Improve OAuth server and MCP integration test coverage

Strengthen assertions across 5 test files by replacing weak `some?`/`string?`/
`contains?` existence checks with `=?` pattern assertions that validate actual
values. Consolidate scattered single-field `(is ...)` calls into single map
assertions.

Add new security-critical tests: expired OAuth bearer tokens, scope enforcement
on tool calls, PKCE S256 flow (happy + missing verifier), expired authorization
codes, and revoked refresh tokens.

Fix invalid-bearer-token test to set site-url and reset the OAuth provider.

.claude/commands/mutation-testing.md

@@ -0,0 +1 @@
+Run mutation testing for $ARGUMENTS

.claude/skills/_shared/clojure-commands.md

@@ -12,14 +12,7 @@
 
 ## Testing
 
-- **Run a test:** `./bin/mage run-tests namespace/test-name`
-- **Run all tests in a namespace:** `./bin/mage run-tests namespace`
-- **Run all tests for a module:** `./bin/mage run-tests test/metabase/notification` Because the module lives in that directory.
-
-Note: the `./bin/mage run-tests` command accepts multiple args, so you can pass
-`./bin/mage run-tests namespace/test-name namespace/other-test namespace/third-test`
-to run 3 tests, or
-`./bin/mage run-tests test/metabase/module1 test/metabase/module2` to run 2 modules.
+Use `./bin/test-agent` to run backend tests. See the top-level CLAUDE.md for usage.
 
 ## Code Readability
 

.claude/skills/_shared/typescript-commands.md

@@ -1,21 +1,21 @@
 ## Linting and Formatting
 
-- **Lint:** `yarn lint-eslint-pure`
+- **Lint:** `bun run lint-eslint-pure`
   - Run ESLint on the codebase
-- **Format:** `yarn prettier`
+- **Format:** `bun run prettier`
   - Format code using Prettier
-- **Type Check:** `yarn type-check-pure`
+- **Type Check:** `bun run type-check-pure`
   - Run TypeScript type checking
 
 ## Testing
 
 ### JavaScript/TypeScript Tests
 
-- **Test a specific file:** `yarn test-unit-keep-cljs path/to/file.unit.spec.js`
-- **Test by pattern:** `yarn test-unit-keep-cljs -t "pattern"`
+- **Test a specific file:** `bun run test-unit-keep-cljs path/to/file.unit.spec.js`
+- **Test by pattern:** `bun run test-unit-keep-cljs -t "pattern"`
   - Runs tests matching the given pattern
 
 ### ClojureScript Tests
 
-- **Test ClojureScript:** `yarn test-cljs`
+- **Test ClojureScript:** `bun run test-cljs`
   - Run ClojureScript tests

