputs.skip != 'true' }}
       with:
         path: "target/junit/**/*_test.xml"
         name: JUnit Test Report ${{ inputs.junit-name }}
@@ -40,9 +79,11 @@ runs:
         list-tests: failed
         fail-on-error: false
     - name: Upload Logs on Failure
-      if: always() && !success()
+      if: always() && steps.run-test.outcome != 'success' && steps.check-driver.outputs.skip != 'true'
       uses: actions/upload-artifact@v4
       with:
         name: test-logs-${{ github.job }}
         path: logs/test-log.json
         retention-days: 1
+      # Failing to upload the artifact should never affect the outcome of the whole test run.
+      continue-on-error: true

.github/actions/update-cache/action.yml

@@ -0,0 +1,41 @@
+name: Update cache
+description: |
+  Update a GitHub Actions cache based on a provided path and key.
+  If a cache entry already exists for the given key, it is first removed.
+  This ensures immutability of cache entries, and prevents runtime errors.
+
+inputs:
+  path:
+    description: "The path(s) to cache, separated by newlines."
+    required: true
+  key:
+    description: "The cache key to use."
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Check if the cache entry exists
+      id: cache-lookup
+      uses: actions/cache/restore@v4
+      with:
+        path: ${{ inputs.path }}
+        key: ${{ inputs.key }}
+        lookup-only: true # Important bit: the action will not fetch anything, just check for the cache existence.
+    - name: Delete the cache entry if it exists
+      if: ${{ steps.cache-lookup.outputs.cache-hit == 'true' }}
+      run: |
+        echo "Cache entry found for key '${{ inputs.key }}'. Deleting it to ensure immutability."
+        gh api \
+          --method DELETE \
+          -H "Accept: application/vnd.github+json" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          /repos/${{ github.repository }}/actions/caches?key=${{ inputs.key }}
+      env:
+        GH_TOKEN: ${{ github.token }}
+      shell: bash
+    - name: Save the new cache entry
+      uses: actions/cache/save@v4
+      with:
+        path: ${{ inputs.path }}
+        key: ${{ inputs.key }}

.github/actions/upload-test-results/action.yml

@@ -48,11 +48,11 @@ runs:
         aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
 
     - name: Upload results to Trunk
-      if: ${{ always() && !(github.event_name == 'pull_request' && github.event.pull_request.draft == true) }}
+      if: always() # Important! This step must always run because it controls job's exit code.
       uses: trunk-io/analytics-uploader@main
       with:
         junit-paths: ${{ inputs.input-path }}
         variant: ${{ inputs.variant || inputs.output-name }}
         org-slug: metabase
+        dry-run: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == true }} # quarantine, but do not upload results
         token: ${{ inputs.trunk-api-token }}
-      continue-on-error: true

.github/codeql/codeql-config.yml

@@ -1,3 +1,5 @@
+version: 1
+
 name: "Metabase CodeQL config"
 
 paths-ignore:

.github/file-paths.yaml

@@ -11,15 +11,19 @@ shared_specs: &shared_specs
   - "test/**/*.cljc"
   - "test/**/*.cljs"
 
-frontend_ci: &frontend_ci
+shared_ci: &shared_ci
   - ".github/actions/prepare-frontend/**"
   - ".github/actions/prepare-backend/**"
-  - ".github/workflows/frontend.yml"
+  - ".github/workflows/run-tests.yml"
 
-frontend_embedding_sdk_ci: &frontend_embedding_sdk_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
-  - ".github/workflows/*embedding-sdk*.yml"
+shared_e2e: &shared_e2e
+  - "e2e/runner/**"
+  - "e2e/snapshot-creators/**"
+  - "e2e/support/**"
+
+frontend_ci: &frontend_ci
+  - *shared_ci
+  - ".github/workflows/frontend.yml"
 
 frontend_configs: &frontend_configs
   - "yarn.lock"
@@ -41,9 +45,14 @@ frontend_sources: &frontend_sources
   - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
   - "frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
 
-frontend_embedding_sdk_sources:
-  - *frontend_configs
-  - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
+# Used only in .github/workflows/conventional-commit-pr-title-reminder.yml
+frontend_embedding_sources:
+  - "enterprise/frontend/src/{embedding,embedding-*}/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
+  - "enterprise/frontend/src/metabase-enterprise/{embedding,embedding-*}**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
+
+# Used only in .github/workflows/embedding-sdk-labels-reminder.yml
+frontend_embedding_sdk_package_sources:
+  - "enterprise/frontend/src/embedding-sdk-package/**/!(*.spec).{js,jsx,ts,tsx,css}"
 
 frontend_specs: &frontend_specs
   - *shared_specs
@@ -69,8 +78,7 @@ frontend_loki_ci: &frontend_loki_ci
   - ".storybook/**"
 
 backend_ci: &backend_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
+  - *shared_ci
   - ".github/actions/test-driver/**"
   - ".github/workflows/backend.yml"
   - ".github/workflows/drivers.yml"
@@ -110,9 +118,9 @@ sources: &sources
   - *backend_sources
 
 e2e_ci: &e2e_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
+  - *shared_ci
   - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/actions/fetch-artifact/action.yml"
   - ".github/actions/e2e-prepare-containers/**"
   - ".github/actions/prepare-cypress/**"
   - ".github/workflows/e2e-*"
@@ -120,22 +128,27 @@ e2e_ci: &e2e_ci
 e2e_specs: &e2e_specs
   - e2e/!(test-host-app)**/*.cy.*.{js,ts}
 
-e2e_cross_version: &e2e_cross_version
-  - ".github/workflows/e2e-cross-version.yml"
-  - "e2e/test/scenarios/cross-version/**"
+embedding_sdk_ci: &embedding_sdk_ci
+  - *shared_ci
+  - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/actions/fetch-artifact/action.yml"
+  - ".github/actions/prepare-cypress/**"
+  - ".github/workflows/embedding-sdk*.yml"
 
-e2e_embedding_sdk:
-  - *frontend_embedding_sdk_ci
-  - *sources
-  - "e2e/component/**/*.cy.*.{js,ts}"
-
-e2e_embedding_sdk_compatibility:
+embedding_sdk_components:
   - *default
-  - *frontend_embedding_sdk_ci
+  - *embedding_sdk_ci
+  - *sources
+  - *shared_e2e
+  - "e2e/test-component/**/*.cy.*.{js,jsx,ts,tsx}"
+
+embedding_sdk_host_sample_apps:
+  - *default
+  - *embedding_sdk_ci
   - *frontend_sources
   - *backend_sources
+  - *shared_e2e
   - "e2e/embedding-sdk-host-apps/**"
-  - "e2e/runner/embedding-sdk/**"
   - "e2e/test-host-app/**/*.cy.*.{js,ts}"
 
 snowplow: &snowplow
@@ -163,6 +176,7 @@ yaml:
   - "**/*.yaml"
 
 codeql:
+  - ".github/workflows/codeql.yml"
   - "frontend/src/**"
   - "enterprise/frontend/src/**"
 

.github/scripts/average-e2e-timings.js

@@ -0,0 +1,171 @@
+const fs = require("fs");
+const path = require("path");
+const { execSync } = require("child_process");
+
+const collectAndAverageTimings = async ({
+  github,
+  context,
+  daysBack = 7,
+  existingTimingsPath = "e2e/support/timings.json",
+}) => {
+  try {
+    const artifacts = await findMergedTimingArtifacts({
+      github,
+      context,
+      daysBack,
+    });
+
+    if (artifacts.length === 0) {
+      throw new Error("No timing artifacts found in the specified time range");
+    }
+
+    const timingData = await downloadAndExtractArtifacts(
+      artifacts,
+      github,
+      context,
+    );
+
+    if (timingData.length === 0) {
+      throw new Error("No valid timing data extracted from artifacts");
+    }
+
+    const averagedTimings = averageTimings(timingData);
+    averagedTimings.durations.sort((a, b) => a.spec.localeCompare(b.spec));
+
+    fs.writeFileSync(
+      existingTimingsPath,
+      JSON.stringify(averagedTimings, null, 2),
+    );
+    console.log(`✅ Updated ${existingTimingsPath} with new timing data`);
+
+    return { artifactCount: timingData.length };
+  } catch (error) {
+    console.error("❌ Error in collectAndAverageTimings:", error.message);
+    throw error;
+  }
+};
+
+const findMergedTimingArtifacts = async ({ github, context, daysBack }) => {
+  const cutoffDate = new Date();
+  cutoffDate.setDate(cutoffDate.getDate() - daysBack);
+
+  console.log(
+    `Searching for merged timing artifacts created after ${cutoffDate.toISOString()}`,
+  );
+
+  const artifacts = [];
+  let page = 1;
+
+  while (true) {
+    try {
+      const { data } = await github.rest.actions.listArtifactsForRepo({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        name: "merged-e2e-timings",
+        per_page: 100,
+        page,
+      });
+
+      const validArtifacts = data.artifacts
+        .filter((a) => new Date(a.created_at) > cutoffDate && !a.expired)
+        .map(({ name, created_at, id }) => ({ name, created_at, id }));
+      artifacts.push(...validArtifacts);
+
+      if (
+        data.artifacts.some((a) => new Date(a.created_at) <= cutoffDate) ||
+        data.artifacts.length < 100
+      ) {
+        break;
+      }
+      page++;
+    } catch (error) {
+      console.log(
+        `Error fetching artifacts page ${page - 1}: ${error.message}`,
+      );
+      break;
+    }
+  }
+
+  console.log(`Found ${artifacts.length} merged timing artifacts total`);
+  return artifacts;
+};
+
+const downloadAndExtractArtifacts = async (artifacts, github, context) => {
+  const tempDir = "timing-artifacts-temp";
+  fs.mkdirSync(tempDir, { recursive: true });
+
+  const timingData = [];
+
+  for (const artifact of artifacts) {
+    try {
+      console.log(`Downloading artifact: ${artifact.name}`);
+
+      const zipPath = path.join(tempDir, `${artifact.name}.zip`);
+      const extractPath = path.join(tempDir, artifact.name);
+
+      const { data } = await github.rest.actions.downloadArtifact({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        artifact_id: artifact.id,
+        archive_format: "zip",
+      });
+
+      fs.writeFileSync(zipPath, Buffer.from(data));
+      fs.mkdirSync(extractPath, { recursive: true });
+      execSync(`unzip -q "${zipPath}" -d "${extractPath}"`);
+
+      const timingFilePath = path.join(extractPath, "runTimings.json");
+
+      if (fs.existsSync(timingFilePath)) {
+        const content = JSON.parse(fs.readFileSync(timingFilePath, "utf8"));
+
+        if (content.durations?.length) {
+          timingData.push(content);
+          console.log(
+            `✅ Extracted timing data from ${artifact.name} (${content.durations.length} specs)`,
+          );
+        } else {
+          console.log(`⚠ Invalid timing data structure in ${artifact.name}`);
+        }
+      } else {
+        console.log(`⚠ No timing data found in ${artifact.name}`);
+      }
+
+      fs.rmSync(extractPath, { recursive: true });
+    } catch (error) {
+      console.log(`❌ Error processing ${artifact.name}: ${error.message}`);
+    }
+  }
+
+  fs.rmSync(tempDir, { recursive: true });
+
+  console.log(
+    `Successfully extracted timing data from ${timingData.length}/${artifacts.length} artifacts`,
+  );
+  return timingData;
+};
+
+const averageTimings = (timingDataArray) => {
+  if (!timingDataArray.length) {
+    throw new Error("No timing data to process");
+  }
+
+  const specTimings = timingDataArray
+    .flatMap((data) => data.durations)
+    .filter((item) => item.spec && typeof item.duration === "number")
+    .reduce((acc, { spec, duration }) => {
+      (acc[spec] = acc[spec] || []).push(duration);
+      return acc;
+    }, {});
+
+  const durations = Object.entries(specTimings).map(([spec, durations]) => ({
+    spec,
+    duration: Math.round(
+      durations.reduce((sum, d) => sum + d, 0) / durations.length,
+    ),
+  }));
+
+  return { durations };
+};
+
+module.exports = { collectAndAverageTimings, averageTimings };

.github/scripts/average-e2e-timings.unit.spec.js

@@ -0,0 +1,132 @@
+const { averageTimings } = require("./average-e2e-timings");
+
+describe("averageTimings", () => {
+  it("should throw error when given empty array", () => {
+    expect(() => averageTimings([])).toThrow("No timing data to process");
+  });
+
+  it("should work for n=1", () => {
+    const input = [
+      {
+        durations: [
+          { spec: "test1.cy.js", duration: 1000 },
+          { spec: "test2.cy.js", duration: 2000 },
+        ],
+      },
+    ];
+
+    const result = averageTimings(input);
+
+    expect(result.durations).toHaveLength(2);
+    expect(result.durations).toContainEqual({
+      spec: "test1.cy.js",
+      duration: 1000,
+    });
+    expect(result.durations).toContainEqual({
+      spec: "test2.cy.js",
+      duration: 2000,
+    });
+  });
+
+  it("should calculate average for multiple specs", () => {
+    const input = [
+      {
+        durations: [
+          { spec: "test1.cy.js", duration: 1000 },
+          { spec: "test2.cy.js", duration: 2000 },
+        ],
+      },
+      {
+        durations: [
+          { spec: "test1.cy.js", duration: 2000 },
+          { spec: "test2.cy.js", duration: 4000 },
+        ],
+      },
+    ];
+
+    const result = averageTimings(input);
+
+    expect(result.durations).toHaveLength(2);
+    expect(result.durations).toContainEqual({
+      spec: "test1.cy.js",
+      duration: 1500,
+    });
+    expect(result.durations).toContainEqual({
+      spec: "test2.cy.js",
+      duration: 3000,
+    });
+  });
+
+  it("should round averages to nearest integer", () => {
+    const input = [
+      {
+        durations: [{ spec: "test1.cy.js", duration: 1001 }],
+      },
+      {
+        durations: [{ spec: "test1.cy.js", duration: 1002 }],
+      },
+    ];
+
+    const result = averageTimings(input);
+
+    expect(result.durations[0].duration).toBe(1002);
+  });
+
+  it("should ignore invalid entries", () => {
+    const input = [
+      {
+        durations: [
+          { spec: "test1.cy.js", duration: 1000 },
+          { spec: "test2.cy.js", duration: "invalid" },
+          { duration: 2000 }, // missing spec
+          { spec: "test3.cy.js", duration: 3000 },
+        ],
+      },
+    ];
+
+    const result = averageTimings(input);
+
+    expect(result.durations).toHaveLength(2);
+    expect(result.durations).toContainEqual({
+      spec: "test1.cy.js",
+      duration: 1000,
+    });
+    expect(result.durations).toContainEqual({
+      spec: "test3.cy.js",
+      duration: 3000,
+    });
+  });
+
+  it("should handle merging different specs", () => {
+    const input = [
+      {
+        durations: [
+          { spec: "test1.cy.js", duration: 1000 },
+          { spec: "test2.cy.js", duration: 2000 },
+        ],
+      },
+      {
+        durations: [
+          { spec: "test1.cy.js", duration: 3000 },
+          { spec: "test3.cy.js", duration: 1000 },
+        ],
+      },
+    ];
+
+    const result = averageTimings(input);
+
+    expect(result.durations).toHaveLength(3);
+    expect(result.durations).toContainEqual({
+      spec: "test1.cy.js",
+      duration: 2000,
+    });
+    expect(result.durations).toContainEqual({
+      spec: "test2.cy.js",
+      duration: 2000,
+    });
+    expect(result.durations).toContainEqual({
+      spec: "test3.cy.js",
+      duration: 1000,
+    });
+  });
+});

.github/scripts/build-e2e-matrix.js

@@ -3,14 +3,8 @@
 // grouping some specific tests together, other tests are split into chunks
 
 const DEFAULT_SPEC_PATTERN = "./e2e/test/scenarios/**/*.cy.spec.*";
-const EMBEDDING_SDK_SPEC_PATTERN =
-  "./e2e/test/scenarios/embedding-sdk/**.cy.spec.*";
 
 const specialTestConfigs = [
-  {
-    name: "embedding-sdk",
-    specs: EMBEDDING_SDK_SPEC_PATTERN,
-  },
   {
     name: "oss-subset",
     edition: "oss",
@@ -18,6 +12,7 @@ const specialTestConfigs = [
     specs: DEFAULT_SPEC_PATTERN,
   },
   { name: "mongo", tags: "@mongo", specs: DEFAULT_SPEC_PATTERN },
+  { name: "python", tags: "@python", specs: DEFAULT_SPEC_PATTERN },
 ];
 
 /**

.github/scripts/build-e2e-matrix.unit.spec.js

@@ -21,10 +21,10 @@ describe("buildMatrix", () => {
   });
 
   it("should apply default specs path when empty entry is provided", () => {
-    const result = testBuildMatrix("", 5);
+    const result = testBuildMatrix("", 6);
 
-    expect(result.regularChunks).toBe(2);
-    expect(result.config.length).toBe(5);
+    expect(result.regularChunks).toBe(3);
+    expect(result.config.length).toBe(6);
   });
 
   it("should name regular test groups sequentially", () => {
@@ -43,9 +43,9 @@ describe("buildMatrix", () => {
 
     expect(result.regularChunks).toBe(0);
     expect(result.config.length).toBe(3);
-    expect(result.config[0].name).toBe("embedding-sdk");
-    expect(result.config[1].name).toBe("oss-subset");
-    expect(result.config[2].name).toBe("mongo");
+    expect(result.config[0].name).toBe("oss-subset");
+    expect(result.config[1].name).toBe("mongo");
+    expect(result.config[2].name).toBe("python");
   });
 
   it("should correctly calculate regularChunks for non-default spec pattern", () => {
@@ -83,9 +83,9 @@ describe("buildMatrix", () => {
   it("should return special test configs when default spec pattern is provided", () => {
     const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 50);
 
