🤖 backported "Better human validation of notification schemas " (#77925)

Better human validation of notification schemas  (#77922)

* fix: tighten schema

* 400 rather than 500

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>

.claude/skills/add-tracing/SKILL.md

@@ -1,4 +1,4 @@
---b-
+---
 name: add-tracing
 description: Add OpenTelemetry tracing spans to Clojure code following Metabase tracing conventions. Use when instrumenting backend code with trace coverage.
 ---

.claude/skills/analytics-events/SKILL.md

@@ -15,7 +15,7 @@ Analytics events in Metabase use Snowplow with typed event schemas. All events m
 **Key Files:**
 - `frontend/src/metabase-types/analytics/event.ts` - Event type definitions
 - `frontend/src/metabase-types/analytics/schema.ts` - Schema registry
-- `frontend/src/metabase/lib/analytics.ts` - Core tracking functions
+- `frontend/src/metabase/analytics/` - Core tracking functions (import from `metabase/analytics`)
 - Feature-specific `analytics.ts` files - Tracking function wrappers
 
 ## Quick Checklist
@@ -91,7 +91,7 @@ export type DataStudioEvent =
 In your feature's `analytics.ts` file (e.g., `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`):
 
 ```typescript
-import { trackSimpleEvent } from "metabase/lib/analytics";
+import { trackSimpleEvent } from "metabase/analytics";
 
 export const trackDataStudioTablePickerFiltersApplied = () => {
   trackSimpleEvent({
@@ -471,7 +471,7 @@ Event type definitions (all in one place):
 frontend/src/metabase-types/analytics/event.ts
 
 Core tracking utilities:
-frontend/src/metabase/lib/analytics.ts
+frontend/src/metabase/analytics/ (import from `metabase/analytics`)
 ```
 
 ## Real-World Examples

.claude/skills/clojure-eval/SKILL.md

@@ -0,0 +1,173 @@
+---
+name: clojure-eval
+description: Evaluate Clojure code via nREPL using clj-nrepl-eval. Use this when you need to test code, check if edited files compile, verify function behavior, or interact with a running REPL session.
+---
+
+# Clojure REPL Evaluation
+
+## When to Use This Skill
+
+Use this skill when you need to:
+- **Verify that edited Clojure files compile and load correctly**
+- Test function behavior interactively
+- Check the current state of the REPL
+- Debug code by evaluating expressions
+- Require or load namespaces for testing
+- Validate that code changes work before committing
+
+## How It Works
+
+The `clj-nrepl-eval` command evaluates Clojure code against an nREPL server. **Session state persists between evaluations**, so you can require a namespace in one evaluation and use it in subsequent calls. Each host:port combination maintains its own session file.
+
+## Instructions
+
+### 0. Discover and select nREPL server
+
+First, discover what nREPL servers are running in the current directory:
+
+```bash
+clj-nrepl-eval --discover-ports
+```
+
+This will show all nREPL servers (Clojure, Babashka, shadow-cljs, etc.) running in the current project directory.
+
+**Then use the AskUserQuestion tool:**
+
+- **If ports are discovered:** Prompt user to select which nREPL port to use:
+  - **question:** "Which nREPL port would you like to use?"
+  - **header:** "nREPL Port"
+  - **options:** Present each discovered port as an option with:
+    - **label:** The port number
+    - **description:** The server type and status (e.g., "Clojure nREPL server in current directory")
+  - Include up to 4 discovered ports as options
+  - The user can select "Other" to enter a custom port number
+
+- **If no ports are discovered:** Prompt user how to start an nREPL server:
+  - **question:** "No nREPL servers found. How would you like to start one?"
+  - **header:** "Start nREPL"
+  - **options:**
+    - **label:** "deps.edn alias", **description:** "Find and use an nREPL alias in deps.edn"
+    - **label:** "Leiningen", **description:** "Start nREPL using 'lein repl'"
+  - The user can select "Other" for alternative methods or if they already have a server running on a specific port
+
+IMPORTANT: IF you start a REPL do not supply a port let the nREPL start and return the port that it was started on.
+
+### 1. Evaluate Clojure Code
+
+> Evaluation automatically connects to the given port
+
+Use the `-p` flag to specify the port and pass your Clojure code.
+
+**Recommended: Pass code as a command-line argument:**
+```bash
+clj-nrepl-eval -p <PORT> "(+ 1 2 3)"
+```
+
+**For multiple expressions (single line):**
+```bash
+clj-nrepl-eval -p <PORT> "(def x 10) (+ x 20)"
+```
+
+**Alternative: Using heredoc (may require permission approval for multiline commands):**
+```bash
+clj-nrepl-eval -p <PORT> <<'EOF'
+(def x 10)
+(+ x 20)
+EOF
+```
+
+**Alternative: Via stdin pipe:**
+```bash
+echo "(+ 1 2 3)" | clj-nrepl-eval -p <PORT>
+```
+
+### 2. Display nREPL Sessions
+
+**Discover all nREPL servers in current directory:**
+```bash
+clj-nrepl-eval --discover-ports
+```
+Shows all running nREPL servers in the current project directory, including their type (clj/bb/basilisp) and whether they match the current working directory.
+
+**Check previously connected sessions:**
+```bash
+clj-nrepl-eval --connected-ports
+```
+Shows only connections you have made before (appears after first evaluation on a port).
+
+### 3. Common Patterns
+
+**Require a namespace (always use :reload to pick up changes):**
+```bash
+clj-nrepl-eval -p <PORT> "(require '[my.namespace :as ns] :reload)"
+```
+
+**Test a function after requiring:**
+```bash
+clj-nrepl-eval -p <PORT> "(ns/my-function arg1 arg2)"
+```
+
+**Check if a file compiles:**
+```bash
+clj-nrepl-eval -p <PORT> "(require 'my.namespace :reload)"
+```
+
+**Multiple expressions:**
+```bash
+clj-nrepl-eval -p <PORT> "(def x 10) (* x 2) (+ x 5)"
+```
+
+**Complex multiline code (using heredoc):**
+```bash
+clj-nrepl-eval -p <PORT> <<'EOF'
+(def x 10)
+(* x 2)
+(+ x 5)
+EOF
+```
+*Note: Heredoc syntax may require permission approval.*
+
+**With custom timeout (in milliseconds):**
+```bash
+clj-nrepl-eval -p <PORT> --timeout 5000 "(long-running-fn)"
+```
+
+**Reset the session (clears all state):**
+```bash
+clj-nrepl-eval -p <PORT> --reset-session
+clj-nrepl-eval -p <PORT> --reset-session "(def x 1)"
+```
+
+## Available Options
+
+- `-p, --port PORT` - nREPL port (required)
+- `-H, --host HOST` - nREPL host (default: 127.0.0.1)
+- `-t, --timeout MILLISECONDS` - Timeout (default: 120000 = 2 minutes)
+- `-r, --reset-session` - Reset the persistent nREPL session
+- `-c, --connected-ports` - List previously connected nREPL sessions
+- `-d, --discover-ports` - Discover nREPL servers in current directory
+- `-h, --help` - Show help message
+
+## Important Notes
+
+- **Prefer command-line arguments:** Pass code as quoted strings: `clj-nrepl-eval -p <PORT> "(+ 1 2 3)"` - works with existing permissions
+- **Heredoc for complex code:** Use heredoc (`<<'EOF' ... EOF`) for truly multiline code, but note it may require permission approval
+- **Sessions persist:** State (vars, namespaces, loaded libraries) persists across invocations until the nREPL server restarts or `--reset-session` is used
+- **Automatic delimiter repair:** The tool automatically repairs missing or mismatched parentheses
+- **Always use :reload:** When requiring namespaces, use `:reload` to pick up recent changes
+- **Default timeout:** 2 minutes (120000ms) - increase for long-running operations
+- **Input precedence:** Command-line arguments take precedence over stdin
+
+## Typical Workflow
+
+1. Discover nREPL servers: `clj-nrepl-eval --discover-ports`
+2. Use **AskUserQuestion** tool to prompt user to select a port
+3. Require namespace:
+   ```bash
+   clj-nrepl-eval -p <PORT> "(require '[my.ns :as ns] :reload)"
+   ```
+4. Test function:
+   ```bash
+   clj-nrepl-eval -p <PORT> "(ns/my-fn ...)"
+   ```
+5. Iterate: Make changes, re-require with `:reload`, test again

.claude/skills/clojure-write/SKILL.md

@@ -67,3 +67,7 @@ Only fall back to `./bin/mage` commands when clojure-mcp is not available.
 - End all files with a newline
 - When editing tabular code, where the columns line up, try to keep them aligned
 - Spaces on a line with nothing after it is not allowed
+- After changing module boundaries (adding/removing/renaming a `src` namespace, a cross-module `require`
+  or `:model/X` reference, or a new module), run `./bin/mage fix-modules-config` to regenerate
+  `.clj-kondo/config/modules/config.edn` and keep `metabase.core.modules-test` green. No-op when nothing
+  drifted; see "Module Boundaries" in the project `CLAUDE.md`.