.claude/skills/add-tracing/SKILL.md

@@ -0,0 +1,357 @@
+--b-
+name: add-tracing
+description: Add OpenTelemetry tracing spans to Clojure code following Metabase tracing conventions. Use when instrumenting backend code with trace coverage.
+---
+
+# Add Tracing Spans to Clojure Code
+
+This skill helps you add OpenTelemetry (OTel) tracing spans to the Metabase backend codebase using the custom `tracing/with-span` macro.
+
+## Reference Files
+
+- `src/metabase/tracing/core.clj` - `with-span` macro, group registry, SDK lifecycle, `best-effort-sanitize-sql`, Pyroscope integration
+- `src/metabase/task/impl.clj` - `defjob` macro that wraps Quartz jobs with root spans
+- `.clj-kondo/config/modules/config.edn` - Module boundary configuration
+
+## Module Architecture
+
+The tracing module has a deliberately minimal API surface. **Only 2 namespaces are public** (listed in `:api` in the module config):
+
+| Namespace | Role | Status |
+|---|---|---|
+| `tracing.core` | Primary API: `with-span`, groups, SDK lifecycle, Pyroscope, MDC, `best-effort-sanitize-sql` | **Public API** |
+| `tracing.init` | Side-effect loader for `quartz` and `settings` | **Public API** (init convention) |
+| `tracing.attributes` | `best-effort-sanitize-sql` implementation (re-exported via `tracing.core`) | Internal |
+| `tracing.settings` | Setting definitions (`MB_TRACING_*` env vars) | Internal |
+| `tracing.quartz` | Quartz JDBC proxy + JobListener | Internal |
+
+**Rules:**
+- Only require `[metabase.tracing.core :as tracing]` from outside the module. `tracing/best-effort-sanitize-sql` and all other public functions are available from this single namespace.
+- Do not add new API namespaces. Add new public functions to `tracing.core` instead.
+- Do not require internal namespaces (`tracing.attributes`, `tracing.settings`, `tracing.quartz`) from outside the module.
+- `:uses :any` on the `core` module does NOT bypass the target module's `:api` check — internal namespaces are still enforced.
+
+### Cyclic Dependency Avoidance
+
+`tracing/core.clj` is required by many modules across the codebase. It **must NOT** compile-time require `tracing.settings`, as this creates transitive cyclic load dependencies (e.g., `settings/core -> tracing/settings -> tracing/core -> events/impl -> events/core`).
+
+Instead, `tracing/core.clj` uses `requiring-resolve` for settings access:
+
+```clojure
+;; CORRECT — lazy runtime resolution, no compile-time dependency
+((requiring-resolve 'metabase.tracing.settings/tracing-enabled))
+
+;; WRONG — creates cyclic load dependency
+(require '[metabase.tracing.settings :as settings])
+(settings/tracing-enabled)
+```
+
+External library namespaces (clj-otel API, SDK, exporters) are safe to require normally — they don't participate in Metabase namespace cycles.
+
+**Important:** `requiring-resolve` must use **literal quoted symbols**. Kondo hooks validate that `required-namespaces` are all simple symbols, so dynamic construction fails:
+
+```clojure
+;; CORRECT — literal quoted symbol
+(requiring-resolve 'metabase.tracing.settings/tracing-endpoint)
+
+;; WRONG — kondo hook rejects this: "Assert failed: (every? simple-symbol? required-namespaces)"
+(requiring-resolve (symbol "metabase.tracing.settings" "tracing-endpoint"))
+```
+
+## Quick Checklist
+
+When adding tracing spans:
+
+- [ ] Module has `tracing` in its `:uses` set in `.clj-kondo/config/modules/config.edn`
+- [ ] Added `[metabase.tracing.core :as tracing]` to ns requires (alphabetically sorted)
+- [ ] Span wraps a meaningful I/O boundary (not pure computation)
+- [ ] Group matches the domain (check `src/metabase/tracing/core.clj` for registered groups; add a new one if none fit)
+- [ ] Span name follows dot-notation convention (`"domain.subsystem.operation"`)
+- [ ] Attributes use namespaced keywords (`:search/query-length`, `:db/id`)
+- [ ] No sensitive data in attributes (use `best-effort-sanitize-sql` for HoneySQL, never raw SQL)
+- [ ] No new tracing namespaces created (add to `tracing.core` instead)
+- [ ] No `DO_NOT_ADD_NEW_FILES_HERE.txt` violations in the target directory
+- [ ] Run `clj-kondo --lint <files>` to verify 0 errors, 0 warnings
+- [ ] Add or update tests in the corresponding `test/` path (see Testing section below)
+- [ ] Run tests: `clojure -X:dev:test :only <test-ns>`
+
+## The `with-span` Macro
+
+```clojure
+(tracing/with-span group span-name attrs & body)
+```
+
+- **group** - A keyword selecting which trace group this span belongs to (e.g., `:tasks`, `:sync`)
+- **span-name** - A string identifying the span in traces (e.g., `"search.execute"`)
+- **attrs** - A map of span attributes (e.g., `{:db/id 42}`)
+- **body** - The code to execute inside the span
+
+**When disabled:** zero overhead -- single atom deref + boolean check, body runs directly.
+**When enabled:** creates OTel span AND injects `trace_id`/`span_id` into Log4j2 MDC for log-to-trace correlation.
+
+## Trace Groups
+
+Groups are registered in `src/metabase/tracing/core.clj`. Check that file for the current list. The general rule: **match the group to the domain, not the call site.** If code runs inside a Quartz job but is logically search work, use `:search`, not `:tasks`.
+
+To add a new group:
+
+```clojure
+;; In src/metabase/tracing/core.clj
+(register-group! :my-domain "Description of what this covers")
+```
+
+Users enable groups via `MB_TRACING_GROUPS=tasks,search,sync` (comma-separated, or `"all"`).
+
+## Naming Conventions
+
+### Span Names
+
+Use dot-separated hierarchical names: `"domain.subsystem.operation"`. The domain prefix should match the group name:
+
+```
+search.execute              -- `:search` group
+sync.fingerprint.table      -- `:sync` group
+task.session-cleanup.delete -- `:tasks` group
+db-app.collection-items     -- `:db-app` group
+```
+
+### Attributes
+
+Use namespaced keywords. The namespace groups related attributes:
+
+```clojure
+:db/id              -- Database ID (integer)
+:db/engine          -- Database engine name (string)
+:db/statement       -- Sanitized SQL (string, via best-effort-sanitize-sql)
+:search/engine      -- Search engine name (string)
+:search/query-length -- Query string length (integer)
+:sync/table         -- Table name (string)
+:sync/step          -- Sync step name (string)
+:task/name          -- Task name (string)
+:http/method        -- HTTP method (string)
+:http/url           -- Request URL (string)
+```
+
+Invent new namespaced attributes as needed (e.g., `:pulse/id`, `:transform/count`). Keep values as primitives (strings, numbers, booleans) -- no maps or collections.
+
+## Step-by-Step: Adding a Span
+
+### 1. Check module boundaries
+
+Look up the module for your namespace in `.clj-kondo/config/modules/config.edn`. If `tracing` is not in the module's `:uses` set, add it (keep alphabetically sorted):
+
+```edn
+my-module
+{:team "MyTeam"
+ :uses #{analytics config tracing util}}
+```
+
+### 2. Add the require
+
+```clojure
+(ns metabase.my-module.thing
+  (:require
+   [metabase.tracing.core :as tracing]
+   [metabase.util :as u]))
+```
+
+`best-effort-sanitize-sql` is available from `tracing.core` — no additional require needed.
+
+### 3. Identify the I/O boundary
+
+Only wrap code at **meaningful I/O boundaries**:
+
+**DO trace:**
+- External API calls (embedding APIs, metabot, webhooks)
+- Database queries (both app DB and user DB)
+- Network requests (HTTP calls to external services)
+- Heavy batch processing (batch indexing, batch embedding)