-    expect(result.config[47].name).toBe("embedding-sdk");
-    expect(result.config[48].name).toBe("oss-subset");
-    expect(result.config[49].name).toBe("mongo");
+    expect(result.config[47].name).toBe("oss-subset");
+    expect(result.config[48].name).toBe("mongo");
+    expect(result.config[49].name).toBe("python");
   });
 
   it("should not return special test configs when non-default spec pattern is provided", () => {

.github/scripts/conventional-commit-pr-title-reminder/utils.js

@@ -1,24 +1,66 @@
-exports.updateComment = updateComment;
+const TYPES = new Set([
+  "feat",
+  "fix",
+  "perf",
+  "docs",
+  "style",
+  "refactor",
+  "test",
+  "build",
+  "ci",
+]);
+
+/**
+ * @param title {string}
+ */
+function isConventionalTitle(title) {
+  const match = /^(?<type>\w+)\((?<rawScopes>[^)]+)\):/.exec(title);
+
+  if (!match) {
+    return false;
+  }
+
+  const [, type, rawScopes] = match;
+  const scopes = rawScopes
+    .split(",")
+    .map((scope) => scope.trim())
+    .filter(Boolean);
+
+  return TYPES.has(type) && scopes.length > 0;
+}
 
 /** @param {import('@types/github-script').AsyncFunctionArguments} AsyncFunctionArguments */
-async function updateComment({ github, context }) {
+async function updateCommentForEmbedding({ github, context }) {
   const githubUsername = context.payload.sender.login;
-  const comment = `${CONVENTIONAL_COMMIT_REMINDER_COMMENT_IDENTIFIER}
-@${githubUsername} You have modified embedding SDK code. Please make sure the PR title follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) style.
-Here are all the supported types that will be shown in the changelog:
+
+  const comment = `${CONVENTIONAL_COMMENT_IDENTIFIER}
+@${githubUsername} You have modified embedding code. Please make sure the PR title follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) style.
+Here are all the supported types:
 - \`feat\`
 - \`fix\`
 - \`perf\`
+- \`docs\`
+- \`style\`
+- \`refactor\`
+- \`test\`
+- \`build\`
+- \`ci\`
 
-These types \`docs\`, \`style\`, \`refactor\`, \`test\`, \`build\`, and \`ci\` are also encouraged for non-changelog related tasks.
-
-Please also make sure to include \`sdk\` scope, otherwise, the changelog will not include this task.
+Please also make sure to include a scope.
 
 For example, these are valid PR titles:
-- \`feat(sdk): Add interactive dashboard component\`
-- \`feat(sdk): Support theming pie chart\`
-- \`fix(sdk): Fix static dashboard crash\``;
+- \`feat(sdk-bundle): Add interactive dashboard component\`
+- \`fix(sdk-package): Fixed MetabaseProviderPropsStore logic\`
+- \`fix(sdk-package, embed-js): Fix API\``;
 
+  return updateComment(comment, { github, context });
+}
+
+/**
+ * @param comment {string}
+ * @param {import('@types/github-script').AsyncFunctionArguments} AsyncFunctionArguments
+ */
+async function updateComment(comment, { github, context }) {
   const owner = context.repo.owner;
   const repo = context.repo.repo;
   const pullRequestNumber = context.issue.number;
@@ -49,20 +91,19 @@ For example, these are valid PR titles:
   }
 }
 
-const CONVENTIONAL_COMMIT_REMINDER_COMMENT_IDENTIFIER =
-  "<!---conventional commit reminder comment ID-->";
+const CONVENTIONAL_COMMENT_IDENTIFIER =
+  "<!---conventional comment identifier-->";
+
 /**
- * @typedef Comment
- * @property {string} body
- *
- * @param {Comment[]} comments
+ * @param comments {{body: string}[]}
  */
 function getExistingConventionalCommitReminderComment(comments) {
   for (const comment of comments) {
-    if (
-      comment.body.startsWith(CONVENTIONAL_COMMIT_REMINDER_COMMENT_IDENTIFIER)
-    ) {
+    if (comment.body.startsWith(CONVENTIONAL_COMMENT_IDENTIFIER)) {
       return comment;
     }
   }
 }
+
+exports.isConventionalTitle = isConventionalTitle;
+exports.updateCommentForEmbedding = updateCommentForEmbedding;

.github/scripts/conventional-commit-pr-title-reminder/utils.unit.spec.js

@@ -0,0 +1,45 @@
+const { isConventionalTitle } = require("./utils");
+
+describe("isConventionalTitle", () => {
+  it("returns true for a simple conventional commit", () => {
+    expect(isConventionalTitle("feat: add new feature")).toBe(false);
+  });
+
+  it("returns true for a commit with a scope", () => {
+    expect(isConventionalTitle("fix(api): correct API bug")).toBe(true);
+  });
+
+  it("returns true for a commit with multiple scopes, comma separated", () => {
+    expect(isConventionalTitle("feat(build,deps): update dependencies")).toBe(
+      true,
+    );
+  });
+
+  it("returns true for a commit with multiple scopes, comma separated with space", () => {
+    expect(isConventionalTitle("feat(build, deps): update dependencies")).toBe(
+      true,
+    );
+  });
+
+  it("returns false for a commit with round brackets in a message", () => {
+    expect(isConventionalTitle("feat: (something) update dependencies")).toBe(
+      false,
+    );
+  });
+
+  it("returns false for missing colon", () => {
+    expect(isConventionalTitle("feat add feature")).toBe(false);
+  });
+
+  it("returns false for invalid type", () => {
+    expect(isConventionalTitle("invalidType: some message")).toBe(false);
+  });
+
+  it("returns false for empty message", () => {
+    expect(isConventionalTitle("feat:")).toBe(false);
+  });
+
+  it("returns false for empty input", () => {
+    expect(isConventionalTitle("")).toBe(false);
+  });
+});

.github/scripts/extract-changed-timings.js

@@ -0,0 +1,39 @@
+const extractChangedTimings = ({ oldTimings, newTimings }) => {
+  const oldTimingMap =
+    oldTimings.durations?.reduce((map, item) => {
+      if (item.spec) {
+        map[item.spec] = item.duration;
+      }
+      return map;
+    }, {}) || {};
+
+  const changedDurations = newTimings.durations
+    .filter((item) => {
+      if (!item || !item.spec || typeof item.duration !== "number") {
+        return false;
+      }
+      const newSpec = convertPathFormat(item.spec);
+      const oldDuration = oldTimingMap[newSpec] || oldTimingMap[item.spec];
+      // Include if it's a new spec or the duration has changed
+      return oldDuration === undefined || oldDuration !== item.duration;
+    })
+    .map((item) => ({
+      spec: convertPathFormat(item.spec),
+      duration: item.duration,
+    }));
+
+  return {
+    changedTimings: { durations: changedDurations },
+    hasChanges: changedDurations.length > 0,
+  };
+};
+
+// Convert cypress-split path format to timings.json path format
+// from "e2e/test/scenarios/..." to "../test/scenarios/..."
+function convertPathFormat(specPath) {
+  return specPath.startsWith("e2e/test/")
+    ? specPath.replace("e2e/test/", "../test/")
+    : specPath;
+}
+
+module.exports = { extractChangedTimings };

.github/scripts/extract-changed-timings.unit.spec.js

@@ -0,0 +1,195 @@
+const { extractChangedTimings } = require("./extract-changed-timings");
+
+describe("extractChangedTimings", () => {
+  it("should return empty durations when no changes", () => {
+    const oldTimings = {
+      durations: [
+        { spec: "test1.cy.js", duration: 1000 },
+        { spec: "test2.cy.js", duration: 2000 },
+      ],
+    };
+
+    const newTimings = {
+      durations: [
+        { spec: "test1.cy.js", duration: 1000 },
+        { spec: "test2.cy.js", duration: 2000 },
+      ],
+    };
+
+    const result = extractChangedTimings({ oldTimings, newTimings });
+
+    expect(result.changedTimings.durations).toHaveLength(0);
+    expect(result.hasChanges).toBe(false);
+  });
+
+  it("should detect new specs", () => {
+    const oldTimings = {
+      durations: [{ spec: "test1.cy.js", duration: 1000 }],
+    };
+
+    const newTimings = {
+      durations: [
+        { spec: "test1.cy.js", duration: 1000 },
+        { spec: "test2.cy.js", duration: 2000 },
+      ],
+    };
+
+    const result = extractChangedTimings({ oldTimings, newTimings });
+
+    expect(result.changedTimings.durations).toHaveLength(1);
+    expect(result.changedTimings.durations[0]).toEqual({
+      spec: "test2.cy.js",
+      duration: 2000,
+    });
+    expect(result.hasChanges).toBe(true);
+  });
+
+  it("should detect duration changes", () => {
+    const oldTimings = {
+      durations: [
+        { spec: "test1.cy.js", duration: 1000 },
+        { spec: "test2.cy.js", duration: 2000 },
+      ],
+    };
+
+    const newTimings = {
+      durations: [
+        { spec: "test1.cy.js", duration: 1000 },
+        { spec: "test2.cy.js", duration: 2200 },
+      ],
+    };
+
+    const result = extractChangedTimings({ oldTimings, newTimings });
+
+    expect(result.changedTimings.durations).toHaveLength(1);
+    expect(result.changedTimings.durations[0]).toEqual({
+      spec: "test2.cy.js",
+      duration: 2200,
+    });
+    expect(result.hasChanges).toBe(true);
+  });
+
+  it("should handle missing old timings", () => {
+    const oldTimings = { durations: [] };
+
+    const newTimings = {
+      durations: [
+        { spec: "test1.cy.js", duration: 1000 },
+        { spec: "test2.cy.js", duration: 2000 },
+      ],
+    };
+
+    const result = extractChangedTimings({ oldTimings, newTimings });
+
+    // All timings should be considered "changed" since old timings is empty
+    expect(result.changedTimings.durations).toHaveLength(2);
+    expect(result.changedTimings.durations).toContainEqual({
+      spec: "test1.cy.js",
+      duration: 1000,
+    });
+    expect(result.changedTimings.durations).toContainEqual({
+      spec: "test2.cy.js",
+      duration: 2000,
+    });
+    expect(result.hasChanges).toBe(true);
+  });
+
+  it("should handle invalid timing entries", () => {
+    const oldTimings = {
+      durations: [{ spec: "test1.cy.js", duration: 1000 }],
+    };
+
+    const newTimings = {
+      durations: [
+        { spec: "test1.cy.js", duration: 1000 },
+        { spec: "test2.cy.js", duration: "invalid" },
+        { duration: 2000 }, // missing spec
+        { spec: "test3.cy.js", duration: 3000 },
+      ],
+    };
+
+    const result = extractChangedTimings({ oldTimings, newTimings });
+
+    // Only test3.cy.js should be included (new spec with valid data)
+    expect(result.changedTimings.durations).toHaveLength(1);
+    expect(result.changedTimings.durations[0]).toEqual({
+      spec: "test3.cy.js",
+      duration: 3000,
+    });
+    expect(result.hasChanges).toBe(true);
+  });
+
+  it("should handle timing data with different specs", () => {
+    const oldTimings = {
+      durations: [
+        { spec: "test1.cy.js", duration: 1000 },
+        { spec: "test2.cy.js", duration: 2000 },
+      ],
+    };
+
+    const newTimings = {
+      durations: [
+        { spec: "test1.cy.js", duration: 3000 },
+        { spec: "test3.cy.js", duration: 1000 },
+      ],
+    };
+
+    const result = extractChangedTimings({ oldTimings, newTimings });
+
+    expect(result.changedTimings.durations).toHaveLength(2);
+    expect(result.changedTimings.durations).toContainEqual({
+      spec: "test1.cy.js",
+      duration: 3000,
+    });
+    expect(result.changedTimings.durations).toContainEqual({
+      spec: "test3.cy.js",
+      duration: 1000,
+    });
+    expect(result.hasChanges).toBe(true);
+  });
+
+  it("should convert cypress-split paths to relative paths", () => {
+    const oldTimings = {
+      durations: [
+        {
+          spec: "../test/scenarios/dashboard/dashboard.cy.spec.js",
+          duration: 1000,
+        },
+        {
+          spec: "../test/scenarios/admin/databases.cy.spec.js",
+          duration: 2000,
+        },
+      ],
+    };
+
+    const newTimings = {
+      durations: [
+        {
+          spec: "e2e/test/scenarios/dashboard/dashboard.cy.spec.js",
+          duration: 1200,
+        },
+        {
+          spec: "e2e/test/scenarios/admin/databases.cy.spec.js",
+          duration: 2000,
+        },
+        {
+          spec: "e2e/test/scenarios/collections/collections.cy.spec.js",
+          duration: 1500,
+        },
+      ],
+    };
+
+    const result = extractChangedTimings({ oldTimings, newTimings });
+
+    expect(result.changedTimings.durations).toHaveLength(2);
+    expect(result.changedTimings.durations).toContainEqual({
+      spec: "../test/scenarios/dashboard/dashboard.cy.spec.js",
+      duration: 1200,
+    });
+    expect(result.changedTimings.durations).toContainEqual({
+      spec: "../test/scenarios/collections/collections.cy.spec.js",
+      duration: 1500,
+    });
+    expect(result.hasChanges).toBe(true);
+  });
+});

.github/scripts/get-issue-data.js

@@ -0,0 +1,84 @@
+const githubSlackMap = require("../../release/github-slack-map.json");
+
+async function getIssueData({ context, github, manualIssueNumber }) {
+  let issueNumber;
+  let issueData;
+  let prReviews = [];
+  const triggerType = context.eventName;
+
+  if (context.eventName === "issues") {
+    issueNumber = context.payload.issue.number;
+    issueData = context.payload.issue;
+  } else if (context.eventName === "workflow_dispatch") {
+    issueNumber = parseInt(manualIssueNumber);
+    const { data } = await github.rest.issues.get({
+      owner: context.repo.owner,
+      repo: context.repo.repo,
+      issue_number: issueNumber,
+    });
+    issueData = data;
+  } else if (context.eventName === "pull_request_review") {
+    const prNumber = context.payload.pull_request.number;
+    const { data: prData } = await github.rest.pulls.get({
+      owner: context.repo.owner,
+      repo: context.repo.repo,
+      pull_number: prNumber,
+    });
+
+    // Extract issue number from branch name (e.g., "claude-fix/issue-12345-some-title")
+    const branchMatch = prData.head.ref.match(/claude-fix\/issue-(\d+)/);
+    if (!branchMatch) {
+      throw new Error(
+        `Could not extract issue number from branch name: ${prData.head.ref}`,
+      );
+    }
+
+    issueNumber = parseInt(branchMatch[1]);
+
+    const { data } = await github.rest.issues.get({
+      owner: context.repo.owner,
+      repo: context.repo.repo,
+      issue_number: issueNumber,
+    });
+    issueData = data;
+
+    const { data: reviews } = await github.rest.pulls.listReviews({
+      owner: context.repo.owner,
+      repo: context.repo.repo,
+      pull_number: prNumber,
+    });
+
+    prReviews = reviews.filter(
+      (review) =>
+        review.state === "CHANGES_REQUESTED" &&
+        isMetabaseMember(review.user.login),
+    );
+  }
+
+  const { data: comments } = await github.rest.issues.listComments({
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    issue_number: issueNumber,
+  });
+
+  const employeeComments = comments.filter((comment) =>
+    isMetabaseMember(comment.user.login),
+  );
+
+  return {
+    issueNumber,
+    issueData,
+    employeeComments,
+    prReviews,
+    triggerType,
+    isIssueAuthorEmployee: isMetabaseMember(issueData.user.login),
+  };
+}
+
+function isMetabaseMember(username) {
+  return username in githubSlackMap;
+}
+
+module.exports = {
+  getIssueData,
+};

.github/scripts/setup-python-runner.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+set -e
+
+# Parse command line arguments
+SKIP_START=false
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --skip-start)
+      SKIP_START=true
+      shift
+      ;;
+    *)
+      echo "Unknown option: $1"
+      echo "Usage: $0 [--skip-start]"
+      exit 1
+      ;;
+  esac
+done
+
+echo "Cloning python-runner repository..."
+git clone --depth 1 https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git python-runner
+
+if [ "$SKIP_START" = false ]; then
+  echo "Starting python-runner..."
+  cd python-runner
+  make run-ci 1> ../python-runner.out.log 2> ../python-runner.err.log
+  make logs 1>> ../python-runner.out.log 2>> ../python-runner.err.log &
+  cd ..
+fi

