🤖 backported "Security Center" (#72346) (#72687)

* 🤖 backported "Security Center" (#72346)

* Security Center (#71661)

* security center data model (#71660)

* add security_center model

* wip: migration

* kondo

* Advisory security endpoints (#71704)

* Security center admin page and advisory list (#71707)

* Use :admin-security-center feature flag and restore premium-handler on route

* Reuse notification system components for security center channel config (#71723)

* Security center settings (#71807)

* feat: add security-center recipients settings

* feat(FE): add security-center settings

* tests

* feat(FE): hook to settings

* Security center matching engine (#71747)

* upgrade banner (#71800)

* added banner (#71816)

* moved the security center into the top bar (#71821)

* fixed an e2e test

* Gate Security Center for non-trial subscriptions (#71799)

* Gate Security Center for non-trial subscriptions

Trial subscriptions should not have access to Security Center to
prevent abuse via easily-obtainable trial enterprise tokens.

Adds `is-trial?` and `assert-not-trial` to the premium features
token check, and applies a `+require-non-trial` middleware to the
security-center route that returns 402 for trial tokens.

* Handle check-token exceptions in is-trial?

Fail open (return false) if the token status check throws, matching
the same pattern used by *token-features*. Prevents a 500 when
MetaStore is unreachable.

* Use token-status setting instead of check-token directly

Follow the existing pattern used by billing and cloud-add-ons.

* Use -token-status instead of the setting getter

* Gate Security Center for non-trial subscriptions

Trial subscriptions should not have access to Security Center to
prevent abuse via easily-obtainable trial enterprise tokens.

Adds is-trial? and security-center-enabled? to premium features
token check, and a +check-not-trial middleware on the security
center API routes that returns 402 for trial tokens.

* Security center notification (#71814)

* feat: add last_notified_at column

* feat: add security-advisory-match event

* feat: security advisory email template

* feat: add slack renderer

* feat: notify

* email fixes

* kondo

* fix: hydrate

* chore: quartz

* test

* send notification sync

* fix: guard against no smtp config

* fix: bcc

* more tests

* only on has feature

* switch to util

* move url builder

* feat: use all-admin-recipients

* Security center: fetch and scheduled evaulation (#71830)

* addressed stas feedback

* all-admins and recipients are no longer exclusive (#71895)

* Fix read only connection for security center (#71898)

* added sync button (#71905)

* Security center unify tasks + CI green (#71894)

* pull notify task into sync task

* make CI green

* chore: exclude security-advisory

* fmt

* require settings in init

* kondo

* set wor

* fixes

* exclude is-hosted

* check-enabled with open-api wrap

* change error

* missing

* fix: emails

* fix use an user-id

* fixes

* init test-users

* enable on dev

* rollback to enforce no writes

* fix: add index

* index before fk

* may not error

* Security center test notification (#71915)

* test notifications

Closes GDGT-2174

* test

* fix

* addressed PR feedback (#71919)

* fix parsing published_at timestamp durign fetch

* fix fetch test to use string published_at matching real API response

The test was using #t tagged literals for published_at which bypassed
the string→timestamp coercion path, masking the bug we just fixed.

* added tests for recipients settings (#71963)

* make recipients non nullable (#71967)

* Treat error match_status as affected (fail-open) (#71961)

* treat error match_status as affected (fail-open)

Per the matching engine spec, when a matching query fails, the advisory
should be treated as potentially affected. The isAffected check was only
looking for "active" status, missing the "error" case.

* fix type errors in createAdvisory mock

Add return type annotation so string literals narrow to the Advisory
type instead of widening to string when spread with Partial<Advisory>.

* Security center: force sync endpoint (#71899)

* Security center cursor (#71969)

* feat: add updated_at

* feat: cursor on updated_at

* feat: since tests

* fix fetch tests

* appease the linter

* fix test

* remove seed

* small fixes

* fix

* feature token properly propagates (#71970)

* added polling for sync button (#71971)

* fix

* fix

* fix

* Add Snowplow tracking for Security Center (#71972)

* Add Snowplow tracking for Security Center

Track 3 events using the existing simple_event schema:
- security_center_page_viewed (FE, on page mount)
- security_advisory_acknowledged (BE, with severity)
- security_advisory_notification_sent (BE, with channel/result/trigger)

* Derive notification channels from handlers instead of config

Instead of re-checking configured-channels at tracking time, derive
the channel list from the notification's actual handlers.

* Move last_notified_at update inside try block

* add :admin-security-center to excluded features in stats test

* kondo

* update schema (#72031)

* hook full feature logic to premium features exposed to the FE (#72026)

* hook full feature logic to premium features exposed to the FE

* tests

* fix test

* chore: error in FE

* fix

* fix e2e test

* lint

* tighten schemas

* fix hydration

* chore: defensively check-superuser

* tighter schemas

* fix test

* chore: simpler schema as we'd need to duplicate with :api/regex

* e2e test should only run on ee

* fix: recipients default (#72035)

* Add testing endpoint for security advisories (#71977)

* fix model boundary violations for SecurityAdvisory

* relax schema

* move to 45 (#72073)

* chore: migrations in 001 file for backporting to 45

* mark-ran preconds

* reorder

* consolidate

* add set null

* Mobile improvements (#72071)

* move to 55

* move severity->repeat-days into an overridable setting

Closes GDGT-2208

* reformat

* typo

* deal with nits

* switch to select-fn->fn

* explicit map building

* more nits

* align

* nit

* add not-empty

* use custom executor instead of future

* use semver4j

* fix test

* restrict queries to selects (#72162)

* reorder

* Security center no h2 (#72215)

* disable security-center for h2 appdbs

* tests

* fix last-checked at, store in setting

* fix tests

* enable for e2e tests

* fix merge conflicts

* Revert "Security center no h2 (#72215)"

This reverts commit 41dc93794d.

* fix: persist last-synced-at in a setting

* fix test

* disable on h2 (enabled for tests) (#72263)

* UI feedback on Security Center (#72214)

* fixed imports

* chore: max 2 mins for advisory query

* kondo

* chore: use sql-jdbc.execute

* kondo

---------

Co-authored-by: Ngoc Khuat <qn.khuat@gmail.com>
Co-authored-by: Sébastien <sebastien@metabase.com>

* fixed conflicts

* seed advisories on first run (#72446)

* Updated UI for Security Center (#72518)

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>

* fix: re-evaluate active advisories even if they've been acked (#72610)

---------

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>
Co-authored-by: Ngoc Khuat <qn.khuat@gmail.com>
Co-authored-by: Sébastien <sebastien@metabase.com>

* remove non related tests that snook in

* type

---------

Co-authored-by: github-automation-metabase <166700802+github-automation-metabase@users.noreply.github.com>
Co-authored-by: Ngoc Khuat <qn.khuat@gmail.com>
Co-authored-by: Sébastien <sebastien@metabase.com>

.claude/skills/typescript-review/SKILL.md

@@ -12,8 +12,9 @@ allowed-tools: Read, Grep, Bash, Glob
 
 Review pull requests with a focus on:
 
+- Readability and maintainability
+- Appropriate test coverage
 - Compliance with project coding standards and conventions
 - Code quality and best practices
-- Clear and correct JSDoc comments
 - Type safety and proper TypeScript usage
-- React best practices (when applicable)
+- React best practices (when applicable)

.clj-kondo/config.edn

@@ -176,6 +176,7 @@
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
      metabase.channel.core/send!
+     metabase.warehouses.models.database/assert-not-h2!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
      metabase.notification.models/create-notification!
      metabase.pulse.send/send-pulse!
@@ -227,7 +228,9 @@
   ;;
 
   :invalid-arity       {:skip-args [metabase.lib.util.match/match
-                                    metabase.lib.util.match/match-lite]}                    ; TODO (cam): can we fix these?
+                                    metabase.lib.util.match/match-lite
+                                    metabase.lib.util.match/match-many
+                                    metabase.lib.util.match/replace-lite]}                    ; TODO (cam): can we fix these?
   :refer-all           {:level :warning, :exclude [clojure.test]}
   :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
@@ -246,12 +249,17 @@
     (metabase.lib.util.match/match)
     (metabase.lib.util.match/match-one)
     (metabase.lib.util.match/match-lite)
+    (metabase.lib.util.match/match-many)
     (metabase.lib.util.match/replace)
     (metabase.lib.util.match/replace-in)
+    (metabase.lib.util.match/replace-lite)
     (metabase.driver-api.core/match)
     (metabase.driver-api.core/match-one)
+    (metabase.driver-api.core/match-lite)
+    (metabase.driver-api.core/match-many)
     (metabase.driver-api.core/replace)
     (metabase.driver-api.core/replace-in)
+    (metabase.driver-api.core/replace-lite)
     (metabase.query-processor.middleware.cache-backend.interface/with-cached-results)
     (metabase.util.regex/rx [opt])
     (metabase.util/prog1 [<>])
@@ -303,6 +311,9 @@
    metabase.lib.convert/->legacy-MBQL                 {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.core/->legacy-MBQL                    {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
+   metabase.lib.util.match/match                      {:message "Use lib.util.match/match-many instead of lib.util.match/match."}
+   metabase.lib.util.match/match-one                  {:message "Use lib.util.match/match-lite instead of lib.util.match/match-one."}
+   metabase.lib.util.match/replace                    {:message "Use lib.util.match/replace-lite instead of lib.util.match/replace."}
    metabase-enterprise.transforms.interface/execute!  {:message "Use metabase-enterprise.transforms.execute/execute! instead of metabase-enterprise.transforms.interface/execute!"}
    next.jdbc/active-tx?                               {:message "Use metabase.app-db.core/in-transaction? to see if we are in a transaction"}
    toucan2.core/debug                                 {:message "Don't commit code using t2/debug"}
@@ -781,7 +792,7 @@
     :private-call                                        {:level :off}
     :metabase/defsetting-must-specify-export             {:level :off}
     :metabase/defsetting-namespace                       {:level :off}
-    :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn
+    :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
 
     :discouraged-var
     {metabase.driver/database-supports? {:level :off}

.clj-kondo/config/modules/config.edn

@@ -133,7 +133,7 @@
            version}}
 
   analyze
-  {:team "Querying"
+  {:team "Graphy"
    :api  #{metabase.analyze.core
            metabase.analyze.query-results}
    :uses #{config
@@ -275,6 +275,7 @@
            config
            events
            models
+           permissions
            premium-features
            request
            settings
@@ -548,6 +549,8 @@
            metabase.driver.common
            metabase.driver.common.parameters
            metabase.driver.common.parameters.parse
+           metabase.driver.connection
+           metabase.driver.connection.workspaces
            metabase.driver.ddl.interface
            metabase.driver.h2
            metabase.driver.impl
@@ -569,7 +572,8 @@
            metabase.driver.sql.util
            metabase.driver.sync
            metabase.driver.util}
-   :uses #{app-db
+   :uses #{analytics
+           app-db
            appearance
            auth-provider
            classloader
@@ -672,6 +676,13 @@
            types
            util}}
 
+  frontend-errors
+  {:team "UX West"
+   :api  #{metabase.frontend-errors.api}
+   :uses #{analytics
+           api
+           util}}
+
   geojson
   {:team "UX West"
    :api  #{metabase.geojson.api
@@ -690,7 +701,7 @@
            util}}
 
   graph
-  {:team "Querying"
+  {:team "Graphy"
    :api  #{metabase.graph.core}
    :uses #{util}}
 
@@ -732,8 +743,7 @@
 
   lib
   {:team "Querying"
-   :api  #{metabase.lib.binning
-           metabase.lib.convert  ; Only so [[metabase.queries.models.card]] can set dynamic vars.
+   :api  #{metabase.lib.convert  ; Only so [[metabase.queries.models.card]] can set dynamic vars.
            metabase.lib.core
            metabase.lib.equality
            metabase.lib.field
@@ -742,7 +752,6 @@
            metabase.lib.init
            metabase.lib.metadata
            metabase.lib.metadata.cached-provider
-           metabase.lib.metadata.column
            metabase.lib.metadata.invocation-tracker
            metabase.lib.metadata.protocols
            metabase.lib.metadata.result-metadata
@@ -758,6 +767,7 @@
            metabase.lib.schema.expression
            metabase.lib.schema.expression.temporal
            metabase.lib.schema.expression.window
+           metabase.lib.schema.filter
            metabase.lib.schema.id
            metabase.lib.schema.info
            metabase.lib.schema.join
@@ -775,7 +785,6 @@
            metabase.lib.schema.test-spec
            metabase.lib.schema.util
            metabase.lib.schema.validate
-           metabase.lib.temporal-bucket
            metabase.lib.types.isa
            metabase.lib.util
            metabase.lib.util.match
@@ -952,6 +961,7 @@
            metabase.parameters.custom-values
            metabase.parameters.dashboard
            metabase.parameters.field
+           metabase.parameters.field-values
            metabase.parameters.init
            metabase.parameters.params
            metabase.parameters.schema
@@ -990,7 +1000,6 @@
   {:team "UX West"
    :api  #{metabase.permissions-rest.api}
    :uses #{api
-           app-db
            audit-app
            events
            permissions
@@ -1026,6 +1035,7 @@
            events
            internal-stats
            settings
+           startup
            task
            util}}
 
@@ -1069,7 +1079,8 @@
            query-processor
            request
            tiles
-           util}}
+           util}
+   :model-imports #{:model/Card :model/Dashboard :model/DashboardCard :model/Document}}
 
   pulse
   {:team "Gadget"
@@ -1181,8 +1192,10 @@
            metabase.query-processor.init
            metabase.query-processor.interface
            metabase.query-processor.metadata
+           metabase.query-processor.middleware.add-remaps
            metabase.query-processor.middleware.annotate
            metabase.query-processor.middleware.cache-backend.db
+           metabase.query-processor.middleware.catch-exceptions
            metabase.query-processor.middleware.constraints
            metabase.query-processor.middleware.limit
            metabase.query-processor.middleware.permissions
@@ -1295,7 +1308,8 @@
            metabase.search.ingestion
            metabase.search.init
            metabase.search.scoring
-           metabase.search.spec}
+           metabase.search.spec
+           metabase.search.task.search-index}
    :uses #{analytics
            api
            app-db
@@ -1316,8 +1330,7 @@
            startup
            task
            transforms
-           util
-           warehouses}}
+           util}}
 
   secrets
   {:team "Querying"
@@ -1457,14 +1470,15 @@
            util}}
 
   sync
-  {:team "Querying"
+  {:team "Graphy"
    :api  #{metabase.sync.api
            metabase.sync.core
            metabase.sync.init
            metabase.sync.schedules
            metabase.sync.task.sync-databases
            metabase.sync.util}
-   :uses #{analyze
+   :uses #{analytics
+           analyze
            api
            app-db
            audit-app
@@ -1591,7 +1605,6 @@
               enterprise/transforms-python
               enterprise/workspaces}}
 
-
   types
   {:team "Querying"
    :api  #{metabase.types.core
@@ -1666,6 +1679,7 @@
            request
            settings
            sso
+           system
            tenants
            users
            util
@@ -2070,10 +2084,13 @@
            settings
            util
            warehouse-schema
-           warehouses-rest}}
+           warehouses-rest}
+   :model-exports #{:model/DatabaseRouter}
+   :model-imports #{:model/Database
+                    :model/Transform}}
 
   enterprise/dependencies
-  {:team "Querying"
+  {:team "Graphy"
    :api  #{metabase-enterprise.dependencies.api
            metabase-enterprise.dependencies.core
            metabase-enterprise.dependencies.init}
@@ -2201,6 +2218,7 @@
               lib-be
               models
               native-query-snippets
+              parameters
               permissions
               premium-features
               pulse
@@ -2216,10 +2234,10 @@
               transforms
               users-rest
               util
-              warehouse-schema
               warehouses-rest
               enterprise/dependencies
-              enterprise/transforms-python}}
+              enterprise/transforms-python}
+   :model-imports #{:model/Card :model/Transform}}
 
   enterprise/permission-debug
   {:team "UX West"
@@ -2253,7 +2271,8 @@
            task
            task-history
            util
-           enterprise/serialization}}
+           enterprise/serialization
+           enterprise/transforms-python}}
 
   enterprise/sandbox
   {:team "UX West"
@@ -2301,6 +2320,28 @@
    :uses #{premium-features
            search}}
 
+  enterprise/security-center
+  {:team "Gadget"
+   :api  #{metabase-enterprise.security-center.api
+           metabase-enterprise.security-center.init}
+   :uses #{analytics
+           api
+           app-db
+           channel
+           config
+           driver
+           events
+           models
+           notification
+           permissions
+           premium-features
+           settings
+           system
+           task
+           util}
+   :model-exports #{:model/SecurityAdvisory}
+   :model-imports #{:model/User}}
+
   enterprise/semantic-search
   {:team "Metabot"
    :api  #{metabase-enterprise.semantic-search.api
@@ -2340,6 +2381,7 @@
            plugins
            premium-features
            search
+           server
            setup
            util}}
 
@@ -2417,11 +2459,12 @@
   enterprise/transforms
   {:team "Querying"
    :api  #{}
-   :uses #{}}
+   :uses #{premium-features}}
 
   enterprise/transforms-python
   {:team "Querying"
    :api  #{metabase-enterprise.transforms-python.api
+           metabase-enterprise.transforms-python.core
            metabase-enterprise.transforms-python.init
            metabase-enterprise.transforms-python.python-runner}
    :uses #{analytics
@@ -2469,7 +2512,12 @@
            system
            transforms
            util
-           enterprise/transforms-python}}}
+           enterprise/transforms-python}}
+
+  enterprise/writable-connection
+  {:team "Querying"
+   :api  #{}
+   :uses #{premium-features}}}
 
  ;; namespaces matching these patterns (with `re-find`) are excluded from the module linter. Since regex literals
  ;; aren't allowed in EDN just used the `(str <regex>)` version i.e. two slashes instead of one.