+- Top-level orchestration functions that coordinate multiple sub-operations
+
+**DO NOT trace:**
+- Pure computation (sorting, filtering, mapping)
+- Simple single-row lookups (`t2/select-one :model/Setting :key k`)
+- Every function in a call chain (only boundaries matter)
+- Trivial operations (string formatting, hash calculations)
+
+### 4. Wrap with `with-span`
+
+```clojure
+;; Simple span (no attributes needed)
+(tracing/with-span :search "search.init-index" {}
+  (do-expensive-thing))
+
+;; Span with static attributes
+(tracing/with-span :sync "sync.fingerprint.table"
+                   {:db/id (:db_id table)
+                    :sync/table (:name table)}
+  (fingerprint-fields! table fields))
+
+;; Span with computed attributes
+(tracing/with-span :search "search.execute"
+                   {:search/engine       (name (:search-engine ctx))
+                    :search/query-length (count (:search-string ctx))}
+  (search.engine/results ctx))
+
+;; Span with sanitized SQL (for dynamic HoneySQL queries)
+(let [hsql {:delete-from [(t2/table-name :model/Session)]
+            :where [:< :created_at oldest-allowed]}]
+  (tracing/with-span :tasks "task.session-cleanup.delete"
+                     {:db/statement (tracing/best-effort-sanitize-sql hsql)}
+    (t2/query-one hsql)))
+
+;; Sub-spans breaking a function into I/O phases
+(let [embedding (tracing/with-span :search "search.semantic.embedding"
+                                   {:search.semantic/provider (:provider model)}
+                  (get-embedding model search-string))
+      results   (tracing/with-span :search "search.semantic.db-query" {}
+                  (into [] xform reducible))]
+  (process results))
+
+;; Per-item iteration spans
+(doseq [e (search.engine/active-engines)]
+  (tracing/with-span :search "search.ingestion.update" {:search/engine (name e)}
+    (search.engine/update! e batch)))
+```
+
+### 5. Add tests
+
+Create or update tests in the corresponding `test/` path. Follow the patterns in existing tracing tests:
+
+- **Reference tests:** `test/metabase/tracing/quartz_test.clj`, `test/metabase/server/middleware/trace_test.clj`
+- Use `tracing/init-enabled-groups!` / `tracing/shutdown-groups!` with `try`/`finally` to manage group lifecycle
+- Test both enabled and disabled paths (verify zero overhead when group is off)
+- Use `reify` mocks for Java interfaces (Connection, PreparedStatement, JobListener, etc.)
+- Add `(set! *warn-on-reflection* true)` and type-hint proxy/reify calls to avoid reflection warnings
+
+```clojure
+(deftest my-span-enabled-test
+  (testing "when group is enabled, span is created"
+    (try
+      (tracing/init-enabled-groups! "my-group" "INFO")
+      ;; ... test that span behavior occurs ...
+      (finally
+        (tracing/shutdown-groups!)))))
+
+(deftest my-span-disabled-test
+  (testing "when group is disabled, code runs without tracing"
+    (tracing/shutdown-groups!)
+    ;; ... test that code still works, no wrapping applied ...
+    ))
+```
+
+### 6. Lint and run tests
+
+```bash
+# Lint modified source and test files — expect 0 errors, 0 warnings
+clj-kondo --lint path/to/modified/file.clj path/to/test/file.clj
+
+# Run tests (requires Java 21+)
+  clojure -X:dev:test :only my-ns.test-ns
+```
+
+Expect: all tests pass, 0 failures, 0 errors, no reflection warnings from your files.
+
+## Sanitizing SQL for Attributes
+
+When including SQL in span attributes, **always** use `tracing/best-effort-sanitize-sql`. This converts HoneySQL maps to parameterized SQL strings where values become `?` placeholders -- no data leaks.
+
+```clojure
+(let [hsql {:delete-from [:core_session]
+            :where [:< :created_at some-timestamp]}]
+  (tracing/with-span :tasks "task.cleanup.delete"
+                     {:db/statement (tracing/best-effort-sanitize-sql hsql)}
+    (t2/query-one hsql)))
+;; Trace attribute: db/statement = "DELETE FROM core_session WHERE created_at < ?"
+```
+
+**Rules:**
+- Never put raw SQL strings or user-provided values in attributes
+- Use `best-effort-sanitize-sql` only for app DB (HoneySQL) queries
+- For external/user DB queries, trace only timing and counts, not SQL content
+
+## Defjob and Root Spans
+
+The `defjob` macro in `metabase.task.impl` automatically wraps every Quartz job with a `:tasks` root span:
+
+```clojure
+(task/defjob ^{DisallowConcurrentExecution true} SessionCleanup [_]
+  (cleanup-sessions!))
+;; Automatically creates span: "task.SessionCleanup" {:task/name "SessionCleanup"}
+```
+
+You do NOT need a root span inside `defjob` bodies. Add **child spans** for I/O inside the job.
+
+For code on plain `Thread`s (not Quartz), add the root span manually:
+
+```clojure
+(defn init! []
+  (tracing/with-span :search "search.task.init" {}
+    (search/init-index!)))
+```
+
+## What NOT to Do
+
+### Span Usage Mistakes
+
+```clojure
+;; WRONG - pure computation, no I/O
+(tracing/with-span :search "search.format-results" {}
+  (map format-result results))
+
+;; WRONG - trivial single-row lookup
+(tracing/with-span :db-app "db-app.get-setting" {}
+  (t2/select-one :model/Setting :key "my-setting"))
+
+;; WRONG - raw SQL in attributes (data leak)
+(tracing/with-span :tasks "task.cleanup" {:db/statement raw-sql-string}
+  (execute! raw-sql-string))
+
+;; WRONG - wrong group (search work should use :search, not :tasks)
+(tracing/with-span :tasks "search.execute" {} ...)
+
+;; WRONG - redundant nesting (do-search already has a span)
+(tracing/with-span :search "search.process" {}
+  (let [results (do-search ctx)]
+    (tracing/with-span :search "search.format" {}
+      (format-results results))))
+```
+
+### Architecture Mistakes
+
+```clojure
+;; WRONG - creating a new tracing namespace
+(ns metabase.tracing.my-feature ...)
+
+;; WRONG - requiring internal tracing namespaces from outside the module
+(ns metabase.my-module.thing
+  (:require [metabase.tracing.attributes :as trace-attrs]      ;; internal!
+            [metabase.tracing.settings :as tracing.settings]   ;; internal!
+            [metabase.tracing.quartz :as tracing.quartz]))     ;; internal!
+
+;; WRONG - adding compile-time requires to tracing/core.clj for settings or SDK
+;; This creates cyclic load dependencies because tracing/core is widely required
+(ns metabase.tracing.core
+  (:require [metabase.tracing.settings :as settings]))  ;; causes cycle!
+
+;; WRONG - dynamic symbol construction with requiring-resolve (kondo rejects it)
+(requiring-resolve (symbol "metabase.tracing.settings" "tracing-enabled"))
+```
+
+## Configuration
+
+All settings are env-var-only (defined in `src/metabase/tracing/settings.clj`):
+
+```bash
+# Core
+MB_TRACING_ENABLED=true              # Enable tracing (default: false)
+MB_TRACING_ENDPOINT=host:4317        # OTLP collector endpoint (default: http://localhost:4317)
+MB_TRACING_GROUPS=tasks,search,sync  # Comma-separated groups or "all" (default: all)
+MB_TRACING_SERVICE_NAME=metabase     # Service name in traces (default: hostname)
+MB_TRACING_LOG_LEVEL=DEBUG           # Log threshold for traced threads: TRACE/DEBUG/INFO (default: INFO)
+
+# Batch span processor tuning
+MB_TRACING_MAX_QUEUE_SIZE=2048       # Max spans queued for export; drops when full (default: 2048)
+MB_TRACING_EXPORT_TIMEOUT_MS=10000   # Max wait for batch export to complete (default: 10000)
+MB_TRACING_SCHEDULE_DELAY_MS=5000    # Delay between consecutive batch exports (default: 5000)
+```