.github/team.json

@@ -32,20 +32,6 @@
         "lorem--ipsum"
       ]
     },
-    {
-      "name": "Workflows",
-      "label": ".Team/Workflows",
-      "members": [
-        "qnkhuat",
-        "piranha",
-        "crisptrutski",
-        "spalt08",
-        "stasgavrylov",
-        "uladzimirdev",
-        "kulyk",
-        "kamilmielnik"
-      ]
-    },
     {
       "name": "Admin Webapp",
       "label": ".Team/AdminWebapp",
@@ -58,10 +44,13 @@
       "label": ".Team/DevEx",
       "members": [
         "camsaul",
-        "escherize"
+        "dpsutton",
+        "escherize",
+        "fraserdrops",
+        "nemanjaglumac"
       ]
     },
-     {
+    {
       "name": "Metabot",
       "label": ".Team/Metabot",
       "members": [
@@ -70,19 +59,10 @@
         "retro",
         "sloansparger",
         "somtom",
-        "wotbrew",
         "tsplude",
         "lbrdnk",
-        "bronsa"
-      ]
-    },
-    {
-      "name": "Product Growth",
-      "label": ".Team/ProductGrowth",
-      "members": [
-        "nemanjaglumac",
-        "chodorowicz",
-        "andsalves"
+        "piranha",
+        "crisptrutski"
       ]
     },
     {
@@ -111,7 +91,24 @@
         "edpaget",
         "deniskaber",
         "alxnddr",
-        "bpander"
+        "bpander",
+        "andsalves",
+        "gantoreno"
+      ]
+    },
+    {
+      "name": "Gadget",
+      "label": ".Team/Gadget",
+      "members": [
+        "nmezzopera",
+        "bronsa",
+        "wotbrew",
+        "qnkhuat",
+        "chodorowicz",
+        "kamilmielnik",
+        "stasgavrylov",
+        "uladzimirdev",
+        "egorgrushin"
       ]
     }
   ]

.github/workflows/app-db.yml

@@ -35,21 +35,21 @@ jobs:
             build-static-viz: false
             test-args: >-
               :only '"enterprise/backend/test"'
-            exclude-tag: ':mb/driver-tests'
+            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
           - name: EE App DB Tests (Part 1)
             build-static-viz: true
             test-args: >-
               :only '"test"'
               :partition/total 2
               :partition/index 0
-            exclude-tag: ':mb/driver-tests'
+            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
           - name: EE App DB Tests (Part 2)
             build-static-viz: true
             test-args: >-
               :only '"test"'
               :partition/total 2
               :partition/index 1
-            exclude-tag: ':mb/driver-tests'
+            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
 
     services:
       mysql:
@@ -137,31 +137,33 @@ jobs:
             image: cimg/mysql:8.0
             env:
               enable-ssl-tests: 'false'
+              enable-aws-iam-tests: 'false'
           - name: MySQL Latest
             junit-name: be-tests-mysql-latest-ee
             image: mysql:latest
             env:
               enable-ssl-tests: 'true'
+              enable-aws-iam-tests: 'true'
         job:
           - name: Enterprise Tests
             build-static-viz: false
             test-args: >-
               :only '"enterprise/backend/test"'
-            exclude-tag: ':mb/driver-tests'
+            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
           - name: EE App DB Tests (Part 1)
             build-static-viz: true
             test-args: >-
               :only '"test"'
               :partition/total 2
               :partition/index 0
-            exclude-tag: ':mb/driver-tests'
+            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
           - name: EE App DB Tests (Part 2)
             build-static-viz: true
             test-args: >-
               :only '"test"'
               :partition/total 2
               :partition/index 1
-            exclude-tag: ':mb/driver-tests'
+            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
 
     services:
       mysql:
@@ -211,6 +213,14 @@ jobs:
       MB_MYSQL_SSL_TEST_SSL_CERT: ${{ secrets.MB_MYSQL_SSL_TEST_SSL_CERT }}
       MB_MYSQL_SSL_TEST_USER: metabase
       MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
+      MB_MYSQL_AWS_IAM_TEST: ${{ matrix.version.env.enable-aws-iam-tests }}
+      MB_MYSQL_AWS_IAM_TEST_HOST: ${{ secrets.MYSQL_AURORA_IAM_INSTANCE_HOST }}
+      MB_MYSQL_AWS_IAM_TEST_PORT: 3306
+      MB_MYSQL_AWS_IAM_TEST_USER: my_iam_user
+      MB_MYSQL_AWS_IAM_TEST_DBNAME: test_db
+      MB_MYSQL_AWS_IAM_TEST_SSL_CERT: trust
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_AURORA_IAM_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
     # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
     # "be-tests-mariadb-10-2-ee (0)"
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
@@ -249,21 +259,19 @@ jobs:
             docker-image: postgres:12-alpine
             env:
               enable-ssl-tests: 'false'
+              enable-aws-iam-tests: 'false'
           - name: Postgres Latest
             junit-name: postgres-latest-ee
             docker-image: postgres:latest
             env:
               enable-ssl-tests: 'true'
+              enable-aws-iam-tests: 'true'
         job:
-          - name: Driver Tests
-            build-static-viz: false
-            test-args: >-
-              :only-tags [:mb/driver-tests]
           - name: Enterprise Tests
             build-static-viz: false
             test-args: >-
               :only '"enterprise/backend/test"'
-            exclude-tag: ':mb/driver-tests'
+            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
           - name: EE App DB Tests (Part 1)
             build-static-viz: true
             test-args: >-
@@ -271,14 +279,14 @@ jobs:
               :exclude-tags [:mb/driver-tests]
               :partition/total 2
               :partition/index 0
-            exclude-tag: ':mb/driver-tests'
+            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
           - name: EE App DB Tests (Part 2)
             build-static-viz: true
             test-args: >-
               :only '"test"'
               :partition/total 2
               :partition/index 1
-            exclude-tag: ':mb/driver-tests'
+            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     env:
       # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
@@ -309,6 +317,13 @@ jobs:
       MB_POSTGRES_SSL_TEST_SSL: ${{ matrix.version.env.enable-ssl-tests }}
       MB_POSTGRES_SSL_TEST_SSL_MODE: verify-full
       MB_POSTGRES_SSL_TEST_SSL_ROOT_CERT_PATH: 'test-resources/certificates/us-east-2-bundle.pem'
+      MB_POSTGRES_AWS_IAM_TEST: ${{ matrix.version.env.enable-aws-iam-tests }}
+      MB_POSTGRES_AWS_IAM_TEST_HOST: ${{ secrets.POSTGRES_AURORA_IAM_INSTANCE_HOST }}
+      MB_POSTGRES_AWS_IAM_TEST_PORT: 5432
+      MB_POSTGRES_AWS_IAM_TEST_USER: my_iam_user
+      MB_POSTGRES_AWS_IAM_TEST_DBNAME: test_db
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_AURORA_IAM_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
     services:
       postgres:
         image: ${{ matrix.version.docker-image }}

.github/workflows/auto-assign.yml

@@ -23,7 +23,7 @@ jobs:
         uses: actions/github-script@v7
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
-          script: |
+          script: | #js
             const fs = require('fs');
             const teamConfig = JSON.parse(fs.readFileSync('.github/team.json', 'utf-8'));
             const prAuthor = context.payload.pull_request.user.login;
@@ -65,10 +65,3 @@ jobs:
               issue_number: prNumber,
               labels: [team.label]
             });
-
-            return team.projectUrl || null;
-      - uses: actions/add-to-project@v0.5.0
-        if: ${{ steps.auto-assign.outputs.result != 'null' }}
-        with:
-          project-url: ${{ steps.auto-assign.outputs.result }}
-          github-token: ${{ steps.generate-token.outputs.token }}

.github/workflows/auto-backport.yml

@@ -6,11 +6,19 @@ on:
 
 jobs:
   create-backport:
-    if: | # the PR must be merged and have a backport label
+    if:
+      | # the PR must have a backport label when it's merged, or be labeled with a backport label after merge
       github.event.pull_request.merged == true && (
-        contains(github.event.pull_request.labels.*.name, 'backport') ||
-        contains(github.event.pull_request.labels.*.name, 'double-backport') ||
-        contains(github.event.pull_request.labels.*.name, 'triple-backport')
+        github.event.action == 'closed' && (
+          contains(github.event.pull_request.labels.*.name, 'backport') ||
+          contains(github.event.pull_request.labels.*.name, 'double-backport') ||
+          contains(github.event.pull_request.labels.*.name, 'triple-backport')
+        ) ||
+        github.event.action == 'labeled' && (
+          github.event.label.name == 'backport' ||
+          github.event.label.name == 'double-backport' ||
+          github.event.label.name == 'triple-backport'
+        )
       )
     runs-on: ubuntu-latest
     steps:

.github/workflows/backend-cloverage.yml

@@ -10,21 +10,202 @@ jobs:
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 90
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        modules:
+          - actions
+          - activity-feed
+          - analytics
+          - analyze
+          - api
+          - api-keys
+          - api-routes
+          - app-db
+          - appearance
+          - audit-app
+          - auth-provider
+          - batch-processing
+          - bookmarks
+          - bug-reporting
+          - cache
+          - channel
+          - classloader
+          - cloud-migration
+          - cmd
+          - collections
+          - config
+          - connection-pool
+          - content-translation
+          - content-verification
+          - core
+          - dashboards
+          - database-routing
+          - driver
+          - driver-api
+          - eid-translation
+          - embedding
+          - events
+          - formatter
+          - geojson
+          - glossary
+          - graph
+          - indexed-entities
+          - internal-stats
+          - legacy-mbql
+          - lib
+          - lib-be
+          - logger
+          - login-history
+          - model-persistence
+          - models
+          - native-query-snippets
+          - notification
+          - parameters
+          - permissions
+          - pivot
+          - plugins
+          - premium-features
+          - product-feedback
+          - public-sharing
+          - pulse
+          - queries
+          - query-permissions
+          - query-processor
+          - remote-sync
+          - request
+          - revisions
+          - sample-data
+          - search
+          - secrets
+          - segments
+          - server
+          - session
+          - settings
+          - setup
+          - sso
+          - startup
+          - store-api
+          - sync
+          - system
+          - task
+          - task-history
+          - testing-api
+          - tiles
+          - timeline
+          - types
+          - upload
+          - user-key-value
+          - users
+          - util
+          - version
+          - view-log
+          - warehouse-schema
+          - warehouses
+          - xrays
     steps:
       - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cloverage"
+
       - name: Build static viz frontend
         run: yarn build-static-viz
         env:
           MB_EDITION: ee
       - name: Collect the test coverage
-        run: clojure -X:dev:ci:ee:ee-dev:test:cloverage
+        run: |
+          clojure -X:dev:ci:ee:ee-dev:test:cloverage \
+            :ns-regex     '["^metabase\\.${{ matrix.modules }}\\..*"]' \
+            :test-ns-path '["test/metabase/${{ matrix.modules }}"]'
+        continue-on-error: true
+
       - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@v4
+        if: always()
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./target/coverage/codecov.json
+          flags: back-end
+
+  be-linter-cloverage-enterprise:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        modules:
+          - action-v2
+          - advanced-config
+          - advanced-permissions
+          - ai-entity-analysis
+          - ai-sql-fixer
+          - ai-sql-generation
+          - analytics
+          - api
+          - audit-app
+          - auth-provider
+          - billing
+          - bookmarks
+          - cache
+          - cloud-add-ons
+          - comments
+          - content-translation
+          - content-verification
+          - core
+          - dashboard-subscription-filters
+          - database-replication
+          - database-routing
+          - dependencies
+          - documents
+          - email
+          - embedding-hub
+          - gsheets
+          - harbormaster
+          - impersonation
+          - internal-stats
+          - llm
+          - metabot-v3
+          - permission-debug
+          - premium-features
+          - public-sharing
+          - remote-sync
+          - sandbox
+          - scim
+          - search
+          - semantic-search
+          - serialization
+          - snippet-collections
+          - sso
+          - stale
+          - transforms
+          - transforms-python
+          - upload-management
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+
+      - name: Build static viz frontend
+        run: yarn build-static-viz
+        env:
+          MB_EDITION: ee
+      - name: Collect the test coverage
+        run: |
+          clojure -X:dev:ci:ee:ee-dev:test:cloverage \
+            :ns-regex     '["^metabase-enterprise\\.${{ matrix.modules }}\\..*"]' \
+            :test-ns-path '["enterprise/backend/test/metabase/${{ matrix.modules }}"]'
+        continue-on-error: true
+
+      - name: Upload coverage to codecov.io
+        if: always()
+        uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./target/coverage/codecov.json

.github/workflows/backend.yml

@@ -21,8 +21,6 @@ jobs:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: 'kondo'
       - name: Run clj-kondo
         run: ./bin/mage kondo
 
@@ -35,8 +33,6 @@ jobs:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "eastwood"
       - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
         name: Run Eastwood linter
 
@@ -51,33 +47,33 @@ jobs:
         job:
           - name: Enterprise Tests
             edition: ee
-            build-static-viz: 'false'
+            test-group-name: ee
             test-args: >-
               :only '"enterprise/backend/test"'
           - name: EE App DB Tests (Part 1)
             edition: ee
-            build-static-viz: 'true'
+            test-group-name: ee-app-db-1
             test-args: >-
               :only '["test" ".clj-kondo/test"]'
               :partition/total 2
               :partition/index 0
           - name: EE App DB Tests (Part 2)
             edition: ee
-            build-static-viz: 'true'
+            test-group-name: ee-app-db-2
             test-args: >-
               :only '["test" ".clj-kondo/test"]'
               :partition/total 2
               :partition/index 1
           - name: OSS App DB Tests (Part 1)
             edition: oss
-            build-static-viz: 'true'
+            test-group-name: oss-app-db-1
             test-args: >-
               :only '["test" ".clj-kondo/test"]'
               :partition/total 2
               :partition/index 0
           - name: OSS App DB Tests (Part 2)
             edition: oss
-            build-static-viz: 'true'
+            test-group-name: oss-app-db-2
             test-args: >-
               :only '["test" ".clj-kondo/test"]'
               :partition/total 2
@@ -102,26 +98,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
-        if: ${{ matrix.job.build-static-viz == 'true' }}
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
-          m2-cache-key: be-tests
           java-version: "${{ matrix.java-version }}"
-      # Depending on which files changed, we might either have to build static-viz
-      # from scratch or download the previously built artifact
       - name: Build static-viz frontend
-        if: ${{ matrix.job.build-static-viz == 'true' && !inputs.skip }}
         run: yarn build-static-viz
         env:
           MB_EDITION: ${{ matrix.job.edition }}
-      - name: Download Static Viz Bundle Artifact
-        if: ${{ matrix.job.build-static-viz == 'true' && !inputs.skip }}
-        uses: actions/download-artifact@v4
-        with:
-          name: static-viz-bundle-${{ github.sha }}
-          path: resources/frontend_client/app/dist
 
       - name: "Test Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
         id: run-java-tests
@@ -129,6 +114,10 @@ jobs:
           clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev
           :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           ${{ matrix.job.test-args }}
+        # Trunk Quarantine controls the final state of the run in the CI!
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
+        continue-on-error: true
 
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
@@ -157,7 +146,7 @@ jobs:
         if: always() && !success()
         uses: actions/upload-artifact@v4
         with:
-          name: test-logs-${{ matrix.java-version }}-${{ matrix.job.edition }}-${{ github.job }}
+          name: test-logs-${{ matrix.java-version }}-${{ matrix.job.edition }}-${{ github.job }}-${{ matrix.job.test-group-name }}
           path: logs/test-log.json
           retention-days: 1
 
@@ -175,8 +164,6 @@ jobs:
       - uses: actions/checkout@v4
       - name: Prepare backend
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: be-check
       # TODO -- we should probably also check WITHOUT ee -- do a check with only OSS namespaces on the classpath
       - name: Check namespaces
         run: clojure -M:ee:drivers:check
@@ -190,8 +177,6 @@ jobs:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: 'cljfmt'
       - name: Run cljfmt
         run: ./bin/mage cljfmt-all --force-check
 

.github/workflows/bugs-triage-slack-notification.yml

@@ -1,52 +0,0 @@
-name: Bugs Slack Notification
-
-on:
-  issues:
-    types:
-      - labeled
-jobs:
-  on-issue-labeled:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    if: |
-      github.event.label.name == '.Needs Triage' && contains(github.event.issue.labels.*.name, 'Type:Bug')
-    steps:
-      - name: Setting title
-        uses: actions/github-script@v7
-        id: vars
-        with:
-          script: |
-            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
-      - name: Check for labels containing team name
-        id: check_labels
-        run: |
-          labels_json=$(sed 's/&/\$/g' <<< '${{ toJson(github.event.issue.labels) }}')
-          echo "has_team_label=false" >> "$GITHUB_OUTPUT"
-          for label in "$labels_json"
-          do
-            if [[ $label == *".Team"* ]]; then
-              echo "Label contains the team name."
-              echo "has_team_label=true" >> "$GITHUB_OUTPUT"
-              break
-            fi
-          done
-      - name: Send the issue ${{ github.event.issue.number }} to Slack
-        id: slack
-        if: steps.check_labels.outputs.has_team_label == 'false'
-        uses: slackapi/slack-github-action@v1.26.0
-        with:
-          payload: |
-            {
-              "blocks": [
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
-                  }
-                }
-              ]
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_BUG_TRIAGE_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/build-scripts.yml

@@ -16,8 +16,6 @@ jobs:
     - name: Prepare back-end environment
       timeout-minutes: 5
       uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'build-scripts'
 
     - name: Run build and release script tests
       run: clojure -X:dev:drivers:build:build-dev:build-test:ci