.claude/skills/emotion-migrate/SKILL.md

@@ -0,0 +1,834 @@
+---
+name: emotion-migrate
+description: Migrate Emotion styled-components to Mantine components with style props and CSS modules. Use when converting .styled.tsx files or removing @emotion imports from components.
+---
+
+# Emotion → Mantine + CSS Modules Migration Skill
+
+Migrate Emotion styled-components (`@emotion/styled`, `@emotion/react`) to Mantine layout components with style props and CSS modules. The goal is zero Emotion imports, zero inline styles, and maximum use of design system tokens.
+
+## Priority Order (Strict)
+
+1. **Mantine components + style props** — `Box`, `Flex`, `Stack`, `Group`, `Text`, `Title`, `Card`. This is the DEFAULT. Every CSS property must be checked against style props FIRST.
+2. **CSS modules** (`.module.css`) — ONLY for properties that Mantine style props genuinely cannot express: pseudo-selectors (`:hover`, `:focus`, `::before`), `box-shadow`, `border` shorthand, `animation`/`@keyframes`, complex selectors, `cursor`, `pointer-events`, `overflow`, `text-overflow`, `white-space`, `transition`.
+3. **Inline styles ONLY for dynamic values** — `style={{ }}` is allowed only for truly dynamic runtime values (e.g., computed widths, positions, data-driven colors). All static styles must use Mantine props or CSS modules.
+
+### Mantine-First Decision Gate (CRITICAL)
+
+For EACH styled component, go through every CSS property and ask: "Can this be a Mantine style prop?" If yes → style prop. If no → CSS module. Do NOT dump an entire component into a CSS module just because one property needs it — split them.
+
+**Properties that ARE style props** (use these, not CSS modules):
+
+- `display` → `display` prop
+- `color` → `c` prop (`c="brand"`, `c="text-primary"`)
+- `background-color` → `bg` prop (`bg="background-primary"`)
+- `font-size` → `fz` prop (`fz="md"`)
+- `font-weight` → `fw` prop (`fw="bold"`)
+- `line-height` → `lh` prop (`lh="md"`)
+- `text-align` → `ta` prop (`ta="center"`)
+- `padding` (all variants) → `p`, `px`, `py`, `pt`, `pb`, `pl`, `pr`
+- `margin` (all variants) → `m`, `mx`, `my`, `mt`, `mb`, `ml`, `mr`
+- `width` → `w`, `min-width` → `miw`, `max-width` → `maw`
+- `height` → `h`, `min-height` → `mih`, `max-height` → `mah`
+- `flex` → `flex` prop (`flex="0 0 auto"`, `flex={1}`)
+- `gap` → `gap` prop (on Flex/Stack/Group)
+- `align-items` → `align` prop (on Flex/Stack/Group)
+- `justify-content` → `justify` prop (on Flex/Stack/Group)
+- `flex-direction` → `direction` prop (on Flex)
+- `flex-wrap` → `wrap` prop (on Flex)
+- `position` → `pos` prop
+- `top/right/bottom/left` → `top`, `right`, `bottom`, `left` props
+- `opacity` → `opacity` prop
+
+**Properties that NEED CSS modules** (no style prop equivalent):
+
+- `:hover`, `:focus`, `:active`, `::before`, `::after` (pseudo-selectors)
+- `box-shadow`, `border` (shorthand with color), `outline`
+- `cursor`, `pointer-events`
+- `overflow`, `text-overflow`, `white-space`
+- `animation`, `transition`, `transform`
+- `@media` queries (UNLESS it's simple responsive spacing/sizing — then use responsive syntax: `p={{ base: "md", lg: "xl" }}`)
+
+**Hybrid approach** — when a component needs BOTH, put style props on the Mantine component AND add a CSS module class for the rest:
+
+```tsx
+<Flex
+  className={S.root}       /* for :hover, box-shadow, border */
+  align="center"            /* style prop */
+  gap="sm"                  /* style prop */
+  p="md"                    /* style prop */
+  bg="background-primary"   /* style prop */
+>
+```
+
+## CSS Module Conventions (Strict)
+
+### Class Naming: camelCase
+
+All CSS module class names MUST use **camelCase**. This is the dominant convention across the codebase (~830 camelCase vs ~620 PascalCase classes), used consistently in Mantine UI components, and matches standard CSS module conventions.
+
+```css
+/* CORRECT */
+.root {
+}
+.settingsSection {
+}
+.dragHandle {
+}
+.closeIcon {
+}
+
+/* WRONG — do not use PascalCase or kebab-case */
+.ItemRoot {
+}
+.settings-section {
+}
+```
+
+Modifier/state classes also use camelCase:
+
+```css
+.selected {
+}
+.disabled {
+}
+.interactive {
+}
+.draggable {
+}
+```
+
+### No Cascading — Direct Class Assignment
+
+Cascading selectors are **discouraged**. Instead of styling through parent-child relationships, assign a class directly to the element that needs styling.
+
+```css
+/* WRONG — cascading/descendant selectors */
+.root > input {
+}
+.root .label {
+}
+.container > div > span {
+}
+
+/* CORRECT — direct class on the target element */
+.input {
+}
+.label {
+}
+.title {
+}
+```
+
+The only acceptable nesting patterns are:
+
+- **Pseudo-selectors on the same element**: `.item { &:hover { } }`
+- **Modifier composition**: `.item { &.selected { } }`
+- **Hover-reveal patterns** where a parent hover affects a child: `.root:hover .showOnHover { opacity: 1; }` — but only when structurally necessary (the child has no way to know about the parent's hover state)
+
+### Import Alias
+
+Always import the CSS module as `S`:
+
+```tsx
+import S from "./ComponentName.module.css";
+```
+
+## Step-by-Step Migration Process
+
+### Step 1: Read and Understand
+
+Read the `.styled.tsx` file AND every component that imports from it. Understand:
+
+- Which styled components are used and where
+- Which props drive dynamic styles
+- Which styles are static vs conditional
+- Which styles can map directly to Mantine style props
+
+### Step 2: Classify Each Styled Component
+
+For each styled component, apply the Mantine-First Decision Gate above. Then determine the migration target:
+
+| Emotion Pattern                                              | Migration Target                                                                                                                                                           |
+| ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `styled.div` with only layout/spacing/color                  | `Box`, `Flex`, `Stack`, or `Group` with style props. **NO CSS module needed.**                                                                                             |
+| `styled.div` with flexbox column                             | `Stack` component with style props                                                                                                                                         |
+| `styled.div` with flexbox row                                | `Flex` or `Group` component with style props                                                                                                                               |
+| `styled.span` / `styled.p` with color/weight/size            | **`Text component="span"` with style props** (`c`, `fw`, `fz`). NO CSS module.                                                                                             |
+| `styled.div` with hover/focus/pseudo-selectors               | **Hybrid**: Mantine component with style props for expressible properties + CSS module class for pseudo-selectors only                                                     |
+| `styled.div` with media queries (simple spacing/sizing)      | **Responsive style props**: `p={{ base: "md", lg: "xl" }}`. NO CSS module.                                                                                                 |
+| `styled.div` with media queries (complex/non-spacing)        | CSS module for the media query parts, style props for the rest                                                                                                             |
+| `styled.div` with animations/keyframes                       | CSS module for animation, style props for layout                                                                                                                           |
+| `styled(SomeComponent)` with only color/spacing/flex         | **Wrap in Mantine component** with style props: `<Box c="brand" flex="0 0 auto"><Icon /></Box>`, or pass style props if the component accepts them                         |
+| `styled(SomeComponent)` with pseudo-selectors/complex styles | CSS module `className` on the component                                                                                                                                    |
+| Dynamic props `styled.div<{ isActive: boolean }>`            | Mantine style props for simple toggles (`c={active ? "brand" : "text-primary"}`), `cx()` with CSS module classes for complex state combinations involving pseudo-selectors |
+
+### Step 3: Create CSS Module (if needed)
+
+Create `ComponentName.module.css` alongside the component file:
+
+```css
+/* Use design system tokens — NEVER raw color/spacing values */
+.root {
+  border: 1px solid var(--mb-color-border);
+  border-radius: var(--mantine-radius-md);
+  background-color: var(--mb-color-background-primary);
+}
+
+/* Conditional states as separate classes, combined with cx() */
+.active {
+  background-color: var(--mb-color-brand);
+  color: var(--mb-color-text-primary-inverse);
+}
+
+.disabled {
+  color: var(--mb-color-text-tertiary);
+  pointer-events: none;
+}
+
+/* Hover/focus/pseudo-selectors — nest with & */
+.interactive {
+  cursor: pointer;
+
+  &:hover {
+    color: var(--mb-color-brand);
+    background-color: var(--mb-color-background-hover);
+  }
+}
+
+/* Hover-reveal: acceptable parent→child nesting */
+.root:hover .showOnHover {
+  opacity: 1;
+}
+
+/* Responsive styles */
+@media (--breakpoint-min-md) {
+  .root {
+    padding: var(--mantine-spacing-lg);
+  }
+}
+```
+
+### Step 4: Update the Component TSX
+
+```tsx
+import cx from "classnames";
+import CS from "metabase/css/core/index.css";
+import { Box, Flex, Group, Stack, Text } from "metabase/ui";
+import S from "./ComponentName.module.css";
+
+// Dynamic props → cx() with conditional classes
+<Flex
+  className={cx(S.root, {
+    [S.active]: isActive,
+    [S.disabled]: disabled,
+  })}
+  align="center"
+  gap="sm"
+  p="md"
+  w="100%"
+>
+```
+
+### Step 5: Delete the `.styled.tsx` File
+
+Remove the old styled file entirely. Remove all imports of it from other files.
+
+### Step 6: Verify
+
+- Confirm zero `@emotion/styled` or `@emotion/react` imports remain in the migrated files
+- Confirm no static inline styles (dynamic runtime values are fine)
+- Confirm all colors use tokens, not raw hex/rgb values
+
+## Design System Token Reference
+
+### Mantine Style Props (use directly on components)
+
+**Spacing** (`p`, `px`, `py`, `pt`, `pb`, `pl`, `pr`, `m`, `mx`, `my`, `mt`, `mb`, `ml`, `mr`):
+
+- `"xs"` = 4px, `"sm"` = 8px, `"md"` = 16px, `"lg"` = 24px, `"xl"` = 32px
+- Custom: `rem(48)` for non-standard values (import `rem` from `metabase/ui`)
+
+**Dimensions** (`w`, `h`, `maw`, `mah`, `miw`, `mih`):
+
+- `"100%"`, `"100vh"`, `rem(400)`, etc.
+
+**Colors** (`c`, `bg`):
+
+- Text: `"text-primary"`, `"text-secondary"`, `"text-tertiary"`
+- Background: `"background-primary"`, `"background-secondary"`, `"background-hover"`
+- Brand: `"brand"`, `"error"`, `"success"`, `"warning"`
+
+**Typography** (`fz`, `fw`, `lh`, `ta`, `ff`):
+
+- Font size: `"xs"` = 11px, `"sm"` = 12px, `"md"` = 14px, `"lg"` = 17px, `"xl"` = 21px
+- Font weight: `"bold"`, `"normal"`, or numeric `700`
+- Line height: `"xs"` = 100%, `"sm"` = 115%, `"md"` = 122%, `"lg"` = 138%, `"xl"` = 150%
+- Text align: `"center"`, `"left"`, `"right"`
+
+**Flexbox** (`align`, `justify`, `gap`, `direction`, `wrap`, `flex`):
+
+- `align="center"`, `justify="space-between"`, `gap="sm"`, `direction="column"`, `wrap="nowrap"`
+- `flex={1}`, `flex="0 0 auto"`
+
+**Other**: `pos` (position), `display`
+
+**Responsive syntax**: `px={{ base: "md", md: "lg", lg: rem(48) }}`
+
+### CSS Variable Tokens (use in `.module.css` files)
+
+**Colors** — `var(--mb-color-<name>)`:
+
+- `--mb-color-text-primary`, `--mb-color-text-secondary`, `--mb-color-text-tertiary`
+- `--mb-color-background-primary`, `--mb-color-background-secondary`, `--mb-color-background-hover`
+- `--mb-color-border`, `--mb-color-border-strong`, `--mb-color-border-subtle`
+- `--mb-color-brand`, `--mb-color-brand-hover`
+- `--mb-color-error`, `--mb-color-success`, `--mb-color-warning`
+- `--mb-color-shadow`, `--mb-color-focus`
+- `--mb-color-accent0` through `--mb-color-accent7`
+
+**Mantine spacing** — `var(--mantine-spacing-<size>)`:
+
+- `--mantine-spacing-xs` (4px), `--mantine-spacing-sm` (8px), `--mantine-spacing-md` (16px), `--mantine-spacing-lg` (24px), `--mantine-spacing-xl` (32px)
+
+**Mantine radius** — `var(--mantine-radius-<size>)`:
+
+- `--mantine-radius-xs` (4px), `--mantine-radius-sm` (6px), `--mantine-radius-md` (8px), `--mantine-radius-xl` (40px)
+
+**Mantine font sizes** — `var(--mantine-font-size-<size>)`:
+
+- `--mantine-font-size-xs` (11px), `--mantine-font-size-sm` (12px), `--mantine-font-size-md` (14px), `--mantine-font-size-lg` (17px), `--mantine-font-size-xl` (21px)
+
+**Breakpoints** (in `.module.css` files):
+
+- `@media (--breakpoint-min-sm)` (40em / 640px)
+- `@media (--breakpoint-min-md)` (60em / 960px)
+- `@media (--breakpoint-min-lg)` (80em / 1280px)
+- `@media (--breakpoint-min-xl)` (120em / 1920px)
+- Also available: `--breakpoint-max-*` variants
+
+### Snap Hardcoded Literals to Nearest Design Token (CRITICAL)
+
+When migrating, **never carry over hardcoded `rem`/`px` values** from the original Emotion code. Instead, snap them to the nearest design system token. The original values were often arbitrary — the migration is an opportunity to align with the design system.
+
+**Spacing** — snap to the nearest Mantine spacing token:
+
+| Hardcoded value                   | Nearest token | Style prop   | CSS variable                   |
+| --------------------------------- | ------------- | ------------ | ------------------------------ |
+| `0.125rem` (2px)                  | `2px`         | `2` (number) | `2px` (keep literal, no token) |
+| `0.2rem` (3.2px), `0.25rem` (4px) | **xs** (4px)  | `"xs"`       | `var(--mantine-spacing-xs)`    |
+| `0.5rem` (8px)                    | **sm** (8px)  | `"sm"`       | `var(--mantine-spacing-sm)`    |
+| `0.75rem` (12px)                  | between sm/md | `rem(12)`    | `0.75rem` (no exact token)     |
+| `1rem` (16px)                     | **md** (16px) | `"md"`       | `var(--mantine-spacing-md)`    |
+| `1.5rem` (24px)                   | **lg** (24px) | `"lg"`       | `var(--mantine-spacing-lg)`    |
+| `2rem` (32px)                     | **xl** (32px) | `"xl"`       | `var(--mantine-spacing-xl)`    |
+
+**Border radius** — snap to the nearest Mantine radius token:
+
+| Hardcoded value  | Nearest token                 | CSS variable               |
+| ---------------- | ----------------------------- | -------------------------- |
+| `0.25rem` (4px)  | **xs** (4px)                  | `var(--mantine-radius-xs)` |
+| `0.375rem` (6px) | **sm** (6px)                  | `var(--mantine-radius-sm)` |
+| `0.5rem` (8px)   | **md** (8px)                  | `var(--mantine-radius-md)` |
+| `1rem`+ (16px+)  | **xl** (40px) or keep literal | `var(--mantine-radius-xl)` |
+
+**Font sizes** — snap to the nearest Mantine font size token:
+
+| Hardcoded value                  | Nearest token | Style prop | CSS variable                  |
+| -------------------------------- | ------------- | ---------- | ----------------------------- |
+| `0.6875rem` (11px)               | **xs** (11px) | `fz="xs"`  | `var(--mantine-font-size-xs)` |
+| `0.75rem` (12px)                 | **sm** (12px) | `fz="sm"`  | `var(--mantine-font-size-sm)` |
+| `0.875rem` (14px), `1rem` (16px) | **md** (14px) | `fz="md"`  | `var(--mantine-font-size-md)` |
+| `1.063rem` (17px)                | **lg** (17px) | `fz="lg"`  | `var(--mantine-font-size-lg)` |
+| `1.3rem` (21px)                  | **xl** (21px) | `fz="xl"`  | `var(--mantine-font-size-xl)` |
+
+**Rules:**
+
+- If the hardcoded value is within ~2px of a token, use the token
+- If it falls exactly between two tokens, prefer the smaller one (tighter is safer)
+- If no token is close (e.g., `48px` spacing), use `rem(48)` for style props or the literal value in CSS modules
+- This applies everywhere: style props, CSS module values, Icon `size` props, etc.
+
+## Common Migration Patterns
+
+### Pattern 1: Static Layout Container → Mantine Component
+
+**Before:**
+
+```tsx
+// Component.styled.tsx
+export const Container = styled.div`
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 1rem;
+  width: 100%;
+`;
+```
+
+**After:**
+
+```tsx
+<Flex align="center" gap="sm" p="md" w="100%">
+```
+
+### Pattern 2: Vertical Stack → Stack Component
+
+**Before:**
+
+```tsx
+export const Wrapper = styled.div`
+  display: flex;
+  flex-direction: column;
+  gap: 1.5rem;
+  padding: 2rem;
+`;
+```
+
+**After:**
+
+```tsx
+<Stack gap="lg" p="xl">
+```
+
+### Pattern 3: Dynamic Props → cx() with CSS Module Classes
+
+**Before:**
+
+```tsx
+export const Item = styled.div<{ isSelected: boolean; disabled: boolean }>`
+  color: ${(props) =>
+    props.disabled ? color("text-tertiary") : color("text-primary")};
+  background-color: ${(props) =>
+    props.isSelected ? color("brand") : "transparent"};
+  cursor: ${(props) => (props.disabled ? "default" : "pointer")};
+
+  &:hover {
+    color: ${(props) => !props.disabled && color("brand")};
+  }
+`;
+```
+
+**After (CSS module):**
+
+```css
+/* Item.module.css */
+.itemRoot {
+  color: var(--mb-color-text-primary);
+  cursor: pointer;
+
+  &:hover {
+    color: var(--mb-color-brand);
+  }
+}
+
+.selected {
+  background-color: var(--mb-color-brand);
+}
+
+.disabled {
+  color: var(--mb-color-text-tertiary);
+  cursor: default;
+
+  &:hover {
+    color: var(--mb-color-text-tertiary);
+  }
+}
+```
+
+**After (TSX):**
+
+```tsx
+<Box
+  className={cx(S.itemRoot, {
+    [S.selected]: isSelected,
+    [S.disabled]: disabled,
+  })}
+>
+```
+
+### Pattern 4: Extending a Component → Style Props First, CSS Module Only If Needed
+
+When a styled component wraps another component, first check if the styles can be expressed as style props on a Mantine wrapper or on the component itself. Only use a CSS module when properties genuinely need it.
+
+**Before:**
+
+```tsx
+export const CardIcon = styled(Icon)`
+  display: block;
+  flex: 0 0 auto;
+  color: var(--mb-color-brand);
+`;
+
+export const CardTitle = styled(Ellipsified)`
+  color: var(--mb-color-text-primary);
+  font-size: 1rem;
+  font-weight: bold;
+  margin-left: 1rem;
+`;
+```
+
+**After — style props on Mantine wrapper (preferred when ALL properties are expressible):**
+
+```tsx
+<Box display="block" flex="0 0 auto" c="brand">
+  <Icon {...icon} />
+</Box>
+<Box c="text-primary" fz="md" fw="bold" ml="md">
+  <Ellipsified>{title}</Ellipsified>
+</Box>
+```
+
+**After — CSS module (use only when component has pseudo-selectors or non-expressible styles):**
+
+```css
+.icon {
+  color: var(--mb-color-brand);
+  width: 1.5rem;
+  height: 1.5rem;
+  cursor: pointer;
+
+  &:hover {
+    color: var(--mb-color-brand-hover);
+  }
+}
+```
+
+```tsx
+<Icon className={S.icon} name="warning" />
+```
+
+### Pattern 4b: `styled.span` / `styled.p` with Text Styles → `Text` Component
+
+**Before:**
+
+```tsx
+export const Label = styled.span`
+  color: var(--mb-color-text-secondary);
+  font-weight: bold;
+`;
+
+export const Title = styled.span`
+  color: var(--mb-color-text-primary);
+  font-size: 1rem;
+  font-weight: bold;
+  margin-left: 0.5rem;
+`;
+```
+
+**After — `Text` component with style props (NO CSS module needed):**
+
+```tsx
+<Text component="span" c="text-secondary" fw="bold">
+  {label}
+</Text>
+
+<Text component="span" c="text-primary" fz="md" fw="bold" ml="sm">
+  {title}
+</Text>
+```
+
+`Text` renders as `<p>` by default. Use `component="span"` to render inline. All color, typography, and spacing props work directly — no CSS module needed for pure text styling.
+
+### Pattern 5: Keyframes Animation → CSS Module
+
+**Before:**
+
+```tsx
+const spin = keyframes`
+  from { transform: rotate(0deg); }
+  to { transform: rotate(360deg); }
+`;
+
+export const Spinner = styled.div`
+  animation: ${spin} 1s infinite linear;
+`;
+```
+
+**After (CSS module):**
+
+```css
+@keyframes spin {
+  from {
+    transform: rotate(0deg);
+  }
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+.spinner {
+  animation: spin 1s infinite linear;
+}
+```
+
+**After (TSX):**
+
+```tsx
+<Box className={S.spinner} />
+```
+
+### Pattern 6: color() Function → CSS Variables
+
+| Emotion (JS)            | CSS Module                                                   | Mantine Style Prop          |
+| ----------------------- | ------------------------------------------------------------ | --------------------------- |
+| `color("brand")`        | `var(--mb-color-brand)`                                      | `c="brand"` or `bg="brand"` |
+| `color("text-primary")` | `var(--mb-color-text-primary)`                               | `c="text-primary"`          |
+| `color("border")`       | `var(--mb-color-border)`                                     | N/A (use CSS module)        |
+| `alpha("brand", 0.2)`   | `color-mix(in srgb, var(--mb-color-brand), transparent 80%)` | N/A (use CSS module)        |
+
+### Pattern 7: Responsive Spacing/Sizing → Responsive Style Props (NOT CSS Media Queries)
+
+When a styled component only changes spacing, sizing, or other style-prop-expressible values at breakpoints, use Mantine's responsive syntax instead of CSS module media queries.
+
+**Before:**
+
+```tsx
+export const CaptionRoot = styled.div`
+  margin-bottom: 1.5rem;
+
+  ${breakpointMinExtraLarge} {
+    margin-bottom: 2rem;
+  }
+`;
+```
+
+**After — responsive style prop (NO CSS module needed):**
+
+```tsx
+<Flex mb={{ base: "lg", xl: "xl" }}>
+```
+
+Breakpoint keys: `base` (default), `xs` (40em), `sm` (48em), `md` (60em), `lg` (80em), `xl` (120em).
+
+Only use CSS module `@media` queries when the responsive change involves non-style-prop properties (e.g., `box-shadow`, `border`, `cursor` changes at breakpoints).
+
+### Pattern 8: Dynamic Computed Styles → Inline Styles
+
+Inline styles are allowed **only** for truly dynamic values computed at runtime (e.g., widths, positions, colors from data). Everything else must use Mantine style props or CSS modules.
+
+**Before:**
+
+```tsx
+export const Bar = styled.div<{ width: number }>`
+  width: ${(props) => props.width}%;
+`;
+```
+
+**After:**
+
+```tsx
+<Box style={{ width: `${width}%` }} />
+```
+
+### Pattern 9: Core CSS Utility Classes (Discouraged)
+
+**Do NOT introduce new `CS` utility class usage.** Core CSS utilities (`CS` from `metabase/css/core/index.css`) are legacy and discouraged for new code. Prefer Mantine style props or CSS modules instead.
+
+If existing code already uses `CS` classes and you're not migrating that specific code, leave them alone. But when migrating Emotion → Mantine, replace with the proper alternative:
+
+| Instead of `CS.*`   | Use                                                     |
+| ------------------- | ------------------------------------------------------- |
+| `CS.overflowHidden` | CSS module: `overflow: hidden`                          |
+| `CS.cursorPointer`  | CSS module: `cursor: pointer`                           |
+| `CS.flex1`          | Style prop: `flex={1}`                                  |
+| `CS.flexNoShrink`   | Style prop: `flex="0 0 auto"`                           |
+| `CS.textBrandHover` | CSS module: `&:hover { color: var(--mb-color-brand); }` |
+
+### Pattern 10: Shared Emotion Styles Across Files → Shared CSS Module + cx()
+
+When Emotion exports a shared `css` block (like `animationStyles`) imported by many files, create ONE CSS module with the shared keyframe and a reusable class, then compose via `cx()`.
+
+**Before (Emotion — shared animation used by 13+ skeleton files):**
+
+```tsx
+// ChartSkeleton.styled.tsx — defines shared animation
+const fadingKeyframes = keyframes`
+  0% { opacity: 0.0625; }
+  50% { opacity: 0.125; }
+  100% { opacity: 0.0625; }
+`;
+export const animationStyles = css`
+  opacity: 0.1;
+  animation: ${fadingKeyframes} 1.5s infinite;
+`;
+
+// AreaSkeleton.styled.tsx — consumes it
+import { animationStyles } from ".../ChartSkeleton.styled";
+export const SkeletonImage = styled.svg`
+  ${animationStyles};
+  flex: 1 1 0;
+  margin-top: 1rem;
+  border-bottom: 1px solid currentColor;
+`;
+
+// BarSkeleton.styled.tsx — also consumes it
+import { animationStyles } from ".../ChartSkeleton.styled";
+export const SkeletonImage = styled.svg`
+  ${animationStyles};
+  flex: 1 1 0;
+  margin-top: 1rem;
+`;
+```
+
+**After — shared CSS module:**
+
+```css
+/* ChartSkeleton.module.css */
+@keyframes fading {
+  0% {
+    opacity: 0.0625;
+  }
+
+  50% {
+    opacity: 0.125;
+  }
+
+  100% {
+    opacity: 0.0625;
+  }
+}
+
+.animated {
+  opacity: 0.1;
+  animation: fading 1.5s infinite;
+}
+```
+
+**After — per-component CSS modules with own styles only:**
+
+```css
+/* AreaSkeleton.module.css */
+.skeletonImage {
+  flex: 1 1 0;
+  margin-top: 1rem;
+  border-bottom: 1px solid currentColor;
+}
+```
+
+```css
+/* BarSkeleton.module.css */
+.skeletonImage {
+  flex: 1 1 0;
+  margin-top: 1rem;
+}
+```
+
+**After — component TSX uses cx() to compose:**
+
+```tsx
+// AreaSkeleton.tsx
+import cx from "classnames";
+import ChartSkeletonS from "../ChartSkeleton/ChartSkeleton.module.css";
+import S from "./AreaSkeleton.module.css";
+
+const AreaSkeleton = (): JSX.Element => {
+  return (
+    <svg
+      className={cx(ChartSkeletonS.animated, S.skeletonImage)}
+      xmlns="http://www.w3.org/2000/svg"
+      viewBox="0 0 371 113"
+      preserveAspectRatio="none"
+    >
+      <path d="..." fill="currentColor" />
+    </svg>
+  );
+};
+```
+
+The shared module owns the `@keyframes` and the `.animated` class. Each consumer composes it with its own module class via `cx()`. No duplication of the keyframe definition.
+
+## Import Template
+
+```tsx
+import cx from "classnames"; // only if needed for conditional classes
+
+import { Box, Flex, Group, Stack, Text, rem } from "metabase/ui";
+
+import S from "./ComponentName.module.css"; // only if CSS module is needed
+```
+
+## Checklist Before Finishing
+
+- [ ] **MANTINE-FIRST CHECK**: Every CSS property that has a style prop equivalent (`c`, `bg`, `p`, `m`, `fw`, `fz`, `flex`, `gap`, `align`, `w`, `h`, etc.) is expressed as a style prop, NOT in a CSS module
+- [ ] `styled.span`/`styled.p` with only color/weight/size are replaced with `Text component="span"` + style props, NOT CSS module classes
+- [ ] `styled.div` with only layout props are replaced with `Flex`/`Stack`/`Group`/`Box` + style props, NOT CSS module classes
+- [ ] Responsive spacing/sizing uses responsive style props (`mb={{ base: "lg", xl: "xl" }}`), NOT CSS module `@media` queries
+- [ ] CSS modules are used ONLY for: pseudo-selectors, box-shadow, border, cursor, overflow, animation, transition, transform, or complex selectors
+- [ ] All `@emotion/styled` and `@emotion/react` imports removed from migrated files
+- [ ] The `.styled.tsx` file is deleted
+- [ ] All imports of the deleted styled file are updated
+- [ ] No static inline styles — `style={{ }}` used only for truly dynamic runtime values
+- [ ] All colors use design tokens (`c="brand"`, `var(--mb-color-brand)`), not raw hex/rgb
+- [ ] All spacing uses design tokens (`p="md"`, `var(--mantine-spacing-md)`), not arbitrary px values — hardcoded `rem`/`px` literals snapped to the nearest token (see mapping table above)
+- [ ] All border-radius values use radius tokens (`var(--mantine-radius-md)`), not hardcoded `0.5rem`
+- [ ] All font sizes use font-size tokens (`fz="md"`, `var(--mantine-font-size-md)`), not hardcoded `1rem`
+- [ ] Layout uses Mantine components (`Flex`, `Stack`, `Group`, `Box`, `Text`) not raw divs/spans with CSS
+- [ ] All CSS module class names use camelCase
+- [ ] No cascading/descendant selectors targeting raw elements — use direct class assignment instead
+- [ ] Component renders identically to the original (visually verify if possible)
+
+## Visual Verification with Screenshots (Optional — Only When Explicitly Asked)
+
+When the user explicitly asks to create before/after screenshots, use the Playwright MCP tools to capture them. This is NOT done by default — only when requested.
+
+Screenshots must be taken in **both light and dark mode** to verify token usage is correct in both themes.
+
+### Switching Color Scheme via API
+
+Toggle between light and dark mode using the Metabase settings API. Use Playwright's `browser_evaluate` or `browser_navigate` with fetch:
+
+```js
+// Switch to dark mode
+await fetch("/api/setting/color-scheme", {
+  method: "PUT",
+  headers: { "Content-Type": "application/json" },
+  body: JSON.stringify({ value: "dark" }),
+});
+
+// Switch to light mode
+await fetch("/api/setting/color-scheme", {
+  method: "PUT",
+  headers: { "Content-Type": "application/json" },
+  body: JSON.stringify({ value: "light" }),
+});
+```
+
+After switching, reload the page for the theme to take effect.
+
+### Process
+
+For each state (**after** = migrated code, **before** = stashed original), capture screenshots in both themes at both viewport widths. This produces **8 screenshots total**.
+
+1. **Take "after" screenshots first** (migrated code is already in place):
+
+   - Navigate to the page that renders the migrated components (`browser_navigate`)
+   - Wait for content to load (`browser_wait_for` with key text, or `textGone: "Loading..."`)
+   - Close the sidebar if it overlaps content on narrow viewports (`browser_click` the toggle button)
+   - **Light mode** (set `color-scheme` to `"light"` via API, reload):
+     - Desktop (1280x900): `after-light-desktop.png`
+     - Narrow (640x900), close sidebar: `after-light-narrow.png`
+   - **Dark mode** (set `color-scheme` to `"dark"` via API, reload):
+     - Desktop (1280x900): `after-dark-desktop.png`
+     - Narrow (640x900), close sidebar: `after-dark-narrow.png`
+
+2. **Stash changes to capture "before" screenshots**:
+
+   - Run `git stash --include-untracked` to temporarily revert to the Emotion version
+   - Repeat the same 4 screenshots with `before-` prefix:
+     - `before-light-desktop.png`, `before-light-narrow.png`
+     - `before-dark-desktop.png`, `before-dark-narrow.png`
+   - Run `git stash pop` to restore the migrated code
+
+3. **Restore the user's original color scheme** (set back to `"auto"` or whatever it was before).
+
+4. **Display all 8 screenshots** using the `Read` tool so the user can visually compare before/after in both themes at both viewport sizes.
+
+### Key Details
+
+- Save screenshots in the repo root (they will be untracked — user can delete after review)
+- The dev server must be running (typically `http://localhost:3000`)
+- Use `browser_snapshot` to find element refs when you need to click buttons (e.g., sidebar toggle)
+- The greeting text on the home page changes randomly on each load — this is expected, not a regression
+- If the page being tested is not the home page, navigate to the correct URL that exercises the migrated components
+- Dark mode screenshots are critical for verifying that CSS variable tokens (`var(--mb-color-*)`) are used correctly — hardcoded colors will look wrong in dark mode

.claude/skills/serdes-workflow/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: serdes-workflow
+description: Export content from a running Metabase instance, validate with checkers, edit YAML, and import back. Use when the user wants to export, import, or run the full serdes round-trip workflow.
+---
+
+# Serdes Workflow Skill
+
+End-to-end workflow for exporting Metabase content as YAML, validating it, editing it, and importing it back.
+
+## Prerequisites
+
+All commands require the `:ee` alias since export, import, and checkers live in enterprise code.
+
+You need `MB_DB_CONNECTION_URI` set to point at the target Metabase Postgres database when importing. The running dev instance's connection string is in the worktree environment (check the nREPL or startup output).
+
+## Export
+
+```bash
+clojure -M:run:ee export /path/to/export-dir
+```
+
+Flags:
+- `-c 123,456` - export only specific collection IDs
+- `-f` - include field values
+- `-e` - continue on error
+
+This writes YAML files in the serdes directory layout:
+```
+databases/<db-name>/<db-name>.yaml
+databases/<db-name>/schemas/<schema>/tables/<table>/<table>.yaml
+databases/<db-name>/schemas/<schema>/tables/<table>/fields/<field>.yaml
+collections/<eid>_<slug>/cards/<eid>_<slug>.yaml
+```
+
+## Validate
+
+Always run both checkers after any modification. They skip full Metabase startup (~8s each).
+
+### Structural checker (fast, schema-based)
+```bash
+clojure -M:run:ee --mode checker --checker structural --export /path/to/export-dir
+```
+Validates YAML shapes against Malli schemas. Catches typos, missing required fields, wrong types.
+
+### Cards checker (query validation)
+```bash
+clojure -M:run:ee --mode checker --checker cards --export /path/to/export-dir
+```
+Validates that card queries resolve correctly against exported metadata (tables, fields, FKs). Uses MLv2 under the hood.
+
+Additional cards checker flags:
+- `--lenient` - fabricate metadata on demand (when no database schema files exist)
+- `--manifest /path/to/manifest.yaml` - write manifest of all referenced entities (lenient mode only)
+- `--output /path/to/results.edn` - write detailed results to file
+
+## Edit YAML
+
+See the **serdes-yaml-edit** skill for guidance on editing YAML files. The critical rule: **run both checkers after every edit before proceeding**.
+
+## Import
+
+```bash
+MB_DB_CONNECTION_URI="postgres://user:pass@localhost:5432/metabase_dbname" \
+  clojure -M:run:ee import /path/to/export-dir -e
+```
+
+The `-e` flag continues on error. The `MB_DB_CONNECTION_URI` must point at the same Postgres database the running Metabase instance uses - without it, import defaults to H2 which is wrong.
+
+## Full Demo Sequence
+
+1. Export: `clojure -M:run:ee export /tmp/metabase-export`
+2. Validate baseline: run both checkers
+3. Edit YAML files (see serdes-yaml-edit skill)
+4. Re-validate: run both checkers again
+5. Import: `MB_DB_CONNECTION_URI=... clojure -M:run:ee import /tmp/metabase-export -e`
+6. Verify in browser

.claude/skills/serdes-yaml-edit/SKILL.md

@@ -0,0 +1,243 @@
+---
+name: serdes-yaml-edit
+description: Edit Metabase serdes YAML files (cards, dashboards, databases) with correct portable references and structural conventions. Use when modifying exported YAML content.
+---
+
+# Serdes YAML Edit Skill
+
+## Golden Rule
+
+**Run both checkers after every edit.** No exceptions. Do not batch multiple edits before validating.
+
+```bash
+clojure -M:run:ee --mode checker --checker structural --export /path/to/export-dir
+clojure -M:run:ee --mode checker --checker cards --export /path/to/export-dir
+```
+
+If either checker fails, fix the issue before making further edits.
+
+## Portable References
+
+Serdes YAML uses portable references instead of integer IDs. This is the most important concept for editing.
+
+### Database references
+String name: `"Sample Database"`
+
+### Table references
+Array of `[database, schema, table]`:
+```yaml
+table_id:
+- Sample Database
+- PUBLIC
+- ACCOUNTS
+```
+
+### Field references
+Array of `[database, schema, table, field]`:
+```yaml
+id:
+- Sample Database
+- PUBLIC
+- ACCOUNTS
+- EMAIL
+```
+
+### Field refs in queries
+```yaml
+field_ref:
+- field
+- - Sample Database
+  - PUBLIC
+  - ACCOUNTS
+  - EMAIL
+- null
+```
+The outer array is `[field, <field-path>, <options>]`. The options are usually `null`.
+
+### Card references
+Entity ID string (21 characters): `"Qk5TgsNx4ubXIUtsQmT8G"`
+
+### Source table in queries
+```yaml
+dataset_query:
+  database: Sample Database
+  query:
+    source-table:
+    - Sample Database
+    - PUBLIC
+    - ACCOUNTS
+  type: query
+```
+
+## Safe Edits (low risk)
+
+These rarely break validation:
+- `name` - card/dashboard display name
+- `description` - card/dashboard description
+- `display` - visualization type (table, bar, line, pie, etc.)
+- `visualization_settings` - chart configuration
+- `archived` - true/false
+- `collection_id` - move to a different collection (use entity_id of target collection, or null for root)
+
+## Structural Edits (must match schema)
+
+These must use valid portable refs and will be caught by the cards checker if wrong:
+- `dataset_query` - the query definition
+- `result_metadata` - column metadata (must match the query's output columns)
+- `table_id` - must reference a table that exists in the export
+- `database_id` - must reference a database that exists in the export
+
+## Editing result_metadata
+
+Each entry in `result_metadata` describes an output column. When changing a query's source table or fields, you must update result_metadata to match. Each field entry needs at minimum:
+- `name` - column name (e.g., `EMAIL`)
+- `base_type` - Metabase type (e.g., `type/Text`, `type/Integer`, `type/DateTime`)
+- `display_name` - human-readable name
+- `field_ref` - portable field reference
+- `id` - portable field path
+- `table_id` - portable table path
+- `source` - usually `fields`
+
+## Common Operations
+
+### Rename a card
+Change `name:` at the top level. Safe, no ref changes needed.
+
+### Change a card's source table
+Update all of these consistently:
+1. `table_id` - top-level
+2. `dataset_query.query.source-table` - in the query
+3. `result_metadata` - every field entry's `id`, `field_ref`, and `table_id`
+
+### Add a filter to a structured query
+```yaml
+dataset_query:
+  database: Sample Database
+  query:
+    source-table:
+    - Sample Database
+    - PUBLIC
+    - ORDERS
+    filter:
+    - ">"
+    - - field
+      - - Sample Database
+        - PUBLIC
+        - ORDERS
+        - TOTAL
+      - null
+    - 100
+  type: query
+```
+
+### Change visualization type
+```yaml
+display: bar    # was: table
+```
+Valid types: `table`, `bar`, `line`, `pie`, `scalar`, `row`, `area`, `combo`, `scatter`, `funnel`, `map`, `pivot`, `progress`, `gauge`, `waterfall`
+
+## Looking Up Valid References
+
+The export directory IS the reference catalog. When you need to find the correct name for a database, table, or field, look it up directly from the export.
+
+### List valid databases
+```bash
+ls databases/
+```
+Each entry is a database name (directory for serdes format, .yaml for concise format).
+
+### List valid tables for a database
+```bash
+ls databases/<db-name>/schemas/<schema>/tables/
+```
+Example: `ls databases/Sample\ Database/schemas/PUBLIC/tables/` shows `ACCOUNTS`, `ORDERS`, `PRODUCTS`, etc.
+
+### List valid fields for a table
+```bash
+ls databases/<db-name>/schemas/<schema>/tables/<table>/fields/
+```
+Example: `ls databases/Sample\ Database/schemas/PUBLIC/tables/PRODUCTS/fields/` shows `CATEGORY.yaml`, `TITLE.yaml`, `PRICE.yaml`, etc. The filename (minus `.yaml`) is the field name.
+
+### Find card entity IDs
+Card filenames encode the entity ID: `<entity-id>_<slug>.yaml`. The entity ID is the part before the first underscore (21 characters).
+
+## Self-Healing Loop
+
+When a checker reports errors, follow this loop:
+
+1. **Read the error message** - it tells you what's wrong and often suggests the fix
+2. **Look up the correct value** from the export directory (see "Looking Up Valid References" above)
+3. **Fix the YAML**
+4. **Re-run both checkers**
+5. **Repeat until clean**
+
+Do not guess at fixes. Always look up the correct value from the export.
+
+## Understanding Checker Errors
+
+### Structural checker errors
+
+The structural checker validates YAML shape against Malli schemas. Common errors:
+
+**Missing required key with typo suggestion:**
+```
+Missing required key 'name' - found 'nameee' which may be a typo
+```
+Fix: rename the typo'd key back to the correct name. The checker tells you what it expected and what it found.
+
+**Wrong type:**
+```
+'archived' should be a boolean, got: "yes"
+```
+Fix: use `true`/`false`, not strings.
+
+**Unknown key:**
+```
+Unknown key 'foobar' in card
+```
+Fix: remove the key, or check if it's a typo of a known key.
+
+### Cards checker errors
+
+The cards checker validates that queries resolve against exported metadata. Error types:
+
+**UNRESOLVED REFERENCES:**
+```
+UNRESOLVED REFERENCES:
+  - field: Sample Database.PUBLIC.PRODUCTS.CATEGORYYY
+```
+The dotted path tells you exactly which reference failed. Look up the correct value:
+- Last segment is the field name - check `databases/.../tables/<table>/fields/`
+- Third segment is the table name - check `databases/.../schemas/<schema>/tables/`
+- First segment is the database name - check `databases/`
+
+**ERROR (query construction failed):**
+```
+ERROR: Error creating query from legacy query: Invalid output: ...
+```
+Usually means the query structure is malformed. This often follows unresolved references - fix the refs first, then re-check.
+
+**ERROR (nil name):**
+```
+ERROR: Invalid output: {:name ["should be a string, got: nil"]}
+```
+The card is missing its `name` field (likely a structural issue that also affects the cards checker).
+
+### Exit codes
+
+- Exit 0: all checks passed
+- Exit 1: one or more failures
+
+## File Naming Convention
+
+Card files: `collections/<collection-path>/cards/<entity-id>_<slug>.yaml`
+
+The filename slug should match the card name (lowercase, underscored). If you rename a card, consider renaming the file to match, though import works on entity_id not filename.
+
+## What NOT to Edit
+
+- `entity_id` - this is the identity of the object, changing it creates a new object on import
+- `serdes/meta` - internal serdes metadata, leave it alone
+- `created_at` - timestamp, no reason to change
+- `creator_id` - email reference, leave it
+- `metabase_version` - informational, leave it