.claude/skills/clojure-eval/SKILL.md

@@ -0,0 +1,173 @@
+---
+name: clojure-eval
+description: Evaluate Clojure code via nREPL using clj-nrepl-eval. Use this when you need to test code, check if edited files compile, verify function behavior, or interact with a running REPL session.
+---
+
+# Clojure REPL Evaluation
+
+## When to Use This Skill
+
+Use this skill when you need to:
+- **Verify that edited Clojure files compile and load correctly**
+- Test function behavior interactively
+- Check the current state of the REPL
+- Debug code by evaluating expressions
+- Require or load namespaces for testing
+- Validate that code changes work before committing
+
+## How It Works
+
+The `clj-nrepl-eval` command evaluates Clojure code against an nREPL server. **Session state persists between evaluations**, so you can require a namespace in one evaluation and use it in subsequent calls. Each host:port combination maintains its own session file.
+
+## Instructions
+
+### 0. Discover and select nREPL server
+
+First, discover what nREPL servers are running in the current directory:
+
+```bash
+clj-nrepl-eval --discover-ports
+```
+
+This will show all nREPL servers (Clojure, Babashka, shadow-cljs, etc.) running in the current project directory.
+
+**Then use the AskUserQuestion tool:**
+
+- **If ports are discovered:** Prompt user to select which nREPL port to use:
+  - **question:** "Which nREPL port would you like to use?"
+  - **header:** "nREPL Port"
+  - **options:** Present each discovered port as an option with:
+    - **label:** The port number
+    - **description:** The server type and status (e.g., "Clojure nREPL server in current directory")
+  - Include up to 4 discovered ports as options
+  - The user can select "Other" to enter a custom port number
+
+- **If no ports are discovered:** Prompt user how to start an nREPL server:
+  - **question:** "No nREPL servers found. How would you like to start one?"
+  - **header:** "Start nREPL"
+  - **options:**
+    - **label:** "deps.edn alias", **description:** "Find and use an nREPL alias in deps.edn"
+    - **label:** "Leiningen", **description:** "Start nREPL using 'lein repl'"
+  - The user can select "Other" for alternative methods or if they already have a server running on a specific port
+
+IMPORTANT: IF you start a REPL do not supply a port let the nREPL start and return the port that it was started on.
+
+### 1. Evaluate Clojure Code
+
+> Evaluation automatically connects to the given port
+
+Use the `-p` flag to specify the port and pass your Clojure code.
+
+**Recommended: Pass code as a command-line argument:**
+```bash
+clj-nrepl-eval -p <PORT> "(+ 1 2 3)"
+```
+
+**For multiple expressions (single line):**
+```bash
+clj-nrepl-eval -p <PORT> "(def x 10) (+ x 20)"
+```
+
+**Alternative: Using heredoc (may require permission approval for multiline commands):**
+```bash
+clj-nrepl-eval -p <PORT> <<'EOF'
+(def x 10)
+(+ x 20)
+EOF
+```
+
+**Alternative: Via stdin pipe:**
+```bash
+echo "(+ 1 2 3)" | clj-nrepl-eval -p <PORT>
+```
+
+### 2. Display nREPL Sessions
+
+**Discover all nREPL servers in current directory:**
+```bash
+clj-nrepl-eval --discover-ports
+```
+Shows all running nREPL servers in the current project directory, including their type (clj/bb/basilisp) and whether they match the current working directory.
+
+**Check previously connected sessions:**
+```bash
+clj-nrepl-eval --connected-ports
+```
+Shows only connections you have made before (appears after first evaluation on a port).
+
+### 3. Common Patterns
+
+**Require a namespace (always use :reload to pick up changes):**
+```bash
+clj-nrepl-eval -p <PORT> "(require '[my.namespace :as ns] :reload)"
+```
+
+**Test a function after requiring:**
+```bash
+clj-nrepl-eval -p <PORT> "(ns/my-function arg1 arg2)"
+```
+
+**Check if a file compiles:**
+```bash
+clj-nrepl-eval -p <PORT> "(require 'my.namespace :reload)"
+```
+
+**Multiple expressions:**
+```bash
+clj-nrepl-eval -p <PORT> "(def x 10) (* x 2) (+ x 5)"
+```
+
+**Complex multiline code (using heredoc):**
+```bash
+clj-nrepl-eval -p <PORT> <<'EOF'
+(def x 10)
+(* x 2)
+(+ x 5)
+EOF
+```
+*Note: Heredoc syntax may require permission approval.*
+
+**With custom timeout (in milliseconds):**
+```bash
+clj-nrepl-eval -p <PORT> --timeout 5000 "(long-running-fn)"
+```
+
+**Reset the session (clears all state):**
+```bash
+clj-nrepl-eval -p <PORT> --reset-session
+clj-nrepl-eval -p <PORT> --reset-session "(def x 1)"
+```
+
+## Available Options
+
+- `-p, --port PORT` - nREPL port (required)
+- `-H, --host HOST` - nREPL host (default: 127.0.0.1)
+- `-t, --timeout MILLISECONDS` - Timeout (default: 120000 = 2 minutes)
+- `-r, --reset-session` - Reset the persistent nREPL session
+- `-c, --connected-ports` - List previously connected nREPL sessions
+- `-d, --discover-ports` - Discover nREPL servers in current directory
+- `-h, --help` - Show help message
+
+## Important Notes
+
+- **Prefer command-line arguments:** Pass code as quoted strings: `clj-nrepl-eval -p <PORT> "(+ 1 2 3)"` - works with existing permissions
+- **Heredoc for complex code:** Use heredoc (`<<'EOF' ... EOF`) for truly multiline code, but note it may require permission approval
+- **Sessions persist:** State (vars, namespaces, loaded libraries) persists across invocations until the nREPL server restarts or `--reset-session` is used
+- **Automatic delimiter repair:** The tool automatically repairs missing or mismatched parentheses
+- **Always use :reload:** When requiring namespaces, use `:reload` to pick up recent changes
+- **Default timeout:** 2 minutes (120000ms) - increase for long-running operations
+- **Input precedence:** Command-line arguments take precedence over stdin
+
+## Typical Workflow
+
+1. Discover nREPL servers: `clj-nrepl-eval --discover-ports`
+2. Use **AskUserQuestion** tool to prompt user to select a port
+3. Require namespace:
+   ```bash
+   clj-nrepl-eval -p <PORT> "(require '[my.ns :as ns] :reload)"
+   ```
+4. Test function:
+   ```bash
+   clj-nrepl-eval -p <PORT> "(ns/my-fn ...)"
+   ```
+5. Iterate: Make changes, re-require with `:reload`, test again