.clj-kondo/config/test-helpers/config.edn

@@ -3,7 +3,7 @@
   ;; TODO -- seems silly to maintain different blacklists and whitelists here than we use for the deftest `^:parallel`
   ;; checker...
   {:explicitly-safe
-   #{ ;; these toucan methods might actually set global values if it's used outside of a transaction,
+   #{;; these toucan methods might actually set global values if it's used outside of a transaction,
      ;; but since mt/with-temp runs in a transaction, so we'll ignore them in this case.
      toucan2.core/delete!
      toucan2.core/update!
@@ -110,6 +110,7 @@
      metabase.settings.models.setting-test/test-user-local-allowed-setting!
      metabase.settings.models.setting-test/test-user-local-only-setting!
      metabase.settings.models.setting.cache/restore-cache!
+     metabase.settings.models.setting/log-deprecated-env-var-usage!
      metabase.settings.models.setting/set!
      metabase.settings.models.setting/validate-settings-formatting!
      metabase.setup.core/create-token!

.clj-kondo/src/hooks/metabase/settings/models/setting.clj

@@ -55,7 +55,6 @@
      help-link-custom-destination
      instance-creation
      is-hosted?
-     is-metabot-enabled
      jdbc-data-warehouse-max-connection-pool-size
      jdbc-data-warehouse-unreturned-connection-timeout-seconds
      jwt-attribute-email

.cljfmt.edn

@@ -120,7 +120,10 @@
   metabase.dashboards.models.dashboard-test/with-dash-in-collection                           [[:inner 0]]
   metabase.driver-api.core/match                                                              [[:inner 0]]
   metabase.driver-api.core/match-one                                                          [[:inner 0]]
+  metabase.driver-api.core/match-lite                                                         [[:inner 0]]
+  metabase.driver-api.core/match-many                                                         [[:inner 0]]
   metabase.driver-api.core/replace                                                            [[:inner 0]]
+  metabase.driver-api.core/replace-lite                                                       [[:inner 0]]
   metabase.driver-api.core/replace-in                                                         [[:inner 0]]
   metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                       [[:default]]
   metabase.driver.druid.client/DELETE                                                         [[:default]]
@@ -156,7 +159,9 @@
   metabase.lib.util.match/match                                                               [[:inner 0]]
   metabase.lib.util.match/match-one                                                           [[:inner 0]]
   metabase.lib.util.match/match-lite                                                          [[:inner 0]]
+  metabase.lib.util.match/match-many                                                          [[:inner 0]]
   metabase.lib.util.match/replace                                                             [[:inner 0]]
+  metabase.lib.util.match/replace-lite                                                        [[:inner 0]]
   metabase.lib.util.match/replace-in                                                          [[:inner 0]]
   metabase.models.interface/define-batched-hydration-method                                   [[:inner 0]]
   metabase.models.interface/define-simple-hydration-method                                    [[:inner 0]]

.github/CODEOWNERS

@@ -1,266 +1,31 @@
 # Before changing this file, make sure you have read how we use it:
 # https://www.notion.so/metabase/Pull-Request-Code-Review-Guide-374f05df889748b69d67af753f9bc9b8?pvs=4#36550c04ceab40b5a8b8bee6264b090c
 
+#  @metabase/core-backend-querying-platform
+src/metabase/lib @metabase/core-backend-querying-platform
+src/metabase/lib_be @metabase/core-backend-querying-platform
+src/metabase/query_processor @metabase/core-backend-querying-platform
+
+# @metabase/graphy
+src/metabase/graph @metabase/graphy
+enterprise/backend/src/metabase_enterprise/dependencies @metabase/graphy
+enterprise/frontend/src/metabase-enterprise/dependencies @metabase/graphy
+
+# @metabase/embedding
 enterprise/frontend/src/embedding-sdk-package @metabase/embedding
 enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
 enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
 frontend/src/metabase/embedding-sdk @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
-frontend/src/metabase/ui @metabase/core-frontend-ux-west
-# snowplow/* @metabase/data
-src/metabase/analytics/prometheus.clj @metabase/cloud-ops
-.github @metabase/devexp
-.clj-kondo @metabase/devexp
-deps.edn @metabase/backend-developers
 
+# @metabase/tech-writers
 docs @metabase/tech-writers
 docs/developers-guide # exclude from tech-writer ownership
 
-#
-# Backend modules <=> teams that own them
-#
+# @metabase/devexp
+.github @metabase/devexp
+.clj-kondo @metabase/devexp
 
-# modules/drivers @metabase/drivers
-src/metabase/driver/sql_jdbc/actions.clj       @metabase/core-ux-east
-test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/api @metabase/devexp
-# enterprise/backend/test/metabase_enterprise/api @metabase/devexp
-
-# enterprise/backend/src/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/billing @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/billing @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/cache @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/cache @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/core @metabase/devexp
-# enterprise/backend/test/metabase_enterprise/core @metabase/devexp
-
-# enterprise/backend/src/metabase_enterprise/dashboard_subscription_filters @metabase/core-ux-east
-# enterprise/backend/test/metabase_enterprise/dashboard_subscription_filters @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
-
-# # enterprise/backend/src/metabase_enterprise/llm
-# # enterprise/backend/test/metabase_enterprise/llm
-
-# enterprise/backend/src/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/scim @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/scim @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/search ...
-# enterprise/backend/test/metabase_enterprise/search ...
-
-# enterprise/backend/src/metabase_enterprise/serialization @metabase/core-ux-east
-# enterprise/backend/test/metabase_enterprise/serialization @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/sso @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/sso @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/stale @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/stale @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/stats @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/stats @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/task @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/task @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
-
-src/metabase/actions @metabase/core-ux-east
-test/metabase/actions @metabase/core-ux-east
-
-# src/metabase/activity_feed @metabase/core-backend-admin-webapp
-# test/metabase/activity_feed @metabase/core-backend-admin-webapp
-
-# src/metabase/analytics @metabase/core-backend-admin-webapp
-# test/metabase/analytics @metabase/core-backend-admin-webapp
-
-# src/metabase/analyze @metabase/drivers
-# test/metabase/analyze @metabase/drivers
-
-# src/metabase/api @metabase/devexp
-# test/metabase/api @metabase/devexp
-
-# src/metabase/audit @metabase/core-backend-admin-webapp
-# test/metabase/audit @metabase/core-backend-admin-webapp
-
-# src/metabase/auth_provider @metabase/core-backend-admin-webapp
-# test/metabase/auth_provider @metabase/core-backend-admin-webapp
-
-# src/metabase/bookmarks @metabase/core-backend-admin-webapp
-# test/metabase/bookmarks @metabase/core-backend-admin-webapp
-
-# src/metabase/cmd @metabase/devexp
-# test/metabase/cmd @metabase/devexp
-
-# src/metabase/channel @metabase/core-ux-east
-# test/metabase/channel @metabase/core-ux-east
-
-# src/metabase/cloud_migration ...
-# test/metabase/cloud_migration ...
-
-# src/metabase/cmd @metabase/devexp
-# test/metabase/cmd @metabase/devexp
-
-# src/metabase/config @metabase/devexp
-# test/metabase/config @metabase/devexp
-
-# src/metabase/core @metabase/devexp
-# test/metabase/core @metabase/devexp
-
-# src/metabase/db @metabase/core-backend-admin-webapp
-# test/metabase/db @metabase/core-backend-admin-webapp
-
-# src/metabase/driver @metabase/drivers
-# test/metabase/driver @metabase/drivers
-
-# src/metabase/eid_translation @metabase/core-backend-admin-webapp
-# test/metabase/eid_translation @metabase/core-backend-admin-webapp
-
-# src/metabase/embed @metabase/embedding
-# test/metabase/embed @metabase/embedding
-
-# src/metabase/events @metabase/devexp
-# test/metabase/events @metabase/devexp
-
-# src/metabase/formatter @metabase/core-backend-querying
-# test/metabase/formatter @metabase/core-backend-querying
-
-# src/metabase/indexed_entities @metabase/core-backend-querying
-# test/metabase/indexed_entities @metabase/core-backend-querying
-
-# src/metabase/integrations ...
-# test/metabase/integrations ...
-
-# src/metabase/legacy_mbql @metabase/core-backend-querying
-# test/metabase/legacy_mbql @metabase/core-backend-querying
-
-# src/metabase/lib @metabase/core-backend-querying
-# test/metabase/lib @metabase/core-backend-querying
-
-# src/metabase/logger @metabase/devexp
-# test/metabase/logger @metabase/devexp
-
-# src/metabase/login_history @metabase/core-backend-admin-webapp
-# test/metabase/login_history @metabase/core-backend-admin-webapp
-
-# src/metabase/model_persistence @metabase/core-backend-querying
-# test/metabase/model_persistence @metabase/core-backend-querying
-
-# src/metabase/models @metabase/devexp
-# test/metabase/models @metabase/devexp
-
-# src/metabase/moderation @metabase/core-backend-admin-webapp
-# test/metabase/moderation @metabase/core-backend-admin-webapp
-
-# src/metabase/notification @metabase/core-ux-east
-# test/metabase/notification @metabase/core-ux-east
-
-# src/metabase/permissions @metabase/core-backend-admin-webapp
-# test/metabase/permissions @metabase/core-backend-admin-webapp
-
-# src/metabase/plugins @metabase/devexp
-# test/metabase/plugins @metabase/devexp
-
-# src/metabase/premium_features @metabase/core-backend-admin-webapp
-# test/metabase/premium_features @metabase/core-backend-admin-webapp
-
-# src/metabase/public_settings @metabase/core-backend-admin-webapp
-# test/metabase/public_settings @metabase/core-backend-admin-webapp
-
-# src/metabase/public_sharing @metabase/core-backend-admin-webapp
-# test/metabase/public_sharing @metabase/core-backend-admin-webapp
-
-# src/metabase/pulse @metabase/core-ux-east
-# test/metabase/pulse @metabase/core-ux-east
-
-# src/metabase/query_analysis @metabase/core-backend-querying
-# test/metabase/query_analysis @metabase/core-backend-querying
-
-# src/metabase/query_processor @metabase/core-backend-querying
-# test/metabase/query_processor @metabase/core-backend-querying
-
-# src/metabase/request @metabase/devexp
-# test/metabase/request @metabase/devexp
-
-# src/metabase/revisions @metabase/core-backend-admin-webapp
-# test/metabase/revisions @metabase/core-backend-admin-webapp
-
-# src/metabase/sample_data @metabase/core-backend-admin-webapp
-# test/metabase/sample_data @metabase/core-backend-admin-webapp
-
-# src/metabase/search ...
-# test/metabase/search ...
-
-# src/metabase/segments @metabase/core-backend-querying
-# test/metabase/segments @metabase/core-backend-querying
-
-# src/metabase/server @metabase/devexp
-# test/metabase/server @metabase/devexp
-
-# src/metabase/session @metabase/core-backend-admin-webapp
-# test/metabase/session @metabase/core-backend-admin-webapp
-
-# src/metabase/setup @metabase/core-backend-admin-webapp
-# test/metabase/setup @metabase/core-backend-admin-webapp
-
-# src/metabase/sso @metabase/core-backend-admin-webapp
-# test/metabase/sso @metabase/core-backend-admin-webapp
-
-# src/metabase/sync @metabase/drivers
-# test/metabase/sync @metabase/drivers
-
-# src/metabase/task @metabase/devexp
-# test/metabase/task @metabase/devexp
-
-# src/metabase/tiles @metabase/core-backend-dashviz
-# test/metabase/tiles @metabase/core-backend-dashviz
-
-# src/metabase/timeline @metabase/core-backend-dashviz
-# test/metabase/timeline @metabase/core-backend-dashviz
-
-# src/metabase/types @metabase/core-backend-querying
-# test/metabase/types @metabase/core-backend-querying
-
-# src/metabase/upload @metabase/core-backend-admin-webapp
-# test/metabase/upload @metabase/core-backend-admin-webapp
-
-# src/metabase/user_key_value @metabase/core-backend-admin-webapp
-# test/metabase/user_key_value @metabase/core-backend-admin-webapp
-
-# src/metabase/util @metabase/devexp
-# test/metabase/util @metabase/devexp
-
-# src/metabase/xrays @metabase/core-backend-querying
-# test/metabase/xrays @metabase/core-backend-querying
+# @metabase/cloud-ops
+src/metabase/analytics/prometheus.clj @metabase/cloud-ops

.github/actions/fetch-artifact/action.yml

@@ -45,17 +45,31 @@ runs:
           });
 
           if (!artifacts.data?.artifacts?.[0]?.id) {
-            throw new Error(`No artifacts found for ${artifactName}`);
+            core.setFailed(`No artifacts found for ${artifactName}`);
+            return;
           }
 
           const artifact_id = artifacts.data.artifacts[0].id;
 