.clj-kondo/config.edn

@@ -39,7 +39,7 @@
   ;;
 
   ;; TODO (cam): most of these either have a ton of things that need to be fixed or cause issues
-  ;; with [[metabase.lib.util.match/match]] and friends -- we need to write a custom hook for those macros so Kondo
+  ;; with [[metabase.util.match/match]] and friends -- we need to write a custom hook for those macros so Kondo
   ;; can understand them.
 
   #_:docstring-leading-trailing-whitespace
@@ -52,6 +52,7 @@
 
   :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
   :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
+  :redundant-primitive-coercion {:level :off} ; there are many defensive boolean coercions, kondo looks too much into it
 
   ;;
   ;; globally-enabled custom linters
@@ -68,6 +69,7 @@
   :metabase/modules                                          {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
   :metabase/namespace-name                                   {:level :warning}
   :metabase/no-jsqlparser-imports                            {:level :warning}
+  :metabase/toucan-model-ns                                  {:level :warning}
   :metabase/require-shape-checker                            {:level :warning}
   :metabase/tests-must-live-in-known-modules                 {:level :warning}
   :metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
@@ -175,14 +177,18 @@
      clojure.core.async/take!
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
+     metabase.api.macros.defendpoint.tools-manifest/assert-optional-fields-nullable!
      metabase.channel.core/send!
+     metabase.warehouses.models.database/assert-not-h2!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
      metabase.notification.models/create-notification!
+     metabase.oauth-server.core/reset-provider!
      metabase.pulse.send/send-pulse!
      metabase-enterprise.transforms-python.python-runner-test/execute!
      ;; Workspace isolation functions are safe in parallel tests because they operate on
      ;; isolated, test-specific workspaces and databases that don't affect other tests
      metabase-enterprise.workspaces.isolation/destroy-workspace-isolation!
+     metabase.lib-metric.ast.plan/validate-arithmetic-ast!
      metabase-enterprise.workspaces.isolation/ensure-database-isolation!
      metabase-enterprise.workspaces.test-util/create-ready-ws!
      ;; Safe in tests, where we typically use a private, temporary index per thread.
@@ -226,10 +232,6 @@
   ;; misc config for built-in linters
   ;;
 
-  :invalid-arity       {:skip-args [metabase.lib.util.match/match
-                                    metabase.lib.util.match/match-lite
-                                    metabase.lib.util.match/match-many
-                                    metabase.lib.util.match/replace-lite]}                    ; TODO (cam): can we fix these?
   :refer-all           {:level :warning, :exclude [clojure.test]}
   :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
@@ -245,25 +247,17 @@
     instaparse.core/transform
     (metabase.server.streaming-response/streaming-response)
     (metabase.driver.druid.query-processor-test/druid-query-returning-rows)
-    (metabase.lib.util.match/match)
-    (metabase.lib.util.match/match-one)
-    (metabase.lib.util.match/match-lite)
-    (metabase.lib.util.match/match-many)
-    (metabase.lib.util.match/replace)
-    (metabase.lib.util.match/replace-in)
-    (metabase.lib.util.match/replace-lite)
-    (metabase.driver-api.core/match)
+    (metabase.util.match/match-one)
+    (metabase.util.match/match-many)
+    (metabase.util.match/replace-in)
+    (metabase.util.match/replace)
     (metabase.driver-api.core/match-one)
-    (metabase.driver-api.core/match-lite)
     (metabase.driver-api.core/match-many)
     (metabase.driver-api.core/replace)
     (metabase.driver-api.core/replace-in)
-    (metabase.driver-api.core/replace-lite)
     (metabase.query-processor.middleware.cache-backend.interface/with-cached-results)
     (metabase.util.regex/rx [opt])
-    (metabase.util/prog1 [<>])
-    (taoensso.nippy/extend-freeze)
-    (taoensso.nippy/extend-thaw)]}
+    (metabase.util/prog1 [<>])]}
 
   ;; TODO (Cam 8/22/25) -- what's the point of marking stuff deprecated if we don't have Kondo enforce it? We should
   ;; remove all of these and add individual ignores as needed.
@@ -310,9 +304,6 @@
    metabase.lib.convert/->legacy-MBQL                 {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.core/->legacy-MBQL                    {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
-   metabase.lib.util.match/match                      {:message "Use lib.util.match/match-many instead of lib.util.match/match."}
-   metabase.lib.util.match/match-one                  {:message "Use lib.util.match/match-lite instead of lib.util.match/match-one."}
-   metabase.lib.util.match/replace                    {:message "Use lib.util.match/replace-lite instead of lib.util.match/replace."}
    metabase-enterprise.transforms.interface/execute!  {:message "Use metabase-enterprise.transforms.execute/execute! instead of metabase-enterprise.transforms.interface/execute!"}
    next.jdbc/active-tx?                               {:message "Use metabase.app-db.core/in-transaction? to see if we are in a transaction"}
    toucan2.core/debug                                 {:message "Don't commit code using t2/debug"}
@@ -346,7 +337,6 @@
     clj-time.coerce                           time.coerce
     clj-time.format                           time.format
     clojure.core.async                        a
-    clojure.core.match                        clojure.core.match
     clojure.data                              data
     clojure.math.combinatorics                math.combo
     clojure.pprint                            pprint
@@ -469,14 +459,15 @@
   metabase.premium-features.settings/define-premium-feature                             clojure.core/def
   metabase.pulse.dashboard-subscription-test/with-dashboard-sub-for-card                clojure.core/let
   metabase.pulse.send-test/with-pulse-for-card                                          clojure.core/let
-  metabase.query-processor.pipeline-queries-test/pmbql-query                       clojure.core/->
-  metabase.query-processor.pipeline-queries-test/run-pmbql-query                   clojure.core/->
+  metabase.query-processor.pipeline-queries-test/mbql5-query                            clojure.core/->
+  metabase.query-processor.pipeline-queries-test/run-mbql5-query                        clojure.core/->
   metabase.query-processor.error-type/deferror                                          clojure.core/def
   metabase.query-processor.middleware.cache.impl/with-reducible-deserialized-results    clojure.core/let
   metabase.query-processor.middleware.process-userland-query-test/with-query-execution! clojure.core/let
   metabase.query-processor.setup/with-qp-setup                                          clojure.core/let
   metabase.search.api-test/do-test-users                                                clojure.core/let
   metabase.settings.core/define-multi-setting                                           clojure.core/def
+  metabase.api-scope.core/defscope                                                      clj-kondo.lint-as/def-catch-all
   metabase.settings.core/defsetting                                                     clj-kondo.lint-as/def-catch-all
   metabase.settings.models.setting.multi-setting/define-multi-setting                   clojure.core/def
   metabase.settings.models.setting/defsetting                                           clj-kondo.lint-as/def-catch-all
@@ -487,6 +478,7 @@
   metabase.task.impl/defjob                                                             clojure.core/defn
   metabase.test.data.interface/defdataset                                               clojure.core/def
   metabase.test.data.interface/defdataset-edn                                           clojure.core/def
+  metabase.test.embedded-postgres.core/with-system                                      clojure.core/let
   metabase.test.gentest/defgentest                                                      clojure.test/deftest
   metabase.test/defdataset                                                              clojure.core/def
   metabase.test/let-url                                                                 clojure.core/let
@@ -552,6 +544,7 @@
    metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
    metabase-enterprise.dependencies.api-test/with-dependents-test!                                                           hooks.common/with-two-bindings
    metabase-enterprise.metabot-v3.tools.dependencies-test/with-dependent-transforms!                                         hooks.common/with-two-bindings
+   metabase-enterprise.metabot.tools.dependencies-test/with-dependent-transforms!                                            hooks.common/with-two-bindings
    metabase-enterprise.semantic-search.db.connection/with-migrate-tx                                                         hooks.common/let-one-with-optional-value
    metabase-enterprise.serialization.api-test/with-serialization-test-data!                                                  hooks.common/with-three-bindings
    metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
@@ -559,7 +552,7 @@
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
    metabase.api.macros/defendpoint                                                                                           hooks.metabase.api.macros/defendpoint
    metabase.app-db.schema-migrations-test.impl/test-migrations                                                               hooks.metabase.app-db.schema-migrations-test.impl/test-migrations
-   metabase.channel.render.js.svg/with-static-viz-context                                                                    hooks.common/with-one-top-level-binding
+   metabase.channel.render.js.pool/with-static-viz-context                                                                   hooks.common/with-one-top-level-binding
    metabase.channel.template.handlebars-helper/defhelper                                                                     hooks.metabase.channel.template.handlebars-helper/defhelper
    metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
    metabase.classloader.core/require                                                                                         hooks.clojure.core.require/lint-require
@@ -586,6 +579,8 @@
    metabase.lib.schema.mbql-clause/define-catn-mbql-clause                                                                   hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.schema.mbql-clause/define-mbql-clause                                                                        hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.schema.mbql-clause/define-tuple-mbql-clause                                                                  hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
+   methodical.core/defmethod                                                                                                 hooks.metabase.toucan.table-name/lint-defmethod
+   methodical.macros/defmethod                                                                                               hooks.metabase.toucan.table-name/lint-defmethod
    metabase.lib.test-util.macros/$ids                                                                                        hooks.metabase.test.data/$ids
    metabase.lib.test-util.macros/mbql-query                                                                                  hooks.metabase.test.data/mbql-query
    metabase.lib.test-util.macros/mbql-5-query                                                                                hooks.metabase.test.data/mbql-query
@@ -683,9 +678,15 @@
    metabase.util.log/warn                                                                                                    hooks.metabase.util.log/info
    metabase.util.log/warnf                                                                                                   hooks.metabase.util.log/infof
    metabase.util.malli.registry/def                                                                                          hooks.metabase.util.malli.registry/def
+   metabase.util.match/match-one                                                                                             hooks.metabase.util.match/match-one
+   metabase.util.match/match-many                                                                                            hooks.metabase.util.match/match-many
+   metabase.util.match/replace                                                                                               hooks.metabase.util.match/replace
+   metabase.util.match/replace-in                                                                                            hooks.metabase.util.match/replace-in
    metabase.util/case-enum                                                                                                   hooks.metabase.util/case-enum
    metabase.util/format-color                                                                                                hooks.metabase.util/format-color
-   metabase.xrays.api.automagic-dashboards-test/with-indexed-model!                                                          hooks.metabase.xrays.api.automagic-dashboards-test/with-indexed-model!}
+   metabase.xrays.api.automagic-dashboards-test/with-indexed-model!                                                          hooks.metabase.xrays.api.automagic-dashboards-test/with-indexed-model!
+   taoensso.nippy/extend-freeze                                                                                              hooks.taoensso.nippy/extend-freeze
+   taoensso.nippy/extend-thaw                                                                                                hooks.taoensso.nippy/extend-thaw}
 
   :macroexpand
   {clojurewerkz.quartzite.jobs/build                                                            macros.quartz/build-job
@@ -793,7 +794,7 @@
     :private-call                                        {:level :off}
     :metabase/defsetting-must-specify-export             {:level :off}
     :metabase/defsetting-namespace                       {:level :off}
-    :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn
+    :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
 
     :discouraged-var
     {metabase.driver/database-supports? {:level :off}

.clj-kondo/config/test-helpers/config.edn

@@ -110,6 +110,7 @@
      metabase.settings.models.setting-test/test-user-local-allowed-setting!
      metabase.settings.models.setting-test/test-user-local-only-setting!
      metabase.settings.models.setting.cache/restore-cache!
+     metabase.settings.models.setting/log-deprecated-env-var-usage!
      metabase.settings.models.setting/set!
      metabase.settings.models.setting/validate-settings-formatting!
      metabase.setup.core/create-token!

.clj-kondo/src/hooks/common.clj

@@ -500,8 +500,8 @@
               (and resolved (:ns resolved))
               (symbol (name (:ns resolved)) (name (:name resolved)))
 
-             ;; if it wasn't resolved but is still qualified it's probably using the full namespace name rather than an
-             ;; alias.
+              ;; if it wasn't resolved but is still qualified it's probably using the full namespace name rather than an
+              ;; alias.
               (qualified-symbol? sexpr)
               sexpr)))))
     ;; some symbols like `*count/Integer` aren't resolvable.

.clj-kondo/src/hooks/metabase/test/util.clj

@@ -28,8 +28,8 @@
                                             (mapcat (fn [[setting-name v]]
                                                       (concat
                                                        [(with-meta (hooks/token-node '_) (meta setting-name)) v]
-                                                        ;; if the setting name is namespace-qualified add a `_`
-                                                        ;; entry for it too.
+                                                       ;; if the setting name is namespace-qualified add a `_`
+                                                       ;; entry for it too.
                                                        (when (namespaced-symbol-node? setting-name)
                                                          [(with-meta (hooks/token-node '_) (meta setting-name)) setting-name]))))
                                             (partition 2 (:children bindings))))

.clj-kondo/src/hooks/metabase/toucan/table_name.clj

@@ -0,0 +1,43 @@
+(ns hooks.metabase.toucan.table-name
+  "Lint that toucan2 model namespaces (those defining `t2/table-name`) live
+  under `metabase[-enterprise]/<module>/models[/…]`.
+
+  This wraps the methodical `defmethod` hook: we delegate to
+  `hooks.methodical.macros/defmethod` for the actual analysis (so arg bindings
+  etc. still work), and additionally check the file location when the
+  multimethod being defined is `t2/table-name`."
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
+
+(defn- models-file? [filename]
+  (boolean
+   (and filename
+        (re-find #"/(?:metabase|metabase_enterprise)/[^/]+/models(?:/|\.clj[cs]?$)"
+                 filename))))
+
+(defn- table-name-dispatch? [sym]
+  (and (symbol? sym)
+       (= (name sym) "table-name")
+       (#{"t2" "toucan2.core"} (namespace sym))))
+
+(defn lint-defmethod
+  "Hook registered at the project level on `methodical.core/defmethod` (and
+  `methodical.macros/defmethod`). Performs the table-name check, then
+  delegates to the vendored methodical hook so kondo's normal analysis of the
+  defmethod body still runs."
+  [{:keys [filename node] :as input}]
+  (let [[_defmethod multimethod & _args] (:children node)
+        dispatch (when multimethod
+                   (try (hooks/sexpr multimethod) (catch Exception _ nil)))]
+    (when (and (table-name-dispatch? dispatch)
+               (not (models-file? filename)))
+      (hooks/reg-finding!
+       (assoc (meta multimethod)
+              :message (format "Toucan2 `table-name` defmethods must live under `<module>/models[/…]` (got %s)"
+                               filename)
+              :type :metabase/toucan-model-ns))))
+  ;; Delegate to the vendored methodical defmethod hook so kondo's normal
+  ;; analysis of the defmethod body still runs. Resolved lazily because
+  ;; `hooks.methodical.macros` isn't on the classpath during `.clj-kondo/test`
+  ;; unit-test runs.
+  ((requiring-resolve 'hooks.methodical.macros/defmethod) input))

.clj-kondo/src/hooks/metabase/util/i18n.clj

@@ -13,23 +13,23 @@
       (let [c (first chars)]
         (if (= c \')
           (cond
-              ;; Doubled quotes: skip both
+            ;; Doubled quotes: skip both
             (and (next chars) (= (second chars) \'))
             (recur (nthrest chars 2))
 
-              ;; Placeholder escape. We allow for intentional escaping, like either '{0}` or '{{`, but not 'arbitrary
-              ;; strings' So basically, just require the *next* character to be a `{`, find the next single-quote, and
-              ;; continue on from there.
-              ;;
-              ;; Technically a string like "foo bar's happy but i'm not" is totally fine, but we'll say it's invalid
-              ;; because... that inner string literal is probably not what we actually want. So since we've never done
-              ;; this intentionally as far as I can tell, let's just remove the possibility to avoid ambiguity.
+            ;; Placeholder escape. We allow for intentional escaping, like either '{0}` or '{{`, but not 'arbitrary
+            ;; strings' So basically, just require the *next* character to be a `{`, find the next single-quote, and
+            ;; continue on from there.
+            ;;
+            ;; Technically a string like "foo bar's happy but i'm not" is totally fine, but we'll say it's invalid
+            ;; because... that inner string literal is probably not what we actually want. So since we've never done
+            ;; this intentionally as far as I can tell, let's just remove the possibility to avoid ambiguity.
             (= (second chars) \{)
             (let [at-closing (drop-while #(not= \' %) (next chars))]
               (if (seq at-closing)
                 (recur (next at-closing))
                 false))
-              ;; Unpaired single quote: invalid
+            ;; Unpaired single quote: invalid
             :else
             false)
           (recur (rest chars)))))))

.clj-kondo/src/hooks/metabase/util/match.clj

@@ -0,0 +1,132 @@
+(ns hooks.metabase.util.match
+  (:require [clj-kondo.hooks-api :as api]))
+
+(defn- token-node? [node token-name]
+  (and (api/token-node? node)
+       (= (str (:value node)) token-name)))
+
+(defn- keyword-node? [node k]
+  (and (api/keyword-node? node)
+       (= (:k node) k)))
+
+(defn- binding-symbol?
+  "True when the token is a plain symbol that should be treated as a binding
+  (not a keyword, not a boolean literal, not nil, not a number, not `_`)."
+  [node]
+  (and (api/token-node? node)
+       (let [v (:value node)]
+         (and (symbol? v)
+              (not (contains? '#{_ nil true false} v))))))
+
+;; To establish fake let bindings, we need to bind them to something. This "something" has to be vague enough to trick
+;; kondo into not looking too much into it. E.g., if we bind everything to `nil`, Kondo linters will get fired up.
+(def opaque-node (api/list-node (list (api/token-node 'rand-nth) (api/list-node []))))
+
+(defn collect-bindings
+  "Return a list of token nodes (symbols) introduced as bindings by `pattern`."
+  [pattern]
+  (cond
+    (binding-symbol? pattern)
+    [[pattern opaque-node]]
+
+    ;; Lists: (:or ...), (:and ...), (sym :guard pred ...), or a quoted symbol.
+    (api/list-node? pattern)
+    (let [[head & rst] (:children pattern)]
+      (cond (or (keyword-node? head :or)
+                (keyword-node? head :and))
+            (mapcat collect-bindings rst)
+
+            (api/token-node? head)
+            (cond-> []
+              (binding-symbol? head) (conj [head opaque-node])
+              (keyword-node? (first rst) :guard) (conj [(api/token-node '_) (second rst)]))
+
+            ;; anything else (e.g. a function call used as predicate) — no bindings
+            :else []))
+
+    (api/vector-node? pattern)
+    (mapcat (fn [node]
+              (when-not (token-node? node "&")
+                (collect-bindings node)))
+            (:children pattern))
+
+    ;; Maps: keys are literal selectors, values are sub-patterns.
+    ;; Special value-symbols &truthy and _ are NOT user bindings.
+    (api/map-node? pattern)
+    (let [children (:children pattern)
+          pairs    (partition 2 children)]
+      (mapcat (fn [[_k v]]
+                (when-not (or (token-node? v "&truthy")
+                              (token-node? v "_"))
+                  (collect-bindings v)))
+              pairs))
+
+    ;; For sets, make sure to use them because they may reference some of the outer local bindings, so if we don't
+    ;; include them, Kondo will complain about those bindings being unused.
+    (api/set-node? pattern)
+    [[(api/token-node '_) pattern]]
+
+    ;; Anything else — no bindings.
+    :else []))
+
+(defn- dedupe-bindings
+  "Prevent Kondo complaining that we have multiple fake bindings."
+  [pairs]
+  (loop [[[sym v] & r] pairs, seen #{}, result []]
+    (cond (nil? sym) result
+          (and (seen sym) (not (token-node? sym "_"))) (recur r seen result)
+          :else (recur r (conj seen sym) (conj result sym v)))))
+
+(defn match-one
+  "clj-kondo :analyze-call hook for match-one.
+
+  Rewrites
+
+    (match-one value
+      pat1 ret1
+      pat2 ret2
+      ...)
+
+  into a `let` form that declares all binding symbols introduced by the patterns, so clj-kondo knows they are
+  legitimate and won't warn about unresolved/unused symbols:
+
+    (let [<all-bindings> (rand-nth []) ...]
+      (or ret1 ret2 ...))"
+  [{:keys [node]}]
+  (let [[_ value & clauses] (:children node)]
+    (when (odd? (count clauses))
+      (api/reg-finding!
+       {:message  "match-one/match-many/replace requires an even number of pattern/result pairs"
+        :type     :metabase/match-odd-clauses
+        :row      (:row node)
+        :col      (:col node)
+        :filename (-> node meta :filename)}))
+    (let [pairs (partition 2 clauses)
+          all-bindings (->> pairs
+                            (mapcat (fn [[pat _ret]] (collect-bindings pat)))
+                            dedupe-bindings)
+          special-bindings [(api/token-node '_)        value
+                            (api/token-node '&match)   opaque-node
+                            (api/token-node '&parents) opaque-node
+                            (api/token-node '&recur)   opaque-node
+                            ;; Pretend to use &match, &parents, and &recur so that Kondo doesn't complain about them
+                            ;; if they are not used by the user code.
+                            (api/token-node '_) (api/token-node '&match)
+                            (api/token-node '_) (api/token-node '&parents)
+                            (api/token-node '_) (api/token-node '&recur)]
+          binding-nodes (into special-bindings all-bindings)
+          result-exprs (map second pairs)
+          new-node (api/list-node
+                    (list
+                     (api/token-node 'let)
+                     (api/vector-node binding-nodes)
+                     (api/list-node
+                      (concat [(api/token-node 'clojure.core/or)] result-exprs [opaque-node]))))]
+      {:node new-node})))
+
+(def match-many match-one)
+(def replace match-one)
+
+(defn replace-in [context]
+  ;; Everything is the same as in match-one, just drop the middle argument.
+  (match-one (update-in context [:node :children] (fn [[sym value path & clauses]] (list* sym value clauses)))))