.github/workflows/cache-generator.yml

@@ -0,0 +1,140 @@
+# This workflow is the single source of truth for generating and updating various caches used by our CI pipeline.
+# It sets the fresh cache each Monday but provides a manual trigger to update it on-demand.
+#
+# All other jobs only restore from this cache; *they never update it*!
+# They should always use `actions/cache/restore@v4` because `actions/cache@v4` would attempt to save the cache.
+#
+# Our agreed-upon strategy is to use a deterministic cache key based on the week of the year.
+# Jobs can utilize the prior week's cache if the current week's cache is not found.
+#
+#
+# PRINCIPLES:
+#   - The cache is never wrong!
+#   - Caches are immutable once created.
+#   - Caches are for speeding up builds, not for correctness.
+#   - It is faster to download a large cache than to re-resolve missing dependencies.
+#
+#
+# DESIGN:
+#
+# 1. Prepare
+#     - A job first prepares the local environment (e.g., installs JDK, Clojure, Node.js, etc.)
+#     - This fetches the dependencies from the cache (if it exists) and warms up the local cache for this workflow.
+# 2. Resolve
+#     - The next step pre-resolves all dependencies, ensuring that the local cache is fully populated and up-to-date.
+# 3. Update
+#     - The final step saves the local cache back to GitHub Actions cache with a deterministic key.
+#     - If a cache entry already exists for that key, it is deleted first to ensure immutability.
+#
+name: Cache Generator
+
+on:
+  schedule:
+    - cron: "0 3 * * 1" # Mondays at 03:00 UTC
+  workflow_dispatch: # manually update the cache
+
+concurrency:
+  group: cache-generator
+  cancel-in-progress: true
+
+jobs:
+  get-cache-keys:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get cache keys
+        uses: ./.github/actions/get-cache-keys
+        id: get-cache-keys
+    outputs:
+      m2-cache-key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+      node-cache-key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
+      eslint-cache-key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
+      cypress-cache-key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
+
+  generate-caches:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    needs: get-cache-keys
+    env:
+      M2_CACHE_KEY: ${{ needs.get-cache-keys.outputs.m2-cache-key }}
+      NODE_CACHE_KEY: ${{ needs.get-cache-keys.outputs.node-cache-key }}
+      CYPRESS_CACHE_KEY: ${{ needs.get-cache-keys.outputs.cypress-cache-key }}
+      ESLINT_CACHE_KEY: ${{ needs.get-cache-keys.outputs.eslint-cache-key }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # Backend preparation and cache
+      - name: Prepare backend
+        uses: ./.github/actions/prepare-backend
+
+      # Add or remove aliases to affect the cache size and its contents.
+      # Adjust to taste, then redeploy this workflow.
+      - name: Pre-resolve Clojure dependencies
+        run: clojure -A:build:dev:ee:ee-dev:drivers:drivers-dev:cljs -P
+
+      - name: Update M2 cache
+        uses: ./.github/actions/update-cache
+        with:
+          path: |
+            ~/.m2
+            ~/.gitlibs
+          key: ${{ env.M2_CACHE_KEY }}
+
+      # Frontend preparation and caches
+      # `prepare-frontend` action (1) prepares Node.js and (2) fetches the node_modules cache if it exists.
+      # It then (3) runs `yarn install --frozen-lockfile --prefer-offline` which ensures the local cache is fully populated.
+      # IMPORTANT: Caching node_modules after patches are already applied will break any PR that attempts to either:
+      #   - upgrade a patched library
+      #   - change a patch
+      # Hence why we explicitly exclude patches from the cache (controlled by the `apply-patches` action input).
+      - name: Install front-end dependencies
+        uses: ./.github/actions/prepare-frontend
+        with:
+          apply-patches: "false"
+
+      - name: Get yarn cache directory
+        id: yarn-cache-dir
+        run: |
+          YARN_CACHE_DIR=$(yarn cache dir)
+          echo "Yarn cache directory: $YARN_CACHE_DIR"
+          echo "dir=$YARN_CACHE_DIR" >> $GITHUB_OUTPUT
+
+      - name: Ensure that Cypress executable is ready
+        run: |
+          yarn cypress install
+          yarn cypress cache path
+          yarn cypress cache list
+          yarn cypress verify
+        shell: bash
+
+      # Run Prettier to populate its cache (stored in node_modules/.cache/prettier)
+      # so it gets saved as part of the node_modules cache below
+      - name: Run Prettier to populate cache
+        run: yarn lint-prettier-pure
+
+      - name: Update node_modules cache
+        uses: ./.github/actions/update-cache
+        with:
+          path: |
+            ${{ steps.yarn-cache-dir.outputs.dir }}
+            node_modules
+          key: ${{ env.NODE_CACHE_KEY }}
+
+      - name: Update Cypress cache
+        uses: ./.github/actions/update-cache
+        with:
+          path: ~/.cache/Cypress
+          key: ${{ env.CYPRESS_CACHE_KEY }}
+
+      # ESLint cache (requires both backend and frontend)
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+
+      - name: Run ESLint to populate cache
+        run: yarn lint-eslint-pure
+
+      - name: Update eslint cache
+        uses: ./.github/actions/update-cache
+        with:
+          path: ${{ github.workspace}}/.eslintcache
+          key: ${{ env.ESLINT_CACHE_KEY }}

.github/workflows/chromatic.yml

@@ -40,8 +40,6 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
       - name: Compile CLJS
         run: NODE_ENV=development yarn build-pure:cljs
       - name: Publish to Chromatic

.github/workflows/claude-code-bug-fix.yml

@@ -4,97 +4,22 @@ on:
   issues:
     types:
       - labeled
+  pull_request_review:
+    types:
+      - submitted
   workflow_dispatch:
     inputs:
       issue_number:
         description: "Issue number to fix"
         required: true
         type: string
+      override_employee_check:
+        description: "Override employee check for issue creator"
+        required: false
+        default: false
+        type: boolean
 
 jobs:
-  check-employee-and-issue:
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    permissions:
-      contents: read
-      issues: read
-    if: |
-      (github.event_name == 'issues' && github.event.label.name == 'Claude Bug Fix' && github.event.issue.state == 'open') ||
-      (github.event_name == 'workflow_dispatch')
-    outputs:
-      is_employee: ${{ steps.check_employee.outputs.is_employee }}
-      issue_number: ${{ steps.get_issue.outputs.issue_number }}
-      issue_data: ${{ steps.get_issue.outputs.issue_data }}
-    steps:
-      - name: Generate GitHub App Token
-        uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-
-      - name: Get issue data
-        id: get_issue
-        uses: actions/github-script@v7
-        with:
-          script: |
-            let issueNumber, issueData;
-
-            if (context.eventName === 'issues') {
-              // Original issue label event
-              issueNumber = context.payload.issue.number;
-              issueData = context.payload.issue;
-            } else if (context.eventName === 'workflow_dispatch') {
-              // Manual trigger with issue number input
-              issueNumber = parseInt('${{ github.event.inputs.issue_number }}');
-              const { data } = await github.rest.issues.get({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: issueNumber
-              });
-              issueData = data;
-            }
-
-            core.setOutput('issue_number', issueNumber);
-            core.setOutput('issue_data', JSON.stringify(issueData));
-
-            console.log(`Issue #${issueNumber}: ${issueData.title}`);
-            console.log(`Issue author: ${issueData.user.login}`);
-
-      - name: Check if issue creator is a Metabase employee
-        id: check_employee
-        uses: actions/github-script@v7
-        env:
-          ISSUE_DATA: ${{ steps.get_issue.outputs.issue_data }}
-        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          script: |
-            const issueData = JSON.parse(process.env.ISSUE_DATA);
-            const issueAuthor = issueData.user.login;
-
-            try {
-              // Check if user is a member of the metabase organization (including private members)
-              const { data: membership } = await github.rest.orgs.getMembershipForUser({
-                org: 'metabase',
-                username: issueAuthor
-              });
-
-              if (membership.state === 'active') {
-                console.log(`User ${issueAuthor} is an active member of the Metabase organization. Proceeding with bug fix automation.`);
-                core.setOutput('is_employee', 'true');
-              } else {
-                console.log(`User ${issueAuthor} is not an active member of the Metabase organization. Skipping bug fix automation.`);
-                core.setOutput('is_employee', 'false');
-              }
-            } catch (error) {
-              if (error.status === 404) {
-                console.log(`User ${issueAuthor} is not a member of the Metabase organization. Skipping bug fix automation.`);
-              } else {
-                console.error('Error checking organization membership:', error);
-              }
-              core.setOutput('is_employee', 'false');
-            }
-
   auto-fix-bug:
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -103,8 +28,10 @@ jobs:
       issues: write
       pull-requests: write
       id-token: write
-    needs: check-employee-and-issue
-    if: needs.check-employee-and-issue.outputs.is_employee == 'true'
+    if: |
+      (github.event_name == 'issues' && github.event.label.name == 'Claude Bug Fix' && github.event.issue.state == 'open') ||
+      (github.event_name == 'workflow_dispatch') ||
+      (github.event_name == 'pull_request_review' && github.event.review.state == 'changes_requested' && startsWith(github.event.pull_request.head.ref, 'claude-fix/'))
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -112,47 +39,153 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Get issue data and check employee status
+        id: get_issue
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { getIssueData } = require('${{ github.workspace }}/.github/scripts/get-issue-data.js');
+
+            try {
+              const result = await getIssueData({
+                context,
+                github,
+                manualIssueNumber: '${{ github.event.inputs.issue_number }}'
+              });
+
+              const { issueNumber, issueData, employeeComments, prReviews, triggerType, isIssueAuthorEmployee } = result;
+
+              // Check employee status and fail if not authorized
+              if (!result.isIssueAuthorEmployee && '${{ github.event.inputs.override_employee_check }}' !== 'true') {
+                  core.setFailed(`User ${result.issueData.user.login} is not a Metabase employee. Skipping bug fix automation.`);
+              }
+
+              core.setOutput('issue_number', issueNumber);
+              core.setOutput('issue_data', JSON.stringify(issueData));
+              core.setOutput('issue_comments', JSON.stringify(employeeComments));
+              core.setOutput('pr_reviews', JSON.stringify(prReviews));
+              core.setOutput('trigger_type', triggerType);
+            } catch (error) {
+              core.setFailed(error.message);
+            }
+
       - name: Set up git configuration
         run: |
           git config --global user.name "Claude Code[bot]"
           git config --global user.email "noreply@anthropic.com"
 
-      - name: Prepare dynamic issue info
-        id: prepare_issue_info
+      - name: Prepare issue context and bug fix prompt
+        id: prepare_prompt
         uses: actions/github-script@v7
         env:
-          ISSUE_DATA: ${{ needs.check-employee-and-issue.outputs.issue_data }}
+          ISSUE_DATA: ${{ steps.get_issue.outputs.issue_data }}
+          ISSUE_COMMENTS: ${{ steps.get_issue.outputs.issue_comments }}
+          PR_REVIEWS: ${{ steps.get_issue.outputs.pr_reviews }}
+          TRIGGER_TYPE: ${{ steps.get_issue.outputs.trigger_type }}
         with:
           script: |
             const issueData = JSON.parse(process.env.ISSUE_DATA);
-            const issueNumber = '${{ needs.check-employee-and-issue.outputs.issue_number }}';
+            const issueComments = JSON.parse(process.env.ISSUE_COMMENTS);
+            const prReviews = JSON.parse(process.env.PR_REVIEWS);
+            const triggerType = process.env.TRIGGER_TYPE;
+            const issueNumber = '${{ steps.get_issue.outputs.issue_number }}';
 
-            // Convert issue title to kebab case
+            // Convert issue title to kebab case and create branch name
             const issueTitle = issueData.title || 'untitled';
             const kebabTitle = issueTitle
               .toLowerCase()
               .replace(/[^a-z0-9]+/g, '-')
               .replace(/^-+|-+$/g, '')
               .replace(/-+/g, '-')
-              .substring(0, 50); // Limit length
+              .substring(0, 50);
+            const branchName = `claude-fix/issue-${issueNumber}-${kebabTitle}`;
 
-            // Create base branch name
-            const baseBranchName = `claude-fix/issue-${issueNumber}-${kebabTitle}`;
-            core.exportVariable('BASE_BRANCH_NAME', baseBranchName);
+            // Format data for bash environment
+            const formattedComments = issueComments.length > 0
+              ? issueComments.map(comment =>
+                  `**Comment by @${comment.user.login} on ${comment.created_at}:**\n${comment.body}`
+                ).join('\n\n---\n\n')
+              : '';
+            const formattedReviews = prReviews.length > 0
+              ? prReviews.map(review =>
+                  `**Review by @${review.user.login} on ${review.submitted_at} (Changes Requested):**\n${review.body || 'No review comment provided'}`
+                ).join('\n\n---\n\n')
+              : '';
 
-            // Export issue info for the prompt
+            core.exportVariable('BRANCH_NAME', branchName);
             core.exportVariable('ISSUE_NUMBER', issueNumber);
             core.exportVariable('ISSUE_TITLE', issueData.title);
             core.exportVariable('ISSUE_AUTHOR', issueData.user.login);
             core.exportVariable('ISSUE_CREATED', issueData.created_at);
             core.exportVariable('ISSUE_BODY', issueData.body || 'No description provided');
+            core.exportVariable('ISSUE_COMMENTS_FORMATTED', formattedComments);
+            core.exportVariable('PR_REVIEWS_FORMATTED', formattedReviews);
+            core.exportVariable('TRIGGER_TYPE', triggerType);
+
+      - name: Generate bug fix prompt
+        run: |
+          cat << 'EOF' >> $GITHUB_ENV
+          BUG_FIX_PROMPT<<PROMPT_END
+          You are helping to fix a bug reported in GitHub issue #${{ env.ISSUE_NUMBER }}.
+
+          ## Bug Report Details
+          **Title:** ${{ env.ISSUE_TITLE }}
+          **Reporter:** ${{ env.ISSUE_AUTHOR }}
+          **Created:** ${{ env.ISSUE_CREATED }}
+
+          **Description:**
+          ${{ env.ISSUE_BODY }}
+
+          **Comments:**
+          ${{ env.ISSUE_COMMENTS_FORMATTED }}
+          EOF
+
+          # Add review feedback section only if this is a review trigger
+          if [ "${{ env.TRIGGER_TYPE }}" = "pull_request_review" ]; then
+            cat << 'EOF' >> $GITHUB_ENV
+
+          ## Previous Fix Attempt - Review Feedback (MUST ADDRESS)
+          Your previous automated fix attempt received the following feedback that needs to be addressed:
+
+          ${{ env.PR_REVIEWS_FORMATTED }}
+          EOF
+          fi
+
+          # Add the rest of the prompt (always the same)
+          cat << 'EOF' >> $GITHUB_ENV
+
+          ## Instructions
+          1. **Analyze the issue description and comments** - Understand what the issue is describing
+             a. Pay particular attention to reproduction steps and if there's an agreed upon fix.
+          2. **Search the codebase** - Use Grep and Glob tools to find relevant files
+          3. **Implement a fix** - Use the appropriate write skill based on the file types:
+             - Use clojure-write for Clojure/ClojureScript files
+             - Use typescript-write for TypeScript/JavaScript files
+             - Follow the coding standards and patterns in each skill
+          4. **Test the fix** - Run appropriate tests as specified in the skills
+          5. **Verify the fix** - Ensure tests pass and code follows conventions
+
+          ## Important Guidelines
+          - Use the appropriate write skill for the language you're working in
+          - Write failing tests first, then fix them
+          - Work in small, testable increments
+          - Don't commit changes - leave that for the workflow
+          - IMPORTANT: Focus only on fixing the reported bug, don't make unrelated changes
+
+          ## Scratchpad Directory
+          A `.claude-scratchpad/` directory has been created for your temporary files:
+          - Use this directory for ALL temporary verification files. However, prefer using production test files rather than adhoc ones.
+          - Only modify actual production code in the main repository directories
+          - The scratchpad will be cleaned up automatically - nothing from it will be committed
+
+          Start by understanding the bug and then systematically work toward a solution.
+          PROMPT_END
+          EOF
 
       - name: Determine branch strategy
         run: |
-          # Use the base branch name (no counters)
-          BRANCH_NAME="${{ env.BASE_BRANCH_NAME }}"
-
-          # Check if this exact branch already exists
+          BRANCH_NAME="${{ env.BRANCH_NAME }}"
           if git branch -r --list "origin/${BRANCH_NAME}" | grep -q .; then
             echo "Branch already exists: $BRANCH_NAME"
             echo "Will push to existing branch and skip PR creation"
@@ -166,54 +199,6 @@ jobs:
           # Export the branch name
           echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
 