-          const download = await github.rest.actions.downloadArtifact({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            artifact_id: artifact_id,
-            archive_format: 'zip',
-          });
+          let download;
+          const maxAttempts = 3;
+          for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+              download = await github.rest.actions.downloadArtifact({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                artifact_id: artifact_id,
+                archive_format: 'zip',
+              });
+              break;
+            } catch (err) {
+              console.log(`Attempt ${attempt}/${maxAttempts} failed: ${err.message}`);
+              if (attempt === maxAttempts) throw err;
+              const delay = attempt * 15000; // 15s, 30s
+              console.log(`Retrying in ${delay / 1000}s...`);
+              await new Promise(r => setTimeout(r, delay));
+            }
+          }
 
           fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
 

.github/actions/get-cache-keys/action.yml

@@ -7,9 +7,15 @@ outputs:
   m2-cache-key:
     description: "The cache key for the Maven cache."
     value: ${{ steps.keys-factory.outputs.m2-cache-key }}
+  m2-restore-key:
+    description: "The fallback restore key prefix for the Maven cache."
+    value: ${{ steps.keys-factory.outputs.m2-restore-key }}
   node-cache-key:
     description: "The cache key for the Node.js cache."
     value: ${{ steps.keys-factory.outputs.node-cache-key }}
+  node-restore-key:
+    description: "The fallback restore key prefix for the Node.js cache."
+    value: ${{ steps.keys-factory.outputs.node-restore-key }}
   eslint-cache-key:
     description: "The cache key for Eslint cache"
     value: ${{ steps.keys-factory.outputs.eslint-cache-key }}
@@ -31,7 +37,9 @@ runs:
         CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
 
         echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> $GITHUB_OUTPUT
         echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> $GITHUB_OUTPUT
         echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
         echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
       shell: bash

.github/actions/prepare-backend/action.yml

@@ -20,10 +20,18 @@ runs:
         distribution: 'temurin'
     - name: Install Clojure CLI
       shell: bash
-      continue-on-error: true
       run: |
-        curl -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh &&
-        sudo bash ./linux-install-${{ inputs.clojure-version }}.sh
+        for attempt in 1 2 3; do
+          curl --retry 3 --retry-delay 5 --fail -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh \
+            && sudo bash ./linux-install-${{ inputs.clojure-version }}.sh \
+            && break
+          echo "::warning::Clojure install attempt $attempt failed, retrying in 10s..."
+          sleep 10
+        done
+        if ! clojure --version; then
+          echo "::error::Clojure CLI installation failed after 3 attempts"
+          exit 1
+        fi
 
     - name: Get M2 cache key
       uses: ./.github/actions/get-cache-keys
@@ -36,3 +44,5 @@ runs:
           ~/.m2
           ~/.gitlibs
         key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.m2-restore-key }}

.github/actions/prepare-cypress/action.yml

@@ -15,11 +15,10 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Install Chrome v111
+    - name: Install Chrome v144
       uses: browser-actions/setup-chrome@v2
       with:
-        # https://chromium.cypress.io/linux/stable/111.0.5563.146
-        chrome-version: 1097615
+        chrome-version: 144
       id: setup-chrome
 
     - name: Get cache keys

.github/actions/prepare-frontend/action.yml

@@ -11,16 +11,10 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Prepare Node.js
-      uses: actions/setup-node@v4
+    - name: Prepare Node + Bun environment
+      uses: ./.github/actions/prepare-node-bun
       with:
-        node-version: ${{ inputs.node-version }} # this overrides, if present
-        node-version-file: ".nvmrc"
-
-    - name: Install bun
-      uses: oven-sh/setup-bun@v2
-      with:
-        bun-version: latest
+        node-version: ${{ inputs.node-version }}
 
     - name: Get cache keys
       uses: ./.github/actions/get-cache-keys
@@ -33,6 +27,8 @@ runs:
           ~/.m2
           ~/.gitlibs
         key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.m2-restore-key }}
 
     - name: Get bun cache directory
       id: bun-cache
@@ -50,6 +46,8 @@ runs:
           ${{ steps.bun-cache.outputs.dir }}
           node_modules
         key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.node-restore-key }}
 
     # postinstall lifecycle hook can be dangerous in CI so we only run it locally (see package.json)
     # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.

.github/actions/prepare-node-bun/action.yml

@@ -0,0 +1,20 @@
+name: Prepare Node + Bun environment
+description: "Set up Node.js and Bun for CI jobs"
+inputs:
+  node-version:
+    description: "The version of Node.js to use, overriding .nvmrc"
+    required: false
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        node-version-file: ".nvmrc"
+
+    - name: Install bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: "1.3.7"
+        token: ${{ github.token }}

.github/actions/prepare-release-scripts/action.yml

@@ -6,7 +6,8 @@ runs:
   steps:
     - uses: oven-sh/setup-bun@v2
       with:
-        bun-version: latest
+        bun-version: "1.3.7"
+        token: ${{ github.token }}
 
     - name: Build release scripts
       shell: bash

.github/actions/test-driver/action.yml

@@ -17,6 +17,11 @@ inputs:
     default: 'ee'
     description: Edition to test (oss or ee)
 
+outputs:
+  test-outcome:
+    description: "The outcome of the test run (success, failure, cancelled, skipped)"
+    value: ${{ steps.run-test.outcome }}
+
 runs:
   using: "composite"
   steps:

.github/actions/upload-test-results/action.yml

@@ -21,6 +21,8 @@ inputs:
   variant:
     required: false
     default: ""
+  previous-step-outcome:
+    required: true
 
 runs:
   using: "composite"
@@ -48,12 +50,18 @@ runs:
         aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
 
     - name: Upload results to Trunk
-      if: always() # Important! This step must always run because it controls job's exit code.
+      # Important!
+      # 1. This step must always run because it controls job's exit code.
+      # 2. There's no point in running this outside the organization
+      if: always() && github.repository_owner == 'metabase'
       uses: trunk-io/analytics-uploader@main
+      env:
+        TRUNK_REPO_URL: git@github.com:metabase/metabase.git
       with:
         junit-paths: ${{ inputs.input-path }}
         variant: ${{ inputs.variant || inputs.output-name }}
         org-slug: metabase
-        dry-run: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == true }} # quarantine, but do not upload results
+        dry-run: ${{ (github.event_name == 'pull_request' && github.event.pull_request.draft == true) || github.repository != 'metabase/metabase' }} # quarantine, but do not upload results
         token: ${{ inputs.trunk-api-token }}
         use-cache: true
+        previous-step-outcome: ${{ inputs.previous-step-outcome }}

.github/copilot-instructions.md

@@ -1,52 +1,55 @@
 # Metabase Developer Assistant Instructions
 
-## Frontend Development
+For detailed coding standards and conventions, see `CLAUDE.md` and the skills in `.claude/skills/`.
 
-### Repository Structure
+## Code Review Standards
 
-```
-frontend/src/
-├── metabase/           # Main application components and pages
-├── metabase-lib/       # Query building and data modeling utilities
-├── metabase-types/     # TypeScript type definitions
-└── metabase/ui/        # Design system components
+Review focus areas: Security → Performance → Testing → Documentation (in priority order)
 
-e2e/                    # Cypress end-to-end tests
-frontend/test/          # Jest unit tests
-```
+When reviewing code, use these emoji prefixes to categorize feedback:
+- 🔒 Security concerns
+- ⚡ Performance opportunities
+- 🧹 Cleanup needs
+- 📚 Documentation gaps
+- 🚨 Blocking issues
+- 💭 Clarification questions
 
-### Technology Stack
+### Security Critical Issues
 
-- **Framework**: React 18 with TypeScript
-- **State**: Redux Toolkit
-- **Styling**: CSS Modules (preferred) > Emotion styled-components
-- **UI**: `metabase/ui` components built with Mantine v8
-- **Build**: Rspack (primary), Webpack (legacy)
-- **Testing**: Jest + React Testing Library, Cypress
+- Check for hardcoded secrets, API keys, or credentials
+- Look for SQL injection and XSS vulnerabilities
+- Verify proper input validation and sanitization
+- Review authentication and authorization logic
+- Ensure enterprise features use the plugin system (no enterprise code in OSS)
 
-### Coding Standards
+### Performance Red Flags
 
-#### Component Preferences
+- Identify N+1 database query problems
+- Spot inefficient loops and algorithmic issues
+- Check for memory leaks and resource cleanup
+- Review caching opportunities for expensive operations
 
-- Prefer `metabase/ui`components over `metabase/common/components`
-- Use `.tsx` for components, `.ts` for utilities
+### Code Quality Essentials
 
-#### Styling
+- Functions should be focused and appropriately sized
+- Use clear, descriptive naming conventions
+- Ensure proper error handling throughout
+- Remove dead code and unused imports
 
-ALWAYS prefer Mantine style props,then CSS modules. DO NOT suggest styled components, they are deprecated.
+### Review Style
 
-#### TypeScript Migration
+- Only flag actual issues worth mentioning
+- Do not post "looks good" comments or congratulate following conventions
+- Be specific and actionable in feedback
+- Explain the "why" behind recommendations
+- Ask clarifying questions when code intent is unclear
 
-When heavily editing `.js`/`.jsx` files, create a separate PR to convert to TypeScript first, then implement changes.
+### Review Format
 
-#### Enterprise Features
+- Condense feedback into as few comments as possible
+- Prefer a single summary comment over dozens of inline comments
+- Only use inline comments for critical issues that require immediate attention
+- For non-critical issues, link to the specific line from the summary instead
+- Delete all stale comments and summaries on each new push or CI run
 
-Enterprise functionality MUST use the plugin system. It is very important to not expose enterprise code in the OSS version.
-
-#### Testing Requirements
-
-All PRs should include tests. Prefer Unit tests over E2E tests.
-
-#### Localization
-
-All user-facing strings MUST be localized using the ttag library. Localized strings should be complete phrases, do not concatenate a few separately localized strings. You should add context to strings where the meaning of the string might not be obvious in isolation: e.g. "Home" might have different words in some languages depending on whether you're talking about a dwelling or the landing page for a website.
+Language-specific rules are in `.github/instructions/*.instructions.md`.

.github/file-paths.yaml

@@ -30,7 +30,7 @@ frontend_configs: &frontend_configs
   - "**/tsconfig*.json"
   - "package.json"
   - "babel.config.json"
-  - ".eslintrc.js"
+  - "eslint.config.mjs"
   - "postcss.config.js"
   - "rspack.config.js"
   - "rspack.main.config.js"
@@ -199,3 +199,15 @@ cljs:
   - *shared_specs
   - ".github/workflows/cljs.yml"
   - "shadow-cljs.edn"
+
+openapi:
+  - ".github/workflows/openapi.yml"
+  - "src/metabase/api/**"
+  - "src/metabase/api_routes/**"
+  - "src/metabase/*_rest/api.clj"
+  - "src/metabase/*/api.clj"
+  - "src/metabase/*/api/*.clj"
+  - "enterprise/backend/src/metabase_enterprise/**/api.clj"
+  - "enterprise/backend/src/metabase_enterprise/**/api/*.clj"
+  - "resources/openapi/**"
+  - "package.json"

.github/instructions/clojure.instructions.md

@@ -0,0 +1,9 @@
+---
+applyTo: "**/*.{clj,cljs,cljc}"
+---
+
+# Clojure/ClojureScript Code Review
+
+When reviewing Clojure or ClojureScript code, apply the guidelines in these files:
+- `.claude/skills/_shared/clojure-style-guide.md`
+- `.claude/skills/clojure-review/SKILL.md`

.github/instructions/docs.instructions.md

@@ -0,0 +1,9 @@
+---
+applyTo: "docs/**/*.md"
+---
+
+# Documentation Review
+
+When reviewing documentation, apply the guidelines in these files:
+- `.claude/skills/_shared/metabase-style-guide.md`
+- `.claude/skills/docs-review/SKILL.md`

.github/instructions/typescript.instructions.md

@@ -0,0 +1,11 @@
+---
+applyTo: "**/*.{ts,tsx,js,jsx}"
+---
+
+# TypeScript/JavaScript Code Review
+
+When reviewing TypeScript or JavaScript code, apply the guidelines in these files:
+
+- `.claude/skills/typescript-review/SKILL.md`
+- `docs/developers-guide/frontend.md`
+- `frontend/CLAUDE.md`

.github/scripts/build-e2e-matrix.unit.spec.js

@@ -3,7 +3,7 @@ const { buildMatrix } = require("./build-e2e-matrix");
 describe("buildMatrix", () => {
   const options = {
     java: "11",
-    defaultRunner: "ubuntu-22.04",
+    defaultRunner: "${{ vars.DEFAULT_RUNNER_KEY }}",
   };
   const testBuildMatrix = (entry, chunks) =>
     buildMatrix(options, entry, chunks);

.github/team.json

@@ -4,14 +4,23 @@
       "name": "Querying",
       "label": ".Team/Querying",
       "members": [
-        "ranquild",
-        "romeovs",
         "bshepherdson",
         "metamben",
-        "wzimrin",
+        "rileythomp",
+        "camsual"
+      ]
+    },
+    {
+      "name": "Graphy",
+      "label": ".Team/Graphy",
+      "members": [
+        "ranquild",
+        "romeovs",
         "ericnormand",
         "galdre",
-        "rileythomp"
+        "dpsutton",
+        "escherize",
+        "bgrabow"
       ]
     },
     {
@@ -36,9 +45,6 @@
       "name": "DevEx",
       "label": ".Team/DevEx",
       "members": [
-        "camsaul",
-        "dpsutton",
-        "escherize",
         "fraserdrops",
         "nemanjaglumac"
       ]

.github/workflows/app-db.yml

@@ -14,20 +14,20 @@ concurrency:
 jobs:
   be-tests-mariadb:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
           - name: MariaDB 10.2
             junit-name: be-tests-mariadb-10-2-ee
-            image: circleci/mariadb:10.2.23
+            image: metabase/mariadb:10.2.23
             env:
               enable-ssl-tests: 'false'
           - name: MariaDB Latest
             junit-name: be-tests-mariadb-latest-ee
-            image: circleci/mariadb:latest
+            image: mariadb:latest
             env:
               enable-ssl-tests: 'false'
         job:
@@ -57,8 +57,13 @@ jobs:
         ports:
           - "3306:3306"
         env:
+          # MYSQL_* isn't supported on :latest aka 12.2.2
+          # MARIADB_* isn't supported on 10.2.23
+          # Send both until we upgrade to 10.6+ then remove MYSQL_*
           MYSQL_ALLOW_EMPTY_PASSWORD: true
-          MYSQL_DATABASE: circle_test
+          MYSQL_DATABASE: mb_test
+          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
+          MARIADB_DATABASE: mb_test
     env:
       # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
       # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
@@ -81,7 +86,7 @@ jobs:
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
       MB_MYSQL_TEST_USER: root
       #
@@ -105,6 +110,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -123,18 +129,19 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mysql:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
           - name: MySQL 8.0
             junit-name: be-tests-mysql-8-0-ee
-            image: cimg/mysql:8.0
+            image: mysql:8.0
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -172,7 +179,7 @@ jobs:
           - "3306:3306"
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
-          MYSQL_DATABASE: circle_test
+          MYSQL_DATABASE: mb_test
     env:
       # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
       # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
@@ -195,7 +202,7 @@ jobs:
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
       MB_MYSQL_TEST_USER: root
       #
@@ -227,6 +234,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -245,11 +253,12 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-postgres:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -336,6 +345,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -354,13 +364,14 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   app-db-tests-result:
     needs:
       - be-tests-mariadb
       - be-tests-mysql
       - be-tests-postgres
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: app-db-tests-result
     if: always() && !cancelled()

.github/workflows/athena.yml

@@ -11,7 +11,7 @@ on:
 jobs:
   deploy:
     name: Publish Athena JDBC Driver
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - name: Check out the code

.github/workflows/auto-assign.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   update_pr:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
 
     steps:
       - uses: tibdex/github-app-token@v2.1.0

.github/workflows/auto-backport.yml

@@ -20,7 +20,7 @@ jobs:
           github.event.label.name == 'triple-backport'
         )
       )
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/backend-cloverage.yml

@@ -16,7 +16,7 @@ on:
 
 jobs:
   setup-oss:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     outputs:
       modules: ${{ steps.get-modules.outputs.modules }}
     steps:
@@ -30,7 +30,7 @@ jobs:
     needs: setup-oss
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -63,7 +63,7 @@ jobs:
           flags: back-end
 
   setup-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     outputs:
       modules: ${{ steps.get-modules.outputs.modules }}
     steps:
@@ -77,7 +77,7 @@ jobs:
     needs: setup-ee
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
       fail-fast: false