.clj-kondo/src/hooks/taoensso/nippy.clj

@@ -0,0 +1,22 @@
+(ns hooks.taoensso.nippy
+  (:require [clj-kondo.hooks-api :as api]))
+
+(defn extend-thaw
+  [{:keys [node]}]
+  (let [[_ _ arglist & body] (:children node)]
+    {:node (with-meta (api/list-node
+                       (list*
+                        (api/token-node 'fn)
+                        arglist
+                        body))
+                      (meta node))}))
+
+(defn extend-freeze
+  [{:keys [node]}]
+  (let [[_ _ _ arglist & body] (:children node)]
+    {:node (with-meta (api/list-node
+                       (list*
+                        (api/token-node 'fn)
+                        arglist
+                        body))
+                      (meta node))}))

.clj-kondo/test/hooks/metabase/toucan/table_name_test.clj

@@ -0,0 +1,46 @@
+(ns hooks.metabase.toucan.table-name-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.metabase.toucan.table-name :as toucan.table-name]))
+
+;; `hooks.methodical.macros` isn't on the classpath under `.clj-kondo/test`,
+;; so stub it out — `lint-defmethod` delegates to it via `requiring-resolve`.
+;; If it ever becomes available, warn so we remember to delete this stub.
+(if (find-ns 'hooks.methodical.macros)
+  (println (str "WARNING: hooks.methodical.macros is now on the test classpath; "
+                "the stub in " *ns* " is no longer needed and can be removed."))
+  (do (create-ns 'hooks.methodical.macros)
+      (intern 'hooks.methodical.macros 'defmethod (fn [input] input))))
+
+(defn- lint-defmethod [form filename]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/toucan-model-ns {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (toucan.table-name/lint-defmethod {:node     (hooks/parse-string (pr-str form))
+                                       :filename filename})
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(deftest ^:parallel table-name-must-live-in-models-namespace-test
+  (testing "defmethod t2/table-name outside a models namespace is flagged"
+    (is (=? [{:type :metabase/toucan-model-ns}]
+            (lint-defmethod '(defmethod t2/table-name :model/Foo [_] :foo)
+                            "/repo/src/metabase/foo/core.clj"))))
+  (testing "defmethod t2/table-name inside <module>/models.clj is allowed"
+    (is (empty? (lint-defmethod '(defmethod t2/table-name :model/Foo [_] :foo)
+                                "/repo/src/metabase/foo/models.clj"))))
+  (testing "defmethod t2/table-name inside <module>/models/<model>.clj is allowed"
+    (is (empty? (lint-defmethod '(defmethod t2/table-name :model/Foo [_] :foo)
+                                "/repo/src/metabase/foo/models/bar.clj"))))
+  (testing "enterprise modules are also allowed"
+    (is (empty? (lint-defmethod '(defmethod t2/table-name :model/Foo [_] :foo)
+                                "/repo/enterprise/backend/src/metabase_enterprise/foo/models.clj"))))
+  (testing "toucan2.core/table-name is also recognized"
+    (is (=? [{:type :metabase/toucan-model-ns}]
+            (lint-defmethod '(defmethod toucan2.core/table-name :model/Foo [_] :foo)
+                            "/repo/src/metabase/foo/core.clj"))))
+  (testing "unrelated defmethods are ignored"
+    (is (empty? (lint-defmethod '(defmethod t2/primary-keys :model/Foo [_] [:id])
+                                "/repo/src/metabase/foo/core.clj")))))

.clj-kondo/test/hooks/metabase/util/match_test.clj

@@ -0,0 +1,59 @@
+(ns hooks.metabase.util.match-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.metabase.util.match :as sut]))
+
+(defn- expand [src]
+  (-> (sut/match-one {:node (hooks/parse-string (pr-str src))})
+      :node
+      hooks/sexpr))
+
+(defn- lint [src]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/match-odd-clauses {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (expand src)
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(deftest odd-clauses-triggers-warning-test
+  (is (=? [{:type :metabase/match-odd-clauses}]
+          (lint '(metabase.util.match/match-one [] [a b c])))))
+
+(deftest expansion-test
+  (testing "simple expansion example"
+    (is (= '(let [_ []
+                  &match (rand-nth ())
+                  &parents (rand-nth ())
+                  &recur (rand-nth ())
+                  _ &match
+                  _ &parents
+                  _ &recur
+                  a (rand-nth ())
+                  b (rand-nth ())
+                  c (rand-nth ())]
+              (clojure.core/or (+ a b) (rand-nth ())))
+           (expand '(match-one [] [a b c] (+ a b))))))
+  (testing "complicated expansion example that uses most match-one macro features, and also binding deduplication by the rewriter"
+    (is (= '(let [_ []
+                  &match (rand-nth ())
+                  &parents (rand-nth ())
+                  &recur (rand-nth ())
+                  _ &match
+                  _ &parents
+                  _ &recur
+                  val1 (rand-nth ())
+                  a (rand-nth ())
+                  _ #{maybe important}
+                  rst (rand-nth ())
+                  x (rand-nth ())
+                  _ (= x 3)
+                  b (rand-nth ())]
+              (clojure.core/or (+ a val1) (rand-nth ())))
+           (expand '(match-one []
+                               (:or [{:key1 val1, :key2 &truthy, :key3 _} _ a #{maybe important} & rst]
+                                    (:and (x :guard (= x 3))
+                                          [a b]))
+                               (+ a val1)))))))

.clj-surgeon.edn

@@ -0,0 +1,27 @@
+{:aliases
+ {;; defendpoint shape: (api.macros/defendpoint METHOD URL DOCSTRING? [args] body)
+  ;; No name slot — synthesize :route [METHOD "path"] from first 2 args.
+  "defendpoint"
+  {:fields {:method (fn [z] (some-> z z/down z/right z/sexpr name str/upper-case))
+            :path   (fn [z] (-> z z/down z/right z/right z/sexpr))}}
+
+  ;; defenterprise shape:
+  ;;   (defenterprise NAME DOCSTRING? EE-NAMESPACE [args] body)
+  "defenterprise"
+  {:fields {:name         ->defn-name
+            :ee-namespace (fn [z]
+                            ;; Skip name + optional docstring; the next
+                            ;; symbol is the EE namespace.
+                            (let [name-z (-> z z/down z/right)
+                                  after-doc (z/right name-z)
+                                  candidate (if (string? (try (z/sexpr after-doc)
+                                                              (catch Exception _ nil)))
+                                              (z/right after-doc)
+                                              after-doc)]
+                              (try (let [v (z/sexpr candidate)]
+                                     (when (symbol? v) v))
+                                   (catch Exception _ nil))))
+            :arglist      ->defn-arg-list}}
+
+  "defsetting"
+  {:fields {:name ->defn-name}}}}

.cljfmt.edn

@@ -1,12 +1,10 @@
 ;; Cljfmt config. See https://github.com/weavejester/cljfmt#formatting-options
-{:sort-ns-references?
- true
-
- :function-arguments-indentation
- :community
-
- :parallel?
- true
+{:function-arguments-indentation  :community
+ :indent-line-comments?           true
+ :normalize-newlines-at-file-end? true
+ :parallel?                       true
+ :remove-blank-lines-in-forms?    true
+ :sort-ns-references?             true
 
  :paths
  ["src"
@@ -15,11 +13,63 @@
   "bin/build"
   "bin/lint-migrations-file"
   "bin/release-list"
+  #_"mage/src"
+  #_"mage/test"
   "modules/drivers"
   ".clj-kondo/src"
   ".clj-kondo/test"
   #_"dev"]
 
+ ;; a map of symbols that tell cljfmt which forms are allowed to have blank lines inside of them. The value may be
+ ;; either `:all`, which means blank lines are allowed between all elements in the form, e.g. `{cond :all}` to allow
+ ;; blank lines between any of the elements inside cond; or it may be a set of element indexes that are allowed to
+ ;; have blank lines, e.g. `{let #{0}}`, to allow blank lines in the binding of a `let` form.
+ :extra-blank-line-forms
+ {are                                                                    :all
+  case                                                                   :all
+  cond->                                                                 :all
+  cond->>                                                                :all
+  condp                                                                  :all
+  clojure.spec.alpha/or                                                  :all
+  clojure.test/are                                                       :all
+  metabase.driver-api.core/match-many                                    :all
+  metabase.driver-api.core/match-one                                     :all
+  metabase.driver-api.core/replace                                       :all
+  metabase.driver-api.core/replace-in                                    :all
+  metabase.lib.drill-thru.test-util/test-drill-variants-with-merged-args :all
+  metabase.lib.drill-thru.test-util/test-returns-drill                   :all
+  metabase.test/with-temp                                                #{0}
+  metabase.util.match/match-many                                         :all
+  metabase.util.match/match-one                                          :all
+  metabase.util.match/replace                                            :all
+  metabase.util.match/replace-in                                         :all
+  ;; TODO (Cam 2026-05-21) I'm not really sure about `defprotocol`, `deftype`, `defrecord`, `proxy`, `reify`, etc., I
+  ;; think idiomatically these should probably not have blank lines but we can worry about that later
+  defprotocol                                                            :all
+  defrecord                                                              :all
+  deftype                                                                :all
+  extend                                                                 :all
+  extend-protocol                                                        :all
+  potemkin.types/def-map-type                                            :all
+  potemkin.types/defprotocol+                                            :all
+  potemkin.types/defrecord+                                              :all
+  potemkin.types/deftype+                                                :all
+  potemkin/def-map-type                                                  :all
+  potemkin/defprotocol+                                                  :all
+  potemkin/defrecord+                                                    :all
+  potemkin/deftype+                                                      :all
+  proxy                                                                  :all
+  reify                                                                  :all
+  ;; TODO (Cam 2026-05-21) -- save these for a follow-on PR
+  defmacro                                                               :all
+  defmethod                                                              :all
+  defn                                                                   :all
+  defn-                                                                  :all
+  fn                                                                     :all
+  metabase.util.malli/defmethod                                          :all
+  metabase.util.malli/defn                                               :all
+  metabase.util.malli/defn-                                              :all}
+
  ;; See https://github.com/weavejester/cljfmt/blob/master/cljfmt/resources/cljfmt/indents/clojure.clj for the default
  ;; definitions
  ;;
@@ -37,13 +87,12 @@
  ;; `:inner` indentation is like `:defn` indentation. `[[:inner 0]]` (default for `defn`) means all arguments at depth
  ;; zero get indented 2 spaces if not on the first line regardless of number of elements on the first line.
  :extra-indents
- {;; clojure.core stuff
+ { ;; clojure.core stuff
   fn*                                                                                         [[:inner 0]]
   let*                                                                                        [[:block 1]]
   with-meta                                                                                   [[:default]]
   ;; library stuff. Libraries that specify their own `:style/indent` specs are included in the section after this
   ;; since it is generated automatically.
-  clojure.core.match/match                                                                    [[:block 1]]
   clojure.test.check.properties/for-all                                                       [[:block 1]]
   clojure.test.check.properties/for-all*                                                      [[:block 1]]
   clojure.test.check/quick-check                                                              [[:block 1]]
@@ -118,12 +167,9 @@
   metabase.collections.models.collection-test/with-personal-and-impersonal-collections        [[:block 1]]
   metabase.config/build-type-case                                                             [[:block 0]]
   metabase.dashboards.models.dashboard-test/with-dash-in-collection                           [[:inner 0]]
-  metabase.driver-api.core/match                                                              [[:inner 0]]
   metabase.driver-api.core/match-one                                                          [[:inner 0]]
-  metabase.driver-api.core/match-lite                                                         [[:inner 0]]
   metabase.driver-api.core/match-many                                                         [[:inner 0]]
   metabase.driver-api.core/replace                                                            [[:inner 0]]
-  metabase.driver-api.core/replace-lite                                                       [[:inner 0]]
   metabase.driver-api.core/replace-in                                                         [[:inner 0]]
   metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                       [[:default]]
   metabase.driver.druid.client/DELETE                                                         [[:default]]
@@ -156,13 +202,10 @@
   metabase.lib.test-util.macros/$ids                                                          [[:inner 0]]
   metabase.lib.test-util.macros/mbql-5-query                                                  [[:inner 0]]
   metabase.lib.test-util.macros/mbql-query                                                    [[:inner 0]]
-  metabase.lib.util.match/match                                                               [[:inner 0]]
-  metabase.lib.util.match/match-one                                                           [[:inner 0]]
-  metabase.lib.util.match/match-lite                                                          [[:inner 0]]
-  metabase.lib.util.match/match-many                                                          [[:inner 0]]
-  metabase.lib.util.match/replace                                                             [[:inner 0]]
-  metabase.lib.util.match/replace-lite                                                        [[:inner 0]]
-  metabase.lib.util.match/replace-in                                                          [[:inner 0]]
+  metabase.util.match/match-one                                                               [[:inner 0]]
+  metabase.util.match/match-many                                                              [[:inner 0]]
+  metabase.util.match/replace                                                                 [[:inner 0]]
+  metabase.util.match/replace-in                                                              [[:inner 0]]
   metabase.models.interface/define-batched-hydration-method                                   [[:inner 0]]
   metabase.models.interface/define-simple-hydration-method                                    [[:inner 0]]
   metabase.parameters.chain-filter-test/with-clean-field-values-for-field                     [[:block 1]]
@@ -188,8 +231,8 @@
   metabase.query-processor.error-type/deferror                                                [[:block 1]]
   metabase.query-processor.middleware.cache-backend.interface/with-cached-results             [[:block 4]]
   metabase.query-processor.middleware.process-userland-query-test/with-query-execution        [[:block 1]]
-  metabase.query-processor.pipeline-queries-test/pmbql-query                                  [[:block 1]]
-  metabase.query-processor.pipeline-queries-test/run-pmbql-query                              [[:block 1]]
+  metabase.query-processor.pipeline-queries-test/mbql5-query                                  [[:block 1]]
+  metabase.query-processor.pipeline-queries-test/run-mbql5-query                              [[:block 1]]
   metabase.query-processor.store/cached                                                       [[:block 1]]
   metabase.query-processor.store/with-metadata-provider                                       [[:inner 0]]
   metabase.query-processor.streaming/streaming-response                                       [[:block 1]]

.coderabbit.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  high_level_summary: false
+  review_status: false
+
+  auto_review:
+    enabled: false
+    drafts: true
+    labels:
+      - "coderabbit"
+
+  path_filters:
+    - "!**/*.snap"
+    - "!**/*.po"
+    - "!**/bun.lock"
+    - "!**/package-lock.json"
+
+  tools:
+    eslint:
+      enabled: false
+
+knowledge_base:
+  code_guidelines:
+    filePatterns:
+      - ".claude/skills/clojure-review/SKILL.md"
+      - ".claude/skills/typescript-review/SKILL.md"
+      - ".claude/skills/e2e-test-review/SKILL.md"
+      - ".claude/skills/docs-review/SKILL.md"

.config/wt.toml

@@ -0,0 +1,10 @@
+# worktrunk project config — https://worktrunk.dev
+# Hooks run when switching, creating, merging, or removing worktrees.
+
+# Setup tasks for newly-created worktrees. Run once, blocking, in the
+# new worktree's cwd before post-start background tasks kick off.
+[pre-start]
+# Trust mise config so it loads the project's tool versions without prompting.
+trust-mise = "mise trust"
+# Install JS deps so husky git hooks get wired up in the new worktree.
+bun-install = "bun install"

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/vscode/devcontainers/java:21
+FROM mcr.microsoft.com/vscode/devcontainers/java:25
 
 # Set up nodesource, install node, bun, fontconfig for static viz, rlwrap for dev ergonomics
 

.dir-locals.el

@@ -41,11 +41,6 @@
   (eval . (put-clojure-indent 'c/step                          1))
   (eval . (put-clojure-indent 'impl/test-migrations            2))
   (eval . (put-clojure-indent 'let-404                         0))
-  (eval . (put-clojure-indent 'lib.schema.match/match          '(:defn)))
-  (eval . (put-clojure-indent 'lib.schema.match/match-one      '(:defn)))
-  (eval . (put-clojure-indent 'lib.schema.match/replace        '(:defn)))
-  (eval . (put-clojure-indent 'lib.schema.match/replace-in     '(:defn)))
-  (eval . (put-clojure-indent 'lib.util.match/replace          '(:defn)))
   (eval . (put-clojure-indent 'macros/case                     0))
   (eval . (put-clojure-indent 'match                           1))
   (eval . (put-clojure-indent 'mt/dataset                      1))
@@ -87,6 +82,8 @@
   (cider-default-cljs-repl . shadow-select)
   (cider-shadow-default-options . "app"))
 
+ (makefile-mode (indent-tabs-mode . t))
+
  ("bin"
   (clojure-mode
    (cider-clojure-cli-aliases . "dev:drivers:build:build-dev"))))

.dockerignore

@@ -1,5 +1,6 @@
+.git
 .babel_cache
-target/*
+target
 .circleci
 .cpcache
 .devcontainer
@@ -15,6 +16,7 @@ test_config/*
 test_modules/*
 test_resources/*
 node_modules
+**/node_modules
 **metabase.jar
 
 *.db

.github/CODEOWNERS

@@ -12,12 +12,12 @@ enterprise/backend/src/metabase_enterprise/dependencies @metabase/graphy
 enterprise/frontend/src/metabase-enterprise/dependencies @metabase/graphy
 
 # @metabase/embedding
-enterprise/frontend/src/embedding-sdk-package @metabase/embedding
-enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
-enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
-frontend/src/metabase/embedding-sdk @metabase/embedding
-frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
-frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
+# enterprise/frontend/src/embedding-sdk-package @metabase/embedding
+# enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
+# enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
+# frontend/src/metabase/embedding-sdk @metabase/embedding
+# frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
+# frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
 
 # @metabase/tech-writers
 docs @metabase/tech-writers

.github/actions/prepare-backend/action.yml

@@ -4,7 +4,7 @@ description: |
 inputs:
   java-version:
     required: true
-    default: "21"
+    default: "25"
   clojure-version:
     required: true
     default: "1.12.0.1488"

.github/actions/prepare-node-bun/action.yml

@@ -16,5 +16,5 @@ runs:
     - name: Install bun
       uses: oven-sh/setup-bun@v2
       with:
-        bun-version: "1.3.7"
+        bun-version-file: 'package.json'
         token: ${{ github.token }}

.github/actions/prepare-release-scripts/action.yml

@@ -6,7 +6,7 @@ runs:
   steps:
     - uses: oven-sh/setup-bun@v2
       with:
-        bun-version: "1.3.7"
+        bun-version-file: 'package.json'
         token: ${{ github.token }}
 
     - name: Build release scripts

.github/actions/sdk-bundle-size-check/action.yml

@@ -31,24 +31,25 @@ runs:
     - name: Prepare frontend
       uses: ./.github/actions/prepare-frontend
     - name: Download current uberjar
-      uses: actions/download-artifact@v4
+      uses: ./.github/actions/fetch-artifact
       with:
-        name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-        path: temp/current-uberjar
+        commit: ${{ github.event.pull_request.head.sha || github.sha }}
+        edition: ${{ inputs.edition }}
+        extract-path: temp/current-uberjar
     - name: Extract embedding-sdk bundles from current uberjar
       shell: bash
       run: |
         # Try new layout first (app/embedding-sdk/legacy/), fall back to old layout (app/embedding-sdk.js)
-        unzip -j temp/current-uberjar/target/uberjar/metabase.jar \
+        unzip -j temp/current-uberjar/metabase.jar \
           "frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" \
           -d temp/current-bundle 2>/dev/null || \
-        unzip -j temp/current-uberjar/target/uberjar/metabase.jar \
+        unzip -j temp/current-uberjar/metabase.jar \
           "frontend_client/app/embedding-sdk.js" \
           -d temp/current-bundle
 
         # Extract chunks directory if it exists (new layout only)
         mkdir -p temp/current-chunks
-        unzip -j temp/current-uberjar/target/uberjar/metabase.jar \
+        unzip -j temp/current-uberjar/metabase.jar \
           "frontend_client/app/embedding-sdk/chunks/*" \
           -d temp/current-chunks 2>/dev/null || true
     - name: Checkout base ref

.github/actions/upload-test-results/action.yml

@@ -7,9 +7,7 @@ inputs:
   output-name:
     required: true
     default: test
-  aws-access-key-id:
-    required: true
-  aws-secret-access-key:
+  role-to-assume:
     required: true
   aws-region:
     required: true
@@ -30,8 +28,7 @@ runs:
     - name: Configure AWS credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
-        aws-access-key-id: ${{ inputs.aws-access-key-id }}
-        aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
+        role-to-assume: ${{ inputs.role-to-assume }}
         aws-region: ${{ inputs.aws-region }}
     - name: zip test results
       env:
@@ -50,13 +47,18 @@ runs:
         aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
 
     - name: Upload results to Trunk
-      if: always() # Important! This step must always run because it controls job's exit code.
+      # Important!
+      # 1. This step must always run because it controls job's exit code.
+      # 2. There's no point in running this outside the organization
+      if: always() && github.repository_owner == 'metabase'
       uses: trunk-io/analytics-uploader@main
+      env:
+        TRUNK_REPO_URL: git@github.com:metabase/metabase.git
       with:
         junit-paths: ${{ inputs.input-path }}
         variant: ${{ inputs.variant || inputs.output-name }}
         org-slug: metabase
-        dry-run: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == true }} # quarantine, but do not upload results
+        dry-run: ${{ (github.event_name == 'pull_request' && github.event.pull_request.draft == true) || github.repository != 'metabase/metabase' }} # quarantine, but do not upload results
         token: ${{ inputs.trunk-api-token }}
         use-cache: true
         previous-step-outcome: ${{ inputs.previous-step-outcome }}

.github/file-paths.yaml

@@ -200,6 +200,10 @@ cljs:
   - ".github/workflows/cljs.yml"
   - "shadow-cljs.edn"
 
+serialization_baseline:
+  - ".github/workflows/serialization.yml"
+  - "test_resources/serialization_baseline/**"
+
 openapi:
   - ".github/workflows/openapi.yml"
   - "src/metabase/api/**"

.github/scripts/build-e2e-matrix.js

@@ -8,7 +8,7 @@ const specialTestConfigs = [
   {
     name: "oss-subset",
     edition: "oss",
-    tags: "@OSS @smoke+-@EE",
+    tags: "@OSS @prerelease+-@EE",
     specs: DEFAULT_SPEC_PATTERN,
   },
   { name: "mongo", tags: "@mongo", specs: DEFAULT_SPEC_PATTERN },
@@ -52,17 +52,21 @@ function buildMatrix(options, inputSpecs, inputChunks) {
     );
   }
 
-  const regularTests = new Array(regularChunks).fill(1).map((files, index) => ({
-    name: `e2e-group-${index + 1}`,
-    // works when specs less than 5, otherwise seems all chunks will contain
-    // same specs
-    ...(!isDefaultSpecPattern && {
-      specs: inputSpecs
-        .split(",")
-        .slice(SPECS_PER_CHUNK * index, SPECS_PER_CHUNK * (index + 1))
-        .join(","),
-    }),
-  }));
+  const regularTests = Array.from({ length: regularChunks }, (_, index) => {
+    const paddedIndex = String(index + 1).padStart(2, "0");
+
+    return {
+      name: `e2e-group-${paddedIndex}`,
+      // works when specs less than 5, otherwise seems all chunks will contain
+      // same specs
+      ...(!isDefaultSpecPattern && {
+        specs: inputSpecs
+          .split(",")
+          .slice(SPECS_PER_CHUNK * index, SPECS_PER_CHUNK * (index + 1))
+          .join(","),
+      }),
+    };
+  });
 
   const testSets = isDefaultSpecPattern
     ? regularTests.concat(specialTestConfigs)