-      - name: Prepare bug fix prompt
-        id: prepare_prompt
-        run: |
-          # Prepare the prompt for Claude
-          cat << 'EOF' >> $GITHUB_ENV
-          BUG_FIX_PROMPT<<PROMPT_END
-          You are helping to automatically fix a bug reported in GitHub issue #${{ env.ISSUE_NUMBER }}.
-
-          ## Bug Report Details
-          **Title:** ${{ env.ISSUE_TITLE }}
-          **Reporter:** ${{ env.ISSUE_AUTHOR }}
-          **Created:** ${{ env.ISSUE_CREATED }}
-
-          **Description:**
-          ${{ env.ISSUE_BODY }}
-
-          ## Instructions
-          1. **Analyze the bug report** - Understand what the issue is describing
-          2. **Search the codebase** - Use Grep and Glob tools to find relevant files
-          3. **Implement a fix** - Follow existing code patterns and conventions
-          4. **Test the fix** - Run appropriate tests using the commands in CLAUDE.md:
-             - JavaScript/TypeScript: `yarn test-unit path/to/file.unit.spec.js`
-             - Clojure: `clojure -X:dev:test :only namespace/test-name`
-             - Lint: `yarn lint-eslint-pure` for JS/TS, `./bin/mage kondo <file>` for Clojure
-          5. **Verify the fix** - Ensure tests pass and code follows conventions
-
-          ## Important Guidelines
-          - Follow the development patterns in CLAUDE.md
-          - Write failing tests first, then fix them
-          - Work in small, testable increments
-          - Don't commit changes - leave that for the workflow
-          - IMPORTANT: Focus only on fixing the reported bug, don't make unrelated changes
-
-          ## Scratchpad Directory
-          A `.claude-scratchpad/` directory has been created for your temporary files:
-          - Use this directory for ALL temporary verification files. However, prefer using production test files rather than adhoc ones.
-          - Only modify actual production code in the main repository directories
-          - The scratchpad will be cleaned up automatically - nothing from it will be committed
-
-          ## If You Cannot Fix The Bug
-          If you determine that you cannot create a definitive fix, create a file called `FAILED_FIX_ANALYSIS.md` with:
-          1. **Why No Fix** - Specific reason why you couldn't implement a fix
-          2. **Tool Limitations** - If you needed additional tools/access that weren't available
-
-          Start by understanding the bug and then systematically work toward a solution.
-          PROMPT_END
-          EOF
-
       - name: Create scratchpad directory for Claude
         run: |
           # Create a scratchpad directory for Claude to use for temporary files
@@ -228,15 +213,14 @@ jobs:
           private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
 
       - name: Generate Bug Fix with Claude Code
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@v1
         with:
-          mode: agent
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ steps.claude-app-token.outputs.token }}
-          direct_prompt: ${{ env.BUG_FIX_PROMPT }}
-          timeout_minutes: "25"
-          allowed_tools: "Bash(yarn test-unit*),Bash(yarn lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
-          disallowed_tools: "Bash(git commit*),Bash(git push*),Bash(gh*)"
+          prompt: ${{ env.BUG_FIX_PROMPT }}
+          claude_args: |
+            --allowedTools "Bash(yarn test-unit*),Bash(yarn lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
+            --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"
 
       - name: Clean up scratchpad directory
         run: |
@@ -249,20 +233,6 @@ jobs:
       - name: Check for changes and analysis
         id: check_changes
         run: |
-          # Check if Claude created an analysis file first and store its content
-          if [ -f "FAILED_FIX_ANALYSIS.md" ]; then
-            echo "has_analysis=true" >> $GITHUB_OUTPUT
-            echo "Analysis file found"
-            # Store analysis content in a GitHub output (base64 encoded to handle multiline)
-            ANALYSIS_CONTENT=$(base64 -w 0 FAILED_FIX_ANALYSIS.md)
-            echo "analysis_content=$ANALYSIS_CONTENT" >> $GITHUB_OUTPUT
-            # Remove analysis file so it doesn't count as a code change
-            rm -f FAILED_FIX_ANALYSIS.md
-          else
-            echo "has_analysis=false" >> $GITHUB_OUTPUT
-            echo "No analysis file found"
-          fi
-
           # Now check for actual code changes (excluding analysis file)
           if [ -n "$(git status --porcelain)" ]; then
             echo "has_changes=true" >> $GITHUB_OUTPUT
@@ -278,25 +248,16 @@ jobs:
         id: prepare_reviewers
         uses: actions/github-script@v7
         env:
-          ISSUE_DATA: ${{ needs.check-employee-and-issue.outputs.issue_data }}
+          ISSUE_DATA: ${{ steps.get_issue.outputs.issue_data }}
         with:
           script: |
-            // Get existing team labels from the issue
             const issueData = JSON.parse(process.env.ISSUE_DATA);
             const issueLabels = issueData.labels.map(label => label.name);
             const teamLabels = issueLabels.filter(label => label.startsWith('.Team/'));
-
-            console.log('Issue labels:', issueLabels);
-            console.log('Team labels found:', teamLabels);
-
-            // Add issue creator as reviewer
             const issueCreator = issueData.user.login;
-
             core.setOutput('team_labels', teamLabels.join(','));
             core.setOutput('reviewers', issueCreator);
 
-            console.log('Reviewer:', issueCreator);
-
       - name: Create Pull Request
         if: steps.check_changes.outputs.has_changes == 'true'
         uses: peter-evans/create-pull-request@v6
@@ -363,25 +324,3 @@ jobs:
         with:
           script: |
             console.log('🤖 No code changes were made by Claude.');
-
-            // Check if Claude provided a detailed analysis
-            if ('${{ steps.check_changes.outputs.has_analysis }}' === 'true') {
-              try {
-                // Decode the base64-encoded analysis content
-                const analysisBase64 = '${{ steps.check_changes.outputs.analysis_content }}';
-                const analysisContent = Buffer.from(analysisBase64, 'base64').toString('utf8');
-                console.log('📋 Claude provided detailed analysis:');
-                console.log('='.repeat(50));
-                console.log(analysisContent);
-                console.log('='.repeat(50));
-              } catch (error) {
-                console.log('❌ Could not decode analysis content:', error);
-              }
-            } else {
-              console.log('ℹ️  No detailed analysis file was created by Claude.');
-              console.log('This could be because:');
-              console.log('- The issue requires more context or clarification');
-              console.log('- The fix is complex and requires human judgment');
-              console.log('- The issue is not a straightforward code bug');
-              console.log('- Claude couldn\'t locate the relevant code to modify');
-            }

.github/workflows/claude-code-review.yaml

@@ -0,0 +1,98 @@
+name: "Claude Code Review"
+
+on:
+  pull_request:
+    types:
+      - closed
+      - synchronize
+      - labeled
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-code-review
+  cancel-in-progress: true
+
+jobs:
+  review:
+    if: |
+      (
+        github.event.action == 'closed' &&
+        github.event.pull_request.merged == true
+      ) ||
+      contains(github.event.pull_request.labels.*.name, 'Claude Code Review')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
+          persist-credentials: false
+
+      # Apparently comments on specific lines and top-level comments about the PR as a whole are TWO TOTALLY DIFFERENT
+      # TYPES OF THINGS. So we have to fetch and delete separately.
+      - name: Delete old Claude PR review comments
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        shell: bash
+        run: |
+          # Get old comment IDs from the bot
+          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
+          echo "Deleting line comments: $old_line_comment_ids"
+          # Delete each comment
+          for id in $old_line_comment_ids; do
+            gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
+            echo "Deleted line comment $id"
+          done
+          # Get old top-level comment IDs (technically "issue" comments on the PR?)
+          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
+          echo "Deleting top-level comments: $old_top_level_comment_ids"
+          # Delete each comment
+          for id in $old_top_level_comment_ids; do
+            gh api -X DELETE "/repos/$REPO/issues/comments/$id"
+            echo "Deleted top-level comment $id"
+          done
+
+      - name: Generate GitHub App Token for Claude
+        uses: actions/create-github-app-token@v1
+        id: claude-app-token
+        with:
+          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
+          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+          permission-contents: read       # Required for reading repository files and PR diffs
+          permission-pull-requests: write # Required for creating inline comments and PR comments
+
+      - name: Fetch Community Clojure Style Guide
+        run: >-
+          curl https://raw.githubusercontent.com/bbatsov/clojure-style-guide/refs/heads/master/README.adoc -o CLOJURE_STYLE_GUIDE.adoc
+
+      - uses: anthropics/claude-code-action@v1
+        timeout-minutes: 10
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ steps.claude-app-token.outputs.token }}
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Review this pull request for compliance with project coding standards and conventions.
+
+            **Use the appropriate review skill based on the file types changed:**
+            - Use clojure-review for Clojure/ClojureScript files
+            - Use typescript-review for TypeScript/JavaScript files
+            - Follow the review guidelines and checklists in each skill
+
+            DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
+
+            Note: The PR branch is already checked out in the current working directory.
+
+            Use `gh pr comment` for top-level feedback.
+            Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
+            Only post GitHub comments - don't submit review text as messages.
+
+          claude_args: |
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),ReadFile(CLOJURE_STYLE_GUIDE.adoc)"

.github/workflows/claude-docs-review.yml

@@ -0,0 +1,101 @@
+name: "Claude Docs Review"
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+    paths:
+      - 'docs/**/*.md'
+      - 'docs/**/*.mdx'
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to review'
+        required: true
+        type: number
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-docs-review
+  cancel-in-progress: true
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
+          persist-credentials: false
+
+      - name: Generate GitHub App Token for Claude
+        uses: actions/create-github-app-token@v1
+        id: claude-app-token
+        with:
+          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
+          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+          permission-contents: read       # Required for reading repository files and PR diffs
+          permission-pull-requests: write # Required for creating inline comments and PR comments
+
+      - name: Delete old Claude docs review comments
+        env:
+          GH_TOKEN: ${{ steps.claude-app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
+        shell: bash
+        run: |
+          # Delete pending reviews first (these can be deleted entirely)
+          pending_review_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/reviews" --jq '.[] | select(.user.login=="metabase-bot[bot]" and .state=="PENDING") | .id')
+          if [ -n "$pending_review_ids" ]; then
+            echo "Deleting pending reviews: $pending_review_ids"
+            for id in $pending_review_ids; do
+              gh api -X DELETE "/repos/$REPO/pulls/$PR_NUMBER/reviews/$id"
+              echo "Deleted pending review $id"
+            done
+          fi
+
+          # Delete individual inline comments from submitted reviews (can't delete the review itself)
+          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
+          if [ -n "$old_line_comment_ids" ]; then
+            echo "Deleting line comments: $old_line_comment_ids"
+            for id in $old_line_comment_ids; do
+              gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
+              echo "Deleted line comment $id"
+            done
+          fi
+
+          # Delete top-level review comments
+          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
+          if [ -n "$old_top_level_comment_ids" ]; then
+            echo "Deleting top-level comments: $old_top_level_comment_ids"
+            for id in $old_top_level_comment_ids; do
+              gh api -X DELETE "/repos/$REPO/issues/comments/$id"
+              echo "Deleted top-level comment $id"
+            done
+          fi
+
+      - uses: anthropics/claude-code-action@v1
+        timeout-minutes: 10
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ steps.claude-app-token.outputs.token }}
+          show_full_output: true
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
+
+            Review the documentation changes in this pull request.
+
+            Use the docs-review skill to review all changed documentation files for compliance with the Metabase writing style guide.
+
+            DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
+
+          claude_args: |
+            --allowedTools "Skill,mcp__github__get_pull_request,mcp__github__get_pull_request_files,mcp__github__create_pending_pull_request_review,mcp__github__get_pull_request_diff,mcp__github__add_comment_to_pending_review,mcp__github__add_pull_request_review_comment_to_pending_review,mcp__github__delete_pending_pull_request_review,mcp__github__submit_pending_pull_request_review"

.github/workflows/cljs.yml

@@ -38,7 +38,5 @@ jobs:
       uses: ./.github/actions/prepare-frontend
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'cljs'
     - name: Run Cljs tests
       run: yarn run test-cljs

.github/workflows/codeql.yml

@@ -30,9 +30,10 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@v4
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v4
       with:
         languages: javascript
         config-file: ./.github/codeql/codeql-config.yml
+        trap-caching: false
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v4

.github/workflows/codespell.yml

@@ -0,0 +1,19 @@
+name: Codespell
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-**'
+  pull_request:
+
+jobs:
+  codespell:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: codespell-project/actions-codespell@v1
+        with:
+          # keep this list in sync with the list in `mage/src/mage/codespell.yml`
+          path: >-
+            docs

.github/workflows/conventional-commit-pr-title-reminder.yml

@@ -4,39 +4,53 @@ on:
   pull_request:
     branches:
       - master
-    paths:
-      - enterprise/frontend/src/embedding-sdk-bundle/**
 
 jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      frontend_embedding_sources: ${{ steps.changes.outputs.frontend_embedding_sources }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
   pr-title-reminder:
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     permissions:
       pull-requests: write
+    needs: [ files-changed ]
+    if: |
+      !cancelled() &&
+      needs.files-changed.outputs.frontend_embedding_sources == 'true'
     steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+
       - name: Check if the PR title is already following Conventional Commits style
         uses: actions/github-script@v7
         id: is-conventional-commit
         with:
           result-encoding: string
           script: | # js
+            const { isConventionalTitle } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
             const pullRequestTitle = context.payload.pull_request.title
-            const conventionalCommitRegex = /^(?<type>\w+)\((?<scope>\w+)\):/
-            const match = pullRequestTitle.match(conventionalCommitRegex)
-            if (match) {
-              const { type, scope } = match.groups
-              return ['feat', 'fix', 'perf', 'docs', 'style', 'refactor', 'test', 'build', 'ci'].includes(type) && scope === 'sdk'
-            }
 
-      - name: Checkout repository so `gh` CLI works
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
+            return isConventionalTitle(pullRequestTitle)
 
       - name: Remind PR authors to use conventional commit in the title
         if: ${{ steps.is-conventional-commit.outputs.result != 'true' }}
         uses: actions/github-script@v7
         with:
-          script: |
-            const { updateComment } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
-            await updateComment({github, context})
+          script: | #js
+            const { updateCommentForEmbedding } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
+
+            await updateCommentForEmbedding({github, context})

.github/workflows/coverage.yml

@@ -1,25 +1,28 @@
-name: Test coverage
+name: Frontend Test Coverage
 
 on:
+  workflow_dispatch:
   schedule:
     - cron: '40 1 * * *' # every day at 1:40
 
 jobs:
   fe-test-coverage:
     runs-on: ubuntu-22.04
-    timeout-minutes: 30
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
       - name: Run frontend unit tests
-        run: yarn run test-unit --silent --coverage
+        run: |
+          yarn run test-unit \
+            --silent \
+            --coverage \
+            --testTimeout=60000
       - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           files: ./coverage/lcov.info
           flags: front-end

.github/workflows/docs-generate-base.yml

@@ -9,10 +9,6 @@ on:
         description: "The branch to check out and create a PR against"
         required: true
         type: string
-      m2_cache_key_suffix:
-        description: "A unique suffix for the Maven cache key"
-        required: true
-        type: string
     secrets:
       automation_token:
         description: "A token with permissions to create branches and PRs"
@@ -37,8 +33,6 @@ jobs:
 
       - name: Prepare backend environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "auto-update-docs-${{ inputs.m2_cache_key_suffix }}"
 
       - name: Generate environment variables documentation
         id: generate_env_docs
@@ -66,6 +60,14 @@ jobs:
           clojure -M:ee:doc api-documentation
         continue-on-error: false
 
+      - name: Generate command documentation
+        id: generate_command_docs
+        run: |
+          set -e  # Exit on any error
+          echo "Generating API documentation..."
+          clojure -M:ee:doc command-documentation
+        continue-on-error: false
+
       - name: Check for changes
         id: check_changes
         run: |

.github/workflows/docs-links.yml

@@ -2,8 +2,6 @@ name: Check doc links
 
 on:
   pull_request:
-    paths:
-      - "docs/**"
   workflow_dispatch:
 
 jobs:
@@ -15,7 +13,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           sparse-checkout: |
             docs
@@ -29,7 +27,7 @@ jobs:
 
       - name: Run link checker
         id: link-check
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@v2.3.0
         with:
           fail: true
           args: docs --config ./.lychee/config.toml --offline

.github/workflows/docs-master-generate.yml

@@ -11,6 +11,5 @@ jobs:
     uses: ./.github/workflows/docs-generate-base.yml
     with:
       target_branch: "master"
-      m2_cache_key_suffix: "master"
     secrets:
       automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/docs-release-generate.yml

@@ -4,13 +4,18 @@ on:
   schedule:
     - cron: "0 2 * * 1-5" # Every Monday through Friday at 2 AM UTC
   workflow_dispatch:
+    inputs:
+      target_branch:
+        description: "Target branch for documentation update"
+        required: false
+        default: "release-x.57.x"
+        type: string
 
 jobs:
   update-release-docs:
     name: Call documentation update for release branch
     uses: ./.github/workflows/docs-generate-base.yml
     with:
-      target_branch: "release-x.56.x"
-      m2_cache_key_suffix: "release"
+      target_branch: ${{ inputs.target_branch || 'release-x.57.x' }}
     secrets:
       automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/docs_bump_detected.yml

@@ -1,44 +0,0 @@
-name: Docs Bump Detected
-
-on:
-  pull_request_target:
-    types:
-      - opened
-      - synchronize
-      - reopened
-    branches:
-      - 'master'
-      - 'release-x.[0-9]+.x'
-    paths:
-      - 'docs/**'
-
-jobs:
-  push_workflow_to_docs_metabase_github_io_job:
-    runs-on: ubuntu-latest
-    env:
-      SOURCE_BRANCH: ${{ github.head_ref || github.ref  }}
-      TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
-      PR_NUMBER: ${{ github.event.pull_request.number }}
-    steps:
-      - name: Report changed docs files exist
-        run: |
-          echo "A PR with changes in the docs directory was detected."
-          echo "Sending workflow trigger to create/update the corresponding PR in docs repo."
-          echo "source branch: $SOURCE_BRANCH"
-          echo "target branch: $TARGET_BRANCH"
-          echo "pr number: $PR_NUMBER"
-
-      - name: Trigger repo dispatch
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          script: | #js
-              github.rest.repos.createDispatchEvent({
-                owner: "${{ github.repository_owner }}",
-                repo: "docs.metabase.github.io",
-                event_type: "docs_update",
-                client_payload: {
-                  dispatch_type: "docs_update",
-                  source_branch: process.env.SOURCE_BRANCH,
-                  target_branch: process.env.TARGET_BRANCH,
-                  pr_number: process.env.PR_NUMBER}});