.github/workflows/backend.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   be-linter-clj-kondo:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     name: Clj-Kondo
     steps:
@@ -26,7 +26,7 @@ jobs:
 
   be-linter-eastwood:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     name: Eastwood
     steps:
@@ -36,10 +36,22 @@ jobs:
       - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
         name: Run Eastwood linter
 
+  be-linter-eastwood-test:
+    if: ${{ !inputs.skip }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 30
+    name: Eastwood (test)
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood/test
+        name: Run Eastwood linter on tests
+
   be-tests:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -130,6 +142,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-java-tests.outcome }}
 
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@v1
@@ -154,7 +167,7 @@ jobs:
   # as `:dev` dependencies). See #27009 for more context.
   be-check:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     strategy:
       matrix:
@@ -170,7 +183,7 @@ jobs:
 
   be-cljfmt:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     name: Cljfmt
     steps:
@@ -183,12 +196,13 @@ jobs:
   be-tests-result:
     needs:
       - be-linter-eastwood
+      - be-linter-eastwood-test
       - be-linter-clj-kondo
       - be-cljfmt
       - be-check
       - be-tests
     if: always() && !cancelled()
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       needs: ${{ toJson(needs) }}

.github/workflows/backport-reminder.yml

@@ -10,7 +10,7 @@ on:
 jobs:
   backport-reminder:
     name: Decide whether to backport or not
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: jesusvasquez333/verify-pr-label-action@v1.4.0

.github/workflows/block-master-source-branch-prs.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   check-source-branch:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Block master branch PRs
         if: github.head_ref == 'master'

.github/workflows/build-for-release.yml

@@ -14,7 +14,7 @@ on:
 
 jobs:
   start-message:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -45,7 +45,7 @@ jobs:
             }).catch(console.error);
 
   trigger-milestone-check:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     needs: start-message
     steps:
@@ -66,7 +66,7 @@ jobs:
 
 
   check-version:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     outputs:
       ee: ${{ fromJson(steps.canonical_version.outputs.result).ee }}
@@ -118,7 +118,7 @@ jobs:
           return versions;
 
   check-commit:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
     - name: Check out the code to verify the release branch
@@ -150,7 +150,7 @@ jobs:
         git checkout -
 
   get-build-requirements:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     outputs:
       java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
@@ -185,7 +185,7 @@ jobs:
 
   build-uberjar-for-release:
     needs: [check-version, check-commit, get-build-requirements]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 50
     strategy:
       matrix:

.github/workflows/build-scripts.yml

@@ -10,7 +10,7 @@ on:
 jobs:
 
   test-build-scripts:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
     - uses: actions/checkout@v4
     - name: Prepare back-end environment

.github/workflows/cache-generator.yml

@@ -39,7 +39,7 @@ concurrency:
 
 jobs:
   get-cache-keys:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - uses: actions/checkout@v4
       - name: Get cache keys
@@ -52,7 +52,7 @@ jobs:
       cypress-cache-key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
 
   generate-caches:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     needs: get-cache-keys
     env:

.github/workflows/check-backport-script.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   check-backport-script:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

.github/workflows/check-milestone.yml

@@ -15,7 +15,7 @@ on:
 jobs:
   set-milestone:
     name: Automatically set milestone
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     env:
       isNewReleaseBranch: ${{ github.event_name == 'workflow_dispatch' }}

.github/workflows/chromatic.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_all: ${{ steps.changes.outputs.frontend_all }}
@@ -30,7 +30,7 @@ jobs:
   fe-chromatic:
     needs: files-changed
     if: contains(github.event.pull_request.labels.*.name, 'chromatic') || (github.ref_name == 'master' && needs.files-changed.outputs.frontend_all == 'true')
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4

.github/workflows/claude-code-bug-fix.yml

@@ -1,360 +0,0 @@
-name: "Claude Code Bug Fix"
-
-on:
-  issues:
-    types:
-      - labeled
-  pull_request_review:
-    types:
-      - submitted
-  workflow_dispatch:
-    inputs:
-      issue_number:
-        description: "Issue number to fix"
-        required: true
-        type: string
-      override_employee_check:
-        description: "Override employee check for issue creator"
-        required: false
-        default: false
-        type: boolean
-
-jobs:
-  auto-fix-bug:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-      id-token: write
-    if: |
-      (github.event_name == 'issues' && github.event.label.name == 'Claude Bug Fix' && github.event.issue.state == 'open') ||
-      (github.event_name == 'workflow_dispatch') ||
-      (github.event_name == 'pull_request_review' && github.event.review.state == 'changes_requested' && startsWith(github.event.pull_request.head.ref, 'claude-fix/'))
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Get issue data and check employee status
-        id: get_issue
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { getIssueData } = require('${{ github.workspace }}/.github/scripts/get-issue-data.js');
-
-            try {
-              const result = await getIssueData({
-                context,
-                github,
-                manualIssueNumber: '${{ github.event.inputs.issue_number }}'
-              });
-
-              const { issueNumber, issueData, employeeComments, prReviews, triggerType, isIssueAuthorEmployee } = result;
-
-              // Check employee status and fail if not authorized
-              if (!result.isIssueAuthorEmployee && '${{ github.event.inputs.override_employee_check }}' !== 'true') {
-                  core.setFailed(`User ${result.issueData.user.login} is not a Metabase employee. Skipping bug fix automation.`);
-              }
-
-              core.setOutput('issue_number', issueNumber);
-              core.setOutput('issue_data', JSON.stringify(issueData));
-              core.setOutput('issue_comments', JSON.stringify(employeeComments));
-              core.setOutput('pr_reviews', JSON.stringify(prReviews));
-              core.setOutput('trigger_type', triggerType);
-            } catch (error) {
-              core.setFailed(error.message);
-            }
-
-      - name: Find linked Linear issue
-        id: find_linear
-        continue-on-error: true
-        uses: actions/github-script@v7
-        env:
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
-          ISSUE_NUMBER: ${{ steps.get_issue.outputs.issue_number }}
-        with:
-          script: |
-            const { findLinearIssue } = require('${{ github.workspace }}/.github/scripts/find-linear-issue.js');
-
-            const githubIssueUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/issues/${process.env.ISSUE_NUMBER}`;
-
-            const result = await findLinearIssue({
-              githubIssueUrl,
-              linearApiKey: process.env.LINEAR_API_KEY
-            });
-
-            if (result.success) {
-              console.log(`Found Linear issue: ${result.issue}`);
-              core.setOutput('linear_issue', result.issue);
-            } else {
-              console.log(`Could not find Linear issue: ${result.message}`);
-            }
-
-      - name: Set up git configuration
-        run: |
-          git config --global user.name "Claude Code[bot]"
-          git config --global user.email "noreply@anthropic.com"
-
-      - name: Prepare issue context and bug fix prompt
-        id: prepare_prompt
-        uses: actions/github-script@v7
-        env:
-          ISSUE_DATA: ${{ steps.get_issue.outputs.issue_data }}
-          ISSUE_COMMENTS: ${{ steps.get_issue.outputs.issue_comments }}
-          PR_REVIEWS: ${{ steps.get_issue.outputs.pr_reviews }}
-          TRIGGER_TYPE: ${{ steps.get_issue.outputs.trigger_type }}
-        with:
-          script: |
-            const issueData = JSON.parse(process.env.ISSUE_DATA);
-            const issueComments = JSON.parse(process.env.ISSUE_COMMENTS);
-            const prReviews = JSON.parse(process.env.PR_REVIEWS);
-            const triggerType = process.env.TRIGGER_TYPE;
-            const issueNumber = '${{ steps.get_issue.outputs.issue_number }}';
-
-            // Convert issue title to kebab case and create branch name
-            const issueTitle = issueData.title || 'untitled';
-            const kebabTitle = issueTitle
-              .toLowerCase()
-              .replace(/[^a-z0-9]+/g, '-')
-              .replace(/^-+|-+$/g, '')
-              .replace(/-+/g, '-')
-              .substring(0, 50);
-            const branchName = `claude-fix/issue-${issueNumber}-${kebabTitle}`;
-
-            // Format data for bash environment
-            const formattedComments = issueComments.length > 0
-              ? issueComments.map(comment =>
-                  `**Comment by @${comment.user.login} on ${comment.created_at}:**\n${comment.body}`
-                ).join('\n\n---\n\n')
-              : '';
-            const formattedReviews = prReviews.length > 0
-              ? prReviews.map(review =>
-                  `**Review by @${review.user.login} on ${review.submitted_at} (Changes Requested):**\n${review.body || 'No review comment provided'}`
-                ).join('\n\n---\n\n')
-              : '';
-
-            core.exportVariable('BRANCH_NAME', branchName);
-            core.exportVariable('ISSUE_NUMBER', issueNumber);
-            core.exportVariable('ISSUE_TITLE', issueData.title);
-            core.exportVariable('ISSUE_AUTHOR', issueData.user.login);
-            core.exportVariable('ISSUE_CREATED', issueData.created_at);
-            core.exportVariable('ISSUE_BODY', issueData.body || 'No description provided');
-            core.exportVariable('ISSUE_COMMENTS_FORMATTED', formattedComments);
-            core.exportVariable('PR_REVIEWS_FORMATTED', formattedReviews);
-            core.exportVariable('TRIGGER_TYPE', triggerType);
-
-      - name: Generate bug fix prompt
-        run: |
-          cat << 'EOF' >> $GITHUB_ENV
-          BUG_FIX_PROMPT<<PROMPT_END
-          You are helping to fix a bug reported in GitHub issue #${{ env.ISSUE_NUMBER }}.
-
-          ## Bug Report Details
-          **Title:** ${{ env.ISSUE_TITLE }}
-          **Reporter:** ${{ env.ISSUE_AUTHOR }}
-          **Created:** ${{ env.ISSUE_CREATED }}
-
-          **Description:**
-          ${{ env.ISSUE_BODY }}
-
-          **Comments:**
-          ${{ env.ISSUE_COMMENTS_FORMATTED }}
-          EOF
-
-          # Add review feedback section only if this is a review trigger
-          if [ "${{ env.TRIGGER_TYPE }}" = "pull_request_review" ]; then
-            cat << 'EOF' >> $GITHUB_ENV
-
-          ## Previous Fix Attempt - Review Feedback (MUST ADDRESS)
-          Your previous automated fix attempt received the following feedback that needs to be addressed:
-
-          ${{ env.PR_REVIEWS_FORMATTED }}
-          EOF
-          fi
-
-          # Add the rest of the prompt (always the same)
-          cat << 'EOF' >> $GITHUB_ENV
-
-          ## Instructions
-          1. **Analyze the issue description and comments** - Understand what the issue is describing
-             a. Pay particular attention to reproduction steps and if there's an agreed upon fix.
-          2. **Search the codebase** - Use Grep and Glob tools to find relevant files
-          3. **Implement a fix** - Use the appropriate write skill based on the file types:
-             - Use clojure-write for Clojure/ClojureScript files
-             - Use typescript-write for TypeScript/JavaScript files
-             - Follow the coding standards and patterns in each skill
-          4. **Test the fix** - Run appropriate tests as specified in the skills
-          5. **Verify the fix** - Ensure tests pass and code follows conventions
-
-          ## Important Guidelines
-          - Use the appropriate write skill for the language you're working in
-          - Write failing tests first, then fix them
-          - Work in small, testable increments
-          - Don't commit changes - leave that for the workflow
-          - IMPORTANT: Focus only on fixing the reported bug, don't make unrelated changes
-
-          ## Scratchpad Directory
-          A `.claude-scratchpad/` directory has been created for your temporary files:
-          - Use this directory for ALL temporary verification files. However, prefer using production test files rather than adhoc ones.
-          - Only modify actual production code in the main repository directories
-          - The scratchpad will be cleaned up automatically - nothing from it will be committed
-
-          Start by understanding the bug and then systematically work toward a solution.
-          PROMPT_END
-          EOF
-
-      - name: Determine branch strategy
-        run: |
-          BRANCH_NAME="${{ env.BRANCH_NAME }}"
-          if git branch -r --list "origin/${BRANCH_NAME}" | grep -q .; then
-            echo "Branch already exists: $BRANCH_NAME"
-            echo "Will push to existing branch and skip PR creation"
-            echo "BRANCH_EXISTS=true" >> $GITHUB_ENV
-          else
-            echo "Creating new branch: $BRANCH_NAME"
-            echo "Will create new PR"
-            echo "BRANCH_EXISTS=false" >> $GITHUB_ENV
-          fi
-
-          # Export the branch name
-          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
-
-      - name: Create scratchpad directory for Claude
-        run: |
-          # Create a scratchpad directory for Claude to use for temporary files
-          mkdir -p .claude-scratchpad
-          echo "Scratchpad directory created for Claude's temporary verification files"
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-
-      - name: Generate Bug Fix with Claude Code
-        uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          prompt: ${{ env.BUG_FIX_PROMPT }}
-          claude_args: |
-            --allowedTools "Bash(bun run test-unit*),Bash(bun run lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
-            --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"
-
-      - name: Clean up scratchpad directory
-        run: |
-          # Remove the scratchpad directory so its contents don't get committed
-          rm -rf .claude-scratchpad/
-          # Remove output file generated by Claude Code action
-          rm -f output.txt
-          echo "Scratchpad directory and action output files cleaned up"
-
-      - name: Check for changes and analysis
-        id: check_changes
-        run: |
-          # Now check for actual code changes (excluding analysis file)
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-            echo "Changes detected:"
-            git status --short
-          else
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-            echo "No changes made by Claude."
-          fi
-
-      - name: Get issue team labels and prepare reviewers
-        if: steps.check_changes.outputs.has_changes == 'true'
-        id: prepare_reviewers
-        uses: actions/github-script@v7
-        env:
-          ISSUE_DATA: ${{ steps.get_issue.outputs.issue_data }}
-        with:
-          script: |
-            const issueData = JSON.parse(process.env.ISSUE_DATA);
-            const issueLabels = issueData.labels.map(label => label.name);
-            const teamLabels = issueLabels.filter(label => label.startsWith('.Team/'));
-            const issueCreator = issueData.user.login;
-            core.setOutput('team_labels', teamLabels.join(','));
-            core.setOutput('reviewers', issueCreator);
-
-      - name: Create Pull Request
-        id: create_pr
-        if: steps.check_changes.outputs.has_changes == 'true'
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: ${{ env.BRANCH_NAME }}
-          base: master
-          commit-message: |
-            Fix: ${{ env.ISSUE_TITLE }}
-
-            Fixes #${{ env.ISSUE_NUMBER }}
-
-            🤖 Generated with [Claude Code](https://claude.ai/code)
-
-            Co-Authored-By: Claude <noreply@anthropic.com>
-          committer: "Claude Code[bot] <noreply@anthropic.com>"
-          author: "Claude Code[bot] <noreply@anthropic.com>"
-          title: "Fix: ${{ env.ISSUE_TITLE }}"
-          body: |
-            This PR automatically fixes the bug reported in #${{ env.ISSUE_NUMBER }}.
-
-            ${{ steps.find_linear.outputs.linear_issue && format('Closes {0}', steps.find_linear.outputs.linear_issue) || '' }}
-
-            ## Bug Report
-            **Original Issue:** #${{ env.ISSUE_NUMBER }}
-            **Reporter:** @${{ env.ISSUE_AUTHOR }}
-            **Issue Title:** ${{ env.ISSUE_TITLE }}
-
-            ## Automated Fix
-            🤖 This fix was generated automatically by Claude Code based on the issue description.
-
-            **Please review carefully:**
-            - [ ] The fix addresses the reported issue
-            - [ ] Tests pass and code follows conventions
-            - [ ] No unrelated changes were introduced
-            - [ ] The solution is appropriate and maintainable
-
-            ## Next Steps
-            - Review the changes and test thoroughly
-            - If the fix looks good, approve and merge
-            - If issues are found, either fix them or close this PR
-
-            ---
-
-            🤖 Generated with [Claude Code](https://claude.ai/code)
-
-            Co-Authored-By: Claude <noreply@anthropic.com>
-          labels: |
-            ${{ steps.prepare_reviewers.outputs.team_labels }}
-            automated-fix
-            ci skip
-          reviewers: ${{ steps.prepare_reviewers.outputs.reviewers }}
-          assignees: ${{ github.actor }}
-
-      - name: Log existing branch update
-        if: steps.check_changes.outputs.has_changes == 'true' && env.BRANCH_EXISTS == 'true'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            console.log('🔄 Updated existing branch: ${{ env.BRANCH_NAME }}');
-            console.log('The changes have been pushed to the existing PR for this issue.');
-
-      - name: Log analysis for no changes
-        if: steps.check_changes.outputs.has_changes == 'false'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            console.log('🤖 No code changes were made by Claude.');