.claude/skills/docs-write/SKILL.md

@@ -40,7 +40,7 @@ allowed-tools: Read, Write, Grep, Bash, Glob
 
 **Format:**
 
-- Run prettier on the file after making edits: `yarn prettier --write <file-path>`
+- Run prettier on the file after making edits: `bun run prettier --write <file-path>`
 - This ensures consistent formatting across all documentation
 
 ### Common patterns

.claude/skills/e2e-test-create/SKILL.md

@@ -0,0 +1,260 @@
+---
+name: e2e-test-create
+description: >
+  Analyze React component source code to understand UI structure,
+  then generate idiomatic Cypress E2E tests following Metabase conventions.
+  Falls back to Playwright MCP browser exploration only when code reading
+  and screenshot debugging are insufficient.
+disable-model-invocation: true
+allowed-tools:
+  - Bash
+  - Read
+  - Write
+  - Grep
+  - Glob
+  - Skill
+  - "mcp__playwright__*"
+---
+
+# Code-Reading-First → Generate Cypress Tests (Metabase)
+
+You are writing Cypress E2E tests for the **Metabase** codebase.
+Before generating ANY test code, you MUST analyze React component source code
+to understand DOM structure, selectors, and user flows.
+
+## Phase 0 — Research
+
+1. Read existing helpers before writing anything:
+   - `e2e/support/helpers/` — all shared helpers (restore, signInAs, openOrdersTable, etc.)
+   - `e2e/support/cypress_sample_database.ts` — table/field schema constants (ORDERS, PRODUCTS, etc.)
+   - `e2e/support/cypress_sample_instance_data.ts` — instance-specific IDs (ORDERS_DASHBOARD_ID, NORMAL_USER_ID, etc.)
+2. Glob `e2e/test/scenarios/` to find the closest existing spec to the area under test.
+   Study its patterns — match them exactly.
+3. Glob `frontend/src/metabase/` to find React components for the feature area.
+
+## Phase 1 — Code Analysis
+
+Read React component source to understand DOM structure. No browser needed — source code has everything.
+
+1. **Find relevant components**: Glob and grep `frontend/src/metabase/` for the feature area.
+2. **Extract selectors**: Grep for `data-testid` in relevant components.
+3. **Note visible text**: Read component JSX for button labels, headings, placeholders.
+4. **Note aria attributes**: Grep for `aria-label` in relevant components.
+5. **Understand user flows**: Read event handlers (onClick, onSubmit, onChange) to understand interactions.
+6. **Find API calls**: Grep for `Api.use`, `fetch`, `useQuery`, endpoint definitions to identify API calls to intercept.
+7. **Cross-reference with existing specs**: Find specs in the same area and reuse their proven selectors and `cy.intercept` patterns.
+
+## Phase 2 — Start Backend
+
+Use `MB_EDITION=oss` by default. Only use `MB_EDITION=ee` when the user explicitly asks to write an enterprise test.
+
+Start the backend using `run_in_background: true` (NOT `&`).
+`bin/e2e-backend` automatically detects if a backend is already running and reuses it.
+```bash
+MB_EDITION=oss bin/e2e-backend
+```
+
+Do NOT manually generate snapshots by running unrelated test specs.
+The `bun test-cypress` runner has `GENERATE_SNAPSHOTS: true` by default and automatically
+generates snapshots before running any spec. When running tests in Phase 4 via the `/e2e-test` skill,
+snapshots will be generated on the first run if they don't already exist.
+
+Restore clean test data:
+```bash
+curl -sf -X POST http://localhost:4000/api/testing/restore/default
+```
+
+## Phase 3 — Generate Cypress Spec
+
+### File location & naming
+
+Place specs in `e2e/test/scenarios/<area>/` mirroring the URL structure.
+Name: `<feature>.cy.spec.js` (NOT `.cy.spec.ts`).
+
+### Metabase conventions (mandatory)
+
+- **Helpers via `cy.H`**: All helpers are accessed via `const { H } = cy;` — NOT via direct imports from `e2e/support/helpers`.
+
+```js
+const { H } = cy;
+
+describe("feature name", () => {
+  beforeEach(() => {
+    H.restore();
+    cy.signInAsAdmin();
+  });
+});
+```
+
+- **Sample Database schema** (table/field definitions): Import from `cypress_sample_database`.
+
+```js
+import { ORDERS, ORDERS_ID, PRODUCTS } from "e2e/support/cypress_sample_database";
+```
+
+- **Instance data** (dashboard IDs, user IDs, etc.): Import from `cypress_sample_instance_data`.
+
+```js
+import { ORDERS_DASHBOARD_ID } from "e2e/support/cypress_sample_instance_data";
+```
+
+- **Selectors** (priority order):
+  1. `cy.findByText()` / `cy.findByLabelText()` / `cy.findByRole()` — from `@testing-library/cypress`
+  2. `cy.findByTestId()` — for `data-testid` attributes
+  3. `cy.get("[data-testid='...']")` — fallback
+  4. NEVER use positional selectors, CSS class names, or XPaths.
+
+- **Navigation helpers**: Use existing helpers like `H.openOrdersTable()`, `H.openNativeEditor()`,
+  `H.visitDashboard(id)`, `H.visitQuestion(id)` instead of raw `cy.visit()` chains.
+  Grep `e2e/support/helpers/` to discover what's available for your area.
+
+- **API setup over UI setup**: Use `cy.request()` or existing API helpers to set up state.
+  Only use the UI for the flow you're actually testing.
+
+- **Assertions**: Assert on visible text, URL, aria state — not DOM structure.
+
+- **Waits**: Never use `cy.wait(ms)`. Use `cy.intercept()` + `cy.wait("@alias")` for API calls,
+  or `cy.findByText().should("be.visible")` for DOM readiness.
+
+- **Isolation**: Each `it()` block must be independently runnable.
+  Don't depend on state from a previous `it()`.
+
+### Spec structure template
+
+```js
+const { H } = cy;
+import { ORDERS_DASHBOARD_ID } from "e2e/support/cypress_sample_instance_data";
+import { ORDERS, ORDERS_ID } from "e2e/support/cypress_sample_database";
+
+describe("area > sub-area > feature (#issue-number)", () => {
+  beforeEach(() => {
+    H.restore();
+    cy.signInAsAdmin();
+  });
+
+  it("should do the primary happy-path thing", () => {
+    // test
+  });
+
+  it("should handle the edge case", () => {
+    // test
+  });
+});
+```
+
+### Intercepts
+
+When you identified API calls during code analysis, stub or wait on them:
+
+```js
+cy.intercept("POST", "/api/dataset").as("dataset");
+// ... trigger action ...
+cy.wait("@dataset");
+```
+
+## Phase 4 — Validate
+
+After generating specs:
+1. Check that all imported helpers exist (Grep `e2e/support/helpers/`).
+2. **You MUST use the `/e2e-test` skill** to run tests — do NOT run `bun test-cypress` directly.
+   The `/e2e-test` skill handles edition selection, snapshot management, and correct env vars.
+   `/e2e-test GREP="should do the thing" --spec e2e/test/scenarios/<path>`
+   If you created multiple `it()` blocks, run each one individually to isolate failures.
+
+## Phase 5 — Fix Failures (up to 2 attempts)
+
+When a test fails, **try to fix it from Cypress output first**:
+1. Read the failure screenshot (path printed under `(Screenshots)`).
+2. Read the error message and code frame from the console output.
+3. Fix the test and re-run (back to Phase 4, step 2).
+
+If you cannot diagnose the issue after 2 attempts, proceed to Phase 6.
+
+## Phase 6 — Playwright Fallback
+
+Only reach this phase after 2 failed fix attempts from Phase 5. The backend is already running.
+
+Restore clean test data:
+```bash
+curl -sf -X POST http://localhost:4000/api/testing/restore/default
+```
+
+**Bypass CSP** headers before navigating (Metabase serves strict CSP that blocks dev server scripts).
+Use `browser_run_code` to set this up:
+
+```js
+async (page) => {
+  // Strip CSP headers so the page loads (mirrors Cypress chromeWebSecurity: false)
+  await page.context().route('**/*', async (route) => {
+    const response = await route.fetch();
+    const headers = { ...response.headers() };
+    delete headers['content-security-policy'];
+    delete headers['content-security-policy-report-only'];
+    await route.fulfill({ response, headers });
+  });
+
+  // Sign in via API
+  const response = await page.request.post('http://localhost:4000/api/session', {
+    data: { username: 'admin@metabase.test', password: '12341234' }
+  });
+  const session = await response.json();
+  await page.context().addCookies([{
+    name: 'metabase.DEVICE',
+    value: session.id,
+    domain: 'localhost',
+    path: '/'
+  }]);
+
+  await page.goto('http://localhost:4000');
+  await page.waitForLoadState('networkidle');
+  return 'signed in';
+}
+```
+
+**Maintain an observation log incrementally.** After EVERY significant Playwright interaction,
+IMMEDIATELY append what you observed to the scratch file BEFORE performing the next interaction:
+
+```bash
+cat >> /tmp/e2e-observations.md << 'OBSERVATION'
+## [Page/Flow name]
+- URL: /question/notebook#...
+- Clicked: "Box plot" button → visible text "Box plot", role: radio
+- Selectors: data-testid="viz-type-button", findByText("Box plot")
+- API call: POST /api/dataset (triggered on viz change)
+- Key state: after selecting viz type, summary sidebar shows metric picker
+OBSERVATION
+```
+
+For each page/flow:
+- Take an accessibility snapshot (`browser_snapshot`).
+- Click through interactive elements, fill forms, trigger modals.
+- **Append to the observation log immediately after each step**: URLs, visible text, aria labels, `data-testid` attrs, API calls.
+- Screenshot key states.
+
+After exploration:
+1. Read back your observation log: `cat /tmp/e2e-observations.md`
+2. Fix the test using observed selectors and behavior.
+3. Re-run the test (back to Phase 4).
+4. Clean up: `rm -f /tmp/e2e-observations.md`
+
+## Phase 7 — Cleanup
+
+After all tests pass (or after giving up on fixing failures), **always kill the backend on port 4000**:
+```bash
+lsof -ti:4000 | xargs kill 2>/dev/null || true
+```
+
+Do NOT use broad `pkill` patterns — there may be other Metabase instances on different ports.
+The backend process started in Phase 2 will NOT be killed automatically when the Claude session ends.
+Leaving it running wastes resources and can interfere with future sessions. Always clean up.
+
+## What NOT to do
+
+- Do NOT use Playwright as the first step — always analyze source code first.
+- Do NOT kill the backend between phases — it stays running throughout.
+- Do NOT invent selectors you didn't find in source code or observe in the browser.
+- Do NOT hardcode database IDs — import from `cypress_sample_database` or `cypress_sample_instance_data`.
+- Do NOT use `cy.wait(1000)` or any numeric wait.
+- Do NOT create setup flows through the UI when an API helper exists.
+- Do NOT put tests in `cypress/e2e/` — Metabase uses `e2e/test/scenarios/`.
+- Do NOT import helpers directly from `e2e/support/helpers` — use `const { H } = cy;`.