.github/workflows/docs_close_detected.yml

@@ -1,43 +0,0 @@
-name: Docs Close Detected
-
-on:
-  pull_request:
-    types:
-      - closed
-    branches:
-      - 'master'
-      - 'release-x.[0-9]+.x'
-    paths:
-      - 'docs/**'
-
-jobs:
-  push_and_merge_workflow_to_docs_metabase_github_io_job:
-    if: github.event.pull_request.merged == false
-    runs-on: ubuntu-latest
-    env:
-      SOURCE_BRANCH: ${{ github.head_ref || github.ref  }}
-      TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
-      PR_NUMBER: ${{ github.event.pull_request.number }}
-    steps:
-      - name: Report changed docs files exist
-        run: |
-          echo "A PR with changes to the docs directory was closed."
-          echo "Sending workflow trigger to close corresponding PR in docs repo."
-          echo "source branch: $SOURCE_BRANCH"
-          echo "target branch: $TARGET_BRANCH"
-          echo "pr number: $PR_NUMBER"
-
-      - name: Trigger repo dispatch
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          script: | #js
-            github.rest.repos.createDispatchEvent({
-                owner: "${{ github.repository_owner }}",
-                repo: "docs.metabase.github.io",
-                event_type: "docs_close",
-                client_payload: {
-                  dispatch_type: "docs_close",
-                  source_branch: process.env.SOURCE_BRANCH,
-                  target_branch: process.env.TARGET_BRANCH,
-                  pr_number: process.env.PR_NUMBER}});

.github/workflows/docs_merge_detected.yml

@@ -1,43 +0,0 @@
-name: Docs Merge Detected
-
-on:
-  pull_request:
-    types:
-      - closed
-    branches:
-      - 'master'
-      - 'release-x.[0-9]+.x'
-    paths:
-      - 'docs/**'
-
-jobs:
-  push_and_merge_workflow_to_docs_metabase_github_io_job:
-    if: github.event.pull_request.merged == true
-    runs-on: ubuntu-latest
-    env:
-      SOURCE_BRANCH: ${{ github.head_ref || github.ref  }}
-      TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
-      PR_NUMBER: ${{ github.event.pull_request.number }}
-    steps:
-      - name: Report changed docs files exist
-        run: |
-          echo "A PR with changes to the docs directory was merged."
-          echo "Sending workflow trigger to merge corresponding PR in docs repo."
-          echo "source branch: $SOURCE_BRANCH"
-          echo "target branch: $TARGET_BRANCH"
-          echo "pr number: $PR_NUMBER"
-
-      - name: Trigger repo dispatch
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          script: | #js
-            github.rest.repos.createDispatchEvent({
-                owner: "${{ github.repository_owner }}",
-                repo: "docs.metabase.github.io",
-                event_type: "docs_merge",
-                client_payload: {
-                  dispatch_type: "docs_merge",
-                  source_branch: process.env.SOURCE_BRANCH,
-                  target_branch: process.env.TARGET_BRANCH,
-                  pr_number: process.env.PR_NUMBER}});

.github/workflows/drivers-stress-test.yml

@@ -689,25 +689,57 @@ jobs:
         junit-name: 'be-tests-starburst-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
-  # TODO(rileythomp, 2025-08-20): Re-enable vertica tests once the docker image is updated
-  # be-tests-vertica-ee:
-  #   if: ${{ false && inputs.driver == 'Vertica' }}
-  #   runs-on: ubuntu-22.04
-  #   timeout-minutes: 90
-  #   env:
-  #     CI: 'true'
-  #     DRIVERS: vertica
-  #   services:
-  #     vertica:
-  #       image: vertica/vertica-ce:12.0.2-0
-  #       ports:
-  #         - "5433:5433"
-  #   steps:
-  #   - uses: actions/checkout@v4
-  #   - name: Make plugins directory
-  #     run: mkdir plugins
-  #   - name: Test Vertica driver
-  #     uses: ./.github/actions/test-driver
-  #     with:
-  #       junit-name: 'be-tests-vertica-ee'
-  #       test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+  login-to-ecr:
+    if: inputs.driver == 'Vertica'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-to-assume: ${{ secrets.CI_IAM_ROLE }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
+        aws-region: us-east-1
+    - name: Get ECR password
+      id: login-ecr
+      run: |
+        PASSWORD=$(aws ecr get-login-password --region us-east-1)
+
+        REGISTRY="$(aws sts get-caller-identity --query Account --output text).dkr.ecr.us-east-1.amazonaws.com"
+
+        echo "docker_username=AWS" >> $GITHUB_OUTPUT
+        echo "docker_password=$PASSWORD" >> $GITHUB_OUTPUT
+        echo "registry=$REGISTRY" >> $GITHUB_OUTPUT
+    outputs:
+      registry: ${{ steps.login-ecr.outputs.registry }}
+      docker_username: ${{ steps.login-ecr.outputs.docker_username }}
+      docker_password: ${{ steps.login-ecr.outputs.docker_password }}
+
+  be-tests-vertica-ee:
+    if: inputs.driver == 'Vertica'
+    runs-on: ubuntu-22.04
+    needs: login-to-ecr
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: vertica
+    services:
+      vertica:
+        image: ${{ needs.login-to-ecr.outputs.registry }}/vertica-ce:25.3.0-0
+        ports:
+          - "5433:5433"
+        credentials:
+          username: ${{ needs.login-to-ecr.outputs.docker_username }}
+          password: ${{ needs.login-to-ecr.outputs.docker_password }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Make plugins directory
+      run: mkdir plugins
+    - name: Test Vertica driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-vertica-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"

.github/workflows/e2e-component-tests-embedding-sdk-backward-compatibility.yml

@@ -1,182 +0,0 @@
-# Thi workflow does the backward compatibility tests
-# between the Embedding SDK package of version N and Embedding SDK Bundle of version N - 1
-# N - 1 is a target of a PR
-name: Embedding SDK backward-compatibility E2E Component Tests
-
-on:
-  workflow_call:
-    inputs:
-      cached-embedding-sdk-dist-artifact-name:
-        required: true
-        type: string
-
-jobs:
-  files-changed:
-    name: "SDK backward-compatibility E2E > Check which files changed"
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_embedding_sdk: ${{ steps.changes.outputs.e2e_embedding_sdk }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  decide-target-ref:
-    runs-on: ubuntu-latest
-    outputs:
-      target-ref: ${{ steps.get-target-ref.outputs.value }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Decide ref to checkout
-        id: get-target-ref
-        run: |
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo "value=${{ github.base_ref }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "value=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
-          fi
-
-  # if this is a test on a release branch, we need to check the build requirements
-  get-build-requirements:
-    name: "SDK backward-compatibility E2E > [Backport only] Get build requirements"
-    needs: [decide-target-ref]
-    if: |
-      !cancelled() &&
-      contains(github.base_ref || github.ref, 'release-x')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.decide-target-ref.outputs.target-ref }}
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      - name: Get build dependencies
-        uses: actions/github-script@v7
-        id: dependencies
-        with:
-          script: | # js
-            const {
-              getBuildRequirements,
-              getVersionFromReleaseBranch,
-            } = require('${{ github.workspace }}/release/dist/index.cjs');
-            const targetBranchName = '${{ github.base_ref || github.ref }}';
-
-            const version = getVersionFromReleaseBranch(targetBranchName);
-            const requirements = getBuildRequirements(version);
-
-            return {
-              java_version: requirements.java,
-              node_version: requirements.node,
-            };
-
-  e2e-tests:
-    name: "SDK backward-compatibility E2E > Run e2e tests"
-    needs: [files-changed, decide-target-ref, get-build-requirements]
-    if: |
-      !cancelled() &&
-      needs.files-changed.outputs.e2e_embedding_sdk == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-    env:
-      MB_EDITION: ee
-      DISPLAY: ""
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
-      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.decide-target-ref.outputs.target-ref }}
-
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: uberjar
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-        with:
-          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
-
-      - name: Build uberjar with ./bin/build.sh
-        run: ./bin/build.sh
-
-      - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: ${{ inputs.cached-embedding-sdk-dist-artifact-name }}
-          path: ${{ github.workspace }}/resources/embedding-sdk
-
-      - name: Prepare Cypress environment
-        id: cypress-prep
-        uses: ./.github/actions/prepare-cypress
-
-      - name: Run Metabase
-        run: node e2e/runner/run_cypress_ci.js start
-
-      - name: Make app db snapshot
-        run: node e2e/runner/run_cypress_ci.js snapshot --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run component tests for Embedding SDK
-        run: node e2e/runner/run_cypress_ci.js component --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-embedding-sdk
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
-      - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: cypress-recording-embedding-sdk-cross-version
-          path: |
-            ./cypress
-            ./logs/test.log
-          if-no-files-found: ignore
-
-      - name: Publish Summary
-        if: failure()
-        uses: actions/github-script@v7
-        with:
-          script: | #js
-            const {
-               generateReport,
-               parseReport,
-               formatSummary
-             } = require("./.github/scripts/handle-mochawesome-report.js");
-
-             const report = await generateReport();
-             const results = parseReport(report);
-             const summary = formatSummary(results);
-
-             await core.summary.addRaw(summary).write();

.github/workflows/e2e-component-tests-embedding-sdk.yml

@@ -1,206 +0,0 @@
-name: E2E Component Tests for Embedding SDK
-
-on:
-  workflow_call:
-    inputs:
-      cached-embedding-sdk-dist-artifact-name:
-        required: true
-        type: string
-
-jobs:
-  files-changed:
-    name: "SDK e2e > Check which files changed"
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_embedding_sdk: ${{ steps.changes.outputs.e2e_embedding_sdk }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  # if this is a test on a release branch, we need to check the build requirements
-  get-build-requirements:
-    name: "SDK e2e > [Backport only] Get build requirements"
-    if: |
-      !cancelled() &&
-      contains(github.base_ref || github.ref, 'release-x')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      - name: Get build dependencies
-        uses: actions/github-script@v7
-        id: dependencies
-        with:
-          script: | # js
-            const {
-              getBuildRequirements,
-              getVersionFromReleaseBranch,
-            } = require('${{ github.workspace }}/release/dist/index.cjs');
-            const targetBranchName = '${{ github.base_ref || github.ref }}';
-
-            const version = getVersionFromReleaseBranch(targetBranchName);
-            const requirements = getBuildRequirements(version);
-
-            return {
-              java_version: requirements.java,
-              node_version: requirements.node,
-            };
-
-  build-uberjar:
-    name: "SDK e2e > Build uberjar"
-    needs: [files-changed, get-build-requirements]
-    if: |
-      !cancelled() &&
-      needs.files-changed.outputs.e2e_embedding_sdk == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    env:
-      MB_EDITION: ee
-      INTERACTIVE: false
-      # make sure that builds on release branches get licenses, because we use them for releases
-      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-        with:
-          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
-
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: uberjar
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
-
-      - name: Build uberjar with ./bin/build.sh
-        run: ./bin/build.sh
-
-      - name: Prepare uberjar artifact
-        uses: ./.github/actions/prepare-uberjar-artifact
-        with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-sdk-tests
-
-  e2e-tests:
-    name: "SDK e2e > Run e2e tests (React ${{ matrix.react-version }})"
-    needs: [get-build-requirements, build-uberjar]
-    if: |
-      !cancelled() &&
-      needs.build-uberjar.result == 'success'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-    strategy:
-      matrix:
-        react-version: [18, 19]
-      fail-fast: false
-    env:
-      MB_EDITION: ee
-      DISPLAY: ""
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
-      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
-      CYPRESS_IS_EMBEDDING_SDK: "true"
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Retrieve uberjar artifact for ee
-        uses: actions/download-artifact@v4
-        with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-sdk-tests
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare JDK ${{ needs.get-build-requirements.outputs.java_version || 21 }}
-        uses: actions/setup-java@v4
-        with:
-          java-version: ${{ needs.get-build-requirements.outputs.java_version || 21 }}
-          distribution: "temurin"
-
-      - name: Prepare Cypress environment
-        id: cypress-prep
-        uses: ./.github/actions/prepare-cypress
-
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
-
-      - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: ${{ inputs.cached-embedding-sdk-dist-artifact-name }}
-          path: ${{ github.workspace }}/resources/embedding-sdk
-
-      - name: Run Metabase
-        run: node e2e/runner/run_cypress_ci.js start
-
-      - name: Make app db snapshot
-        run: node e2e/runner/run_cypress_ci.js snapshot --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      # Has to be run after the app db snapshot is made, as it is not compatible with React 19
-      - name: Change React version to ${{ matrix.react-version }}
-        run: ./bin/embedding-sdk/change-react-version.bash ${{ matrix.react-version }}
-
-      - name: Run component tests for Embedding SDK
-        run: node e2e/runner/run_cypress_ci.js component --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-embedding-sdk-react-${{ matrix.react-version }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
-      - name: "SDK e2e > Upload Cypress Artifacts upon failure"
-        uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: cypress-recording-embedding-sdk-react-${{ matrix.react-version }}
-          path: |
-            ./cypress
-            ./logs/test.log
-          if-no-files-found: ignore
-
-      - name: "SDK e2e > Publish Summary"
-        if: failure()
-        uses: actions/github-script@v7
-        with:
-          script: | #js
-            const {
-               generateReport,
-               parseReport,
-               formatSummary
-             } = require("./.github/scripts/handle-mochawesome-report.js");
-
-             const report = await generateReport();
-             const results = parseReport(report);
-             const summary = formatSummary(results);
-
-             await core.summary.addRaw(summary).write();

.github/workflows/e2e-cross-version.yml

@@ -1,171 +0,0 @@
-name: E2E Cross-version Tests
-
-on:
-  schedule:
-    - cron: '0 9 * * 1-5'
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    # don't run this workflow on a cron for forks
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_cross_version: ${{ steps.changes.outputs.e2e_cross_version }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  cross-version-testing:
-    needs: files-changed
-    if: ${{ needs.files-changed.outputs.e2e_cross_version == 'true' || github.event_name == 'schedule'}}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    strategy:
-      matrix:
-        version: [
-          # Major OSS upgrade
-          { source: v0.42.2, target: v0.48.7 },
-          # OSS upgrade
-          { source: v0.41.3.1, target: v0.42.2 },
-          # EE upgrade
-          { source: v1.43.4, target: v1.44.0 },
-          # EE downgrade
-          { source: v1.42.0, target: v1.41.3.1 },
-          # Cross-edition upgrade
-          { source: v0.41.3.1, target: v1.42.2 }
-        ]
-      fail-fast: false
-    env:
-      CROSS_VERSION_SOURCE: ${{ matrix.version.source }}
-      CROSS_VERSION_TARGET: ${{ matrix.version.target }}
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-    - name: Set source Docker image to OSS
-      run: |
-        echo "DOCKER_SOURCE_IMAGE=metabase/metabase:${{ matrix.version.source }}" >> $GITHUB_ENV
-      if: startsWith(matrix.version.source, 'v0')
-    - name: Set source Docker image to EE
-      run: |
-        echo "DOCKER_SOURCE_IMAGE=metabase/metabase-enterprise:${{ matrix.version.source }}" >> $GITHUB_ENV
-      if: startsWith(matrix.version.source, 'v1')
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Start Metabase ${{ matrix.version.source }}
-      run: |
-        docker run -d \
-        -v $PWD/my-metabase:/metabase.db \
-        -p 3000:3000 \
-        -e CYPRESS_MB_ALL_FEATURES_TOKEN=${{ secrets.MB_ALL_FEATURES_TOKEN }} \
-        -e CYPRESS_MB_STARTER_CLOUD_TOKEN=${{ secrets.MB_STARTER_CLOUD_TOKEN }} \
-        -e CYPRESS_MB_PRO_CLOUD_TOKEN=${{ secrets.MB_PRO_CLOUD_TOKEN }} \
-        -e CYPRESS_MB_PRO_SELF_HOSTED_TOKEN=${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }} \
-        --name metabase-${{ matrix.version.source }} \
-        ${{ env.DOCKER_SOURCE_IMAGE }}
-    - name: Wait for Metabase to start on port 3000
-      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-    - name: Prepare Cypress environment
-      id: cypress-prep
-      uses: ./.github/actions/prepare-cypress
-    - name: Run Cypress on the source
-      run: |
-        yarn cypress run \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
-          --config-file e2e/test/scenarios/cross-version/source/shared/cross-version-source.config.js \
-          --spec e2e/test/scenarios/cross-version/source/**/*.cy.spec.js
-    - name: Stop Metabase ${{ matrix.version.source }}
-      run: docker stop metabase-${{ matrix.version.source }}
-
-    - name: Set target Docker image to OSS
-      run: |
-        echo "DOCKER_TARGET_IMAGE=metabase/metabase:${{ matrix.version.source }}" >> $GITHUB_ENV
-      if: startsWith(matrix.version.source, 'v0')
-    - name: Set target Docker image to EE
-      run: |
-        echo "DOCKER_TARGET_IMAGE=metabase/metabase-enterprise:${{ matrix.version.source }}" >> $GITHUB_ENV
-      if: startsWith(matrix.version.source, 'v1')
-    - name: Start Metabase ${{ matrix.version.target }}
-      run: |
-        docker run -d \
-          -v $PWD/my-metabase:/metabase.db \
-          -p 3001:3000 \
-          -e CYPRESS_MB_ALL_FEATURES_TOKEN=${{ secrets.MB_ALL_FEATURES_TOKEN }} \
-          -e CYPRESS_MB_STARTER_CLOUD_TOKEN=${{ secrets.MB_STARTER_CLOUD_TOKEN }} \
-          -e CYPRESS_MB_PRO_CLOUD_TOKEN=${{ secrets.MB_PRO_CLOUD_TOKEN }} \
-          -e CYPRESS_MB_PRO_SELF_HOSTED_TOKEN=${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }} \
-          --name metabase-${{ matrix.version.target }} \
-          ${{ env.DOCKER_TARGET_IMAGE }}
-    - name: Wait for Metabase to start on port 3001
-      run: while ! curl -s 'http://localhost:3001/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-    - name: Run Cypress on the target
-      run: |
-        yarn cypress run \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
-          --config-file e2e/test/scenarios/cross-version/target/shared/cross-version-target.config.js \
-          --spec e2e/test/scenarios/cross-version/target/**/*.cy.spec.js
-    - name: Upload Cypress Artifacts upon failure
-      uses: actions/upload-artifact@v4
-      if: failure()
-      with:
-        name: cypress-artifacts-${{ matrix.version.source}}-to-${{ matrix.version.target }}
-        path: |
-          ./cypress
-        if-no-files-found: ignore
-  notify-on-failure:
-    needs: cross-version-testing
-    if: ${{ always() && contains(needs.*.result, 'failure') && github.event_name == 'schedule' }}
-    name: Cross-version test failure
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/Jod # 22.x.x
-      - run: npm install @slack/web-api
-      - name: notify slack of failure
-        uses: actions/github-script@v7
-        with:
-          script: | # js
-            const FAILED_RUN_URL = "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}";
-            const REF_NAME = "${{ github.ref_name }}";
-
-            // notify slack of failure
-            const { WebClient } = require('@slack/web-api');
-            const slack = new WebClient('${{ secrets.SLACK_BOT_TOKEN }}');
-
-            await slack.chat.postMessage({
-              channel: 'engineering-ci',
-              text: 'Cross-version Tests Have Failed',
-              blocks: [
-                {
-                  "type": "header",
-                  "text": {
-                    "type": "plain_text",
-                    "text": `:broken_heart:   Cross-version tests are failing on ${REF_NAME}`,
-                    "emoji": true,
-                  }
-                },
-              ],
-              attachments: [{
-                color: "#BF40BF",
-                blocks: [
-                  {
-                    "type": "section",
-                    "text": {
-                      "type": "mrkdwn",
-                      "text": `See <${FAILED_RUN_URL}|failing run details>.`
-                    }
-                  },
-                ]
-              }]
-            });