.github/workflows/claude-code-review.yaml

@@ -1,98 +0,0 @@
-name: "Claude Code Review"
-
-on:
-  pull_request:
-    types:
-      - closed
-      - synchronize
-      - labeled
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-code-review
-  cancel-in-progress: true
-
-jobs:
-  review:
-    if: |
-      (
-        github.event.action == 'closed' &&
-        github.event.pull_request.merged == true
-      ) ||
-      contains(github.event.pull_request.labels.*.name, 'Claude Code Review')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
-          persist-credentials: false
-
-      # Apparently comments on specific lines and top-level comments about the PR as a whole are TWO TOTALLY DIFFERENT
-      # TYPES OF THINGS. So we have to fetch and delete separately.
-      - name: Delete old Claude PR review comments
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        shell: bash
-        run: |
-          # Get old comment IDs from the bot
-          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          echo "Deleting line comments: $old_line_comment_ids"
-          # Delete each comment
-          for id in $old_line_comment_ids; do
-            gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
-            echo "Deleted line comment $id"
-          done
-          # Get old top-level comment IDs (technically "issue" comments on the PR?)
-          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          echo "Deleting top-level comments: $old_top_level_comment_ids"
-          # Delete each comment
-          for id in $old_top_level_comment_ids; do
-            gh api -X DELETE "/repos/$REPO/issues/comments/$id"
-            echo "Deleted top-level comment $id"
-          done
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-          permission-contents: read       # Required for reading repository files and PR diffs
-          permission-pull-requests: write # Required for creating inline comments and PR comments
-
-      - name: Fetch Community Clojure Style Guide
-        run: >-
-          curl https://raw.githubusercontent.com/bbatsov/clojure-style-guide/refs/heads/master/README.adoc -o CLOJURE_STYLE_GUIDE.adoc
-
-      - uses: anthropics/claude-code-action@v1
-        timeout-minutes: 10
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Review this pull request for compliance with project coding standards and conventions.
-
-            **Use the appropriate review skill based on the file types changed:**
-            - Use clojure-review for Clojure/ClojureScript files
-            - Use typescript-review for TypeScript/JavaScript files
-            - Follow the review guidelines and checklists in each skill
-
-            DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
-
-            Note: The PR branch is already checked out in the current working directory.
-
-            Use `gh pr comment` for top-level feedback.
-            Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
-            Only post GitHub comments - don't submit review text as messages.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),ReadFile(CLOJURE_STYLE_GUIDE.adoc)"

.github/workflows/claude-docs-review.yml

@@ -1,103 +0,0 @@
-name: "Claude Docs Review"
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-    paths:
-      - 'docs/**/*.md'
-      - 'docs/**/*.mdx'
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: 'PR number to review'
-        required: true
-        type: number
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-docs-review
-  cancel-in-progress: true
-
-jobs:
-  review:
-    runs-on: ubuntu-latest
-    if: github.event.pull_request.draft == false
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
-          persist-credentials: false
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-          permission-contents: read       # Required for reading repository files and PR diffs
-          permission-pull-requests: write # Required for creating inline comments and PR comments
-
-      - name: Delete old Claude docs review comments
-        env:
-          GH_TOKEN: ${{ steps.claude-app-token.outputs.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
-        shell: bash
-        run: |
-          # Delete pending reviews first (these can be deleted entirely)
-          pending_review_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/reviews" --jq '.[] | select(.user.login=="metabase-bot[bot]" and .state=="PENDING") | .id')
-          if [ -n "$pending_review_ids" ]; then
-            echo "Deleting pending reviews: $pending_review_ids"
-            for id in $pending_review_ids; do
-              gh api -X DELETE "/repos/$REPO/pulls/$PR_NUMBER/reviews/$id"
-              echo "Deleted pending review $id"
-            done
-          fi
-
-          # Delete individual inline comments from submitted reviews (can't delete the review itself)
-          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          if [ -n "$old_line_comment_ids" ]; then
-            echo "Deleting line comments: $old_line_comment_ids"
-            for id in $old_line_comment_ids; do
-              gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
-              echo "Deleted line comment $id"
-            done
-          fi
-
-          # Delete top-level review comments
-          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          if [ -n "$old_top_level_comment_ids" ]; then
-            echo "Deleting top-level comments: $old_top_level_comment_ids"
-            for id in $old_top_level_comment_ids; do
-              gh api -X DELETE "/repos/$REPO/issues/comments/$id"
-              echo "Deleted top-level comment $id"
-            done
-          fi
-
-      - uses: anthropics/claude-code-action@v1
-        timeout-minutes: 10
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          show_full_output: true
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
-
-            Review the documentation changes in this pull request.
-
-            Use the docs-review skill to review all changed documentation files for compliance with the Metabase writing style guide.
-
-            IMPORTANT: Only review markdown files (.md and .mdx). Skip any .txt files or other non-markdown files.
-
-            DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
-
-          claude_args: |
-            --allowedTools "Skill,mcp__github__get_pull_request,mcp__github__get_pull_request_files,mcp__github__create_pending_pull_request_review,mcp__github__get_pull_request_diff,mcp__github__add_comment_to_pending_review,mcp__github__add_pull_request_review_comment_to_pending_review,mcp__github__delete_pending_pull_request_review,mcp__github__submit_pending_pull_request_review"

.github/workflows/cljs.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       cljs: ${{ steps.changes.outputs.cljs }}
@@ -30,7 +30,7 @@ jobs:
   shared-tests-cljs:
     needs: files-changed
     if: needs.files-changed.outputs.cljs == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
     - uses: actions/checkout@v4

.github/workflows/codeql.yml

@@ -10,7 +10,7 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       codeql: ${{ steps.changes.outputs.codeql }}
@@ -25,7 +25,7 @@ jobs:
   analyze:
     needs: files-changed
     if: needs.files-changed.outputs.codeql == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4

.github/workflows/codespell.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   codespell:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     permissions:
       contents: write

.github/workflows/containerize-jar.yml

@@ -48,7 +48,7 @@ on:
 
 jobs:
   containerize:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     outputs:
       platforms: ${{ steps.platforms.outputs.result }}
@@ -117,7 +117,7 @@ jobs:
           bin/docker/.
 
   verify-docker-pull:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     needs: containerize
     timeout-minutes: 15
     steps:

.github/workflows/containerize-uberjar.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   get-container-info:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: Get container info
     outputs:
@@ -68,7 +68,7 @@ jobs:
     strategy:
       matrix:
         edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: Run Trivy vulnerability scanner
     steps:
       - name: Check out the code
@@ -76,7 +76,7 @@ jobs:
         with:
           ref: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.29.0
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         env:
           TRIVY_OFFLINE_SCAN: true
           repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
@@ -85,7 +85,6 @@ jobs:
           image-ref: docker.io/${{ env.repo }}:${{ env.tag }}
           format: sarif
           output: trivy-results.sarif
-          version: "v0.57.1"
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
         with:
@@ -94,7 +93,7 @@ jobs:
   post-comment:
     needs: [get-container-info, containerize]
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: Post PR comment
     steps:
       - name: Check out the code

.github/workflows/conventional-commit-pr-title-reminder.yml

@@ -8,7 +8,7 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_embedding_sources: ${{ steps.changes.outputs.frontend_embedding_sources }}
@@ -22,7 +22,7 @@ jobs:
           filters: .github/file-paths.yaml
 
   pr-title-reminder:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     permissions:
       pull-requests: write

.github/workflows/coverage.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   fe-test-coverage:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4

.github/workflows/cross-branch-migrations.yml

@@ -25,7 +25,7 @@ concurrency:
 
 jobs:
   migrations-h2-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
@@ -39,7 +39,7 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-postgres-12-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
@@ -65,7 +65,7 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-postgres-latest-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
@@ -76,7 +76,7 @@ jobs:
       MB_DB_USER: circle_test
     services:
       postgres:
-        image: circleci/postgres:latest
+        image: postgres:latest
         ports:
           - "5432:5432"
         env:
@@ -91,7 +91,7 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-mysql-8-0-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
@@ -102,7 +102,7 @@ jobs:
       MB_DB_USER: root
     services:
       mysql:
-        image: cimg/mysql:8.0
+        image: mysql:8.0
         ports:
           - "3306:3306"
     steps:
@@ -113,7 +113,7 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-mysql-latest-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
@@ -139,7 +139,7 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-mariadb-10-2-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
@@ -150,7 +150,7 @@ jobs:
       MB_DB_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:10.2.23
+        image: metabase/mariadb:10.2.23
         ports:
           - "3306:3306"
     steps:
@@ -161,7 +161,7 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-mariadb-latest-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
@@ -172,7 +172,7 @@ jobs:
       MB_DB_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:latest
+        image: mariadb:latest
         ports:
           - "3306:3306"
     steps:

.github/workflows/docs-generate-base.yml

@@ -21,7 +21,7 @@ permissions:
 jobs:
   update-docs:
     name: Update documentation for ${{ inputs.target_branch }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     steps:
       - name: Checkout code

.github/workflows/docs-links.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   link-checker:
     name: Check documentation links
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     permissions:
       contents: read

.github/workflows/drivers-stress-test.yml

@@ -49,7 +49,7 @@ jobs:
 
   be-tests-athena-ee:
     if: inputs.driver == 'Athena'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -68,7 +68,7 @@ jobs:
 
   be-tests-bigquery-cloud-sdk-ee:
     if: inputs.driver == 'BigQuery'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -89,7 +89,7 @@ jobs:
 
   be-tests-druid-ee:
     if: inputs.driver == 'Druid'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -111,7 +111,7 @@ jobs:
 
   be-tests-mariadb-10-2-ee:
     if: inputs.driver == 'Maria DB'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -124,7 +124,7 @@ jobs:
       MB_MYSQL_TEST_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:10.2.23
+        image: metabase/mariadb:10.2.23
         ports:
           - "3306:3306"
     steps:
@@ -137,7 +137,7 @@ jobs:
 
   be-tests-mariadb-latest-ee:
     if: inputs.driver == 'Maria DB (latest)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -150,7 +150,7 @@ jobs:
       MB_MYSQL_TEST_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:latest
+        image: mariadb:latest
         ports:
           - "3306:3306"
     steps:
@@ -163,7 +163,7 @@ jobs:
 
   be-tests-mongo-4-4-ee:
     if: inputs.driver == 'Mongo 4'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -185,7 +185,7 @@ jobs:
 
   be-tests-mongo-4-4-ssl-ee:
     if: inputs.driver == 'Mongo 4 (SSL)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -219,7 +219,7 @@ jobs:
 
   be-tests-mongo-5-0-ee:
     if: inputs.driver == 'Mongo 5'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -241,7 +241,7 @@ jobs:
 
   be-tests-mongo-5-0-ssl-ee:
     if: inputs.driver == 'Mongo 5 (SSL)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -275,7 +275,7 @@ jobs:
 
   be-tests-mongo-latest-ee:
     if: inputs.driver == 'Mongo (latest)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -284,7 +284,7 @@ jobs:
       MB_MONGO_TEST_PASSWORD: metasample123
     services:
       mongodb:
-        image: circleci/mongo:latest
+        image: mongo:latest
         ports:
           - "27017:27017"
         env:
@@ -300,7 +300,7 @@ jobs:
 
   be-tests-mysql-8-0-ee:
     if: inputs.driver == 'MySQL'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -313,7 +313,7 @@ jobs:
       MB_MYSQL_TEST_USER: root
     services:
       mysql:
-        image: cimg/mysql:8.0
+        image: mysql:8.0
         ports:
           - "3306:3306"
     steps:
@@ -326,7 +326,7 @@ jobs:
 
   be-tests-mysql-latest-ee:
     if: inputs.driver == 'MySQL (latest)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -364,7 +364,7 @@ jobs:
 
   be-tests-oracle-18-4-ee:
     if: inputs.driver == 'Oracle 18'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -390,7 +390,7 @@ jobs:
 
   be-tests-oracle-21-3-ee:
     if: inputs.driver == 'Oracle 21'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -425,7 +425,7 @@ jobs:
 
   be-tests-postgres-ee:
     if: inputs.driver == 'Postgres'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -455,7 +455,7 @@ jobs:
 
   be-tests-postgres-latest-ee:
     if: inputs.driver == 'Postgres (latest)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -471,7 +471,7 @@ jobs:
       MB_POSTGRES_SSL_TEST_SSL_ROOT_CERT_PATH: 'test-resources/certificates/us-east-2-bundle.pem'
     services:
       postgres:
-        image: circleci/postgres:latest
+        image: postgres:latest
         ports:
           - "5432:5432"
         env:
@@ -488,7 +488,7 @@ jobs:
 
   be-tests-presto-jdbc-ee:
     if: inputs.driver == 'Presto JDBC'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -537,7 +537,7 @@ jobs:
 
   be-tests-redshift-ee:
     if: inputs.driver == 'Redshift'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -556,7 +556,7 @@ jobs:
 
   be-tests-snowflake-ee:
     if: inputs.driver == 'Snowflake'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -577,7 +577,7 @@ jobs:
 
   be-tests-sparksql-ee:
     if: inputs.driver == 'SparkSQL'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -597,7 +597,7 @@ jobs:
 
   be-tests-sqlite-ee:
     if: inputs.driver == 'SQLite'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -612,7 +612,7 @@ jobs:
 
   be-tests-sqlserver-2017-ee:
     if: inputs.driver == 'SQL Server 2017'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -639,7 +639,7 @@ jobs:
 
   be-tests-sqlserver-2022-ee:
     if: inputs.driver == 'SQL Server 2022'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -666,7 +666,7 @@ jobs:
 
   be-tests-starburst-ee:
     if: inputs.driver == 'Starburst'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -691,7 +691,7 @@ jobs:
 
   login-to-ecr:
     if: inputs.driver == 'Vertica'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     permissions:
       id-token: write
@@ -720,7 +720,7 @@ jobs:
 
   be-tests-vertica-ee:
     if: inputs.driver == 'Vertica'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     needs: login-to-ecr
     timeout-minutes: 90
     env:

.github/workflows/drivers.yml

@@ -15,7 +15,7 @@ jobs:
   # This job determines which driver tests should run based on PR context.
   # All decision logic is consolidated in mage driver-decisions.
   determine-driver-skips:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     outputs:
       # All driver run decisions (from mage driver-decisions)
       h2-should-run: ${{ steps.driver-decisions.outputs.h2-should-run }}
@@ -72,13 +72,19 @@ jobs:
           # All decision logic is in mage - it analyzes module dependencies,
           # branch context, labels, and file changes to decide what runs.
           MAGE_ARGS=(
-            --git-ref="${{ github.event.pull_request.base.ref || 'master' }}"
+            --git-ref="${{ github.event.pull_request.base.ref || github.ref_name }}"
             --is-master-or-release="${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}"
             --pr-labels="${{ join(github.event.pull_request.labels.*.name, ',') }}"
             --skip="${{ inputs.skip }}"
           )
+          echo "Running:"
+          echo "./bin/mage -driver-decisions ${MAGE_ARGS[@]}"
+          echo ""
           # First call: show human-readable output for debugging
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}"
+          echo ""
+          echo "Want to force-run a specific driver? Add a ci:run-<driver> or ci:run-all-drivers label to your PR."
+          echo "Run './bin/mage -driver-decisions -h' locally for the full list of drivers and labels."
           # Second call: output only key=value lines for GITHUB_OUTPUT
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> $GITHUB_OUTPUT
         shell: bash
@@ -86,8 +92,8 @@ jobs:
   be-tests-athena-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.athena-should-run == 'true' || needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: athena
@@ -132,11 +138,12 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' || needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -198,6 +205,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -208,8 +216,8 @@ jobs:
   be-tests-clickhouse-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.clickhouse-should-run == 'true' || needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -280,6 +288,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -290,8 +299,8 @@ jobs:
   be-tests-druid-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.druid-should-run == 'true' || needs.determine-driver-skips.outputs.druid-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: druid
@@ -334,12 +343,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: druid-jdbc
@@ -382,12 +392,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -430,12 +441,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -479,12 +491,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-h2:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
     name: H2
@@ -509,12 +522,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-h2-oss:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
     name: H2 (OSS)
@@ -540,25 +554,26 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-should-run == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
           - name: MariaDB 10.2
             junit-name: be-tests-mariadb-10-2-ee
-            image: circleci/mariadb:10.2.23
+            image: metabase/mariadb:10.2.23
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
           - name: MariaDB Latest
             junit-name: be-tests-mariadb-latest-ee
-            image: circleci/mariadb:latest
+            image: mariadb:latest
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -670,6 +685,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -680,8 +696,8 @@ jobs:
   be-tests-mongo:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -750,6 +766,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -760,8 +777,8 @@ jobs:
   be-tests-mongo-ssl:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -832,12 +849,13 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: mongo
@@ -877,12 +895,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-oracle:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.oracle-should-run == 'true' || needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -962,12 +981,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-postgres:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.postgres-should-run == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -1066,6 +1086,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -1076,8 +1097,8 @@ jobs:
   be-tests-presto-jdbc-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: presto-jdbc
@@ -1153,12 +1174,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' || needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -1197,7 +1219,7 @@ jobs:
       MB_REDSHIFT_TEST_USER: metabase_ci
       MB_REDSHIFT_TEST_DB: testdb
       MB_REDSHIFT_TEST_DB_ROUTING: dev
-      MB_REDSHIFT_TEST_HOST: ${{ secrets.MB_REDSHIFT_TEST_HOST }}
+      MB_REDSHIFT_TEST_HOSTS: ${{ secrets.MB_REDSHIFT_TEST_HOSTS }}
       MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
     name: ${{ matrix.job.name }}
     steps:
@@ -1237,6 +1259,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1247,7 +1270,7 @@ jobs:
   be-tests-snowflake-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.snowflake-should-run == 'true' || needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -1319,6 +1342,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1329,8 +1353,8 @@ jobs:
   be-tests-sparksql-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.sparksql-should-run == 'true' || needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: sparksql
@@ -1371,12 +1395,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.sqlite-should-run == 'true' || needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: sqlite
@@ -1412,11 +1437,12 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-sqlserver:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.sqlserver-should-run == 'true' || needs.determine-driver-skips.outputs.sqlserver-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -1488,6 +1514,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1499,8 +1526,8 @@ jobs:
   # be-tests-starburst-ee:
   #   needs: determine-driver-skips
   #   if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
-  #   runs-on: ubuntu-latest
-  #   timeout-minutes: 60
+  #   runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+  #   timeout-minutes: 40
   #   env:
   #     CI: 'true'
   #     DRIVERS: starburst
@@ -1537,7 +1564,7 @@ jobs:
   login-to-ecr:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     permissions:
       id-token: write
@@ -1567,8 +1594,8 @@ jobs:
   be-tests-vertica-ee:
     needs: [determine-driver-skips, login-to-ecr]
     if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: vertica
@@ -1614,6 +1641,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   drivers-tests-result:
     needs:
@@ -1640,7 +1668,7 @@ jobs:
       # TODO(rileythomp, 2025-08-20): Re-enable vertica tests once the docker image is updated
       # - be-tests-vertica-ee
       - be-tests-clickhouse-ee
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: drivers-tests-result
     if: always() && !cancelled()

.github/workflows/e2e-matrix-builder.yml

@@ -21,7 +21,7 @@ on:
 
 jobs:
   build-matrix:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       matrix: ${{ steps.matrix.outputs.config }}
@@ -47,7 +47,7 @@ jobs:
             const inputSpecs = "${{ inputs.specs }}";
             const inputChunks = Number(process.env.chunks);
             const java = 21;
-            const defaultRunner = "ubuntu-22.04";
+            const defaultRunner = "${{ vars.DEFAULT_RUNNER_KEY }}";
             const options = {
               java,
               defaultRunner,

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -35,7 +35,7 @@ on:
 jobs:
   determine-test-type:
     name: Determine test type
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       type: ${{ steps.detect.outputs.type }}
@@ -53,7 +53,7 @@ jobs:
   workflow-summary:
     name: Stress test inputs
     needs: [determine-test-type]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
@@ -72,7 +72,7 @@ jobs:
 
   stress-test-flake-fix:
     needs: [determine-test-type]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     name: Stress test E2E flake fix
     env:

.github/workflows/e2e-test.yml

@@ -21,7 +21,7 @@ on:
       runner:
         required: false
         type: string
-        default: ubuntu-22.04
+        default: ${{ vars.DEFAULT_RUNNER_KEY }}
       total_chunks: # number of chunks
         required: false
         type: number
@@ -41,12 +41,13 @@ env:
 jobs:
   e2e-tests:
     runs-on: ${{ inputs.runner }}
-    timeout-minutes: 45
+    timeout-minutes: 40
     name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
     env:
       MB_EDITION: ${{ inputs.edition }}
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
+      # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
+      # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
@@ -171,6 +172,7 @@ jobs:
           # Related to Trunk uploader
           variant: e2e-tests
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ inputs.specs && steps.tagged-e2e.outcome || steps.split-e2e.outcome }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/e2e-tests.yml

@@ -24,7 +24,7 @@ jobs:
 
   reset-e2e-test-comment:
     if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Remove test results comment
@@ -75,7 +75,7 @@ jobs:
 
   collect-timings:
     name: Collect E2E Timings
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     needs: e2e-tests
     if: always() && !cancelled() && github.ref == 'refs/heads/master'
@@ -138,7 +138,7 @@ jobs:
   e2e-tests-result:
     needs:
       - e2e-tests
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: e2e-tests-result
     if: always() && !cancelled()

.github/workflows/embedding-sdk-component-tests.yml

@@ -12,15 +12,16 @@ env:
 jobs:
   sdk-component-tests:
     name: "SDK component tests (React ${{ matrix.react-version }})"
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     strategy:
       matrix:
         react-version: [18, 19]
       fail-fast: false
     env:
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
+      # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
+      # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
@@ -81,6 +82,7 @@ jobs:
         run: ./bin/embedding-sdk/change-react-version.bash ${{ matrix.react-version }}
 
       - name: Run component tests for Embedding SDK
+        id: run-tests
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: node e2e/runner/run_cypress_ci.js component
@@ -96,6 +98,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
       - name: "SDK component tests > Upload Cypress Artifacts upon failure"
         uses: actions/upload-artifact@v4
@@ -125,7 +128,7 @@ jobs:
              await core.summary.addRaw(summary).write();
 
   decide-target-ref:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     outputs:
       target-ref: ${{ steps.get-target-ref.outputs.value }}
     steps:
@@ -148,13 +151,14 @@ jobs:
   sdk-component-tests-backward-compatibility:
     name: "SDK component tests (Backward compatibility)"
     needs: [decide-target-ref]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     env:
       MB_RUN_MODE: "e2e"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
+      # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
+      # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
@@ -230,6 +234,7 @@ jobs:
             --spec "e2e/snapshot-creators/default.cy.snap.js"
 
       - name: Run component tests for Embedding SDK
+        id: run-tests
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
@@ -247,6 +252,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -13,7 +13,7 @@ env:
   MB_EDITION: ee
 jobs:
   get-sample-apps-data:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       # we must support the last two stable releases
@@ -103,7 +103,7 @@ jobs:
         environment: ["production", "development"]
     if: |
       !cancelled() && needs.get-sample-apps-data.result == 'success'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: e2e-sample-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
@@ -115,6 +115,8 @@ jobs:
       SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
       id-token: write
+      contents: read
+      actions: read
 
     steps:
       - uses: actions/checkout@v4
@@ -238,7 +240,7 @@ jobs:
             "angular-20-host-app-e2e",
           ]
         environment: ["production", "development"]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
@@ -246,6 +248,8 @@ jobs:
       HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
       id-token: write
+      contents: read
+      actions: read
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/embedding-sdk-labels-reminder.yml

@@ -10,7 +10,7 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_embedding_sdk_package_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_package_sources }}
@@ -29,7 +29,7 @@ jobs:
       !cancelled() &&
       (needs.files-changed.outputs.frontend_embedding_sdk_package_sources == 'true')
     name: Embedding SDK package release-notes/no-release-notes label reminder
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4

.github/workflows/embedding-sdk-package-build.yml

@@ -10,7 +10,7 @@ concurrency:
 
 jobs:
   build-sdk-package:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@v4

.github/workflows/embedding-sdk.yml

@@ -35,7 +35,7 @@ concurrency:
 jobs:
   embedding-sdk-cli-snippets-type-check:
     if: inputs.cli-snippets-type-check && !inputs.skip
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -51,7 +51,7 @@ jobs:
 
   embedding-sdk-docs-snippets-type-check:
     if: inputs.docs-snippets-type-check && !inputs.skip
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -67,7 +67,7 @@ jobs:
 
   embedding-sdk-api-documentation-generation-validation:
     if: inputs.documentation-validation && !inputs.skip
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -131,7 +131,7 @@ jobs:
       - embedding-sdk-api-documentation-generation-validation
       - embedding-sdk-component-tests
     if: always() && !cancelled()
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       needs: ${{ toJson(needs) }}

.github/workflows/escalation-slack-notification.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   on-escalation-label:
     if: github.event.label.name == '.Escalation'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - name: Format issue title (escape quotes)

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -19,7 +19,7 @@ on:
 jobs:
   workflow-summary:
     name: Stress test inputs
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
@@ -34,7 +34,7 @@ jobs:
           echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
 
   frontend-unit-test-stress-test-flake-fix:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     name: Stress test frontend unit test flake fix
     steps:
@@ -49,7 +49,7 @@ jobs:
         run: |
           for i in {1..${{ github.event.inputs.burn_in }}}; do
             bun run jest --runInBand --ci --silent --no-cache \
-              --testPathPattern '${{ github.event.inputs.spec }}' \
+              --testPathPatterns '${{ github.event.inputs.spec }}' \
               --testNamePattern '${{ github.event.inputs.grep }}'
             if [[ "$?" != 0 ]]; then
               echo "Failed after $i attempts" && break;

.github/workflows/frontend.yml

@@ -27,7 +27,7 @@ concurrency:
 jobs:
   fe-lint:
     if: ${{ !inputs.skip-lint }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -58,7 +58,7 @@ jobs:
 
   fe-type-check:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -73,7 +73,7 @@ jobs:
 
   fe-tests-unit:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -90,6 +90,7 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run frontend unit tests
+        id: fe-tests
         run: bun run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
         # Trunk Quarantine controls the final state of the run in the CI!
         # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
@@ -106,10 +107,11 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.fe-tests.outcome }}
 
   fe-tests-timezones:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -127,7 +129,7 @@ jobs:
       - fe-tests-unit
       - fe-tests-timezones
     if: always() && !cancelled()
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       needs: ${{ toJson(needs) }}

.github/workflows/generative-query-test.yml

@@ -24,7 +24,7 @@ on:
 # TODO: Consider renaming the job in next milestones
 jobs:
   generative-query-test:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     name: Generative Query Test
     env:

.github/workflows/i18n.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       i18n: ${{ steps.changes.outputs.i18n }}
@@ -30,7 +30,7 @@ jobs:
   verify-i18n-files:
     needs: files-changed
     if: needs.files-changed.outputs.i18n == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
     - uses: actions/checkout@v4

.github/workflows/js-stats-update.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   js-stats:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4

.github/workflows/linear-pr-links.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   add-issue-references:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

.github/workflows/loki-stress-test-flake-fix.yml

@@ -21,7 +21,7 @@ on:
 jobs:
   detect-changed-stories:
     name: Detect changed stories
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       story_files: ${{ steps.detect.outputs.story_files }}
@@ -84,32 +84,40 @@ jobs:
     name: Summary
     needs: detect-changed-stories
     if: needs.detect-changed-stories.outputs.should_run == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
+        env:
+          BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
+          STORY_FILES: ${{ needs.detect-changed-stories.outputs.story_files }}
+          BURN_IN: ${{ inputs.burn_in || 50 }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_ACTOR: ${{ github.event.pull_request.user.login }}
+          ACTOR: ${{ github.actor }}
         run: |
           echo '## Loki Stress Test' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
-          echo '**Branch:** `${{ github.head_ref || github.ref_name }}`' >> $GITHUB_STEP_SUMMARY
+          echo "**Branch:** \`${BRANCH_NAME}\`" >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
           echo '**Story files:**' >> $GITHUB_STEP_SUMMARY
-          echo '${{ needs.detect-changed-stories.outputs.story_files }}' | tr ',' '\n' | while read -r file; do
+          echo "${STORY_FILES}" | tr ',' '\n' | while read -r file; do
             echo "- \`$file\`" >> $GITHUB_STEP_SUMMARY
           done
           echo '' >> $GITHUB_STEP_SUMMARY
-          echo '**Burn-in:** ${{ inputs.burn_in || 50 }} runs' >> $GITHUB_STEP_SUMMARY
+          echo "**Burn-in:** ${BURN_IN} runs" >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo 'Triggered by PR #${{ github.event.pull_request.number }} from @${{ github.event.pull_request.user.login }}' >> $GITHUB_STEP_SUMMARY
+          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
+            echo "Triggered by PR #${PR_NUMBER} from @${PR_ACTOR}" >> $GITHUB_STEP_SUMMARY
           else
-            echo 'Triggered manually by @${{ github.actor }}' >> $GITHUB_STEP_SUMMARY
+            echo "Triggered manually by @${ACTOR}" >> $GITHUB_STEP_SUMMARY
           fi
 
   stress-test-loki:
     needs: detect-changed-stories
     if: needs.detect-changed-stories.outputs.should_run == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     name: Stress test Loki visual tests
     services:

.github/workflows/loki-update.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   check-label-and-update-snapshot:
     if: contains(github.event.pull_request.labels.*.name, 'loki-update')
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4

.github/workflows/loki.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_ci: ${{ steps.changes.outputs.frontend_ci }}
@@ -25,7 +25,7 @@ jobs:
   visual-test:
     needs: files-changed
     if: needs.files-changed.outputs.frontend_ci == 'true' || needs.files-changed.outputs.frontend_sources == 'true' || needs.files-changed.outputs.frontend_loki_ci == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     services:
       docker:
         image: docker:19.03.12