.github/scripts/build-e2e-matrix.unit.spec.js

@@ -3,7 +3,7 @@ const { buildMatrix } = require("./build-e2e-matrix");
 describe("buildMatrix", () => {
   const options = {
     java: "11",
-    defaultRunner: "ubuntu-22.04",
+    defaultRunner: "${{ vars.DEFAULT_RUNNER_KEY }}",
   };
   const testBuildMatrix = (entry, chunks) =>
     buildMatrix(options, entry, chunks);
@@ -34,7 +34,9 @@ describe("buildMatrix", () => {
     );
 
     regularTests.forEach((test, index) => {
-      expect(test.name).toBe(`e2e-group-${index + 1}`);
+      expect(test.name).toBe(
+        `e2e-group-${String(index + 1).padStart(2, "0")}`,
+      );
     });
   });
 
@@ -92,6 +94,6 @@ describe("buildMatrix", () => {
     const result = testBuildMatrix("test1.cy.spec.js,test2.cy.spec.js", 50);
 
     expect(result.config.length).toBe(1);
-    expect(result.config[0].name).toBe("e2e-group-1");
+    expect(result.config[0].name).toBe("e2e-group-01");
   });
 });

.github/team.json

@@ -1,13 +1,14 @@
 {
   "teams": [
     {
-      "name": "Querying",
-      "label": ".Team/Querying",
+      "name": "Querying Platform",
+      "label": ".Team/QueryingPlatform",
       "members": [
         "bshepherdson",
         "metamben",
         "rileythomp",
-        "camsual"
+        "camsaul",
+        "technomancy"
       ]
     },
     {
@@ -15,12 +16,12 @@
       "label": ".Team/Graphy",
       "members": [
         "ranquild",
-        "romeovs",
         "ericnormand",
         "galdre",
         "dpsutton",
         "escherize",
-        "bgrabow"
+        "bgrabow",
+        "alxnddr"
       ]
     },
     {
@@ -46,7 +47,8 @@
       "label": ".Team/DevEx",
       "members": [
         "fraserdrops",
-        "nemanjaglumac"
+        "nemanjaglumac",
+        "romeovs"
       ]
     },
     {
@@ -89,9 +91,9 @@
         "nvoxland",
         "edpaget",
         "deniskaber",
-        "alxnddr",
         "andsalves",
-        "kevinkelleher12"
+        "kevinkelleher12",
+        "AndreyChernykh"
       ]
     },
     {
@@ -106,7 +108,9 @@
         "kamilmielnik",
         "stasgavrylov",
         "uladzimirdev",
-        "egorgrushin"
+        "egorgrushin",
+        "metatyb",
+        "olehk-mb"
       ]
     },
     {

.github/workflows/ai-benchmark.yml

@@ -0,0 +1,21 @@
+name: AI Benchmark
+
+# Runs the ai-benchmark E2E test suite against a Metabase instance.
+#
+# NOTE: This is a stub. The real workflow — which builds the benchmark Docker
+# image, boots Metabase + Postgres with a preloaded data dump, runs the
+# benchmark suite, and uploads results as artifacts — is being developed on a
+# feature branch. This stub exists on master so that the "Run workflow" button
+# is available in the GitHub Actions UI, which lets us dispatch the real
+# workflow against feature branches during development.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  placeholder:
+    name: Placeholder
+    runs-on: ubuntu-latest
+    steps:
+      - name: Stub
+        run: echo "ai-benchmark workflow stub — real implementation pending"

.github/workflows/app-db.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   be-tests-mariadb:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -22,12 +22,12 @@ jobs:
         version:
           - name: MariaDB 10.6
             junit-name: be-tests-mariadb-10-6-ee
-            image: circleci/mariadb:10.6
+            image: metabase/mariadb:10.6 # https://github.com/metabase/metabase-mariadb-docker-image
             env:
               enable-ssl-tests: 'false'
           - name: MariaDB Latest
             junit-name: be-tests-mariadb-latest-ee
-            image: circleci/mariadb:latest
+            image: mariadb:latest
             env:
               enable-ssl-tests: 'false'
         job:
@@ -57,8 +57,8 @@ jobs:
         ports:
           - "3306:3306"
         env:
-          MYSQL_ALLOW_EMPTY_PASSWORD: true
-          MYSQL_DATABASE: circle_test
+          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
+          MARIADB_DATABASE: mb_test
     env:
       # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
       # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
@@ -81,7 +81,7 @@ jobs:
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
       MB_MYSQL_TEST_USER: root
       #
@@ -120,23 +120,22 @@ jobs:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mysql:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: MySQL 8.4
-            junit-name: be-tests-mysql-8-4-ee
-            image: cimg/mysql:8.4
+          - name: MySQL 8.0
+            junit-name: be-tests-mysql-8-0-ee
+            image: mysql:8.0
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -174,7 +173,7 @@ jobs:
           - "3306:3306"
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
-          MYSQL_DATABASE: circle_test
+          MYSQL_DATABASE: mb_test
     env:
       # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
       # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
@@ -197,7 +196,7 @@ jobs:
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
       MB_MYSQL_TEST_USER: root
       #
@@ -244,15 +243,14 @@ jobs:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-postgres:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -355,8 +353,7 @@ jobs:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -366,7 +363,7 @@ jobs:
       - be-tests-mariadb
       - be-tests-mysql
       - be-tests-postgres
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: app-db-tests-result
     if: always() && !cancelled()

.github/workflows/athena.yml

@@ -7,32 +7,49 @@ on:
         description: 'Athena JDBC driver version to publish'
         required: true
         type: string
+      force:
+        description: 'Re-deploy even if version already exists'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  id-token: write
+  contents: read
 
 jobs:
   deploy:
     name: Publish Athena JDBC Driver
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - name: Check out the code
         uses: actions/checkout@v4
 
       - name: Set up Babashka
-        uses: turtlequeue/setup-babashka@v1.7.0
+        uses: turtlequeue/setup-babashka@2d4df498c7a578b4f3e906283f9af913590bdec7 # v1.7.0
         with:
           babashka-version: 1.12.197
 
       - name: Set up AWS CLI
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
-          aws-access-key-id: ${{ secrets.AWS_S3_MAVEN_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_S3_MAVEN_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_MAVEN_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
 
       - name: Deploy Athena JDBC driver
-        run: ./bin/athena.bb ${{ github.event.inputs.version }} --deploy
+        run: ./bin/athena.bb "${VERSION}" --deploy ${{ github.event.inputs.force == 'true' && '--force' || '' }}
+        env:
+          VERSION: ${{ github.event.inputs.version }}
 
       - name: Verify deployment
+        env:
+          VERSION: ${{ github.event.inputs.version }}
         run: |
-          aws s3 ls s3://metabase-maven-downloads/com/metabase/athena-jdbc/${{ github.event.inputs.version }}/
-          echo "Athena JDBC driver version ${{ github.event.inputs.version }} has been deployed"
+          aws s3 ls s3://metabase-maven-downloads/com/metabase/athena-jdbc/"${VERSION}"/
+          aws s3 ls s3://metabase-maven-downloads/com/metabase/athena-jdbc-thin/"${VERSION}"/
+          echo "Verifying thin jar pom exists..."
+          aws s3 ls s3://metabase-maven-downloads/com/metabase/athena-jdbc-thin/"${VERSION}"/athena-jdbc-thin-"${VERSION}".pom
+          echo "Verifying athena-streaming..."
+          aws s3 ls s3://metabase-maven-downloads/com/metabase/athena-streaming/2.0/
+          echo "Athena JDBC driver version ${VERSION} has been deployed (uber-jar, thin jar, and athena-streaming)"

.github/workflows/auto-assign.yml

@@ -7,10 +7,10 @@ on:
 
 jobs:
   update_pr:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
 
     steps:
-      - uses: tibdex/github-app-token@v2.1.0
+      - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
         id: generate-token
         with:
           app_id: ${{ secrets.METABASE_BOT_APP_ID }}

.github/workflows/auto-backport.yml

@@ -20,7 +20,7 @@ jobs:
           github.event.label.name == 'triple-backport'
         )
       )
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/backend-cloverage.yml

@@ -17,7 +17,7 @@ on:
 
 jobs:
   setup-oss:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     outputs:
       modules: ${{ steps.get-modules.outputs.modules }}
     steps:
@@ -31,7 +31,7 @@ jobs:
     needs: setup-oss
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -57,14 +57,14 @@ jobs:
 
       - name: Upload coverage to codecov.io
         if: always()
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./target/coverage/codecov.json
           flags: back-end
 
   setup-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     outputs:
       modules: ${{ steps.get-modules.outputs.modules }}
     steps:
@@ -78,7 +78,7 @@ jobs:
     needs: setup-ee
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -104,7 +104,7 @@ jobs:
 
       - name: Upload coverage to codecov.io
         if: always()
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./target/coverage/codecov.json

.github/workflows/backend.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   be-linter-clj-kondo:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     name: Clj-Kondo
     steps:
@@ -26,7 +26,7 @@ jobs:
 
   be-linter-eastwood:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     name: Eastwood
     steps:
@@ -37,25 +37,84 @@ jobs:
         name: Run Eastwood linter
 
   be-linter-eastwood-test:
-    if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    name: Eastwood (test)
+    # Master / release safety net: lint every backend test namespace.
+    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-')) }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 45
+    name: Eastwood (tests only)
     steps:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood/test
-        name: Run Eastwood linter on tests
+        name: Run Eastwood linter on our backend tests
+
+  be-linter-eastwood-test-changed:
+    # PR / merge queue: lint only the test namespaces touched by the diff.
+    if: ${{ !inputs.skip && (github.event_name == 'pull_request' || github.event_name == 'merge_group') }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 15
+    name: Eastwood (changed tests only)
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Enough history for `git merge-base` on a typical PR.
+          fetch-depth: 200
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Compute changed test namespaces
+        id: changed
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || github.sha }}
+        run: |
+          set -euo pipefail
+
+          # Diff from the merge-base so changes that landed on the base branch after the PR was
+          # last synced don't widen our scope. Falls back to BASE_SHA if older than fetched depth.
+          git fetch --no-tags --depth=200 origin "$BASE_SHA"
+          DIFF_BASE=$(git merge-base "$BASE_SHA" "$HEAD_SHA" 2>/dev/null || echo "$BASE_SHA")
+          # Test roots we lint: core, EE, and each driver module's test tree.
+          # :eastwood/test derives matching :source-paths from the classpath, so any
+          # namespace we name here is reachable. Include renames (R) so a test that
+          # was just renamed still gets linted under its new name.
+          FILES=$(git diff --name-only --diff-filter=AMR "$DIFF_BASE" "$HEAD_SHA" \
+                    -- 'test/**/*.clj' 'test/**/*.cljc' \
+                       'enterprise/backend/test/**/*.clj' 'enterprise/backend/test/**/*.cljc' \
+                       'modules/drivers/**/test/**/*.clj' 'modules/drivers/**/test/**/*.cljc')
+
+          if [ -z "$FILES" ]; then
+            echo "No backend test files changed; skipping lint."
+            echo "namespaces=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Defence-in-depth: paths flow into a subsequent shell command via $GITHUB_OUTPUT.
+          if grep -Eqv '^[A-Za-z0-9_./-]+$' <<<"$FILES"; then
+            echo "Refusing to lint: unexpected characters in changed file paths:" >&2
+            echo "$FILES" >&2
+            exit 1
+          fi
+
+          NS=$(sed -E 's#^(test/|enterprise/backend/test/|modules/drivers/[^/]+/test/)##; s#\.cljc?$##; s#/#.#g; s#_#-#g' <<<"$FILES" \
+                 | sort -u \
+                 | paste -sd' ' -)
+          echo "Changed test namespaces: $NS"
+          echo "namespaces=$NS" >> "$GITHUB_OUTPUT"
+      - name: Run Eastwood on changed test namespaces
+        if: steps.changed.outputs.namespaces != ''
+        env:
+          NAMESPACES: ${{ steps.changed.outputs.namespaces }}
+        run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood/test :namespaces "[$NAMESPACES]"
 
   be-tests:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
-        java-version: [21]
+        java-version: [25]
         job:
           - name: Enterprise Tests
             edition: ee
@@ -138,14 +197,13 @@ jobs:
           input-path: ./target/junit/
           output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-java-tests.outcome }}
 
       - name: Publish Test Report (JUnit)
-        uses: dorny/test-reporter@v1
+        uses: dorny/test-reporter@3eeb9fc888e82e8be2fb356bbeec2750231672bc # v1
         if: failure()
         with:
           path: "target/junit/**/*_test.xml"
@@ -167,11 +225,11 @@ jobs:
   # as `:dev` dependencies). See #27009 for more context.
   be-check:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     strategy:
       matrix:
-        java-version: [21]
+        java-version: [25]
     name: "Check Java ${{ matrix.java-version }}"
     steps:
       - uses: actions/checkout@v4
@@ -183,7 +241,7 @@ jobs:
 
   be-cljfmt:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     name: Cljfmt
     steps:
@@ -197,12 +255,13 @@ jobs:
     needs:
       - be-linter-eastwood
       - be-linter-eastwood-test
+      - be-linter-eastwood-test-changed
       - be-linter-clj-kondo
       - be-cljfmt
       - be-check
       - be-tests
     if: always() && !cancelled()
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       needs: ${{ toJson(needs) }}

.github/workflows/backport-reminder.yml

@@ -10,10 +10,10 @@ on:
 jobs:
   backport-reminder:
     name: Decide whether to backport or not
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
-      - uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+      - uses: jesusvasquez333/verify-pr-label-action@657d111bbbe13e22bbd55870f1813c699bde1401 # v1.4.0
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
           valid-labels: 'no-backport, backport, double-backport, triple-backport'

.github/workflows/block-master-source-branch-prs.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   check-source-branch:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Block master branch PRs
         if: github.head_ref == 'master'

.github/workflows/build-for-release.yml

@@ -14,7 +14,7 @@ on:
 
 jobs:
   start-message:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -45,7 +45,7 @@ jobs:
             }).catch(console.error);
 
   trigger-milestone-check:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     needs: start-message
     steps:
@@ -66,7 +66,7 @@ jobs:
 
 
   check-version:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     outputs:
       ee: ${{ fromJson(steps.canonical_version.outputs.result).ee }}
@@ -118,7 +118,7 @@ jobs:
           return versions;
 
   check-commit:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
     - name: Check out the code to verify the release branch
@@ -150,7 +150,7 @@ jobs:
         git checkout -
 
   get-build-requirements:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     outputs:
       java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
@@ -185,7 +185,7 @@ jobs:
 
   build-uberjar-for-release:
     needs: [check-version, check-commit, get-build-requirements]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 50
     strategy:
       matrix:

.github/workflows/build-scripts.yml

@@ -10,7 +10,7 @@ on:
 jobs:
 
   test-build-scripts:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
     - uses: actions/checkout@v4
     - name: Prepare back-end environment

.github/workflows/cache-generator.yml

@@ -39,7 +39,8 @@ concurrency:
 
 jobs:
   get-cache-keys:
-    runs-on: ubuntu-22.04
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - uses: actions/checkout@v4
       - name: Get cache keys
@@ -52,7 +53,7 @@ jobs:
       cypress-cache-key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
 
   generate-caches:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     needs: get-cache-keys
     env:
@@ -107,11 +108,6 @@ jobs:
           bun run cypress verify
         shell: bash
 
-      # Run Prettier to populate its cache (stored in node_modules/.cache/prettier)
-      # so it gets saved as part of the node_modules cache below
-      - name: Run Prettier to populate cache
-        run: bun run lint-prettier-pure
-
       - name: Update node_modules cache
         uses: ./.github/actions/update-cache
         with:

.github/workflows/check-backport-script.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   check-backport-script:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

.github/workflows/check-milestone.yml

@@ -15,7 +15,7 @@ on:
 jobs:
   set-milestone:
     name: Automatically set milestone
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     env:
       isNewReleaseBranch: ${{ github.event_name == 'workflow_dispatch' }}

.github/workflows/chromatic.yml

@@ -14,14 +14,14 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_all: ${{ steps.changes.outputs.frontend_all }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
+        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
@@ -30,7 +30,7 @@ jobs:
   fe-chromatic:
     needs: files-changed
     if: contains(github.event.pull_request.labels.*.name, 'chromatic') || (github.ref_name == 'master' && needs.files-changed.outputs.frontend_all == 'true')
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -43,7 +43,7 @@ jobs:
       - name: Compile CLJS
         run: NODE_ENV=development bun run build-pure:cljs
       - name: Publish to Chromatic
-        uses: chromaui/action@v10.2.0
+        uses: chromaui/action@c03d144dc72e609acbb960489fdd1e1a4a23b34f # v10.2.0
         env:
           PUBLISH_CHROMATIC: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
           STORYBOOK_BUILD_TIMEOUT: 900000

.github/workflows/claude-code-bug-fix.yml

@@ -1,360 +0,0 @@
-name: "Claude Code Bug Fix"
-
-on:
-  issues:
-    types:
-      - labeled
-  pull_request_review:
-    types:
-      - submitted
-  workflow_dispatch:
-    inputs:
-      issue_number:
-        description: "Issue number to fix"
-        required: true
-        type: string
-      override_employee_check:
-        description: "Override employee check for issue creator"
-        required: false
-        default: false
-        type: boolean
-
-jobs:
-  auto-fix-bug:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-      id-token: write
-    if: |
-      (github.event_name == 'issues' && github.event.label.name == 'Claude Bug Fix' && github.event.issue.state == 'open') ||
-      (github.event_name == 'workflow_dispatch') ||
-      (github.event_name == 'pull_request_review' && github.event.review.state == 'changes_requested' && startsWith(github.event.pull_request.head.ref, 'claude-fix/'))
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Get issue data and check employee status
-        id: get_issue
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { getIssueData } = require('${{ github.workspace }}/.github/scripts/get-issue-data.js');
-
-            try {
-              const result = await getIssueData({
-                context,
-                github,
-                manualIssueNumber: '${{ github.event.inputs.issue_number }}'
-              });
-
-              const { issueNumber, issueData, employeeComments, prReviews, triggerType, isIssueAuthorEmployee } = result;
-
-              // Check employee status and fail if not authorized
-              if (!result.isIssueAuthorEmployee && '${{ github.event.inputs.override_employee_check }}' !== 'true') {
-                  core.setFailed(`User ${result.issueData.user.login} is not a Metabase employee. Skipping bug fix automation.`);
-              }
-
-              core.setOutput('issue_number', issueNumber);
-              core.setOutput('issue_data', JSON.stringify(issueData));
-              core.setOutput('issue_comments', JSON.stringify(employeeComments));
-              core.setOutput('pr_reviews', JSON.stringify(prReviews));
-              core.setOutput('trigger_type', triggerType);
-            } catch (error) {
-              core.setFailed(error.message);
-            }
-
-      - name: Find linked Linear issue
-        id: find_linear
-        continue-on-error: true
-        uses: actions/github-script@v7
-        env:
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
-          ISSUE_NUMBER: ${{ steps.get_issue.outputs.issue_number }}
-        with:
-          script: |
-            const { findLinearIssue } = require('${{ github.workspace }}/.github/scripts/find-linear-issue.js');
-
-            const githubIssueUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/issues/${process.env.ISSUE_NUMBER}`;
-
-            const result = await findLinearIssue({
-              githubIssueUrl,
-              linearApiKey: process.env.LINEAR_API_KEY
-            });
-
-            if (result.success) {
-              console.log(`Found Linear issue: ${result.issue}`);
-              core.setOutput('linear_issue', result.issue);
-            } else {
-              console.log(`Could not find Linear issue: ${result.message}`);
-            }
-
-      - name: Set up git configuration
-        run: |
-          git config --global user.name "Claude Code[bot]"
-          git config --global user.email "noreply@anthropic.com"
-
-      - name: Prepare issue context and bug fix prompt
-        id: prepare_prompt
-        uses: actions/github-script@v7
-        env:
-          ISSUE_DATA: ${{ steps.get_issue.outputs.issue_data }}
-          ISSUE_COMMENTS: ${{ steps.get_issue.outputs.issue_comments }}
-          PR_REVIEWS: ${{ steps.get_issue.outputs.pr_reviews }}
-          TRIGGER_TYPE: ${{ steps.get_issue.outputs.trigger_type }}
-        with:
-          script: |
-            const issueData = JSON.parse(process.env.ISSUE_DATA);
-            const issueComments = JSON.parse(process.env.ISSUE_COMMENTS);
-            const prReviews = JSON.parse(process.env.PR_REVIEWS);
-            const triggerType = process.env.TRIGGER_TYPE;
-            const issueNumber = '${{ steps.get_issue.outputs.issue_number }}';
-
-            // Convert issue title to kebab case and create branch name
-            const issueTitle = issueData.title || 'untitled';
-            const kebabTitle = issueTitle
-              .toLowerCase()
-              .replace(/[^a-z0-9]+/g, '-')
-              .replace(/^-+|-+$/g, '')
-              .replace(/-+/g, '-')
-              .substring(0, 50);
-            const branchName = `claude-fix/issue-${issueNumber}-${kebabTitle}`;
-
-            // Format data for bash environment
-            const formattedComments = issueComments.length > 0
-              ? issueComments.map(comment =>
-                  `**Comment by @${comment.user.login} on ${comment.created_at}:**\n${comment.body}`
-                ).join('\n\n---\n\n')
-              : '';
-            const formattedReviews = prReviews.length > 0
-              ? prReviews.map(review =>
-                  `**Review by @${review.user.login} on ${review.submitted_at} (Changes Requested):**\n${review.body || 'No review comment provided'}`
-                ).join('\n\n---\n\n')
-              : '';
-
-            core.exportVariable('BRANCH_NAME', branchName);
-            core.exportVariable('ISSUE_NUMBER', issueNumber);
-            core.exportVariable('ISSUE_TITLE', issueData.title);
-            core.exportVariable('ISSUE_AUTHOR', issueData.user.login);
-            core.exportVariable('ISSUE_CREATED', issueData.created_at);
-            core.exportVariable('ISSUE_BODY', issueData.body || 'No description provided');
-            core.exportVariable('ISSUE_COMMENTS_FORMATTED', formattedComments);
-            core.exportVariable('PR_REVIEWS_FORMATTED', formattedReviews);
-            core.exportVariable('TRIGGER_TYPE', triggerType);
-
-      - name: Generate bug fix prompt
-        run: |
-          cat << 'EOF' >> $GITHUB_ENV
-          BUG_FIX_PROMPT<<PROMPT_END
-          You are helping to fix a bug reported in GitHub issue #${{ env.ISSUE_NUMBER }}.
-
-          ## Bug Report Details
-          **Title:** ${{ env.ISSUE_TITLE }}
-          **Reporter:** ${{ env.ISSUE_AUTHOR }}
-          **Created:** ${{ env.ISSUE_CREATED }}
-
-          **Description:**
-          ${{ env.ISSUE_BODY }}
-
-          **Comments:**
-          ${{ env.ISSUE_COMMENTS_FORMATTED }}
-          EOF
-
-          # Add review feedback section only if this is a review trigger
-          if [ "${{ env.TRIGGER_TYPE }}" = "pull_request_review" ]; then
-            cat << 'EOF' >> $GITHUB_ENV
-
-          ## Previous Fix Attempt - Review Feedback (MUST ADDRESS)
-          Your previous automated fix attempt received the following feedback that needs to be addressed:
-
-          ${{ env.PR_REVIEWS_FORMATTED }}
-          EOF
-          fi
-
-          # Add the rest of the prompt (always the same)
-          cat << 'EOF' >> $GITHUB_ENV
-
-          ## Instructions
-          1. **Analyze the issue description and comments** - Understand what the issue is describing
-             a. Pay particular attention to reproduction steps and if there's an agreed upon fix.
-          2. **Search the codebase** - Use Grep and Glob tools to find relevant files
-          3. **Implement a fix** - Use the appropriate write skill based on the file types:
-             - Use clojure-write for Clojure/ClojureScript files
-             - Use typescript-write for TypeScript/JavaScript files
-             - Follow the coding standards and patterns in each skill
-          4. **Test the fix** - Run appropriate tests as specified in the skills
-          5. **Verify the fix** - Ensure tests pass and code follows conventions
-
-          ## Important Guidelines
-          - Use the appropriate write skill for the language you're working in
-          - Write failing tests first, then fix them
-          - Work in small, testable increments
-          - Don't commit changes - leave that for the workflow
-          - IMPORTANT: Focus only on fixing the reported bug, don't make unrelated changes
-
-          ## Scratchpad Directory
-          A `.claude-scratchpad/` directory has been created for your temporary files:
-          - Use this directory for ALL temporary verification files. However, prefer using production test files rather than adhoc ones.
-          - Only modify actual production code in the main repository directories
-          - The scratchpad will be cleaned up automatically - nothing from it will be committed
-
-          Start by understanding the bug and then systematically work toward a solution.
-          PROMPT_END
-          EOF
-
-      - name: Determine branch strategy
-        run: |
-          BRANCH_NAME="${{ env.BRANCH_NAME }}"
-          if git branch -r --list "origin/${BRANCH_NAME}" | grep -q .; then
-            echo "Branch already exists: $BRANCH_NAME"
-            echo "Will push to existing branch and skip PR creation"
-            echo "BRANCH_EXISTS=true" >> $GITHUB_ENV
-          else
-            echo "Creating new branch: $BRANCH_NAME"
-            echo "Will create new PR"
-            echo "BRANCH_EXISTS=false" >> $GITHUB_ENV
-          fi
-
-          # Export the branch name
-          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
-
-      - name: Create scratchpad directory for Claude
-        run: |
-          # Create a scratchpad directory for Claude to use for temporary files
-          mkdir -p .claude-scratchpad
-          echo "Scratchpad directory created for Claude's temporary verification files"
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-
-      - name: Generate Bug Fix with Claude Code
-        uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          prompt: ${{ env.BUG_FIX_PROMPT }}
-          claude_args: |
-            --allowedTools "Bash(bun run test-unit*),Bash(bun run lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
-            --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"
-
-      - name: Clean up scratchpad directory
-        run: |
-          # Remove the scratchpad directory so its contents don't get committed
-          rm -rf .claude-scratchpad/
-          # Remove output file generated by Claude Code action
-          rm -f output.txt
-          echo "Scratchpad directory and action output files cleaned up"
-
-      - name: Check for changes and analysis
-        id: check_changes
-        run: |
-          # Now check for actual code changes (excluding analysis file)
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-            echo "Changes detected:"
-            git status --short
-          else
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-            echo "No changes made by Claude."
-          fi
-
-      - name: Get issue team labels and prepare reviewers
-        if: steps.check_changes.outputs.has_changes == 'true'
-        id: prepare_reviewers
-        uses: actions/github-script@v7
-        env:
-          ISSUE_DATA: ${{ steps.get_issue.outputs.issue_data }}
-        with:
-          script: |
-            const issueData = JSON.parse(process.env.ISSUE_DATA);
-            const issueLabels = issueData.labels.map(label => label.name);
-            const teamLabels = issueLabels.filter(label => label.startsWith('.Team/'));
-            const issueCreator = issueData.user.login;
-            core.setOutput('team_labels', teamLabels.join(','));
-            core.setOutput('reviewers', issueCreator);
-
-      - name: Create Pull Request
-        id: create_pr
-        if: steps.check_changes.outputs.has_changes == 'true'
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: ${{ env.BRANCH_NAME }}
-          base: master
-          commit-message: |
-            Fix: ${{ env.ISSUE_TITLE }}
-
-            Fixes #${{ env.ISSUE_NUMBER }}
-
-            🤖 Generated with [Claude Code](https://claude.ai/code)
-
-            Co-Authored-By: Claude <noreply@anthropic.com>
-          committer: "Claude Code[bot] <noreply@anthropic.com>"
-          author: "Claude Code[bot] <noreply@anthropic.com>"
-          title: "Fix: ${{ env.ISSUE_TITLE }}"
-          body: |
-            This PR automatically fixes the bug reported in #${{ env.ISSUE_NUMBER }}.
-
-            ${{ steps.find_linear.outputs.linear_issue && format('Closes {0}', steps.find_linear.outputs.linear_issue) || '' }}
-
-            ## Bug Report
-            **Original Issue:** #${{ env.ISSUE_NUMBER }}
-            **Reporter:** @${{ env.ISSUE_AUTHOR }}
-            **Issue Title:** ${{ env.ISSUE_TITLE }}
-
-            ## Automated Fix
-            🤖 This fix was generated automatically by Claude Code based on the issue description.
-
-            **Please review carefully:**
-            - [ ] The fix addresses the reported issue
-            - [ ] Tests pass and code follows conventions
-            - [ ] No unrelated changes were introduced
-            - [ ] The solution is appropriate and maintainable
-
-            ## Next Steps
-            - Review the changes and test thoroughly
-            - If the fix looks good, approve and merge
-            - If issues are found, either fix them or close this PR
-
-            ---
-
-            🤖 Generated with [Claude Code](https://claude.ai/code)
-
-            Co-Authored-By: Claude <noreply@anthropic.com>
-          labels: |
-            ${{ steps.prepare_reviewers.outputs.team_labels }}
-            automated-fix
-            ci skip
-          reviewers: ${{ steps.prepare_reviewers.outputs.reviewers }}
-          assignees: ${{ github.actor }}
-
-      - name: Log existing branch update
-        if: steps.check_changes.outputs.has_changes == 'true' && env.BRANCH_EXISTS == 'true'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            console.log('🔄 Updated existing branch: ${{ env.BRANCH_NAME }}');
-            console.log('The changes have been pushed to the existing PR for this issue.');
-
-      - name: Log analysis for no changes
-        if: steps.check_changes.outputs.has_changes == 'false'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            console.log('🤖 No code changes were made by Claude.');