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -22,14 +22,10 @@ on:
         required: false
         default: "ee"
       qa_db:
-        description: "Select the type of Database you want to run your tests with"
-        type: choice
+        description: "Whether to set up and include external QA databases"
+        type: boolean
         required: true
-        default: "none"
-        options:
-          - none
-          - sql
-          - mongo
+        default: false
       enable_network_throttling:
         description: "Enable network throttling simulation (4g slow like in chrome dev tools)"
         type: boolean
@@ -37,8 +33,26 @@ on:
         default: true
 
 jobs:
+  determine-test-type:
+    name: Determine test type
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      type: ${{ steps.detect.outputs.type }}
+    steps:
+      - name: Detect test type from spec path
+        id: detect
+        run: |
+          SPEC='${{ inputs.spec }}'
+          if [[ "$SPEC" == e2e/test-component/scenarios/embedding-sdk/* ]]; then
+            echo "type=component" >> $GITHUB_OUTPUT
+          else
+            echo "type=e2e" >> $GITHUB_OUTPUT
+          fi
+
   workflow-summary:
     name: Stress test inputs
+    needs: [determine-test-type]
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     steps:
@@ -48,6 +62,7 @@ jobs:
           echo '' >> $GITHUB_STEP_SUMMARY
           echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
           echo '- `spec`: ${{ inputs.spec }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `test_type` (inferred): ${{ needs.determine-test-type.outputs.type }}' >> $GITHUB_STEP_SUMMARY
           echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
           echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
           echo '- `qa_db`: "${{ inputs.qa_db }}"' >> $GITHUB_STEP_SUMMARY
@@ -56,17 +71,18 @@ jobs:
           echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
 
   stress-test-flake-fix:
+    needs: [determine-test-type]
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     name: Stress test E2E flake fix
     env:
       DISPLAY: ""
-      QA_DB_ENABLED: ${{ contains(fromJSON('["sql", "mongo"]'), inputs.qa_db) }}
-      CYPRESS_QA_DB_MONGO: ${{ inputs.qa_db == 'mongo' }}
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
+      MB_RUN_MODE: e2e
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
       MB_EDITION: ${{ inputs.mb_edition }}
@@ -87,9 +103,9 @@ jobs:
           maildev: true
           openldap: true
           snowplow: true
-          postgres: ${{ inputs.qa_db == 'sql' }}
-          mysql: ${{ inputs.qa_db == 'sql' }}
-          mongo: ${{ inputs.qa_db == 'mongo' }}
+          postgres: ${{ inputs.qa_db }}
+          mysql: ${{ inputs.qa_db }}
+          mongo: ${{ inputs.qa_db }}
 
       - name: Download Metabase ${{ matrix.edition }} uberjar
         uses: ./.github/actions/e2e-download-uberjar
@@ -98,6 +114,16 @@ jobs:
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        if: ${{ needs.determine-test-type.outputs.type == 'component' }}
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - name: Build Embedding SDK package
+        if: ${{ needs.determine-test-type.outputs.type == 'component' }}
+        run: yarn build-embedding-sdk-package
+
       - name: Prepare JDK 21
         uses: actions/setup-java@v4
         with:
@@ -108,20 +134,23 @@ jobs:
         uses: ./.github/actions/prepare-cypress
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
+
       - name: Generate database snapshots
-        run: node e2e/runner/run_cypress_ci.js snapshot
+        run: |
+          node e2e/runner/run_cypress_ci.js snapshot \
+            --env grepTags="${{inputs.qa_db && '' || '-@external'}}"
 
       # For all options and fine-grained control, take a look at the documentation
       # https://github.com/cypress-io/cypress/tree/develop/npm/grep
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
         env:
           GREP: ${{ github.event.inputs.grep }}
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
-          node e2e/runner/run_cypress_ci.js e2e \
+          node e2e/runner/run_cypress_ci.js ${{ needs.determine-test-type.outputs.type }} \
           --spec '${{ github.event.inputs.spec }}' \
           --env burn=${{ github.event.inputs.burn_in }} \
-          --config-file e2e/support/cypress-stress-test.config.js \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+          --config-file e2e/support/cypress-stress-test.config.js
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/e2e-test.yml

@@ -37,17 +37,18 @@ jobs:
     env:
       MB_EDITION: ${{ inputs.edition }}
       DISPLAY: ""
-      QA_DB_ENABLED: true
       PR_NUMBER: ${{ github.event.pull_request.number || '' }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
       JOB_NAME: ${{ inputs.name }}
+      MB_RUN_MODE: "e2e"
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
       # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
       CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
       COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
       MB_EXPERIMENTAL_SEARCH_BLOCK_ON_QUEUE: true
@@ -56,10 +57,17 @@ jobs:
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
       TZ: US/Pacific # to make node match the instance tz
       CYPRESS_CI: true
-      CYPRESS_QA_DB_MONGO: ${{ inputs.name == 'mongo' }}
-      CYPRESS_IS_EMBEDDING_SDK: "${{ inputs.name == 'embedding-sdk' }}"
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: true
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - name: Setup python-runner
+        if: ${{ inputs.name == 'python' }}
+        env:
+          METABASE_AUTOMATION_USER_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: ./.github/scripts/setup-python-runner.sh
 
       - name: Prepare Docker containers
         uses: ./.github/actions/e2e-prepare-containers
@@ -70,13 +78,9 @@ jobs:
           openldap: true
           webhook: true
           snowplow: true
-          postgres: ${{ inputs.name != 'mongo' }}
-          mysql: ${{ inputs.name != 'mongo' }}
-          mongo: ${{ inputs.name == 'mongo' }}
-
-      - name: Run Embedding SDK Storybook
-        if: inputs.name == 'embedding-sdk'
-        uses: ./.github/actions/run-embedding-sdk-storybook
+          postgres: true
+          mysql: true
+          mongo: true
 
       - name: Retrieve uberjar artifact for ${{ inputs.edition }}
         uses: ./.github/actions/fetch-artifact
@@ -114,6 +118,8 @@ jobs:
         run: node e2e/runner/run_cypress_ci.js start
 
       - name: Generate database snapshots
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: node e2e/runner/run_cypress_ci.js snapshot
 
       - name: Run auto-split Cypress tests on ${{ inputs.name }}
@@ -123,41 +129,51 @@ jobs:
           SPLIT_INDEX: ${{ inputs.split_index }}
           SPLIT_FILE: "./e2e/support/timings.json"
           SPLIT_OUTPUT_FILE: "newTimes.json"
-          SPLIT_TIME_THRESHOLD: 5.0
+          SPLIT_TIME_THRESHOLD: 0.01 # 1% threshold for changes
           # do not write cypress-split summary to github
           SPLIT_SUMMARY: false
           SPEC_PATH: ${{ env.specs || inputs.specs }}
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         shell: bash
         run: |
           echo "Running tests with specs: $SPEC_PATH"
           node e2e/runner/run_cypress_ci.js e2e \
-            --env grepTags="-@mongo+-@flaky+-@OSS+-@skip",grepOmitFiltered=true \
-            --spec "$SPEC_PATH" \
-            --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+            --env grepTags="-@mongo+-@python+-@OSS+-@skip" \
+            --spec "$SPEC_PATH"
+        # Trunk Quarantine controls the final state of the run in the CI!
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
+        continue-on-error: true
 
       - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
         if: ${{ inputs.specs }}
         shell: bash
         env:
           SPEC_PATH: ${{ env.specs || inputs.specs }}
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
           echo "Running tests with specs: $SPEC_PATH"
           node e2e/runner/run_cypress_ci.js e2e \
-          --env grepTags="${{inputs.tags}}+-@skip",grepOmitFiltered=true \
-          --spec "$SPEC_PATH" \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+          --env grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@skip'}}" \
+          --spec "$SPEC_PATH"
+        # Trunk Quarantine controls the final state of the run in the CI!
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
+        continue-on-error: true
 
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
         with:
           input-path: ./target/junit
+          # Related to our custom upload to S3
           output-name: e2e-${{ inputs.name }}
-          variant: e2e-tests
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
           aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
+          # Related to Trunk uploader
+          variant: e2e-tests
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
       - name: Upload Cypress Artifacts upon failure
@@ -177,6 +193,51 @@ jobs:
           name: failed-tests-${{ inputs.name }}-${{ inputs.edition }}
           path: ./cypress/test-results
 
+      - name: Extract chunk-specific changed timings
+        id: extract-timings
+        if: inputs.split_index >= 0 && github.ref == 'refs/heads/master'
+        continue-on-error: true
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const oldTimingsPath = "./e2e/support/timings.json";
+            const newTimingsPath = "./e2e/support/newTimes.json";
+
+            if (!fs.existsSync(newTimingsPath)) {
+              throw new Error(`newTimes.json not found - cypress-split may not have generated it`);
+            }
+
+            if (!fs.existsSync(oldTimingsPath)) {
+              throw new Error(`Original timings file ${oldTimingsPath} not found`);
+            }
+
+            const oldTimings = fs.existsSync(oldTimingsPath)
+              ? JSON.parse(fs.readFileSync(oldTimingsPath, "utf8"))
+              : { durations: [] };
+
+            const newTimings = fs.existsSync(newTimingsPath)
+              ? JSON.parse(fs.readFileSync(newTimingsPath, "utf8"))
+              : { durations: [] };
+
+            const { extractChangedTimings } = require('${{ github.workspace }}/.github/scripts/extract-changed-timings.js');
+
+            const result = extractChangedTimings({ oldTimings, newTimings });
+
+            if (result.hasChanges) {
+              core.setOutput('has-changes', 'true');
+              fs.writeFileSync('chunkTimings.json', JSON.stringify(result.changedTimings, null, 2));
+              console.log(`Extracted ${Object.keys(result.changedTimings).length} changed timings for chunk index ${{ inputs.split_index }}`);
+            }
+
+      - name: Upload Timing Data
+        uses: actions/upload-artifact@v4
+        if: steps.extract-timings.outcome == 'success' && steps.extract-timings.outputs.has-changes == 'true'
+        with:
+          name: timing-data-${{ inputs.name }}-${{ inputs.split_index }}
+          path: chunkTimings.json
+          retention-days: 1 # gets merged immediately by parent workflow
+
       - name: Publish Summary
         if: failure()
         uses: actions/github-script@v7

.github/workflows/e2e-tests.yml

@@ -73,31 +73,77 @@ jobs:
       tags: ${{ matrix.tags }}
       runner: ${{ matrix.runner }}
 
-  # run this separately to make it non-blocking
-  flaky-e2e-tests:
-    name: Flaky e2e Tests
-    uses: ./.github/workflows/e2e-test.yml
-    needs:
-      - e2e-matrix-builder
-    # skip flaky test run if only e2e specs changed as an optimization
-    if: |
-      !cancelled() && !inputs.skip && needs.e2e-matrix-builder.outputs.isDefaultSpecPattern == 'true'
-    secrets: inherit
-    with:
-      name: Flaky
-      tags: "@flaky"
+  collect-timings:
+    name: Collect E2E Timings
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    needs: e2e-tests
+    if: always() && !cancelled() && github.ref == 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            e2e/support
+          sparse-checkout-cone-mode: false
+
+      - name: Download all timing artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: timing-data-*
+          path: timing-files
+          merge-multiple: false
+        continue-on-error: true
+
+      - name: Merge split timings
+        id: merge
+        continue-on-error: true
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+
+            const globber = await glob.create('timing-files/*/chunkTimings.json');
+            const chunkFiles = await globber.glob();
+
+            const specs = new Map();
+            chunkFiles.forEach(file => {
+              const { durations = [] } = JSON.parse(fs.readFileSync(file, 'utf8'));
+              durations.forEach(({ spec, duration }) => specs.set(spec, duration));
+            });
+
+            if (specs.size === 0) {
+              throw new Error('No timing data found - no specs had timing changes');
+            }
+
+            const outputPath = 'e2e/support/runTimings.json';
+            fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+
+            const runTimings = {
+              durations: [...specs].map(([spec, duration]) => ({ spec, duration }))
+            };
+
+            fs.writeFileSync(outputPath, JSON.stringify(runTimings, null, 2));
+            console.log(`Merged timing data for ${specs.size} specs`);
+
+      - name: Upload merged timing files
+        if: steps.merge.outcome == 'success'
+        uses: actions/upload-artifact@v4
+        with:
+          name: merged-e2e-timings
+          path: e2e/support/runTimings.json
+          retention-days: 7
 
   e2e-tests-result:
     needs:
       - e2e-tests
-      - flaky-e2e-tests
     runs-on: ubuntu-latest
     timeout-minutes: 5
     name: e2e-tests-result
     if: always() && !cancelled()
     env:
       E2E_TESTS_RESULT: ${{ needs.e2e-tests.result }}
-      FLAKY_E2E_TESTS_RESULT: ${{ needs.flaky-e2e-tests.result }}
     steps:
       - name: Stub
         if: ${{ needs.e2e-tests.result == 'skipped' }}
@@ -107,7 +153,6 @@ jobs:
         if: ${{ needs.e2e-tests.result != 'skipped' }}
         run: | # sh
           echo "E2E Tests: ${{ needs.e2e-tests.result }}"
-          echo "Flaky E2E Tests: ${{ needs.flaky-e2e-tests.result }}"
 
           if [ "${{ needs.e2e-tests.result }}" != "success" ]; then
             echo "E2E Tests failed"