.github/workflows/mage.yml

@@ -2,14 +2,11 @@ name: Mage Tests
 
 on:
   pull_request:
-    paths:
-      - "mage/**"
-      - "bb.edn"
 
 jobs:
   # run mage tests even if the rest of be isnt needed
   mage-tests:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: Mage
     steps:
       - uses: actions/checkout@v4

.github/workflows/main.yml

@@ -6,7 +6,7 @@ on:
       - labeled
 jobs:
   on-issue-labeled:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     if: |
       contains(github.event.issue.labels.*.name, 'Type:New Feature')

.github/workflows/mbql-library-changelog.yml

@@ -11,7 +11,7 @@ on:
       - src/metabase/lib/js.cljs
 jobs:
   mbql-library-changelog-check:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     if: ${{ !contains( github.event.pull_request.labels.*.name, '.metabase-lib/no-change' ) }}
     steps:
       # - uses: jesusvasquez333/verify-pr-label-action@v1.4.0

.github/workflows/migrations.yml

@@ -10,7 +10,7 @@ on:
 jobs:
 
   lint-migrations:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4

.github/workflows/minimal-tests.yml

@@ -11,7 +11,7 @@ concurrency:
 jobs:
   # Only run if the PR has the minimal-tests label
   check-label:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 1
     outputs:
       should-run: ${{ steps.check.outputs.result }}
@@ -29,10 +29,10 @@ jobs:
   postgres-app-db-test:
     needs: check-label
     if: needs.check-label.outputs.should-run == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
-      CI: 'true'
+      CI: "true"
       DRIVERS: postgres
       MB_DB_TYPE: postgres
       MB_DB_PORT: 5432
@@ -53,10 +53,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test Postgres App DB
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: true
-          junit-name: 'minimal-be-tests-postgres-ee'
+          junit-name: "minimal-be-tests-postgres-ee"
           test-args: >-
             :only '["test" "enterprise/backend/test"]'
             :exclude-tags '[:mb/driver-tests :mb/transforms-python-test]'
@@ -73,15 +74,16 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   # Postgres driver tests
   postgres-driver-test:
     needs: check-label
     if: needs.check-label.outputs.should-run == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     env:
-      CI: 'true'
+      CI: "true"
       DRIVERS: postgres
       MB_DB_TYPE: postgres
       MB_DB_PORT: 5432
@@ -102,9 +104,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test Postgres Driver
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
-          junit-name: 'minimal-be-tests-postgres-driver-ee'
+          junit-name: "minimal-be-tests-postgres-driver-ee"
           test-args: >-
             :only-tags [:mb/driver-tests]
             :exclude-tags [:mb/transforms-python-test]
@@ -119,12 +122,13 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   # Frontend unit tests
   frontend-unit-tests:
     needs: check-label
     if: needs.check-label.outputs.should-run == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     env:
       JEST_JUNIT_OUTPUT_DIR: ./target/junit
@@ -137,6 +141,7 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run frontend unit tests
+        id: run-tests
         run: bun run test-unit --silent
         continue-on-error: true
       - name: Upload Test Results
@@ -150,6 +155,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
   # Summary job
   minimal-tests-result:
@@ -157,7 +163,7 @@ jobs:
       - postgres-app-db-test
       - postgres-driver-test
       - frontend-unit-tests
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: minimal-tests-result
     if: always() && !cancelled()

.github/workflows/openapi-check.yml

@@ -10,7 +10,7 @@ concurrency:
 
 jobs:
   check-openapi-specs:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     if: contains(github.event.pull_request.labels.*.name, 'openapi-self-healing')
     steps:
@@ -22,10 +22,8 @@ jobs:
           token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           # fetch full git history to allow fetching the latest base branch commit and comparing changes
           fetch-depth: 0
-      - name: Setup Node.js 22
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22.x
+      - name: Prepare Node + Bun environment
+        uses: ./.github/actions/prepare-node-bun
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Generate version.properties

.github/workflows/openapi.yml

@@ -0,0 +1,44 @@
+name: Validate OpenAPI
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-**'
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 3
+    outputs:
+      openapi: ${{ steps.changes.outputs.openapi }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  validate-openapi:
+    needs: files-changed
+    if: needs.files-changed.outputs.openapi == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Generate OpenAPI spec
+        run: bun run generate-openapi
+      - name: Validate OpenAPI spec
+        run: bun run lint-openapi

.github/workflows/optimize-images.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   optimize-images:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     if: ${{ contains(github.event.pull_request.labels.*.name,'Type:Documentation') }}
     steps:
     - name: Checkout repository

.github/workflows/perf-test.yml

@@ -5,7 +5,7 @@ on:
   workflow_call:
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     if: github.event.pull_request.head.repo.full_name == github.repository
     name: Build Metabase Docker image
     timeout-minutes: 60
@@ -47,7 +47,7 @@ jobs:
           push: true
   launch_perf_test:
     needs: [ build ]
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: Launch Perf Test
     permissions:
       id-token: write

.github/workflows/pr-env-destroy.yml

@@ -12,7 +12,7 @@ on:
 
 jobs:
   destroy_pr:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: PR Review ENV Destroy
     permissions:
       id-token: write

.github/workflows/pr-env.yml

@@ -16,7 +16,7 @@ on:
         default: false
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     if: github.event.pull_request.head.repo.full_name == github.repository
     name: Build Metabase Docker image
     timeout-minutes: 60
@@ -58,7 +58,7 @@ jobs:
           push: true
   deploy_pr:
     needs: [build]
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: PR Review ENV
     permissions:
       id-token: write
@@ -188,7 +188,7 @@ jobs:
             --atomic \
             --timeout 10m
   preview_links:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     needs: [deploy_pr]
     steps:
       - uses: marocchino/sticky-pull-request-comment@v2

.github/workflows/presto-kerberos-integration-test.yml

@@ -18,7 +18,7 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       backend_presto_kerberos: ${{ steps.changes.outputs.backend_presto_kerberos }}
@@ -34,7 +34,7 @@ jobs:
   run-presto-kerberos-test:
     needs: files-changed
     if: needs.files-changed.outputs.backend_presto_kerberos == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     steps:
       - name: Install babashka

.github/workflows/pull-request-reminders.yml

@@ -10,7 +10,7 @@ jobs:
   external-reminder:
     name: External PR Helper
     if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     permissions:
       pull-requests: write

.github/workflows/querying-team-pagerduty.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   notify-querying-on-call:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     if: |
       (github.event.label.name == 'Priority:P0' || github.event.label.name == 'Priority:P1' || github.event.label.name == '.Escalation') &&

.github/workflows/release-embedding-sdk.yml

@@ -8,9 +8,9 @@ on:
         description: "Branch we want to release the SDK from (to release from other branches use the workflow from those branches)"
         type: choice
         required: true
-        default: "master"
+        default: "release-x.59.x"
         options:
-          - master
+          - release-x.59.x
 
 concurrency:
   # We want to ensure only one job is running at a time per branch because
@@ -21,7 +21,7 @@ concurrency:
 jobs:
   workflow-summary:
     name: Log inputs
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
@@ -37,7 +37,7 @@ jobs:
   send-slack-notification-start:
     name: "Send Slack notification: SDK release started"
     needs: determine-sdk-version
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       slackMessageId: ${{ steps.send-slack-message-start.outputs.result }}
@@ -96,7 +96,7 @@ jobs:
         "publish-npm",
         "git-tag",
       ]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       slackMessageId: ${{ needs.send-slack-notification-start.outputs.slackMessageId }}
@@ -134,7 +134,7 @@ jobs:
     name: "Send Slack notification: SDK release successful"
     needs:
       ["determine-sdk-version", "send-slack-notification-start", "publish-npm"]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       slackMessageId: ${{ needs.send-slack-notification-start.outputs.slackMessageId }}
@@ -168,7 +168,7 @@ jobs:
             });
 
   determine-sdk-version:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     outputs:
       sdk_version: ${{ fromJson(steps.new-sdk-version.outputs.result).version }}
@@ -219,7 +219,7 @@ jobs:
 
   check-git-tag:
     needs: determine-sdk-version
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     env:
       tag: embedding-sdk-${{ needs.determine-sdk-version.outputs.sdk_version }}
@@ -243,7 +243,7 @@ jobs:
 
   test:
     needs: check-git-tag
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - name: Check out the code using the provided branch
@@ -262,7 +262,7 @@ jobs:
 
   build-sdk:
     needs: [test, determine-sdk-version]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - name: Check out the code using the provided branch
@@ -297,7 +297,7 @@ jobs:
 
   publish-npm:
     needs: [build-sdk, determine-sdk-version]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     env:
       sdk_version: ${{ needs.determine-sdk-version.outputs.sdk_version }}
@@ -371,34 +371,23 @@ jobs:
           name: metabase-sdk
           path: sdk
 
-      - name: Compute master tag
-        id: compute-tag
-        run: |
-          if [ -n "${{ needs.determine-sdk-version.outputs.pre_release_label }}" ]; then
-            echo "masterTag=${{ needs.determine-sdk-version.outputs.pre_release_label }}" >> $GITHUB_OUTPUT
-          else
-            echo "masterTag=nightly" >> $GITHUB_OUTPUT
-          fi
-
       - name: Publish to NPM
         working-directory: sdk
         run: |
           echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
 
-          TAG="${{ steps.compute-tag.outputs.masterTag }}"
-          echo "Resolved npm tag: $TAG"
-          npm publish --tag "$TAG"
+          npm publish --tag 59-stable
 
       # ⚠️ This step should only be executed on the latest stable (gold) release branch.
       # Only uncomment this when the new release branch becomes stable (gold).
-      # - name: Add `latest` tag to the latest release branch (`release-x.55.x`) deployment
-      #   working-directory: sdk
-      #   run: |
-      #     npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest
+      - name: Add `latest` tag to the latest release branch (`release-x.59.x`) deployment
+        working-directory: sdk
+        run: |
+          npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest
 
   git-tag:
     needs: [publish-npm, determine-sdk-version]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     env:
       tag: embedding-sdk-${{ needs.determine-sdk-version.outputs.sdk_version }}

.github/workflows/release-log.yml

@@ -23,7 +23,7 @@ on:
 
 jobs:
   update-release-log:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     # don't run this workflow for forks
     if: ${{ github.event_name != 'push' || github.repository == 'metabase/metabase' }}
@@ -38,14 +38,10 @@ jobs:
         with:
           ref: master # this only works on master
           fetch-depth: 0 # we want all branches and tags
-      - name: Install bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-      - name: Install Dependencies
-        run: bun install --cwd release --frozen-lockfile && npm i -g tsx
-      - name: Build release scripts
-        run: bun run --cwd release build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+      - name: Install tsx
+        run: npm i -g tsx
       - name: Get version number
         uses: actions/github-script@v7
         with:

.github/workflows/release-milestone-check.yml

@@ -15,7 +15,7 @@ on:
 jobs:
   check-milestone:
     permissions: write-all
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -24,7 +24,8 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Prepare build scripts
         run: bun install --cwd release --frozen-lockfile && bun run --cwd release build
       - uses: actions/github-script@v7

.github/workflows/release-notes-preview.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   preview-release-notes:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
     - name: Fail early on the incorrect version format

.github/workflows/release-patch.yml

@@ -20,7 +20,7 @@ jobs:
   auto-patch-trigger:
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -29,7 +29,8 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Prepare build scripts
         run: bun install --cwd release --frozen-lockfile && bun run --cwd release build
       - name: Trigger auto-patch

.github/workflows/release-status.yml

@@ -9,7 +9,7 @@ jobs:
   check-release-status:
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v4
@@ -44,7 +44,7 @@ jobs:
           });
 
   open-backport-reminder:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v4

.github/workflows/release-tests.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       release_source: ${{ steps.changes.outputs.release_source }}
@@ -30,7 +30,7 @@ jobs:
   release-type-check:
     needs: files-changed
     if: needs.files-changed.outputs.release_source == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -39,7 +39,8 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
         run: bun install --cwd release --frozen-lockfile
       - name: Run frontend type-check
@@ -48,7 +49,7 @@ jobs:
   release-tests-unit:
     needs: files-changed
     if: needs.files-changed.outputs.release_source == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -57,7 +58,8 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
         run: bun install --cwd release --frozen-lockfile
       - name: Run release unit tests
@@ -66,7 +68,7 @@ jobs:
   release-test-build:
     needs: files-changed
     if: needs.files-changed.outputs.release_source == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -75,7 +77,8 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
         run: bun install --cwd release --frozen-lockfile
       - name: Build release bundle

.github/workflows/rerun-workflows.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   rerun-on-failure:
     name: 'Re-run ''${{ github.event.workflow_run.name }}'' workflow'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     # Do not re-run scheduled workflow runs
     if: github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event != 'schedule'
     env:
@@ -40,11 +40,19 @@ jobs:
             const BRANCH = process.env.BRANCH_NAME;
 
             if (ATTEMPT <= MAX_ATTEMPTS) {
-              github.rest.actions.reRunWorkflowFailedJobs({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                run_id: ${{ github.event.workflow_run.id }},
-              });
+              try {
+                await github.rest.actions.reRunWorkflowFailedJobs({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  run_id: ${{ github.event.workflow_run.id }},
+                });
+              } catch (error) {
+                if (error.status === 403) {
+                  console.log(`Skipping re-run: ${error.message}`);
+                } else {
+                  throw error;
+                }
+              }
             } else if (!BRANCH.includes('backport-')) {
               // notify slack of repeated failure
               const { WebClient } = require('@slack/web-api');

.github/workflows/reset-cloud-test-dataset.yml

@@ -0,0 +1,63 @@
+name: Reset Cloud Test Dataset
+
+on:
+  workflow_dispatch:
+    inputs:
+      driver:
+        description: 'Driver to reset dataset for'
+        required: true
+        default: 'snowflake'
+        type: choice
+        options:
+          - snowflake
+          - bigquery-cloud-sdk
+          - redshift
+          - databricks
+      dataset-name:
+        description: 'Dataset name to drop (e.g., test-data)'
+        required: true
+        default: 'test-data'
+        type: string
+
+jobs:
+  reset-dataset:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    env:
+      CI: 'true'
+      DRIVERS: ${{ inputs.driver }}
+      # Snowflake
+      MB_SNOWFLAKE_TEST_USER: METABASE CI
+      MB_SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.MB_SNOWFLAKE_TEST_ACCOUNT }}
+      MB_SNOWFLAKE_TEST_PASSWORD: ${{ secrets.MB_SNOWFLAKE_TEST_PASSWORD }}
+      MB_SNOWFLAKE_TEST_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PRIVATE_KEY }}
+      MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
+      # BigQuery
+      MB_BIGQUERY_TEST_PROJECT_ID: ${{ secrets.BIGQUERY_TEST_PROJECT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_ID: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_SECRET: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_SECRET }}
+      MB_BIGQUERY_TEST_ACCESS_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_ACCESS_TOKEN }}
+      MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
+      # Redshift
+      MB_REDSHIFT_TEST_USER: metabase_ci
+      MB_REDSHIFT_TEST_DB: testdb
+      MB_REDSHIFT_TEST_HOST: ${{ secrets.MB_REDSHIFT_TEST_HOST }}
+      MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
+      # Databricks
+      MB_DATABRICKS_TEST_HOST: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HOST }}
+      MB_DATABRICKS_TEST_HTTP_PATH: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HTTP_PATH }}
+      MB_DATABRICKS_TEST_TOKEN: ${{ secrets.MB_DATABRICKS_JDBC_TEST_TOKEN }}
+      MB_DATABRICKS_TEST_CATALOG: metabase_ci
+      MB_DATABRICKS_TEST_CLIENT_ID: ${{ secrets.MB_DATABRICKS_JDBC_TEST_CLIENT_ID }}
+      MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/prepare-backend
+      - name: Drop dataset
+        run: >-
+          clojure -X:dev:drivers:drivers-dev:test
+          metabase.test.data.impl/drop-dataset!
+          :driver '"${{ inputs.driver }}"'
+          :dataset-name '"${{ inputs.dataset-name }}"'