.claude/skills/e2e-test/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: e2e-test
+description: Run Cypress E2E tests, analyze failures including screenshots, and stress test for flakiness
+disable-model-invocation: false
+---
+
+Run Cypress E2E test: $ARGUMENTS
+
+## Edition selection
+
+**Default: `MB_EDITION=oss`** — runs without enterprise tokens, simpler and faster.
+
+Only use `MB_EDITION=ee` when the user explicitly asks to write or run an enterprise test.
+
+**For `MB_EDITION=ee`:**
+These tokens must be exported in the shell before starting Claude Code:
+- `CYPRESS_MB_ALL_FEATURES_TOKEN` — all features (most EE tests need this)
+- `CYPRESS_MB_PRO_SELF_HOSTED_TOKEN` — pro self-hosted (permissions, SSO, sandboxing)
+- `CYPRESS_MB_STARTER_CLOUD_TOKEN` — starter plan (rarely needed)
+- `CYPRESS_MB_PRO_CLOUD_TOKEN` — pro cloud (rarely needed)
+
+**NEVER echo, print, or log token values. Only check if they are set:**
+```bash
+echo "ALL_FEATURES: ${CYPRESS_MB_ALL_FEATURES_TOKEN:+set}" && echo "PRO_SELF_HOSTED: ${CYPRESS_MB_PRO_SELF_HOSTED_TOKEN:+set}" && echo "STARTER: ${CYPRESS_MB_STARTER_CLOUD_TOKEN:+set}" && echo "PRO_CLOUD: ${CYPRESS_MB_PRO_CLOUD_TOKEN:+set}"
+```
+
+If tokens are missing, tell the user: "EE tokens are not set. Either export them and restart Claude Code, or add `MB_EDITION=oss` to run OSS-only tests."
+
+## Running
+
+First check if snapshots exist:
+```bash
+ls e2e/snapshots/default.sql 2>/dev/null && echo "snapshots exist" || echo "snapshots missing"
+```
+
+If snapshots exist, skip regeneration for speed:
+```bash
+MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false GENERATE_SNAPSHOTS=false bun test-cypress $ARGUMENTS
+```
+
+If snapshots are missing (first run), let the runner generate them:
+```bash
+MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false bun test-cypress $ARGUMENTS
+```
+
+When running enterprise tests, replace `MB_EDITION=oss` with `MB_EDITION=ee` in the commands above.
+
+If `$ARGUMENTS` is empty, ask the user which spec to run.
+
+If the user provides a test name or fuzzy name instead of a spec path, find the spec file:
+```bash
+find e2e/test/scenarios -name "*FUZZY_NAME*.cy.spec.*" -type f
+```
+Then run with `--spec "path/to/matched.cy.spec.js"`.
+
+To filter by test name, use the `GREP` env var (not `--env grep=`, which breaks on commas):
+```bash
+GREP="test name here" MB_EDITION=oss bun test-cypress --spec path/to/spec.js
+```
+
+## Stress test (flaky detection)
+
+When the user asks to verify a test is not flaky:
+
+```bash
+MB_EDITION=oss bin/e2e-stress-test $ARGUMENTS
+```
+
+Set `E2E_STRESS_RUNS=N` for more iterations (default: 5). Stops on first failure and prints screenshot paths. Read those screenshots to analyze the failure.
+
+## Analyzing failures
+
+When tests fail:
+
+1. Read the **screenshot** for each failure — paths are printed in Cypress output under `(Screenshots)`, typically at `cypress/screenshots/<spec-name>/<test-name> (failed).png`
+2. Read the error message and code frame from the console output
+3. Identify the root cause: is it a test bug, a product bug, or a timing issue?
+4. Suggest a fix with specific code changes

.claude/skills/mutation-testing/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: mutation-testing
+description: Run mutation testing on a Clojure namespace, generate tests to kill surviving mutations, and open draft PRs with Linear issue tracking.
+---
+
+# Mutation Testing Skill
+
+This skill runs mutation testing end-to-end: generates a coverage report, groups functions, shells out to `claude -p` to write tests, verifies mutations are killed, and creates draft PRs with Linear issues.
+
+## Prerequisites
+
+- A running nREPL connected to the Metabase dev environment
+- `LINEAR_API_KEY` environment variable set with a valid Linear personal API key
+- `gh` CLI authenticated with GitHub
+- `claude` CLI available on PATH
+
+## Reference Files
+
+- `dev/src/dev/coverage.clj` — mutation testing engine (generates reports, runs mutations)
+- `dev/src/dev/mutation_testing.clj` — orchestration, Linear API, PR helpers
+
+## Invocation
+
+The argument is a Clojure namespace, optionally followed by a base branch:
+
+```
+/mutation-testing metabase.lib.order-by
+/mutation-testing metabase.lib.order-by --base-branch release-x.52.x
+/mutation-testing metabase.lib.order-by --project-id abc-123
+/mutation-testing metabase.lib.order-by --base-branch release-x.52.x --project-id abc-123
+```
+
+- `--base-branch`: defaults to the value in config (set via `set-config!`), or `"master"` if not configured.
+- `--project-id`: if provided, issues are added to this existing Linear project instead of creating a new one.
+
+## Steps
+
+### 1. Parse arguments
+
+Parse `$ARGUMENTS` to extract:
+- **namespace** (required) — the first positional argument
+- **`--base-branch`** (optional) — if present, the next argument is the base branch name
+- **`--project-id`** (optional) — if present, the next argument is an existing Linear project ID
+
+### 2. Load and configure
+
+```clojure
+(require '[dev.mutation-testing :as mut-test] :reload)
+(require '[dev.coverage :as cov] :reload)
+```
+
+If this is the first invocation (or the REPL was restarted), set up the Linear team:
+
+```clojure
+(mut-test/list-teams!)
+(mut-test/set-config! {:team-id "<id>"})
+```
+
+### 3. Run
+
+```clojure
+(mut-test/run! '<target-ns>)
+;; Or with options:
+(mut-test/run! '<target-ns> {:base-branch "release-x.52.x"})
+(mut-test/run! '<target-ns> {:project-id "abc-123"})
+(mut-test/run! '<target-ns> {:base-branch "release-x.52.x" :project-id "abc-123"})
+```
+
+Pass the opts map with `:base-branch` and/or `:project-id` if those flags were provided in the arguments.
+
+This will:
+1. Generate a baseline mutation testing report
+2. Create a Linear project for the namespace
+3. Group functions by coverage relationships
+4. For each group: create branch → invoke Claude to write tests → verify → retry if needed → commit & push → create Linear issue → create draft PR
+5. Print a summary with PR links
+
+### 4. Handle failures
+
+If a group fails mid-processing, `run!` catches the error and continues to the next group. To retry a single group manually:
+
+```clojure
+;; Get the parsed namespace info
+(def parsed (mut-test/parse-namespace '<target-ns>))
+
+;; Run coverage to get the data
+(def coverage-results (cov/test-namespace (:target-ns parsed) [(:test-ns parsed)]))
+
+;; Group and find the one you want
+(def groups (mut-test/group-functions coverage-results))
+
+;; Process just that group
+(mut-test/process-group! parsed (nth groups <index>))
+```
+
+### 5. Verify the prompt (dry run)
+
+To inspect what Claude will see without invoking it:
+
+```clojure
+(def parsed (mut-test/parse-namespace '<target-ns>))
+(def coverage-results (cov/test-namespace (:target-ns parsed) [(:test-ns parsed)]))
+(def groups (mut-test/group-functions coverage-results))
+(println (mut-test/build-test-prompt
+           (merge (select-keys parsed [:target-ns :test-ns :source-path :test-path])
+                  (select-keys (first groups) [:fn-names :mutations]))))
+```
+
+## Configuration
+
+- **Team ID**: Set once per REPL session via `(mut-test/list-teams!)` and `(mut-test/set-config! {:team-id "..."})`
+- **Project ID**: Set automatically when `run!` calls `create-project-for-namespace!`
+- **Base Branch**: Defaults to `"master"`. Override via `(mut-test/set-config! {:base-branch "release-x.52.x"})` or pass `{:base-branch "..."}` as the second arg to `run!`
+- **Project ID**: If set (via `set-config!` or `run!` opts), `run!` reuses the existing Linear project instead of creating a new one