.github/workflows/cljs.yml

@@ -14,14 +14,14 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       cljs: ${{ steps.changes.outputs.cljs }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
+        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
@@ -30,7 +30,7 @@ jobs:
   shared-tests-cljs:
     needs: files-changed
     if: needs.files-changed.outputs.cljs == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
     - uses: actions/checkout@v4

.github/workflows/codeql.yml

@@ -10,14 +10,14 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       codeql: ${{ steps.changes.outputs.codeql }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
+        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
@@ -25,7 +25,7 @@ jobs:
   analyze:
     needs: files-changed
     if: needs.files-changed.outputs.codeql == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4

.github/workflows/codespell.yml

@@ -8,7 +8,8 @@ on:
 
 jobs:
   codespell:
-    runs-on: ubuntu-latest
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     permissions:
       contents: write
@@ -67,7 +68,7 @@ jobs:
 
       - name: Fix spelling errors with Claude Code
         if: steps.codespell_check.outcome == 'failure'
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@3ac52d0da9f8ec9ca7b4dc23bb477e36ef9c77a9 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ steps.claude-app-token.outputs.token }}
@@ -82,7 +83,7 @@ jobs:
 
       - name: Create Pull Request
         if: steps.codespell_check.outcome == 'failure'
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: claude-fix/codespell-${{ steps.date.outputs.date }}

.github/workflows/containerize-jar.yml

@@ -48,16 +48,18 @@ on:
 
 jobs:
   containerize:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     outputs:
       platforms: ${{ steps.platforms.outputs.result }}
     steps:
     - uses: actions/checkout@v4
       with:
-        fetch-depth: 0
+        fetch-depth: 1
       # we want the dockerfile from the commit we're building
-    - run: git checkout ${{ inputs.commit }} -- bin/docker
+    - run: |
+        git fetch --depth=1 origin ${{ inputs.commit }}
+        git checkout ${{ inputs.commit }} -- bin/docker
     - name: Retrieve uberjar artifact
       uses: ./.github/actions/fetch-artifact
       with:
@@ -84,19 +86,19 @@ jobs:
     - name: Move the Uberjar to the context dir
       run: mv ./metabase.jar bin/docker/.
     - name: Login to Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
         password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
     - name: Set up QEMU
       if: contains(steps.platforms.outputs.result, 'arm')
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
     - name: Set up Docker Buildx
       if: contains(steps.platforms.outputs.result, 'arm')
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
     - name: Build multi-arch container
       if: contains(steps.platforms.outputs.result, 'arm')
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
       with:
         context: bin/docker/.
         platforms: ${{ steps.platforms.outputs.result }}
@@ -117,12 +119,12 @@ jobs:
           bin/docker/.
 
   verify-docker-pull:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     needs: containerize
     timeout-minutes: 15
     steps:
     - name: Login to Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
         password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
@@ -142,7 +144,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - name: Login to Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
         password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}

.github/workflows/containerize-uberjar.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   get-container-info:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: Get container info
     outputs:
@@ -68,7 +68,7 @@ jobs:
     strategy:
       matrix:
         edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: Run Trivy vulnerability scanner
     steps:
       - name: Check out the code
@@ -76,7 +76,7 @@ jobs:
         with:
           ref: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.29.0
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         env:
           TRIVY_OFFLINE_SCAN: true
           repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
@@ -85,7 +85,6 @@ jobs:
           image-ref: docker.io/${{ env.repo }}:${{ env.tag }}
           format: sarif
           output: trivy-results.sarif
-          version: "v0.57.1"
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
         with:
@@ -94,7 +93,7 @@ jobs:
   post-comment:
     needs: [get-container-info, containerize]
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: Post PR comment
     steps:
       - name: Check out the code
@@ -107,7 +106,7 @@ jobs:
           edition: ee
 
       - name: Post PR comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
         with:
           header: docker-build-status
           message: |

.github/workflows/conventional-commit-pr-title-reminder.yml

@@ -8,21 +8,21 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_embedding_sources: ${{ steps.changes.outputs.frontend_embedding_sources }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
+        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
           filters: .github/file-paths.yaml
 
   pr-title-reminder:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     permissions:
       pull-requests: write

.github/workflows/coverage.yml

@@ -7,7 +7,8 @@ on:
 
 jobs:
   fe-test-coverage:
-    runs-on: ubuntu-22.04
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
@@ -22,7 +23,7 @@ jobs:
             --coverage \
             --testTimeout=60000
       - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5
         with:
           files: ./coverage/lcov.info
           flags: front-end

.github/workflows/cross-branch-migrations.yml

@@ -25,7 +25,7 @@ concurrency:
 
 jobs:
   migrations-h2-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
@@ -39,23 +39,23 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-postgres-14-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: postgres
       MB_DB_PORT: 5432
       MB_DB_HOST: localhost
-      MB_DB_DBNAME: circle_test
-      MB_DB_USER: circle_test
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
     services:
       postgres:
         image: postgres:14-alpine
         ports:
           - "5432:5432"
         env:
-          POSTGRES_USER: circle_test
-          POSTGRES_DB: circle_test
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
       - uses: actions/checkout@v4
@@ -65,23 +65,23 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-postgres-latest-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: postgres
       MB_DB_PORT: 5432
       MB_DB_HOST: localhost
-      MB_DB_DBNAME: circle_test
-      MB_DB_USER: circle_test
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
     services:
       postgres:
-        image: circleci/postgres:latest
+        image: postgres:latest
         ports:
           - "5432:5432"
         env:
-          POSTGRES_USER: circle_test
-          POSTGRES_DB: circle_test
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
       - uses: actions/checkout@v4
@@ -90,21 +90,24 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
-  migrations-mysql-8-4-ee:
-    runs-on: ubuntu-22.04
+  migrations-mysql-8-0-ee:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
     services:
       mysql:
-        image: cimg/mysql:8.4
+        image: mysql:8.0
         ports:
           - "3306:3306"
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: mb_test
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/cross-branch-migration-test
@@ -113,14 +116,14 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-mysql-latest-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
       MB_MYSQL_TEST_USER: root
     services:
@@ -128,7 +131,7 @@ jobs:
         image: mysql:latest
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
-          MYSQL_DATABASE: circle_test
+          MYSQL_DATABASE: mb_test
         ports:
           - "3306:3306"
     steps:
@@ -139,20 +142,23 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-mariadb-10-6-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:10.6
+        image: metabase/mariadb:10.6 # https://github.com/metabase/metabase-mariadb-docker-image
         ports:
           - "3306:3306"
+        env:
+          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
+          MARIADB_DATABASE: mb_test
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/cross-branch-migration-test
@@ -161,20 +167,23 @@ jobs:
           head-ref: ${{ env.HEAD_REF }}
 
   migrations-mariadb-latest-ee:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:latest
+        image: mariadb:latest
         ports:
           - "3306:3306"
+        env:
+          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
+          MARIADB_DATABASE: mb_test
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/cross-branch-migration-test

.github/workflows/cross-version.yml

@@ -25,8 +25,8 @@ on:
 jobs:
   # Generate matrix for scheduled/PR runs
   generate-matrix:
-    if: github.event_name != 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    if: github.event_name != 'workflow_dispatch' && github.repository == 'metabase/metabase'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
@@ -47,9 +47,9 @@ jobs:
 
   # Matrix-based tests for scheduled/PR runs
   test-matrix:
-    if: github.event_name != 'workflow_dispatch'
+    if: github.event_name != 'workflow_dispatch' && github.repository == 'metabase/metabase'
     needs: generate-matrix
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
       matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
@@ -61,13 +61,38 @@ jobs:
       - name: Prepare release scripts
         uses: ./.github/actions/prepare-release-scripts
 
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare Cypress environment
+        uses: ./.github/actions/prepare-cypress
+
       - name: Run cross-version test
         env:
           CURRENT_VERSION: ${{ vars.CURRENT_VERSION }}
+          RESULT_FILE: ${{ runner.temp }}/cross-version-result-${{ matrix.source }}-${{ matrix.target }}.json
         run: |
           cd cross-version
           ./test.sh --source "${{ matrix.source }}" --target "${{ matrix.target }}"
 
+      - name: Upload failure result
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: failure-result-${{ matrix.source }}-${{ matrix.target }}
+          path: ${{ runner.temp }}/cross-version-result-${{ matrix.source }}-${{ matrix.target }}.json
+          if-no-files-found: ignore
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-${{ matrix.source }}-${{ matrix.target }}
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
       - name: Show logs on failure
         if: failure()
         run: |
@@ -75,10 +100,92 @@ jobs:
           docker compose logs metabase || true
           docker compose logs postgres || true
 
+  # Notify Slack on nightly failures
+  notify-on-failure:
+    if: >-
+      always()
+      && github.event_name == 'schedule'
+      && github.repository == 'metabase/metabase'
+      && needs.test-matrix.result == 'failure'
+    needs: [test-matrix]
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            release
+            .github
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Download failure results
+        uses: actions/download-artifact@v4
+        continue-on-error: true
+        with:
+          pattern: failure-result-*
+          path: failure-results
+          merge-multiple: true
+
+      - name: Notify Slack
+        continue-on-error: true
+        uses: actions/github-script@v7
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+            const { buildFailureResults, sendCrossVersionSlackNotification } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            // Get all failed jobs from the GitHub API
+            const { owner, repo } = context.repo;
+            const jobInfo = await github.rest.actions.listJobsForWorkflowRun({
+              owner,
+              repo,
+              run_id: context.runId,
+              per_page: 100,
+            });
+
+            const failedJobs = jobInfo.data.jobs
+              .filter(job => job.status === 'completed' && job.conclusion === 'failure' && job.name.startsWith('test-matrix'))
+              .map(job => ({ name: job.name, url: job.html_url }));
+
+            if (failedJobs.length === 0) {
+              console.log('No failed test-matrix jobs found');
+              return;
+            }
+
+            // Load artifact data for enrichment (phase)
+            const resultsDir = 'failure-results';
+            const artifactData = new Map();
+            if (fs.existsSync(resultsDir)) {
+              for (const file of fs.readdirSync(resultsDir)) {
+                if (!file.endsWith('.json')) continue;
+                try {
+                  const result = JSON.parse(fs.readFileSync(path.join(resultsDir, file), 'utf8'));
+                  artifactData.set(`${result.source}-${result.target}`, result);
+                } catch (e) {
+                  console.log(`Skipping malformed result: ${file}`);
+                }
+              }
+            }
+
+            const failures = buildFailureResults(failedJobs, artifactData);
+            const runUrl = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${context.runId}`;
+            const slackBotToken = process.env.SLACK_BOT_TOKEN;
+            if (!slackBotToken) {
+              console.log('SLACK_BOT_TOKEN is not set; skipping Slack notification.');
+              return;
+            }
+            await sendCrossVersionSlackNotification(failures, runUrl, slackBotToken);
+            console.log('Slack notification sent');
+
   # Manual test for workflow_dispatch
   test-manual:
     if: github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
 
     steps:
@@ -87,6 +194,12 @@ jobs:
       - name: Prepare release scripts
         uses: ./.github/actions/prepare-release-scripts
 
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare Cypress environment
+        uses: ./.github/actions/prepare-cypress
+
       - name: Run cross-version test
         env:
           CURRENT_VERSION: ${{ vars.CURRENT_VERSION }}
@@ -94,6 +207,16 @@ jobs:
           cd cross-version
           ./test.sh --source "${{ inputs.source_version }}" --target "${{ inputs.target_version }}"
 
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-${{ inputs.source_version }}-${{ inputs.target_version }}
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
       - name: Show logs on failure
         if: failure()
         run: |

.github/workflows/cut-release-branch.yml

@@ -0,0 +1,113 @@
+name: Cut Next Release Branch
+run-name: Cut next release branch (current is v${{ vars.CURRENT_VERSION }})
+
+on:
+  workflow_dispatch:
+
+jobs:
+  cut:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: master
+          sparse-checkout: |
+            release
+            .github
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Preflight
+        id: preflight
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            const { versionRequirements } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const currentRaw = '${{ vars.CURRENT_VERSION }}';
+            const current = Number(currentRaw);
+            if (!Number.isInteger(current) || current <= 0) {
+              throw new Error(`vars.CURRENT_VERSION is not a valid positive integer: "${currentRaw}"`);
+            }
+
+            const next = current + 1;
+            const branch = `release-x.${next}.x`;
+
+            const needsRequirementsUpdate = !(next in versionRequirements);
+
+            try {
+              await github.rest.git.getRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `heads/${branch}`,
+              });
+              throw new Error(`Branch ${branch} already exists — nothing to cut.`);
+            } catch (err) {
+              if (err.status !== 404) {
+                throw err;
+              }
+            }
+
+            core.setOutput('branch', branch);
+            core.setOutput('next', String(next));
+            core.setOutput('needsRequirementsUpdate', String(needsRequirementsUpdate));
+
+      - name: Cut the branch
+        id: cut
+        run: |
+          BRANCH="${{ steps.preflight.outputs.branch }}"
+          git config user.name github-actions
+          git config user.email github-actions@github.com
+          git checkout -b "$BRANCH"
+          git commit --allow-empty --no-verify -m "Cut $BRANCH branch"
+          git push -u origin "$BRANCH"
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Bump vars.CURRENT_VERSION
+        id: bump
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: |
+          gh variable set CURRENT_VERSION \
+            --body "${{ steps.preflight.outputs.next }}" \
+            --repo "${{ github.repository }}"
+
+      - name: Notify Slack
+        uses: actions/github-script@v7
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendSlackMessage, mentionSlackTeam } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const branch = '${{ steps.preflight.outputs.branch }}';
+            const next = '${{ steps.preflight.outputs.next }}';
+            const sha = '${{ steps.cut.outputs.sha }}';
+            const bumpFailed = '${{ steps.bump.outcome }}' === 'failure';
+            const needsReqs = '${{ steps.preflight.outputs.needsRequirementsUpdate }}' === 'true';
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            const shaLink = `<https://github.com/${owner}/${repo}/commit/${sha}|${sha.slice(0, 7)}>`;
+            const team = mentionSlackTeam('releasemanagers');
+
+            const notes = [
+              bumpFailed
+                ? `:warning: Auto-bump of \`CURRENT_VERSION\` to *${next}* failed — please update it manually: <https://github.com/${owner}/${repo}/settings/variables/actions|Actions variables>`
+                : `\`CURRENT_VERSION\` bumped to *${next}*.`,
+              needsReqs
+                ? `:warning: Please add \`versionRequirements[${next}]\` to \`release/src/version-helpers.ts\` (java + node + platforms).`
+                : null,
+            ].filter(Boolean).join('\n');
+
+            const message = `:tree_evergreen: Cut new release branch *${branch}* at ${shaLink} ${team}\n${notes}`;
+
+            await sendSlackMessage({
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+              message,
+            }).catch(console.error);

.github/workflows/disabled-drivers-slack-notification.yml

@@ -7,7 +7,8 @@ on:
 
 jobs:
   notify-disabled-drivers:
-    runs-on: ubuntu-latest
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: actions/setup-node@v4

.github/workflows/docs-generate-base.yml

@@ -1,4 +1,3 @@
-# .github/workflows/reusable-doc-update.yml
 name: Reusable - Update Documentation
 
 # This workflow is designed to be called by other workflows.
@@ -21,7 +20,7 @@ permissions:
 jobs:
   update-docs:
     name: Update documentation for ${{ inputs.target_branch }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     steps:
       - name: Checkout code
@@ -34,6 +33,11 @@ jobs:
       - name: Prepare backend environment
         uses: ./.github/actions/prepare-backend
 
+      - name: Set up Babashka
+        uses: turtlequeue/setup-babashka@2d4df498c7a578b4f3e906283f9af913590bdec7 # v1.7.0
+        with:
+          babashka-version: 1.12.197
+
       - name: Generate environment variables documentation
         id: generate_env_docs
         run: |
@@ -68,6 +72,9 @@ jobs:
           clojure -M:ee:doc command-documentation
         continue-on-error: false
 
+      - name: Generate usage analytics documentation
+        run: ./bin/generate-usage-analytics-docs.bb
+
       - name: Check for changes
         id: check_changes
         run: |
@@ -137,6 +144,8 @@ jobs:
           - \`clojure -M:ee:doc environment-variables-documentation\`
           - \`clojure -M:ee:doc config-template\`
           - \`clojure -M:ee:doc api-documentation\`
+          - \`clojure -M:ee:doc command-documentation\`
+          - \`./bin/generate-usage-analytics-docs.bb\`
 
           Please review the changes and merge if they look correct." \
               --label "Type:Documentation" \

.github/workflows/docs-links.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   link-checker:
     name: Check documentation links
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     permissions:
       contents: read
@@ -27,7 +27,7 @@ jobs:
 
       - name: Run link checker
         id: link-check
-        uses: lycheeverse/lychee-action@v2.3.0
+        uses: lycheeverse/lychee-action@f613c4a64e50d792e0b31ec34bbcbba12263c6a6 # v2.3.0
         with:
           fail: true
           args: docs --config ./.lychee/config.toml --offline

.github/workflows/docs-master-generate.yml

@@ -2,11 +2,12 @@ name: Auto-update documentation (master)
 
 on:
   schedule:
-    - cron: "0 1 * * 1-5" # Every Monday through Friday at 1 AM UTC
+    - cron: "0 21 * * 1-5" # Every Monday through Friday at 9 PM UTC
   workflow_dispatch:
 
 jobs:
   update-master-docs:
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     name: Call documentation update for master
     uses: ./.github/workflows/docs-generate-base.yml
     with:

.github/workflows/docs-release-generate.yml

@@ -2,20 +2,21 @@ name: Auto-update documentation (release)
 
 on:
   schedule:
-    - cron: "0 2 * * 1-5" # Every Monday through Friday at 2 AM UTC
+    - cron: "0 22 * * 1-5" # Every Monday through Friday at 10 PM UTC
   workflow_dispatch:
     inputs:
       target_branch:
         description: "Target branch for documentation update"
         required: false
-        default: "release-x.59.x"
+        default: "release-x.60.x"
         type: string
 
 jobs:
   update-release-docs:
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     name: Call documentation update for release branch
     uses: ./.github/workflows/docs-generate-base.yml
     with:
-      target_branch: ${{ inputs.target_branch || 'release-x.59.x' }}
+      target_branch: ${{ inputs.target_branch || 'release-x.60.x' }}
     secrets:
       automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers-stress-test.yml