.github/workflows/resolve-backport-conflicts.yml

@@ -0,0 +1,321 @@
+name: Auto-resolve backport conflicts
+run-name: Auto-resolve conflicts on PR #${{ github.event.pull_request.number || github.event.inputs.pr_number }}
+
+on:
+  pull_request:
+    types: [labeled]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "PR number of the backport PR with conflicts"
+        required: true
+        type: string
+      max_turns:
+        description: "Maximum number of Claude turns"
+        required: false
+        type: number
+        default: 75
+
+jobs:
+  resolve-conflicts:
+    if: |
+      (github.event_name == 'pull_request' && github.event.label.name == 'auto-resolve-conflicts') ||
+      (github.event_name == 'workflow_dispatch')
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+    env:
+      GIT_EDITOR: "true"
+
+    steps:
+      - name: Get PR data
+        id: pr
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: |
+            let pr;
+            if (context.eventName === 'workflow_dispatch') {
+              const { data } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: Number('${{ github.event.inputs.pr_number }}'),
+              });
+              pr = data;
+            } else {
+              pr = context.payload.pull_request;
+            }
+            core.setOutput('number', pr.number);
+            core.setOutput('head_ref', pr.head.ref);
+            core.setOutput('base_ref', pr.base.ref);
+
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.pr.outputs.head_ref }}
+          fetch-depth: 0
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - name: Detect package manager
+        id: pkg
+        run: |
+          if [ -f "bun.lock" ] || [ -f "bun.lockb" ]; then
+            echo "mgr=bun" >> $GITHUB_OUTPUT
+          else
+            echo "mgr=yarn" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Validate backport PR
+        id: validate
+        run: |
+          if [ ! -f "./backport.sh" ]; then
+            echo "::error::No backport.sh found on this branch. This workflow only works on backport PRs with conflicts."
+            exit 1
+          fi
+          echo "backport.sh found, proceeding with conflict resolution"
+          cat ./backport.sh
+
+      - name: Set up git configuration
+        run: |
+          git config --global user.name "Metabase bot"
+          git config --global user.email "metabase-bot@metabase.com"
+          git config --global core.editor "true"
+
+      - name: Run backport script to create cherry-pick conflicts
+        id: backport
+        run: |
+          bash ./backport.sh 2>&1 || true
+
+          # Check if we're in a cherry-pick state with conflicts
+          CONFLICTED=$(git diff --name-only --diff-filter=U || true)
+          if [ -n "$CONFLICTED" ]; then
+            echo "has_conflicts=true" >> $GITHUB_OUTPUT
+            echo "conflicted_files<<EOF" >> $GITHUB_OUTPUT
+            echo "$CONFLICTED" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+            echo "::notice::Found conflicts in: $CONFLICTED"
+          else
+            echo "has_conflicts=false" >> $GITHUB_OUTPUT
+            echo "::notice::Cherry-pick applied cleanly, no conflicts to resolve"
+          fi
+
+      - name: Push clean cherry-pick (no conflicts)
+        if: steps.backport.outputs.has_conflicts == 'false'
+        run: git push --force
+
+      - name: Prepare back-end environment
+        if: steps.backport.outputs.has_conflicts == 'true'
+        uses: ./.github/actions/prepare-backend
+
+      - name: Prepare front-end environment
+        if: steps.backport.outputs.has_conflicts == 'true'
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Build CLJS for type checking
+        if: steps.backport.outputs.has_conflicts == 'true'
+        run: ${{ steps.pkg.outputs.mgr }} run build-pure:cljs
+
+      - name: Generate GitHub App Token for Claude
+        if: steps.backport.outputs.has_conflicts == 'true'
+        uses: actions/create-github-app-token@v1
+        id: claude-app-token
+        with:
+          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
+          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+
+      - name: Resolve conflicts with Claude
+        if: steps.backport.outputs.has_conflicts == 'true'
+        id: claude
+        uses: anthropics/claude-code-base-action@beta
+        env:
+          NODE_VERSION: "22"
+        with:
+          # TODO: get a dedicated API key, sharing repro bot's key for now
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_BACKPORT_FIX }}
+          model: "claude-sonnet-4-20250514"
+          max_turns: "${{ github.event.inputs.max_turns || '75' }}"
+          allowed_tools: "Read,Edit,Write,Bash(git:*),Bash(grep:*),Bash(find:*),Bash(ls:*),Bash(cat:*),Bash(clojure:*),Bash(${{ steps.pkg.outputs.mgr }} run type-check-pure:*),Bash(${{ steps.pkg.outputs.mgr }} run lint-eslint:*),Bash(./bin/mage cljfmt:*),Glob,Grep"
+          prompt: |
+            You are resolving git cherry-pick merge conflicts for a Metabase backport PR.
+
+            ## Context
+            A commit from the `master` branch is being cherry-picked onto the `${{ steps.pr.outputs.base_ref }}` release branch.
+            The cherry-pick has failed with conflicts in these files:
+
+            ${{ steps.backport.outputs.conflicted_files }}
+
+            ## How to read conflict markers
+            ```
+            <<<<<<< HEAD
+            (code from the release branch - the current state)
+            =======
+            (code from master - the change being backported)
+            >>>>>>> <commit-sha>
+            ```
+
+            ## Common conflict patterns in Metabase backports
+            - **Module/namespace renames**: A Clojure namespace was renamed or moved between versions. Check what the correct namespace is on the release branch.
+            - **Test file divergence**: Tests may have been added or reordered differently. Keep the backported test changes while preserving existing release-branch tests.
+            - **Import path changes**: Frontend imports may reference different paths. Check actual file locations on this branch.
+            - **Translation files (.po)**: For translation conflicts, prefer the release branch version of existing translations and add new translations from the backported change.
+            - **Minor context differences**: Surrounding code changed slightly. Adapt the backported change to fit the release branch context.
+
+            ## Instructions
+            1. Read each conflicted file to understand the conflict
+            2. For context, you may search the codebase to understand the current state of the release branch (e.g., check if a module exists at a certain path)
+            3. Resolve each conflict by editing the file to remove ALL conflict markers (`<<<<<<<`, `=======`, `>>>>>>>`) and leave only the correct resolved code
+            4. The goal is to apply the INTENT of the backported change while adapting it to the release branch's code structure
+            5. Verify no conflict markers remain by searching for them
+            6. Auto-format resolved files:
+               - **Clojure/ClojureScript** (.clj, .cljc, .cljs): run cljfmt to fix formatting:
+                 ```
+                 ./bin/mage cljfmt-files <file1> <file2> ...
+                 ```
+               - **TypeScript/JavaScript** (.ts, .tsx, .js, .jsx): run eslint with auto-fix:
+                 ```
+                 ${{ steps.pkg.outputs.mgr }} run lint-eslint --fix
+                 ```
+            7. Validate resolved files before committing:
+               - **Clojure/ClojureScript** (.clj, .cljc, .cljs): run clj-kondo to verify syntax:
+                 ```
+                 clojure -M:kondo --lint <file1> <file2> ...
+                 ```
+               - **TypeScript/JavaScript** (.ts, .tsx, .js, .jsx): run the type checker:
+                 ```
+                 ${{ steps.pkg.outputs.mgr }} run type-check-pure
+                 ```
+               If either tool reports errors or warnings, fix them before proceeding. CI treats kondo warnings as errors.
+               Repeat steps 6-7 until all errors are resolved.
+            7. Once all files are clean, stage and complete the cherry-pick:
+               ```
+               git add -A
+               git cherry-pick --continue
+               ```
+            8. Push the result:
+               ```
+               git push --force
+               ```
+
+            IMPORTANT: Do not skip any conflicted files. Every conflict marker must be resolved.
+
+      - name: Check for max turns exceeded
+        if: always() && steps.claude.outcome != 'skipped'
+        id: check-failure
+        run: |
+          if [ -f "${{ steps.claude.outputs.execution_file }}" ]; then
+            SUBTYPE=$(jq -r '.[] | select(.type == "result") | .subtype' "${{ steps.claude.outputs.execution_file }}" | tail -1)
+            if [ "$SUBTYPE" = "error_max_turns" ]; then
+              echo "max_turns_exceeded=true" >> $GITHUB_OUTPUT
+            else
+              echo "max_turns_exceeded=false" >> $GITHUB_OUTPUT
+            fi
+          else
+            echo "max_turns_exceeded=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Get commit details
+        if: always() && steps.claude.outcome == 'success' && steps.check-failure.outputs.max_turns_exceeded != 'true'
+        id: commit-info
+        run: |
+          echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+          FILES=$(git diff --name-only HEAD~1)
+          echo "changed_files<<EOF" >> $GITHUB_OUTPUT
+          echo "$FILES" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Comment on PR (success)
+        if: always() && steps.claude.outcome == 'success' && steps.check-failure.outputs.max_turns_exceeded != 'true'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: |
+            const sha = '${{ steps.commit-info.outputs.sha }}';
+            const changedFiles = `${{ steps.commit-info.outputs.changed_files }}`.trim().split('\n').map(f => `- \`${f}\``).join('\n');
+            await github.rest.issues.createComment({
+              issue_number: ${{ steps.pr.outputs.number }},
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: [
+                '🤖 Backport conflicts have been automatically resolved and force-pushed.',
+                '',
+                `**Commit:** [\`${sha.substring(0, 10)}\`](https://github.com/${context.repo.owner}/${context.repo.repo}/commit/${sha})`,
+                '',
+                '<details>',
+                '<summary>Changed files</summary>',
+                '',
+                changedFiles,
+                '',
+                '</details>',
+                '',
+                'Please review the changes to make sure the resolution is correct before merging.',
+              ].join('\n')
+            });
+
+      - name: Comment on PR (max turns exceeded)
+        if: always() && steps.check-failure.outputs.max_turns_exceeded == 'true'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: |
+            await github.rest.issues.createComment({
+              issue_number: ${{ steps.pr.outputs.number }},
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: [
+                '🤖 Auto-resolution of backport conflicts stopped because Claude reached the maximum number of turns (${{ github.event.inputs.max_turns || '75' }}).',
+                '',
+                'The conflicts may be too complex for automatic resolution, or Claude needed more turns to finish.',
+                '',
+                'You can try again with more turns by manually running the [resolve-backport-conflicts workflow](https://github.com/' + context.repo.owner + '/' + context.repo.repo + '/actions/workflows/resolve-backport-conflicts.yml) with a higher `max_turns` value, or resolve the conflicts manually by checking out the branch and running `./backport.sh`.',
+              ].join('\n')
+            });
+
+      - name: Comment on PR (failure)
+        if: always() && steps.claude.outcome == 'failure' && steps.check-failure.outputs.max_turns_exceeded != 'true'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: |
+            await github.rest.issues.createComment({
+              issue_number: ${{ steps.pr.outputs.number }},
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: [
+                '🤖 Auto-resolution of backport conflicts failed.',
+                '',
+                'Manual resolution is still required. Check out the branch and run `./backport.sh` to resolve conflicts manually.',
+              ].join('\n')
+            });
+
+      - name: Comment on PR (clean cherry-pick)
+        if: always() && steps.backport.outputs.has_conflicts == 'false'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: |
+            await github.rest.issues.createComment({
+              issue_number: ${{ steps.pr.outputs.number }},
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: '🤖 Cherry-pick applied cleanly with no conflicts. Force-pushed the resolved branch.'
+            });
+
+      - name: Remove label
+        if: always()
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: |
+            try {
+              await github.rest.issues.removeLabel({
+                issue_number: ${{ steps.pr.outputs.number }},
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: 'auto-resolve-conflicts'
+              });
+            } catch (e) {
+              console.log('Label already removed or not found:', e.message);
+            }

.github/workflows/run-tests.yml

@@ -14,7 +14,7 @@ jobs:
   files-changed:
     if: ${{ !contains(github.event.pull_request.labels.*.name,'ci skip') && !contains(github.event.pull_request.labels.*.name,'minimal-tests') }}
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       e2e_all: ${{ steps.changes.outputs.e2e_all }}
@@ -81,7 +81,7 @@ jobs:
     secrets: inherit
     with:
       skip: ${{ needs.files-changed.outputs.frontend_all != 'true' }}
-      skip-lint: ${{ needs.files-changed.outputs.frontend_all != 'true' && needs.files-changed.outputs.e2e_specs != 'true' }}
+      skip-lint: ${{ needs.files-changed.outputs.frontend_all != 'true' && needs.files-changed.outputs.e2e_all != 'true' }}
 
   e2e-tests:
     needs: [files-changed, uberjar]
@@ -103,7 +103,8 @@ jobs:
       (needs.files-changed.outputs.embedding_sdk_components == 'true' ||
       needs.files-changed.outputs.frontend_sources == 'true' ||
       needs.files-changed.outputs.embedding_documentation == 'true' ||
-      needs.files-changed.outputs.embedding_sdk_ci == 'true')
+      needs.files-changed.outputs.embedding_sdk_ci == 'true' ||
+      needs.files-changed.outputs.embedding_sdk_host_sample_apps == 'true')
     uses: ./.github/workflows/embedding-sdk-package-build.yml
     secrets: inherit
 

.github/workflows/security-slack-notification.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   on-issue-opened:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     if: github.event.label.name == 'SECURITY'
     steps:

.github/workflows/semantic-search.yml

@@ -14,8 +14,8 @@ concurrency:
 jobs:
   semantic-search-tests-h2:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -46,6 +46,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -64,22 +65,23 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   semantic-search-tests-mariadb:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
           - name: MariaDB 10.2 with pgvector pg17
             junit-name: semantic-search-tests-mariadb-10-2
-            mariadb-image: circleci/mariadb:10.2.23
+            mariadb-image: metabase/mariadb:10.2.23
             pgvector-image: pgvector/pgvector:pg17
           - name: MariaDB Latest with pgvector pg17
             junit-name: semantic-search-tests-mariadb-latest
-            mariadb-image: circleci/mariadb:latest
+            mariadb-image: mariadb:latest
             pgvector-image: pgvector/pgvector:pg17
         job:
           - name: Semantic Search Tests
@@ -118,6 +120,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -136,18 +139,19 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   semantic-search-tests-mysql:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
           - name: MySQL 8.0 with pgvector pg17
             junit-name: semantic-search-tests-mysql-8-0
-            mysql-image: cimg/mysql:8.0
+            mysql-image: mysql:8.0
             pgvector-image: pgvector/pgvector:pg17
           - name: MySQL Latest with pgvector pg17
             junit-name: semantic-search-tests-mysql-latest
@@ -190,6 +194,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -208,11 +213,12 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   semantic-search-tests-postgres:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -263,6 +269,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -281,6 +288,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   semantic-search-tests-result:
     needs:
@@ -288,7 +296,7 @@ jobs:
       - semantic-search-tests-mariadb
       - semantic-search-tests-mysql
       - semantic-search-tests-postgres
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: semantic-search-tests-result
     if: always() && !cancelled()

.github/workflows/set-announce-url.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   set-announce-url:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
       - name: Validate input

.github/workflows/snowplow.yml

@@ -8,7 +8,7 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       snowplow: ${{ steps.changes.outputs.snowplow }}
@@ -24,7 +24,7 @@ jobs:
   lint:
     needs: files-changed
     if: needs.files-changed.outputs.snowplow == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4