.claude/skills/typescript-review/SKILL.md

@@ -12,8 +12,9 @@ allowed-tools: Read, Grep, Bash, Glob
 
 Review pull requests with a focus on:
 
+- Readability and maintainability
+- Appropriate test coverage
 - Compliance with project coding standards and conventions
 - Code quality and best practices
-- Clear and correct JSDoc comments
 - Type safety and proper TypeScript usage
-- React best practices (when applicable)
+- React best practices (when applicable)

.clj-kondo/config.edn

@@ -1,7 +1,7 @@
 ;; -*- comment-column: 100; -*-
 {:config-paths ["macros" "src" "config"]
  :linters
- { ;;
+ {;;
   ;; enabled optional linters (these are disabled by default)
   ;;
 
@@ -50,13 +50,15 @@
   ;; disabled linters
   ;;
 
-  :redundant-ignore {:level :off}    ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
+  :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
   :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
 
   ;;
   ;; globally-enabled custom linters
   ;;
   :metabase/check-defmulti-arglists                          {:level :warning}
+  :metabase/check-def-check-not-uppercase-name               {:level :warning}
+  :metabase/check-def-no-underscores                         {:level :warning}
   :metabase/check-me-humanize                                {:level :warning}
   :metabase/defsetting-must-specify-export                   {:level :warning}
   :metabase/defsetting-namespace                             {:level :warning}
@@ -67,7 +69,6 @@
   :metabase/namespace-name                                   {:level :warning}
   :metabase/no-jsqlparser-imports                            {:level :warning}
   :metabase/require-shape-checker                            {:level :warning}
-  :metabase/test-helpers-use-non-thread-safe-functions       {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
   :metabase/tests-must-live-in-known-modules                 {:level :warning}
   :metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
   :metabase/validate-defendpoint-query-params-use-kebab-case {:level :warning}
@@ -179,6 +180,11 @@
      metabase.notification.models/create-notification!
      metabase.pulse.send/send-pulse!
      metabase-enterprise.transforms-python.python-runner-test/execute!
+     ;; Workspace isolation functions are safe in parallel tests because they operate on
+     ;; isolated, test-specific workspaces and databases that don't affect other tests
+     metabase-enterprise.workspaces.isolation/destroy-workspace-isolation!
+     metabase-enterprise.workspaces.isolation/ensure-database-isolation!
+     metabase-enterprise.workspaces.test-util/create-ready-ws!
      ;; Safe in tests, where we typically use a private, temporary index per thread.
      metabase.search.core/reindex!
      metabase.util/run-count!
@@ -192,7 +198,7 @@
   :metabase/disallow-hardcoded-driver-names-in-tests
   ;; don't include `:h2` since that will probably lead to a mountain of tests where we are specifically testing
   ;; middleware or compilation behavior with just H2 since it's the default.
-  {:drivers #{ ;; core drivers
+  {:drivers #{;; core drivers
               #_:h2
               :postgres
               :mysql
@@ -220,7 +226,10 @@
   ;; misc config for built-in linters
   ;;
 
-  :invalid-arity       {:skip-args [metabase.lib.util.match/match]}                    ; TODO (cam): can we fix these?
+  :invalid-arity       {:skip-args [metabase.lib.util.match/match
+                                    metabase.lib.util.match/match-lite
+                                    metabase.lib.util.match/match-many
+                                    metabase.lib.util.match/replace-lite]}                    ; TODO (cam): can we fix these?
   :refer-all           {:level :warning, :exclude [clojure.test]}
   :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
@@ -239,13 +248,17 @@
     (metabase.lib.util.match/match)
     (metabase.lib.util.match/match-one)
     (metabase.lib.util.match/match-lite)
-    (metabase.lib.util.match/match-lite-recursive)
+    (metabase.lib.util.match/match-many)
     (metabase.lib.util.match/replace)
     (metabase.lib.util.match/replace-in)
+    (metabase.lib.util.match/replace-lite)
     (metabase.driver-api.core/match)
     (metabase.driver-api.core/match-one)
+    (metabase.driver-api.core/match-lite)
+    (metabase.driver-api.core/match-many)
     (metabase.driver-api.core/replace)
     (metabase.driver-api.core/replace-in)
+    (metabase.driver-api.core/replace-lite)
     (metabase.query-processor.middleware.cache-backend.interface/with-cached-results)
     (metabase.util.regex/rx [opt])
     (metabase.util/prog1 [<>])
@@ -297,11 +310,14 @@
    metabase.lib.convert/->legacy-MBQL                 {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.core/->legacy-MBQL                    {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
+   metabase.lib.util.match/match                      {:message "Use lib.util.match/match-many instead of lib.util.match/match."}
+   metabase.lib.util.match/match-one                  {:message "Use lib.util.match/match-lite instead of lib.util.match/match-one."}
+   metabase.lib.util.match/replace                    {:message "Use lib.util.match/replace-lite instead of lib.util.match/replace."}
    metabase-enterprise.transforms.interface/execute!  {:message "Use metabase-enterprise.transforms.execute/execute! instead of metabase-enterprise.transforms.interface/execute!"}
    next.jdbc/active-tx?                               {:message "Use metabase.app-db.core/in-transaction? to see if we are in a transaction"}
    toucan2.core/debug                                 {:message "Don't commit code using t2/debug"}
    toucan2.tools.debug/debug                          {:message "Don't commit code using t2/debug"}
-   macaw.core/parsed-query                            {:message "Use metabase.driver.util/parsed-query instead of macaw.core/parsed-query"}}
+   }
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
@@ -406,6 +422,8 @@
     ring.util.codec                           codec
     ring.util.response                        response
     saml20-clj.core                           saml
+    metabase.transforms-base.util              transforms-base.u
+    metabase.transforms.util                   transforms.u
     toucan2.core                              t2}}}
 