@@ -49,7 +49,7 @@ jobs:
 
   be-tests-athena-ee:
     if: inputs.driver == 'Athena'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -68,7 +68,7 @@ jobs:
 
   be-tests-bigquery-cloud-sdk-ee:
     if: inputs.driver == 'BigQuery'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -89,7 +89,7 @@ jobs:
 
   be-tests-druid-ee:
     if: inputs.driver == 'Druid'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -111,7 +111,7 @@ jobs:
 
   be-tests-mariadb-10-6-ee:
     if: inputs.driver == 'Maria DB'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -119,14 +119,17 @@ jobs:
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
       MB_MYSQL_TEST_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:10.6
+        image: metabase/mariadb:10.6 # https://github.com/metabase/metabase-mariadb-docker-image
         ports:
           - "3306:3306"
+        env:
+          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
+          MARIADB_DATABASE: mb_test
     steps:
     - uses: actions/checkout@v4
     - name: Test MariaDB driver (10.6)
@@ -137,7 +140,7 @@ jobs:
 
   be-tests-mariadb-latest-ee:
     if: inputs.driver == 'Maria DB (latest)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -145,14 +148,17 @@ jobs:
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
       MB_MYSQL_TEST_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:latest
+        image: mariadb:latest
         ports:
           - "3306:3306"
+        env:
+          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
+          MARIADB_DATABASE: mb_test
     steps:
     - uses: actions/checkout@v4
     - name: Test MariaDB driver (latest)
@@ -163,7 +169,7 @@ jobs:
 
   be-tests-mongo-4-4-ee:
     if: inputs.driver == 'Mongo 4'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -185,7 +191,7 @@ jobs:
 
   be-tests-mongo-4-4-ssl-ee:
     if: inputs.driver == 'Mongo 4 (SSL)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -219,7 +225,7 @@ jobs:
 
   be-tests-mongo-5-0-ee:
     if: inputs.driver == 'Mongo 5'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -241,7 +247,7 @@ jobs:
 
   be-tests-mongo-5-0-ssl-ee:
     if: inputs.driver == 'Mongo 5 (SSL)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -275,7 +281,7 @@ jobs:
 
   be-tests-mongo-latest-ee:
     if: inputs.driver == 'Mongo (latest)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -284,7 +290,7 @@ jobs:
       MB_MONGO_TEST_PASSWORD: metasample123
     services:
       mongodb:
-        image: circleci/mongo:latest
+        image: mongo:latest
         ports:
           - "27017:27017"
         env:
@@ -298,9 +304,9 @@ jobs:
         junit-name: 'be-tests-mongo-latest-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
-  be-tests-mysql-8-4-ee:
+  be-tests-mysql-8-0-ee:
     if: inputs.driver == 'MySQL'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -308,25 +314,28 @@ jobs:
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
       MB_MYSQL_TEST_USER: root
     services:
       mysql:
-        image: cimg/mysql:8.4
+        image: mysql:8.0
         ports:
           - "3306:3306"
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: mb_test
     steps:
     - uses: actions/checkout@v4
-    - name: Test MySQL driver (8.4)
+    - name: Test MySQL driver (8.0)
       uses: ./.github/actions/test-driver
       with:
-        junit-name: 'be-tests-mysql-8-4-ee'
+        junit-name: 'be-tests-mysql-8-0-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mysql-latest-ee:
     if: inputs.driver == 'MySQL (latest)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -334,7 +343,7 @@ jobs:
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
       MB_MYSQL_TEST_USER: root
       # set up env vars for something named "MYSQL_SSL" to run MySQL SSL tests verifying connectivity with PEM cert
@@ -364,7 +373,7 @@ jobs:
 
   be-tests-oracle-18-4-ee:
     if: inputs.driver == 'Oracle 18'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -390,7 +399,7 @@ jobs:
 
   be-tests-oracle-21-3-ee:
     if: inputs.driver == 'Oracle 21'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -425,7 +434,7 @@ jobs:
 
   be-tests-postgres-ee:
     if: inputs.driver == 'Postgres'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -455,7 +464,7 @@ jobs:
 
   be-tests-postgres-latest-ee:
     if: inputs.driver == 'Postgres (latest)'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -463,20 +472,20 @@ jobs:
       MB_DB_TYPE: postgres
       MB_DB_PORT: 5432
       MB_DB_HOST: localhost
-      MB_DB_DBNAME: circle_test
-      MB_DB_USER: circle_test
-      MB_POSTGRESQL_TEST_USER: circle_test
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
+      MB_POSTGRESQL_TEST_USER: mb_test
       MB_POSTGRES_SSL_TEST_SSL: true
       MB_POSTGRES_SSL_TEST_SSL_MODE: verify-full
       MB_POSTGRES_SSL_TEST_SSL_ROOT_CERT_PATH: 'test-resources/certificates/us-east-2-bundle.pem'
     services:
       postgres:
-        image: circleci/postgres:latest
+        image: postgres:latest
         ports:
           - "5432:5432"
         env:
-          POSTGRES_USER: circle_test
-          POSTGRES_DB: circle_test
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
     - uses: actions/checkout@v4
@@ -488,7 +497,7 @@ jobs:
 
   be-tests-presto-jdbc-ee:
     if: inputs.driver == 'Presto JDBC'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -537,7 +546,7 @@ jobs:
 
   be-tests-redshift-ee:
     if: inputs.driver == 'Redshift'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -556,7 +565,7 @@ jobs:
 
   be-tests-snowflake-ee:
     if: inputs.driver == 'Snowflake'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -577,7 +586,7 @@ jobs:
 
   be-tests-sparksql-ee:
     if: inputs.driver == 'SparkSQL'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -597,7 +606,7 @@ jobs:
 
   be-tests-sqlite-ee:
     if: inputs.driver == 'SQLite'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -612,7 +621,7 @@ jobs:
 
   be-tests-sqlserver-2017-ee:
     if: inputs.driver == 'SQL Server 2017'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -639,7 +648,7 @@ jobs:
 
   be-tests-sqlserver-2022-ee:
     if: inputs.driver == 'SQL Server 2022'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -666,7 +675,7 @@ jobs:
 
   be-tests-starburst-ee:
     if: inputs.driver == 'Starburst'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -691,14 +700,14 @@ jobs:
 
   login-to-ecr:
     if: inputs.driver == 'Vertica'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     permissions:
       id-token: write
       contents: read
     steps:
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
       with:
         role-to-assume: ${{ secrets.CI_IAM_ROLE }}
         role-session-name: GitHub_to_AWS_via_FederatedOIDC
@@ -720,7 +729,7 @@ jobs:
 
   be-tests-vertica-ee:
     if: inputs.driver == 'Vertica'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     needs: login-to-ecr
     timeout-minutes: 90
     env:

.github/workflows/drivers.yml

@@ -15,7 +15,7 @@ jobs:
   # This job determines which driver tests should run based on PR context.
   # All decision logic is consolidated in mage driver-decisions.
   determine-driver-skips:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     outputs:
       # All driver run decisions (from mage driver-decisions)
       h2-should-run: ${{ steps.driver-decisions.outputs.h2-should-run }}
@@ -72,8 +72,8 @@ jobs:
           # All decision logic is in mage - it analyzes module dependencies,
           # branch context, labels, and file changes to decide what runs.
           MAGE_ARGS=(
-            --git-ref="${{ github.event.pull_request.base.ref || github.ref_name }}"
-            --is-master-or-release="${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}"
+            --git-ref="${BASE_REF}"
+            --is-master-or-release="${IS_MASTER_OR_RELEASE}"
             --pr-labels="${{ join(github.event.pull_request.labels.*.name, ',') }}"
             --skip="${{ inputs.skip }}"
           )
@@ -82,14 +82,20 @@ jobs:
           echo ""
           # First call: show human-readable output for debugging
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}"
+          echo ""
+          echo "Want to force-run a specific driver? Add a ci:run-<driver> or ci:run-all-drivers label to your PR."
+          echo "Run './bin/mage -driver-decisions -h' locally for the full list of drivers and labels."
           # Second call: output only key=value lines for GITHUB_OUTPUT
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> $GITHUB_OUTPUT
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }}
+          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}
         shell: bash
 
   be-tests-athena-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.athena-should-run == 'true' || needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: 'true'
@@ -131,8 +137,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -140,7 +145,7 @@ jobs:
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' || needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -197,8 +202,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -212,7 +216,7 @@ jobs:
   be-tests-clickhouse-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.clickhouse-should-run == 'true' || needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -255,7 +259,7 @@ jobs:
       run: |
         sudo echo "127.0.0.1 server.clickhouseconnect.test" | sudo tee -a /etc/hosts
     - name: Start ClickHouse in Docker
-      uses: hoverkraft-tech/compose-action@v2.0.0
+      uses: hoverkraft-tech/compose-action@802a148945af6399a338c7906c267331b39a71af # v2.0.0
       with:
         compose-file: "modules/drivers/clickhouse/docker-compose.yml"
         down-flags: "--volumes"
@@ -280,8 +284,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -295,7 +298,7 @@ jobs:
   be-tests-druid-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.druid-should-run == 'true' || needs.determine-driver-skips.outputs.druid-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: 'true'
@@ -335,8 +338,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -344,7 +346,7 @@ jobs:
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: 'true'
@@ -384,8 +386,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -393,8 +394,33 @@ jobs:
   be-tests-databricks-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - name: Driver Tests Part 1
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 0
+          - name: Driver Tests Part 2
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 1
+          - name: Driver Tests Part 3
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 2
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -423,9 +449,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-databricks-ee'
-        test-args: >-
-          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
+        test-args: ${{ matrix.job.test-args }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -433,8 +457,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -442,8 +465,33 @@ jobs:
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - name: Driver Tests Part 1
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 0
+          - name: Driver Tests Part 2
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 1
+          - name: Driver Tests Part 3
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 2
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -473,9 +521,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-databricks-multi-catalog-ee'
-        test-args: >-
-          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
+        test-args: ${{ matrix.job.test-args }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -483,8 +529,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -492,7 +537,7 @@ jobs:
   be-tests-h2:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: 'true'
@@ -514,8 +559,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -523,7 +567,7 @@ jobs:
   be-tests-h2-oss:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: 'true'
@@ -546,8 +590,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -555,7 +598,7 @@ jobs:
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-should-run == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -563,19 +606,19 @@ jobs:
         version:
           - name: MariaDB 10.6
             junit-name: be-tests-mariadb-10-6-ee
-            image: circleci/mariadb:10.6
+            image: metabase/mariadb:10.6 # https://github.com/metabase/metabase-mariadb-docker-image
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
           - name: MariaDB Latest
             junit-name: be-tests-mariadb-latest-ee
-            image: circleci/mariadb:latest
+            image: mariadb:latest
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
-          - name: MySQL 8.4
-            junit-name: be-tests-mysql-8-4-ee
-            image: mysql:8.4
+          - name: MySQL 8.0
+            junit-name: be-tests-mysql-8-0-ee
+            image: mysql:8.0
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -602,7 +645,7 @@ jobs:
           - "3306:3306"
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
-          MYSQL_DATABASE: circle_test
+          MYSQL_DATABASE: mb_test
     env:
       # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
       # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
@@ -625,7 +668,7 @@ jobs:
       MB_DB_TYPE: mysql
       MB_DB_HOST: localhost
       MB_DB_PORT: 3306
-      MB_DB_DBNAME: circle_test
+      MB_DB_DBNAME: mb_test
       MB_DB_USER: root
       MB_MYSQL_TEST_USER: root
       #
@@ -677,8 +720,7 @@ jobs:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -692,7 +734,7 @@ jobs:
   be-tests-mongo:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -758,8 +800,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -773,7 +814,7 @@ jobs:
   be-tests-mongo-ssl:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -841,8 +882,7 @@ jobs:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -850,7 +890,7 @@ jobs:
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: 'true'
@@ -887,8 +927,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -896,7 +935,7 @@ jobs:
   be-tests-oracle:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.oracle-should-run == 'true' || needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -973,8 +1012,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -982,7 +1020,7 @@ jobs:
   be-tests-postgres:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.postgres-should-run == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -1078,8 +1116,7 @@ jobs:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -1093,7 +1130,7 @@ jobs:
   be-tests-presto-jdbc-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: 'true'
@@ -1166,8 +1203,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -1175,7 +1211,7 @@ jobs:
   be-tests-redshift-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' || needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -1215,7 +1251,7 @@ jobs:
       MB_REDSHIFT_TEST_USER: metabase_ci
       MB_REDSHIFT_TEST_DB: testdb
       MB_REDSHIFT_TEST_DB_ROUTING: dev
-      MB_REDSHIFT_TEST_HOST: ${{ secrets.MB_REDSHIFT_TEST_HOST }}
+      MB_REDSHIFT_TEST_HOSTS: ${{ secrets.MB_REDSHIFT_TEST_HOSTS }}
       MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
     name: ${{ matrix.job.name }}
     steps:
@@ -1251,8 +1287,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -1266,7 +1301,7 @@ jobs:
   be-tests-snowflake-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.snowflake-should-run == 'true' || needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -1332,8 +1367,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -1347,7 +1381,7 @@ jobs:
   be-tests-sparksql-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.sparksql-should-run == 'true' || needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: 'true'
@@ -1385,8 +1419,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -1394,7 +1427,7 @@ jobs:
   be-tests-sqlite-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.sqlite-should-run == 'true' || needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: 'true'
@@ -1427,8 +1460,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -1436,7 +1468,7 @@ jobs:
   be-tests-sqlserver:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.sqlserver-should-run == 'true' || needs.determine-driver-skips.outputs.sqlserver-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -1504,8 +1536,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -1520,7 +1551,7 @@ jobs:
   # be-tests-starburst-ee:
   #   needs: determine-driver-skips
   #   if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
-  #   runs-on: ubuntu-latest
+  #   runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
   #   timeout-minutes: 40
   #   env:
   #     CI: 'true'
@@ -1550,22 +1581,21 @@ jobs:
   #       input-path: ./target/junit/
   #       output-name: ${{ github.job }}
   #       bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-  #       aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-  #       aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+  #       role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
   #       aws-region: ${{ vars.AWS_REGION }}
   #       trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   login-to-ecr:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     permissions:
       id-token: write
       contents: read
     steps:
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
       with:
         role-to-assume: ${{ secrets.CI_IAM_ROLE }}
         role-session-name: GitHub_to_AWS_via_FederatedOIDC
@@ -1588,7 +1618,7 @@ jobs:
   be-tests-vertica-ee:
     needs: [determine-driver-skips, login-to-ecr]
     if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: 'true'
@@ -1631,8 +1661,7 @@ jobs:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
         bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -1642,7 +1671,9 @@ jobs:
       # if you add a driver job, you must add it to this list for it to be a required check
       - be-tests-h2
       - be-tests-athena-ee
-      - be-tests-bigquery-cloud-sdk-ee
+      # these are not reliable, but we want to run them anyway to gather data about failures
+      # - be-tests-snowflake-ee
+      # - be-tests-bigquery-cloud-sdk-ee
       - be-tests-druid-ee
       - be-tests-databricks-ee
       - be-tests-druid-jdbc-ee
@@ -1654,7 +1685,6 @@ jobs:
       - be-tests-postgres
       - be-tests-presto-jdbc-ee
       - be-tests-redshift-ee
-      - be-tests-snowflake-ee
       - be-tests-sparksql-ee
       - be-tests-sqlite-ee
       - be-tests-sqlserver
@@ -1662,7 +1692,7 @@ jobs:
       # TODO(rileythomp, 2025-08-20): Re-enable vertica tests once the docker image is updated
       # - be-tests-vertica-ee
       - be-tests-clickhouse-ee
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: drivers-tests-result
     if: always() && !cancelled()
@@ -1682,7 +1712,7 @@ jobs:
               }));
 
             // are all jobs skipped or successful?
-            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success' || job.name == 'be-tests-starburst-ee'))) {
+            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
                 console.log("");
                 console.log("        _------.        ");
                 console.log("       /  ,     \_      ");

.github/workflows/e2e-matrix-builder.yml

@@ -21,7 +21,7 @@ on:
 
 jobs:
   build-matrix:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       matrix: ${{ steps.matrix.outputs.config }}
@@ -47,7 +47,7 @@ jobs:
             const inputSpecs = "${{ inputs.specs }}";
             const inputChunks = Number(process.env.chunks);
             const java = 21;
-            const defaultRunner = "ubuntu-22.04";
+            const defaultRunner = "${{ vars.DEFAULT_RUNNER_KEY }}";
             const options = {
               java,
               defaultRunner,

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -31,11 +31,16 @@ on:
         type: boolean
         required: false
         default: true
+      fail_fast:
+        description: "Stop running remaining tests after the first failure"
+        type: boolean
+        required: false
+        default: false
 
 jobs:
   determine-test-type:
     name: Determine test type
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       type: ${{ steps.detect.outputs.type }}
@@ -53,7 +58,7 @@ jobs:
   workflow-summary:
     name: Stress test inputs
     needs: [determine-test-type]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
@@ -67,12 +72,13 @@ jobs:
           echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
           echo '- `qa_db`: "${{ inputs.qa_db }}"' >> $GITHUB_STEP_SUMMARY
           echo '- `enable_network_throttling`: "${{ inputs.enable_network_throttling }}"' >> $GITHUB_STEP_SUMMARY
+          echo '- `fail_fast`: "${{ inputs.fail_fast }}"' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
           echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
 
   stress-test-flake-fix:
     needs: [determine-test-type]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     name: Stress test E2E flake fix
     env:
@@ -144,10 +150,13 @@ jobs:
         env:
           GREP: ${{ github.event.inputs.grep }}
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+          FAIL_FAST: ${{ inputs.fail_fast }}
+          SPEC: ${{ github.event.inputs.spec }}
+          BURN_IN: ${{ github.event.inputs.burn_in }}
         run: |
           node e2e/runner/run_cypress_ci.js ${{ needs.determine-test-type.outputs.type }} \
-          --spec '${{ github.event.inputs.spec }}' \
-          --env burn=${{ github.event.inputs.burn_in }} \
+          --spec "${SPEC}" \
+          --expose burn="${BURN_IN}" \
           --config-file e2e/support/cypress-stress-test.config.js
 
       - name: Upload Cypress Artifacts upon failure

.github/workflows/e2e-test.yml

@@ -21,7 +21,7 @@ on:
       runner:
         required: false
         type: string
-        default: ubuntu-22.04
+        default: ${{ vars.DEFAULT_RUNNER_KEY }}
       total_chunks: # number of chunks
         required: false
         type: number
@@ -134,7 +134,7 @@ jobs:
         run: |
           echo "Running tests with specs: $SPEC_PATH"
           node e2e/runner/run_cypress_ci.js e2e \
-            --env grepTags="-@mongo+-@python+-@OSS+-@skip" \
+            --expose grepTags="-@mongo+-@python+-@OSS+-@skip" \
             --spec "$SPEC_PATH"
         # Trunk Quarantine controls the final state of the run in the CI!
         # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
@@ -151,7 +151,7 @@ jobs:
         run: |
           echo "Running tests with specs: $SPEC_PATH"
           node e2e/runner/run_cypress_ci.js e2e \
-          --env grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@skip'}}" \
+          --expose grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@skip'}}" \
           --spec "$SPEC_PATH"
         # Trunk Quarantine controls the final state of the run in the CI!
         # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
@@ -166,8 +166,7 @@ jobs:
           # Related to our custom upload to S3
           output-name: e2e-${{ inputs.name }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           # Related to Trunk uploader
           variant: e2e-tests
@@ -235,7 +234,7 @@ jobs:
         uses: actions/upload-artifact@v4
         if: steps.extract-timings.outcome == 'success' && steps.extract-timings.outputs.has-changes == 'true'
         with:
-          name: timing-data-${{ inputs.name }}-${{ inputs.split_index }}
+          name: timing-data-${{ inputs.name }}
           path: chunkTimings.json
           retention-days: 1 # gets merged immediately by parent workflow
 

.github/workflows/e2e-tests.yml

@@ -24,7 +24,7 @@ jobs:
 
   reset-e2e-test-comment:
     if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Remove test results comment
@@ -75,7 +75,7 @@ jobs:
 
   collect-timings:
     name: Collect E2E Timings
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     needs: e2e-tests
     if: always() && !cancelled() && github.ref == 'refs/heads/master'
@@ -138,7 +138,7 @@ jobs:
   e2e-tests-result:
     needs:
       - e2e-tests
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: e2e-tests-result
     if: always() && !cancelled()

.github/workflows/embedding-sdk-component-tests.yml

@@ -12,7 +12,7 @@ env:
 jobs:
   sdk-component-tests:
     name: "SDK component tests (React ${{ matrix.react-version }})"
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     strategy:
       matrix:
@@ -94,8 +94,7 @@ jobs:
           input-path: ./target/junit
           output-name: e2e-embedding-sdk-react-${{ matrix.react-version }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-tests.outcome }}
@@ -128,7 +127,7 @@ jobs:
              await core.summary.addRaw(summary).write();
 
   decide-target-ref:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     outputs:
       target-ref: ${{ steps.get-target-ref.outputs.value }}
     steps:
@@ -151,7 +150,7 @@ jobs:
   sdk-component-tests-backward-compatibility:
     name: "SDK component tests (Backward compatibility)"
     needs: [decide-target-ref]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     env:
       MB_RUN_MODE: "e2e"
@@ -239,7 +238,7 @@ jobs:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
           node e2e/runner/run_cypress_ci.js component \
-            --env grepTags="-@skip-backward-compatibility"
+            --expose grepTags="-@skip-backward-compatibility"
 
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
@@ -248,8 +247,7 @@ jobs:
           input-path: ./target/junit
           output-name: e2e-embedding-sdk
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-tests.outcome }}

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -12,7 +12,7 @@ env:
   MB_EDITION: ee
 jobs:
   get-sample-apps-data:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     env:
       # we must support the last two stable releases
@@ -94,7 +94,7 @@ jobs:
         environment: ["production", "development"]
     if: |
       !cancelled() && needs.get-sample-apps-data.result == 'success'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: e2e-sample-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
@@ -106,6 +106,8 @@ jobs:
       SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
       id-token: write
+      contents: read
+      actions: read
 
     steps:
       - uses: actions/checkout@v4
@@ -114,7 +116,7 @@ jobs:
 
       # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
       - name: Set up Docker Compose
-        uses: docker/setup-compose-action@v1
+        uses: docker/setup-compose-action@2fe291b7677a45ee1269ec56a42604c143505e7e # v1
         with:
           version: latest
 
@@ -201,7 +203,7 @@ jobs:
     if: |
       !cancelled() && needs.get-sample-apps-data.result == 'success' &&
       (github.ref == 'refs/heads/master' || github.base_ref == 'master')
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: e2e-sample-app-shoppy-e2e-tests-${{ matrix.environment }}-bundle
     env:
@@ -213,6 +215,8 @@ jobs:
       SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
       id-token: write
+      contents: read
+      actions: read
 
     steps:
       - uses: actions/checkout@v4
@@ -264,7 +268,7 @@ jobs:
       !cancelled() && needs.get-sample-apps-data.result == 'success' &&
       github.event_name == 'push' &&
       github.ref == 'refs/heads/master'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: e2e-shoppy-synthetic-monitoring-tests
     env:
@@ -277,6 +281,7 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      actions: read
 
     steps:
       - uses: actions/checkout@v4
@@ -354,7 +359,7 @@ jobs:
             "angular-20-host-app-e2e",
           ]
         environment: ["production", "development"]
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
@@ -362,6 +367,8 @@ jobs:
       HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
       id-token: write
+      contents: read
+      actions: read
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/embedding-sdk-labels-reminder.yml

@@ -10,14 +10,14 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_embedding_sdk_package_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_package_sources }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
+        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
@@ -29,11 +29,11 @@ jobs:
       !cancelled() &&
       (needs.files-changed.outputs.frontend_embedding_sdk_package_sources == 'true')
     name: Embedding SDK package release-notes/no-release-notes label reminder
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
-      - uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+      - uses: jesusvasquez333/verify-pr-label-action@657d111bbbe13e22bbd55870f1813c699bde1401 # v1.4.0
         id: verify-release-notes-labels
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'

.github/workflows/embedding-sdk-package-build.yml

@@ -10,7 +10,7 @@ concurrency:
 
 jobs:
   build-sdk-package:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@v4

.github/workflows/embedding-sdk.yml

@@ -39,7 +39,7 @@ concurrency:
 jobs:
   embedding-sdk-cli-snippets-type-check:
     if: inputs.cli-snippets-type-check && !inputs.skip
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -55,7 +55,7 @@ jobs:
 
   embedding-sdk-docs-snippets-type-check:
     if: inputs.docs-snippets-type-check && !inputs.skip
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -71,7 +71,7 @@ jobs:
 
   embedding-sdk-api-documentation-generation-validation:
     if: inputs.documentation-validation && !inputs.skip
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -131,7 +131,7 @@ jobs:
   embedding-sdk-bundle-size-check:
     if: inputs.bundle-size-check
     continue-on-error: true
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     env:
       BUNDLE_SIZE_THRESHOLD_PERCENT: 2
@@ -186,7 +186,7 @@ jobs:
       - embedding-sdk-api-documentation-generation-validation
       - embedding-sdk-component-tests
     if: always() && !cancelled()
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       needs: ${{ toJson(needs) }}