.github/workflows/embedding-sdk-component-tests.yml

@@ -0,0 +1,256 @@
+name: Embedding SDK Component Tests
+
+on:
+  workflow_call:
+
+jobs:
+  sdk-component-tests:
+    name: "SDK component tests (React ${{ matrix.react-version }})"
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    strategy:
+      matrix:
+        react-version: [18, 19]
+      fail-fast: false
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      MB_RUN_MODE: "e2e"
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve uberjar artifact for ee
+        uses: ./.github/actions/fetch-artifact
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"
+
+      - name: Retrieve Embedding SDK dist artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ github.workspace }}/resources/embedding-sdk
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: 21
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Make app db snapshot
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        # Component tests only need the default snapshot
+        run: |
+          node e2e/runner/run_cypress_ci.js snapshot \
+            --spec "e2e/snapshot-creators/default.cy.snap.js"
+
+      # Has to be run after the app db snapshot is made, as it is not compatible with React 19
+      - name: Change React version to ${{ matrix.react-version }}
+        run: ./bin/embedding-sdk/change-react-version.bash ${{ matrix.react-version }}
+
+      - name: Run component tests for Embedding SDK
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js component
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk-react-${{ matrix.react-version }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: "SDK component tests > Upload Cypress Artifacts upon failure"
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-react-${{ matrix.react-version }}
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: "SDK component tests > Publish Summary"
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();
+
+  decide-target-ref:
+    runs-on: ubuntu-latest
+    outputs:
+      target-ref: ${{ steps.get-target-ref.outputs.value }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Decide ref to checkout
+        id: get-target-ref
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "value=${{ github.base_ref }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
+          fi
+
+  # This job ensures that the Embedding SDK package from the current commit (N) works with the
+  # Embedding SDK Bundle (Metabase JAR) from the previous commit (N-1).
+  # N - 1 is a target of a pull request, or a literal previous commit when this job is run on push in a branch.
+  sdk-component-tests-backward-compatibility:
+    name: "SDK component tests (Backward compatibility)"
+    needs: [decide-target-ref]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      MB_RUN_MODE: "e2e"
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - name: Check out the code from the previous commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.decide-target-ref.outputs.target-ref }}
+
+      - name: Get the actual commit SHA from the checked out branch
+        id: get-commit-sha
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Attempt to retrieve the ee uberjar artifact from the previous commit
+        id: download-uberjar
+        uses: ./.github/actions/fetch-artifact
+        with:
+          name: metabase-ee-${{ steps.get-commit-sha.outputs.sha }}-uberjar
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"
+        continue-on-error: true # do not break the whole job if this step doesn't succeed
+
+      # Build the uberjar from the previous commit only if we couldn't fetch it.
+      # `step.foo.OUTCOME` is important because it looks at the step status *before* continue-on-error is applied.
+      # Do not confuse it with the `step.foo.conclusion`.
+      - name: Build MB uberjar from the commit N-1
+        if: steps.download-uberjar.outcome != 'success'
+        run: ./bin/build.sh
+
+      - name: Retrieve Embedding SDK dist artifact built from the current commit N
+        uses: actions/download-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ github.workspace }}/resources/embedding-sdk
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Make app db snapshot
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        # Component tests only need the default snapshot
+        run: |
+          node e2e/runner/run_cypress_ci.js snapshot \
+            --spec "e2e/snapshot-creators/default.cy.snap.js"
+
+      - name: Run component tests for Embedding SDK
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: |
+          node e2e/runner/run_cypress_ci.js component \
+            --env grepTags="-@skip-backward-compatibility"
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-cross-version
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -1,78 +1,14 @@
 name: "[NOT REQUIRED] SDK Compatibility tests"
 
 on:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-  pull_request:
-    types: [opened, synchronize, reopened]
-    branches:
-      - "master"
-      - "release-**"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
+  workflow_call:
 
 jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_embedding_sdk_compatibility: ${{ steps.changes.outputs.e2e_embedding_sdk_compatibility }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  # if this is a test on a release branch, we need to check the build requirements
-  get-build-requirements:
-    if: |
-      !cancelled() &&
-      contains(github.base_ref || github.ref, 'release-x')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      - name: Get build dependencies
-        uses: actions/github-script@v7
-        id: dependencies
-        with:
-          script: | # js
-            const {
-              getBuildRequirements,
-              getVersionFromReleaseBranch,
-            } = require('${{ github.workspace }}/release/dist/index.cjs');
-            const targetBranchName = '${{ github.base_ref || github.ref }}';
-
-            const version = getVersionFromReleaseBranch(targetBranchName);
-            const requirements = getBuildRequirements(version);
-
-            return {
-              java_version: requirements.java,
-              node_version: requirements.node,
-            };
-
   get-sample-apps-data:
-    if: |
-      !cancelled()
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     env:
-      # we must support last two stable releases
+      # we must support the last two stable releases
       SUPPORTED_RELEASES_COUNT: 2
       TEST_SUITES: |
         [
@@ -145,48 +81,6 @@ jobs:
               matrix: []
             };
 
-  build:
-    needs: [files-changed, get-build-requirements, get-sample-apps-data]
-    if: |
-      !cancelled() &&
-      needs.files-changed.outputs.e2e_embedding_sdk_compatibility == 'true' &&
-      fromJSON(needs.get-sample-apps-data.outputs.matrix)[0] != null
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    env:
-      MB_EDITION: ee
-      INTERACTIVE: false
-      # make sure that builds on release branches get licenses, because we use them for releases
-      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-        with:
-          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: uberjar
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
-
-      - name: Build uberjar with ./bin/build.sh
-        run: ./bin/build.sh
-
-      - name: Prepare uberjar artifact
-        uses: ./.github/actions/prepare-uberjar-artifact
-        with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-
-      - name: Build Embedding SDK package
-        run: yarn build-embedding-sdk-package
-
-      - name: Prepare Embedding SDK artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
-          path: resources/embedding-sdk
-
   # In order to check compatibility between Sample Apps and Embedding SDK, the job for each sample app:
   # - pulls a Sample App
   # - starts it
@@ -194,13 +88,13 @@ jobs:
   # The job is not required, though if it's failing better to be sure that it's not caused by a breaking change.
   # For more details see `Sample Apps compatibility with Embedding SDK tests` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
   e2e-sample-apps-tests:
-    needs: [get-build-requirements, get-sample-apps-data, build]
+    needs: [get-sample-apps-data]
     strategy:
       matrix:
         test_suite: ${{ fromJSON(needs.get-sample-apps-data.outputs.matrix) }}
         environment: ["production", "development"]
     if: |
-      !cancelled() && needs.build.result == 'success'
+      !cancelled() && needs.get-sample-apps-data.result == 'success'
     runs-on: ubuntu-22.04
     timeout-minutes: 45
     name: e2e-sample-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
@@ -210,8 +104,9 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       PR_NUMBER: ${{ github.event.pull_request.number || '' }}
       HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_IS_EMBEDDING_SDK: "true"
+      MB_RUN_MODE: e2e
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       TZ: US/Pacific # to make node match the instance tz
       CYPRESS_CI: true
       SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
@@ -236,9 +131,11 @@ jobs:
           echo "sample_app_name=${test_suite%-e2e}" >> "$GITHUB_OUTPUT"
 
       - name: Retrieve uberjar artifact for ee
-        uses: actions/download-artifact@v4
+        uses: ./.github/actions/fetch-artifact
         with:
           name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"
 
       - name: Retrieve Embedding SDK dist artifact
         uses: actions/download-artifact@v4
@@ -294,7 +191,9 @@ jobs:
         id: run-e2e-tests
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
         continue-on-error: true
-        run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }} --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4
@@ -318,7 +217,6 @@ jobs:
   # The job is not required, though if it's failing better to be sure that it's not caused by a breaking change.
   # For more details see `Embedding SDK integration tests with Host Apps` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
   e2e-host-apps-tests:
-    needs: [get-build-requirements, build]
     strategy:
       matrix:
         test_suite:
@@ -329,8 +227,6 @@ jobs:
             "angular-20-host-app-e2e",
           ]
         environment: ["production", "development"]
-    if: |
-      !cancelled() && needs.build.result == 'success'
     runs-on: ubuntu-22.04
     timeout-minutes: 45
     name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
@@ -340,8 +236,9 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       PR_NUMBER: ${{ github.event.pull_request.number || '' }}
       HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_IS_EMBEDDING_SDK: "true"
+      MB_RUN_MODE: e2e
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       TZ: US/Pacific # to make node match the instance tz
       CYPRESS_CI: true
       HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
@@ -352,9 +249,11 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Retrieve uberjar artifact for ee
-        uses: actions/download-artifact@v4
+        uses: ./.github/actions/fetch-artifact
         with:
           name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"
 
       - name: Retrieve Embedding SDK dist artifact
         uses: actions/download-artifact@v4
@@ -379,7 +278,9 @@ jobs:
         run: node e2e/runner/run_cypress_ci.js start
 
       - name: Generate database snapshots
-        run: node e2e/runner/run_cypress_ci.js snapshot
+        run: |
+          node e2e/runner/run_cypress_ci.js snapshot \
+            --spec "e2e/snapshot-creators/default.cy.snap.js"
 
       - name: Prepare and launch Host App
         run: npx tsx ./e2e/runner/embedding-sdk/host-apps/start-ci.ts ${{ matrix.test_suite }}
@@ -387,7 +288,9 @@ jobs:
       - name: Run e2e tests for Host App
         id: run-e2e-tests
         continue-on-error: true
-        run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }} --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/embedding-sdk-labels-reminder.yml

@@ -0,0 +1,49 @@
+name: Embedding SDK Labels Reminder
+
+on:
+  pull_request:
+    types: [auto_merge_enabled, review_requested, labeled, unlabeled, synchronize]
+    branches:
+      - "master"
+  merge_group:
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      frontend_embedding_sdk_package_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_package_sources }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  embedding-sdk-package-no-release-notes-reminder:
+    needs: [ files-changed ]
+    if: |
+      !cancelled() &&
+      (needs.files-changed.outputs.frontend_embedding_sdk_package_sources == 'true')
+    name: Embedding SDK package release-notes/no-release-notes label reminder
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+        id: verify-release-notes-labels
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          valid-labels: 'release-notes, no-release-notes'
+          disable-reviews: true
+      - name: Comment on PR if label should be added
+        if: ${{ always() }}
+        uses: ./.github/actions/notify-pull-request
+        with:
+          remove-previous-comment: true
+          add-new-comment: ${{ steps.verify-release-notes-labels.outcome == 'failure' }}
+          message: "⚠️ Changes were made to the <b>Embedding SDK Package</b>. Review this PR and apply one of the following labels.<br><br>- <code>release-notes</code> — select if this PR must be included in the main Metabase changelog release notes.<br>- <code>no-release-notes</code> — select if this PR should not be included in the main Metabase changelog release notes."
+          include-log: true

.github/workflows/embedding-sdk-package-build.yml

@@ -0,0 +1,31 @@
+name: Embedding SDK Package Build
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  group: embedding-sdk-package-${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build-sdk-package:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Build Embedding SDK package
+        run: |
+          # Remove the matchers to not report false positives on every PR
+          # unrelated to embedding (EMB-765)
+          echo "::remove-matcher owner=tsc::"
+          yarn build-embedding-sdk-package
+      - name: Prepare Embedding SDK artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: resources/embedding-sdk

.github/workflows/embedding-sdk.yml

@@ -2,59 +2,39 @@ name: SDK
 
 on:
   workflow_call:
+    inputs:
+      cli-snippets-type-check:
+        description: "Whether to run cli snippets type check."
+        required: true
+        type: boolean
+      docs-snippets-type-check:
+        description: "Whether to run docs snippets type check."
+        required: true
+        type: boolean
+      documentation-validation:
+        description: "Whether to run documentation generation validation check."
+        required: true
+        type: boolean
+      component-tests:
+        description: "Whether to run component tests."
+        required: true
+        type: boolean
+      host-sample-apps-tests:
+        description: "Whether to run host and sample apps compatibility tests."
+        required: true
+        type: boolean
+      skip:
+        description: Whether to skip running tests due to one of the artifacts failing to build.
+        required: true
+        type: boolean
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_embedding_sdk: ${{ steps.changes.outputs.e2e_embedding_sdk }}
-      frontend_embedding_sdk_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_sources }}
-      embedding_documentation: ${{ steps.changes.outputs.embedding_documentation }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  build:
-    needs: [files-changed]
-    if: |
-      !cancelled() &&
-      (needs.files-changed.outputs.e2e_embedding_sdk == 'true' ||
-      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' ||
-      needs.files-changed.outputs.embedding_documentation == 'true')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
-      - name: Build Embedding SDK package
-        run: yarn build-embedding-sdk-package
-      - name: Prepare Embedding SDK artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
-          path: resources/embedding-sdk
-
   embedding-sdk-cli-snippets-type-check:
-    needs: [files-changed, build]
-    if: |
-      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' &&
-      needs.build.result == 'success'
+    if: inputs.cli-snippets-type-check && !inputs.skip
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -70,10 +50,7 @@ jobs:
         run: yarn run embedding-sdk:cli-snippets:type-check
 
   embedding-sdk-docs-snippets-type-check:
-    needs: [files-changed, build]
-    if: |
-      needs.files-changed.outputs.embedding_documentation == 'true' &&
-      needs.build.result == 'success'
+    if: inputs.docs-snippets-type-check && !inputs.skip
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -89,10 +66,7 @@ jobs:
         run: yarn run embedding-sdk:docs-snippets:type-check
 
   embedding-sdk-api-documentation-generation-validation:
-    needs: [files-changed, build]
-    if: |
-      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' &&
-      needs.build.result == 'success'
+    if: inputs.documentation-validation && !inputs.skip
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -138,29 +112,24 @@ jobs:
         run: exit 1
 
   # See `Component e2e tests` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
-  sdk-e2e-tests:
-    name: "SDK e2e tests"
-    uses: ./.github/workflows/e2e-component-tests-embedding-sdk.yml
-    needs: [build]
+  embedding-sdk-component-tests:
+    name: "SDK component tests"
+    if: inputs.component-tests && !inputs.skip
+    uses: ./.github/workflows/embedding-sdk-component-tests.yml
     secrets: inherit
-    with:
-      cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
 
-  e2e-component-tests-embedding-sdk-backward-compatibility:
-    name: "SDK e2e backward compatibility tests"
-    uses: ./.github/workflows/e2e-component-tests-embedding-sdk-backward-compatibility.yml
-    needs: [build]
+  not-required-embedding-sdk-apps-compatibility-tests:
+    name: "SDK e2e tests for compatibility with (host/sample) apps"
+    if: inputs.host-sample-apps-tests && !inputs.skip
+    uses: ./.github/workflows/embedding-sdk-host-sample-apps-tests.yml
     secrets: inherit
-    with:
-      cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
 
   embedding-sdk-tests-result:
     needs:
       - embedding-sdk-cli-snippets-type-check
       - embedding-sdk-docs-snippets-type-check
       - embedding-sdk-api-documentation-generation-validation
-      - sdk-e2e-tests
-      - e2e-component-tests-embedding-sdk-backward-compatibility
+      - embedding-sdk-component-tests
     if: always() && !cancelled()
     runs-on: ubuntu-latest
     timeout-minutes: 5

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -43,8 +43,6 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
       - name: Build cljs
         run: yarn build:cljs
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times

.github/workflows/frontend.yml

@@ -35,15 +35,16 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
+
+      - name: Get Eslint cache key
+        uses: ./.github/actions/get-cache-keys
+        id: get-cache-keys
       - name: Restore ESLint cache
-        uses: actions/cache@v4
+        uses: actions/cache/restore@v4
         with:
-          path: .eslintcache
-          key: eslintcache-${{ hashFiles('yarn.lock', '.eslintrc.js') }}
-          restore-keys: |
-            eslintcache-
+          path: ${{ github.workspace}}/.eslintcache
+          key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
+
       - name: Compile CLJS
         run: yarn build-pure:cljs
       - name: Find CSS variables that are used but never defined
@@ -65,8 +66,6 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
       - run: yarn build-pure:cljs
         name: Compile CLJS
       - run: yarn type-check-pure
@@ -90,10 +89,12 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
       - name: Run frontend unit tests
         run: yarn run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
+        # Trunk Quarantine controls the final state of the run in the CI!
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
+        continue-on-error: true
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always() && github.event_name != 'workflow_dispatch'
@@ -116,8 +117,6 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
       - name: Run frontend timezones tests
         run: yarn run test-timezones
 

.github/workflows/fuzzing.yml

@@ -22,8 +22,6 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
       - run: yarn test-unit frontend/src/metabase/querying/expressions/pratt/fuzz.lexifier.unit.spec.ts
         env:
           MB_FUZZ: 1
@@ -38,8 +36,6 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
       - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.compiler.unit.spec.ts
         env:
           MB_FUZZ: 1
@@ -54,8 +50,6 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
       - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.string.unit.spec.ts
         env:
           MB_FUZZ: 1

.github/workflows/generative-query-test.yml

@@ -40,8 +40,6 @@ jobs:
           ref: ${{ inputs.ref }}
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: generative-query-test
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
 

.github/workflows/i18n.yml

@@ -38,8 +38,6 @@ jobs:
       uses: ./.github/actions/prepare-frontend
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'i18n'
     - name: Install xgettext if necessary
       run: |
         if ! command -v xgettext > /dev/null; then

.github/workflows/loki-update.yml

@@ -20,32 +20,12 @@ jobs:
 
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
 
       - name: Compile CLJS
         run: yarn build-pure:cljs
 
-      - name: Build Storybook
-        # We won't be able to use Storybook play's `userEvent` with production build
-        # see https://github.com/storybookjs/storybook/issues/19758
-        run: NODE_ENV=development yarn build-storybook
-
-      - name: Serve Storybook
-        run: yarn http-server storybook-static -p 6006 &
-        shell: bash
-
-      - name: Wait for Storybook to become available
-        run: |
-          echo "Waiting for Storybook to be served..."
-          while ! curl --silent --fail http://localhost:6006; do
-            sleep 5
-            echo "Retrying..."
-          done
-          echo "Storybook is being served!"
-
       - name: Update Loki Snapshots
-        run: yarn test-visual:loki || yarn test-visual:loki-approve-diff && yarn test-visual:loki-prune
+        run: yarn test-visual:loki:ci || yarn test-visual:loki-approve-diff && yarn test-visual:loki-prune
 
       - name: Check for changes
         id: check-changes

.github/workflows/loki.yml

@@ -47,20 +47,12 @@ jobs:
 
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
 
       - name: Compile CLJS
         run: NODE_ENV=development yarn build-pure:cljs
 
-      - name: Build Storybook
-        # We won't be able to use Storybook play's `userEvent` with production build
-        # see https://github.com/storybookjs/storybook/issues/19758
-        run: NODE_ENV=development yarn build-storybook
-
       - name: Run Loki Visual Tests
-        run: |
-          yarn loki --requireReference --reactUri file:./storybook-static --chromeFlags='--headless --disable-gpu' --verboseRenderer
+        run: yarn test-visual:loki:ci
 
       - name: Generate Visual Report on Failure
         if: failure()