.github/workflows/emotion-stats-update.yml

@@ -0,0 +1,78 @@
+# Weekly count of files importing @emotion/*, uploaded to stats.metabase.com.
+# Feeds the "Emotion CSS Elimination Progress" chart tracking the migration
+# off Emotion onto Mantine (+ CSS modules as a fallback).
+name: Emotion Stats Update
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: 40 1 * * 2 # every Tuesday at 1:40
+
+jobs:
+  emotion-stats:
+    if: github.repository == 'metabase/metabase'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get Emotion file count
+        id: get-emotion-file-count
+        run: |
+          # Match both `import ... from '@emotion/...'` and bare side-effect imports
+          # (`import '@emotion/...'`, used in e.g. frontend/src/types/emotion.d.ts).
+          # `|| true` prevents failing on the day the count reaches 0 — git grep
+          # exits 1 on no matches, which cascades through bash's default pipefail.
+          oss=$(
+            git grep -l -E "(from|import) ['\"]@emotion/" -- \
+              'frontend/**/*.ts' \
+              'frontend/**/*.tsx' \
+              'frontend/**/*.js' \
+              'frontend/**/*.jsx' \
+              | wc -l || true
+          )
+
+          ee=$(
+            git grep -l -E "(from|import) ['\"]@emotion/" -- \
+              'enterprise/frontend/**/*.ts' \
+              'enterprise/frontend/**/*.tsx' \
+              'enterprise/frontend/**/*.js' \
+              'enterprise/frontend/**/*.jsx' \
+              | wc -l || true
+          )
+
+          echo "$(($oss+$ee)) files importing @emotion/*"
+
+          echo "EMOTION_FILES=$(($oss+$ee))" >> $GITHUB_OUTPUT
+      - name: Upload count to Stats
+        uses: actions/github-script@v7
+        env:
+          EMOTION_FILES: ${{ steps.get-emotion-file-count.outputs.EMOTION_FILES }}
+          API_KEY: ${{ secrets.STATS_API_KEY }}
+        with:
+          script: | # js
+            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
+
+            console.log("EMOTION_FILES", Number(process.env.EMOTION_FILES));
+
+            // Keys become CSV headers and must match the target table's columns
+            // (Metabase slugifies both sides, so casing/spacing is forgiving).
+            const data = [
+              {
+                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+                'Emotion Files': Number(process.env.EMOTION_FILES),
+              }
+            ];
+
+            // tableId 76283 = "Emotion Files" table on stats.metabase.com.
+            // Auth via x-api-key, sourced from STATS_API_KEY (see env block above).
+            uploadCsvToMb({
+              baseUrl: 'https://stats.metabase.com',
+              tableId: 76283,
+              jsonData: data,
+              mode: 'append',
+            }).then(() => {
+              console.log('Data uploaded successfully');
+            }).catch((error) => {
+              console.error('Error uploading data:', error);
+              process.exit(1);
+            });

.github/workflows/escalation-slack-notification.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   on-escalation-label:
     if: github.event.label.name == '.Escalation'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - name: Format issue title (escape quotes)
@@ -18,7 +18,7 @@ jobs:
             core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
       - name: Send escalated issue ${{ github.event.issue.number }} to Slack
         id: slack
-        uses: slackapi/slack-github-action@v1.23.0
+        uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0
         with:
           payload: |
             {

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -19,7 +19,7 @@ on:
 jobs:
   workflow-summary:
     name: Stress test inputs
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
@@ -34,7 +34,7 @@ jobs:
           echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
 
   frontend-unit-test-stress-test-flake-fix:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     name: Stress test frontend unit test flake fix
     steps:
@@ -47,11 +47,16 @@ jobs:
         run: bun run build:cljs
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
         run: |
-          for i in {1..${{ github.event.inputs.burn_in }}}; do
+          for ((i=1; i<=BURN_IN; i++)); do
             bun run jest --runInBand --ci --silent --no-cache \
-              --testPathPatterns '${{ github.event.inputs.spec }}' \
-              --testNamePattern '${{ github.event.inputs.grep }}'
+              --testPathPatterns "${SPEC}" \
+              --testNamePattern "${GREP}"
             if [[ "$?" != 0 ]]; then
               echo "Failed after $i attempts" && break;
             fi
           done
+
+        env:
+          BURN_IN: ${{ github.event.inputs.burn_in }}
+          SPEC: ${{ github.event.inputs.spec }}
+          GREP: ${{ github.event.inputs.grep }}

.github/workflows/frontend.yml

@@ -16,7 +16,7 @@ on:
         type: boolean
         default: false
       skip-lint:
-        description: "Skip linting jobs (prettier, eslint, css variables check)"
+        description: "Skip linting jobs (oxfmt, eslint, css variables check)"
         type: boolean
         default: false
 
@@ -27,7 +27,7 @@ concurrency:
 jobs:
   fe-lint:
     if: ${{ !inputs.skip-lint }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -49,8 +49,8 @@ jobs:
         run: bun run build-pure:cljs
       - name: Find CSS variables that are used but never defined
         run: bun run find-never-defined-css-variables
-      - name: Run Prettier formatting linter
-        run: bun run lint-prettier-pure
+      - name: Run oxfmt formatting linter
+        run: bun run lint-format-pure
       - name: Run ESLint linter
         run: bun run lint-eslint-pure
       - name: Run CSS linter
@@ -58,7 +58,7 @@ jobs:
 
   fe-type-check:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -73,7 +73,7 @@ jobs:
 
   fe-tests-unit:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -103,22 +103,19 @@ jobs:
           input-path: ./target/junit
           output-name: frontend-unit
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.fe-tests.outcome }}
 
   fe-tests-timezones:
     if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
       - name: Run frontend timezones tests
         run: bun run test-timezones
 
@@ -129,7 +126,7 @@ jobs:
       - fe-tests-unit
       - fe-tests-timezones
     if: always() && !cancelled()
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       needs: ${{ toJson(needs) }}

.github/workflows/generative-query-test.yml

@@ -24,7 +24,7 @@ on:
 # TODO: Consider renaming the job in next milestones
 jobs:
   generative-query-test:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 90
     name: Generative Query Test
     env:
@@ -47,7 +47,7 @@ jobs:
         run: clojure -X:dev:ci:test:ee:ee-dev :only '${{ inputs.test }}'
 
       - name: Publish Test Report (JUnit)
-        uses: dorny/test-reporter@v1
+        uses: dorny/test-reporter@3eeb9fc888e82e8be2fb356bbeec2750231672bc # v1
         if: failure()
         with:
           path: "target/junit/**/*_test.xml"

.github/workflows/i18n.yml

@@ -14,14 +14,14 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       i18n: ${{ steps.changes.outputs.i18n }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
+        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
@@ -30,22 +30,22 @@ jobs:
   verify-i18n-files:
     needs: files-changed
     if: needs.files-changed.outputs.i18n == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v4
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-    - name: Install xgettext if necessary
-      run: |
-        if ! command -v xgettext > /dev/null; then
-          sudo apt install gettext
-        fi
-    - name: Check xgettext version
-      run: xgettext --version
-    - name: Check i18n tags/make sure template can be built
-      run: ./bin/i18n/update-translation-template
-    - name: Verify i18n translations (.po files)
-      run: ./bin/i18n/build-translation-resources
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Install xgettext if necessary
+        run: |
+          if ! command -v xgettext > /dev/null; then
+            sudo apt install gettext
+          fi
+      - name: Check xgettext version
+        run: xgettext --version
+      - name: Check i18n tags/make sure template can be built
+        run: ./bin/i18n/update-translation-template
+      - name: Verify i18n translations (.po files)
+        run: ./bin/i18n/build-translation-resources

.github/workflows/js-stats-update.yml

@@ -7,7 +7,8 @@ on:
 
 jobs:
   js-stats:
-    runs-on: ubuntu-latest
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4

.github/workflows/linear-pr-links.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   add-issue-references:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

.github/workflows/loki-stress-test-flake-fix.yml

@@ -21,7 +21,7 @@ on:
 jobs:
   detect-changed-stories:
     name: Detect changed stories
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       story_files: ${{ steps.detect.outputs.story_files }}
@@ -84,32 +84,40 @@ jobs:
     name: Summary
     needs: detect-changed-stories
     if: needs.detect-changed-stories.outputs.should_run == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
+        env:
+          BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
+          STORY_FILES: ${{ needs.detect-changed-stories.outputs.story_files }}
+          BURN_IN: ${{ inputs.burn_in || 50 }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_ACTOR: ${{ github.event.pull_request.user.login }}
+          ACTOR: ${{ github.actor }}
         run: |
           echo '## Loki Stress Test' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
-          echo '**Branch:** `${{ github.head_ref || github.ref_name }}`' >> $GITHUB_STEP_SUMMARY
+          echo "**Branch:** \`${BRANCH_NAME}\`" >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
           echo '**Story files:**' >> $GITHUB_STEP_SUMMARY
-          echo '${{ needs.detect-changed-stories.outputs.story_files }}' | tr ',' '\n' | while read -r file; do
+          echo "${STORY_FILES}" | tr ',' '\n' | while read -r file; do
             echo "- \`$file\`" >> $GITHUB_STEP_SUMMARY
           done
           echo '' >> $GITHUB_STEP_SUMMARY
-          echo '**Burn-in:** ${{ inputs.burn_in || 50 }} runs' >> $GITHUB_STEP_SUMMARY
+          echo "**Burn-in:** ${BURN_IN} runs" >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo 'Triggered by PR #${{ github.event.pull_request.number }} from @${{ github.event.pull_request.user.login }}' >> $GITHUB_STEP_SUMMARY
+          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
+            echo "Triggered by PR #${PR_NUMBER} from @${PR_ACTOR}" >> $GITHUB_STEP_SUMMARY
           else
-            echo 'Triggered manually by @${{ github.actor }}' >> $GITHUB_STEP_SUMMARY
+            echo "Triggered manually by @${ACTOR}" >> $GITHUB_STEP_SUMMARY
           fi
 
   stress-test-loki:
     needs: detect-changed-stories
     if: needs.detect-changed-stories.outputs.should_run == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 60
     name: Stress test Loki visual tests
     services:

.github/workflows/loki-update.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   check-label-and-update-snapshot:
     if: contains(github.event.pull_request.labels.*.name, 'loki-update')
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4

.github/workflows/loki.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_ci: ${{ steps.changes.outputs.frontend_ci }}
@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
+        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
@@ -25,7 +25,7 @@ jobs:
   visual-test:
     needs: files-changed
     if: needs.files-changed.outputs.frontend_ci == 'true' || needs.files-changed.outputs.frontend_sources == 'true' || needs.files-changed.outputs.frontend_loki_ci == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     services:
       docker:
         image: docker:19.03.12

.github/workflows/mage.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   # run mage tests even if the rest of be isnt needed
   mage-tests:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: Mage
     steps:
       - uses: actions/checkout@v4

.github/workflows/main.yml

@@ -6,7 +6,7 @@ on:
       - labeled
 jobs:
   on-issue-labeled:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     if: |
       contains(github.event.issue.labels.*.name, 'Type:New Feature')
@@ -19,7 +19,7 @@ jobs:
             core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
       - name: Send the issue ${{ github.event.issue.number }} to Slack
         id: slack
-        uses: slackapi/slack-github-action@v1.26.0
+        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
         with:
           payload: |
             {

.github/workflows/mbql-library-changelog.yml

@@ -8,10 +8,10 @@ on:
       - unlabeled
       - synchronize
     paths:
-      - src/metabase/lib/js.cljs
+      - src/metabase/utils/js.cljs
 jobs:
   mbql-library-changelog-check:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     if: ${{ !contains( github.event.pull_request.labels.*.name, '.metabase-lib/no-change' ) }}
     steps:
       # - uses: jesusvasquez333/verify-pr-label-action@v1.4.0

.github/workflows/migrations.yml

@@ -6,11 +6,13 @@ on:
       - 'master'
       - 'release-**'
   pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
 
 jobs:
 
   lint-migrations:
-    runs-on: ubuntu-22.04
+    if: github.event.action != 'labeled' && github.event.action != 'unlabeled'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
@@ -18,3 +20,19 @@ jobs:
         uses: ./.github/actions/prepare-backend
       - name: Verify Liquibase Migrations
         run: ./bin/mage lint-migrations
+
+  check-migration-versions:
+    if: github.event_name == 'pull_request'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          filter: blob:none
+          fetch-depth: 0
+      - name: Check migration versions
+        env:
+          BASE_REF: ${{ github.base_ref }}
+          CURRENT_VERSION: ${{ vars.CURRENT_VERSION }}
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+        run: bin/check-migration-versions

.github/workflows/minimal-tests.yml

@@ -8,10 +8,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+  checks: write
+  actions: read
+
 jobs:
   # Only run if the PR has the minimal-tests label
   check-label:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 1
     outputs:
       should-run: ${{ steps.check.outputs.result }}
@@ -29,7 +35,7 @@ jobs:
   postgres-app-db-test:
     needs: check-label
     if: needs.check-label.outputs.should-run == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: "true"
@@ -70,8 +76,7 @@ jobs:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -80,7 +85,7 @@ jobs:
   postgres-driver-test:
     needs: check-label
     if: needs.check-label.outputs.should-run == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
       CI: "true"
@@ -118,8 +123,7 @@ jobs:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
@@ -128,7 +132,7 @@ jobs:
   frontend-unit-tests:
     needs: check-label
     if: needs.check-label.outputs.should-run == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     env:
       JEST_JUNIT_OUTPUT_DIR: ./target/junit
@@ -151,8 +155,7 @@ jobs:
           input-path: ./target/junit
           output-name: frontend-unit
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-tests.outcome }}
@@ -163,7 +166,7 @@ jobs:
       - postgres-app-db-test
       - postgres-driver-test
       - frontend-unit-tests
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: minimal-tests-result
     if: always() && !cancelled()

.github/workflows/module-boundaries-stats.yml

@@ -7,11 +7,14 @@ on:
 
 jobs:
   module-boundaries-stats:
-    runs-on: ubuntu-latest
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version-file: 'package.json'
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: get module boundary stats
@@ -20,6 +23,13 @@ jobs:
           NAMED_MODULES=$(node --input-type=module -e "
             import { elements } from './frontend/lint/module-boundaries.mjs';
             const named = elements.filter(e => !['shared/other', 'app/misc', 'other'].includes(e.type));
+            console.log(named.length);
+          ")
+
+          ENFORCED_MODULES=$(node --input-type=module -e "
+            import { elements } from './frontend/lint/module-boundaries.mjs';
+            const enforced = new Set(elements.filter(e => e.enforceOutgoing).map(e => e.type));
+            console.log(enforced.size);
           ")
 
           NAMED_DIRS=$(node --input-type=module -e "
@@ -29,6 +39,7 @@ jobs:
               const m = el.pattern.match(/^frontend\/src\/metabase\/(\w[\w-]*)\//)
               if (m) dirs.add(m[1]);
             }
+            for (const d of dirs) console.log(d);
           ")
           TOTAL_DIRS=$(ls -d frontend/src/metabase/*/ | xargs -I{} basename {} | wc -l | tr -d ' ')
           NAMED_COUNT=$(echo "$NAMED_DIRS" | grep -c . || true)
@@ -36,15 +47,17 @@ jobs:
 
           VIOLATIONS=$(bun run module-boundaries 2>&1 | grep -o '✖ [0-9]* problems' | grep -o '[0-9]*' || echo "0")
 
-          echo "$NAMED_MODULES modules, $UNMODULED unmoduled folders, $VIOLATIONS violations"
+          echo "$NAMED_MODULES modules, $ENFORCED_MODULES enforced, $UNMODULED unmoduled folders, $VIOLATIONS violations"
 
           echo "NAMED_MODULES=$NAMED_MODULES" >> $GITHUB_OUTPUT
+          echo "ENFORCED_MODULES=$ENFORCED_MODULES" >> $GITHUB_OUTPUT
           echo "UNMODULED=$UNMODULED" >> $GITHUB_OUTPUT
           echo "VIOLATIONS=$VIOLATIONS" >> $GITHUB_OUTPUT
       - name: Upload stats
         uses: actions/github-script@v7
         env:
           NAMED_MODULES: ${{ steps.get-stats.outputs.NAMED_MODULES }}
+          ENFORCED_MODULES: ${{ steps.get-stats.outputs.ENFORCED_MODULES }}
           UNMODULED: ${{ steps.get-stats.outputs.UNMODULED }}
           VIOLATIONS: ${{ steps.get-stats.outputs.VIOLATIONS }}
           API_KEY: ${{ secrets.STATS_API_KEY }}
@@ -53,6 +66,7 @@ jobs:
             const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
 
             console.log("NAMED_MODULES", Number(process.env.NAMED_MODULES));
+            console.log("ENFORCED_MODULES", Number(process.env.ENFORCED_MODULES));
             console.log("UNMODULED", Number(process.env.UNMODULED));
             console.log("VIOLATIONS", Number(process.env.VIOLATIONS));
 
@@ -60,6 +74,7 @@ jobs:
               {
                 'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
                 'Modules': Number(process.env.NAMED_MODULES),
+                'Enforced modules': Number(process.env.ENFORCED_MODULES),
                 'Unmoduled folders': Number(process.env.UNMODULED),
                 'Violations': Number(process.env.VIOLATIONS),
               }

.github/workflows/openapi-check.yml

@@ -10,7 +10,7 @@ concurrency:
 
 jobs:
   check-openapi-specs:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     if: contains(github.event.pull_request.labels.*.name, 'openapi-self-healing')
     steps:

.github/workflows/openapi.yml

@@ -14,14 +14,14 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       openapi: ${{ steps.changes.outputs.openapi }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
+        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
         id: changes
         with:
           token: ${{ github.token }}
@@ -30,7 +30,7 @@ jobs:
   validate-openapi:
     needs: files-changed
     if: needs.files-changed.outputs.openapi == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4

.github/workflows/optimize-images.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   optimize-images:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     if: ${{ contains(github.event.pull_request.labels.*.name,'Type:Documentation') }}
     steps:
     - name: Checkout repository

.github/workflows/perf-test.yml

@@ -5,7 +5,7 @@ on:
   workflow_call:
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     if: github.event.pull_request.head.repo.full_name == github.repository
     name: Build Metabase Docker image
     timeout-minutes: 60
@@ -17,13 +17,13 @@ jobs:
       - name: Checkout source code
         uses: actions/checkout@v4
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
           role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-east-1
       - name: Login to Amazon ECR
-        uses: aws-actions/amazon-ecr-login@v2
+        uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896 # v2
         with:
           registries: "${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}"
       - name: Retrieve uberjar artifact for ee
@@ -38,7 +38,7 @@ jobs:
           jar xf target/uberjar/metabase.jar
           mv target/uberjar/metabase.jar bin/docker/metabase.jar
       - name: Build container
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: bin/docker/
           platforms: linux/amd64
@@ -47,7 +47,7 @@ jobs:
           push: true
   launch_perf_test:
     needs: [ build ]
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: Launch Perf Test
     permissions:
       id-token: write
@@ -56,7 +56,7 @@ jobs:
       - name: Checkout source code
         uses: actions/checkout@v4
       - name: Tailscale
-        uses: tailscale/github-action@v2
+        uses: tailscale/github-action@4e4c49acaa9818630ce0bd7a564372c17e33fb4d # v2
         with:
           oauth-client-id: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_CLIENT_ID }}
           oauth-secret: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_SECRET }}
@@ -67,12 +67,14 @@ jobs:
         id: create-oidc-token
         shell: bash
         run: |
-          export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${{ secrets.PR_ENV_K8S_AUDIENCE }}"
+          export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${PR_ENV_K8S_AUDIENCE}"
           IDTOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" -H "Accept: application/json; api-version=2.0" "$OIDC_URL_WITH_AUDIENCE" | jq -r .value)
           echo "::add-mask::${IDTOKEN}"
           echo "idToken=${IDTOKEN}" >>$GITHUB_OUTPUT
+        env:
+          PR_ENV_K8S_AUDIENCE: ${{ secrets.PR_ENV_K8S_AUDIENCE }}
       - name: Setup Kube Context
-        uses: azure/k8s-set-context@v2
+        uses: azure/k8s-set-context@0b53301dcc7ddd3f6d35f97fb67228ac4e5ab2fd # v2
         with:
           method: kubeconfig
           kubeconfig: |
@@ -95,7 +97,7 @@ jobs:
                 namespace: default
                 user: oidc-token
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
           role-session-name: GitHub_to_AWS_via_FederatedOIDC
@@ -106,9 +108,9 @@ jobs:
         env:
           SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         id: split
-        run: echo "::set-output name=fragment::${SHA:5}"
+        run: echo "fragment=${SHA:5}" >> $GITHUB_OUTPUT
       - name: Render Deployment YAML
-        uses: nowactions/envsubst@v1
+        uses: nowactions/envsubst@c4b8e3977354d294659a7ec164279ce8fba5c2e1 # v1
         with:
           input: ./perf-test-pr.yml.tmpl
           output: ./perf-test-pr.yml

.github/workflows/pr-env-destroy-manual.yml

@@ -14,7 +14,7 @@ on:
 
 jobs:
   approve:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     environment: pr-env-admin
     steps:
       - name: Approved

.github/workflows/pr-env-destroy.yml

@@ -19,7 +19,7 @@ env:
 
 jobs:
   destroy_pr:
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     name: PR Review ENV Destroy
     permissions:
       id-token: write
@@ -28,7 +28,7 @@ jobs:
       - name: Checkout source code
         uses: actions/checkout@v4
       - name: Tailscale
-        uses: tailscale/github-action@v2
+        uses: tailscale/github-action@4e4c49acaa9818630ce0bd7a564372c17e33fb4d # v2
         with:
           oauth-client-id: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_CLIENT_ID }}
           oauth-secret: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_SECRET }}
@@ -39,12 +39,14 @@ jobs:
         id: create-oidc-token
         shell: bash
         run: |
-          export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${{ secrets.PR_ENV_K8S_AUDIENCE }}"
+          export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${PR_ENV_K8S_AUDIENCE}"
           IDTOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" -H "Accept: application/json; api-version=2.0" "$OIDC_URL_WITH_AUDIENCE" | jq -r .value)
           echo "::add-mask::${IDTOKEN}"
           echo "idToken=${IDTOKEN}" >>$GITHUB_OUTPUT
+        env:
+          PR_ENV_K8S_AUDIENCE: ${{ secrets.PR_ENV_K8S_AUDIENCE }}
       - name: Setup Kube Context
-        uses: azure/k8s-set-context@v2
+        uses: azure/k8s-set-context@0b53301dcc7ddd3f6d35f97fb67228ac4e5ab2fd # v2
         with:
           method: kubeconfig
           kubeconfig: |
@@ -73,7 +75,7 @@ jobs:
           kubectl delete ns hosting-pr${{ env.PR_NUMBER }}
       - name: Setup Helm
         if: ${{ inputs.self_hosting }}
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           version: 'latest'
       - name: Destroy PR Review ENV (self-hosting)
@@ -87,9 +89,15 @@ jobs:
           sudo apt-get install -y postgresql-client
       - name: Drop app database if exists
         run: |
-          PGPASSWORD='${{ secrets.PR_ENV_DB_PASSWORD }}' \
+          PGPASSWORD="${PR_ENV_DB_PASSWORD}" \
           psql \
-          -h ${{ secrets.PR_ENV_DB_HOST }} \
-          -U ${{ secrets.PR_ENV_DB_USER }} \
-          -d ${{ secrets.PR_ENV_DB_NAME }} \
+          -h "${PR_ENV_DB_HOST}" \
+          -U "${PR_ENV_DB_USER}" \
+          -d "${PR_ENV_DB_NAME}" \
           -c "DROP DATABASE IF EXISTS hosting_pr${{ env.PR_NUMBER }};"
+
+        env:
+          PR_ENV_DB_PASSWORD: ${{ secrets.PR_ENV_DB_PASSWORD }}
+          PR_ENV_DB_HOST: ${{ secrets.PR_ENV_DB_HOST }}
+          PR_ENV_DB_USER: ${{ secrets.PR_ENV_DB_USER }}
+          PR_ENV_DB_NAME: ${{ secrets.PR_ENV_DB_NAME }}