  :lint-as
@@ -420,11 +438,10 @@
   metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
-  metabase-enterprise.transforms.api-test/with-transform-tags                           clojure.core/let
-  metabase-enterprise.transforms.api-test/with-worker-runs                              clojure.core/let
-  metabase-enterprise.transforms.test-util/with-transform-cleanup!                      clojure.core/let
-  metabase-enterprise.transforms.execute/with-transform-lifecycle                       clojure.core/let
+  metabase-enterprise.workspaces.test-util/with-resources!                              clojure.core/let
+  metabase-enterprise.workspaces.test-util/with-workspaces!                             clojure.core/let
   metabase.actions.test-util/with-actions                                               clojure.core/let
+  metabase.transforms.test-util/with-transform-cleanup!                                 clojure.core/let
   metabase.api.common/let-404                                                           clojure.core/let
   metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
   metabase.app-db.custom-migrations/define-migration                                    clj-kondo.lint-as/def-catch-all
@@ -512,7 +529,16 @@
   {cljs.test/deftest                                                                                                         hooks.clojure.test/deftest
    cljs.test/is                                                                                                              hooks.clojure.test/is
    cljs.test/use-fixtures                                                                                                    hooks.clojure.test/use-fixtures
+   clojure.core/def                                                                                                          hooks.clojure.core.def/lint-def
+   clojure.core/definterface                                                                                                 hooks.clojure.core.def/lint-def
+   clojure.core/defmacro                                                                                                     hooks.clojure.core.defmacro/lint-defmacro
    clojure.core/defmulti                                                                                                     hooks.clojure.core.defmulti/lint-defmulti
+   clojure.core/defn                                                                                                         hooks.clojure.core.defn/lint-defn
+   clojure.core/defn-                                                                                                        hooks.clojure.core.defn/lint-defn
+   clojure.core/defonce                                                                                                      hooks.clojure.core.def/lint-def
+   clojure.core/defprotocol                                                                                                  hooks.clojure.core.def/lint-def
+   clojure.core/defrecord                                                                                                    hooks.clojure.core.def/lint-def
+   clojure.core/deftype                                                                                                      hooks.clojure.core.def/lint-def
    clojure.core/ns                                                                                                           hooks.clojure.core.ns/lint-ns
    clojure.core/require                                                                                                      hooks.clojure.core.require/lint-require
    clojure.core/requiring-resolve                                                                                            hooks.clojure.core.require/lint-requiring-resolve
@@ -762,22 +788,17 @@
  :config-in-ns
  {test-namespaces
   {:linters
-   {:inline-def                              {:level :off}
-    :missing-docstring                       {:level :off}
-    :private-call                            {:level :off}
-    :metabase/defsetting-must-specify-export {:level :off}
-    :metabase/defsetting-namespace           {:level :off}
+   {:inline-def                                          {:level :off}
+    :missing-docstring                                   {:level :off}
+    :private-call                                        {:level :off}
+    :metabase/defsetting-must-specify-export             {:level :off}
+    :metabase/defsetting-namespace                       {:level :off}
+    :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn
 
     :discouraged-var
     {metabase.driver/database-supports? {:level :off}
      metabase.lib.convert/->legacy-MBQL {:level :off}
-     metabase.lib.core/->legacy-MBQL    {:level :off}}}
-
-   :hooks
-   {:analyze-call
-    {clojure.core/defmacro hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation
-     clojure.core/defn     hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation
-     clojure.core/defn-    hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation}}}
+     metabase.lib.core/->legacy-MBQL    {:level :off}}}}
 
   source-namespaces
   {:linters

.clj-kondo/config/test-helpers/config.edn

@@ -3,7 +3,7 @@
   ;; TODO -- seems silly to maintain different blacklists and whitelists here than we use for the deftest `^:parallel`
   ;; checker...
   {:explicitly-safe
-   #{ ;; these toucan methods might actually set global values if it's used outside of a transaction,
+   #{;; these toucan methods might actually set global values if it's used outside of a transaction,
      ;; but since mt/with-temp runs in a transaction, so we'll ignore them in this case.
      toucan2.core/delete!
      toucan2.core/update!

.clj-kondo/src/hooks/clojure/core.clj

@@ -0,0 +1,38 @@
+(ns hooks.clojure.core
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]))
+
+(defn- all-uppercase? [symb]
+  (let [s (str symb)]
+    (= s #_{:clj-kondo/ignore [:discouraged-var]} (str/upper-case s))))
+
+(defn- has-underscores? [symb]
+  (str/includes? (str symb) "_"))
+
+(defn-  check-symbol-is-kebab-case [symbol-node]
+  (let [symb (hooks/sexpr symbol-node)]
+    (when (or (all-uppercase? symb)
+              (has-underscores? symb))
+      (hooks/reg-finding! (assoc (meta symbol-node)
+                                 :message "Use kebab-case for function and variable names; don't use special notation for constants."
+                                 :type    :metabase/check-def-kebab-case)))))
+
+(defn lint-def* [{:keys [node]}]
+  (let [[_def & args] (:children node)
+        name-symbol   (some (fn [arg]
+                              (when (and (hooks/token-node? arg)
+                                         (symbol? (hooks/sexpr arg)))
+                                arg))
+                            args)]
+    (check-symbol-is-kebab-case name-symbol)))
+
+(defn lint-def [x]
+  (lint-def* x)
+  x)
+
+(comment
+  (defn x []
+    (let [node (-> "(def ^:private TYPE->MODEL {\"document\" :model/Document})"
+                   hooks/parse-string)]
+      (lint-def {:node node}))))

.clj-kondo/src/hooks/clojure/core/def.clj

@@ -0,0 +1,52 @@
+(ns hooks.clojure.core.def
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]))
+
+(defn- uppercase-name?
+  "Whether the symbol is clearly an uppercase name like `TYPE-CONSTANTS` or `SOME_CONSTANT` or `TYPE->MODEL`."
+  [s]
+  (and (re-find #"[A-Z0-9]+(?:[-_]>?[A-Z0-9]+)+" s)
+       ;; ignore stuff like `->SCREAMING_SNAKE_CASE`... this is ok
+       (not (str/includes? s "SCREAMING_SNAKE_CASE"))))
+
+(defn- has-underscores? [s]
+  (and (str/includes? s "_")
+       ;; ignore stuff like `->snake_case` and `->SCREAMING_SNAKE_CASE`
+       (not (str/includes? s "snake_case"))
+       (not (str/includes? s "SCREAMING_SNAKE_CASE"))))
+
+(defn-  check-symbol-is-kebab-case [symbol-node]
+  (let [symb (hooks/sexpr symbol-node)
+        s    (str symb)]
+    (cond
+      (uppercase-name? s)
+      (hooks/reg-finding!
+       (assoc (meta symbol-node)
+              :message "Use lower-case names for functions and variables; don't use special notation for constants. [:metabase/check-def-check-not-all-uppercase]"
+              :type    :metabase/check-def-check-not-uppercase-name))
+
+      (has-underscores? s)
+      (hooks/reg-finding!
+       (assoc (meta symbol-node)
+              :message "Use kebab-case names for functions and variables. [:metabase/check-def-no-underscores]"
+              :type    :metabase/check-def-no-underscores)))))
+
+(defn lint-def* [{:keys [node]}]
+  (let [[_def & args] (:children node)
+        name-symbol   (some (fn [arg]
+                              (when (and (hooks/token-node? arg)
+                                         (symbol? (hooks/sexpr arg)))
+                                arg))
+                            args)]
+    (check-symbol-is-kebab-case name-symbol)))
+
+(defn lint-def [x]
+  (lint-def* x)
+  x)
+
+(comment
+  (defn x []
+    (let [node (-> "(def ^:private TYPE->MODEL {\"document\" :model/Document})"
+                   hooks/parse-string)]
+      (lint-def {:node node}))))

.clj-kondo/src/hooks/clojure/core/defmacro.clj

@@ -0,0 +1,7 @@
+(ns hooks.clojure.core.defmacro
+  (:require
+   [hooks.clojure.core.def]))
+
+(defn lint-defmacro [x]
+  (hooks.clojure.core.def/lint-def* x)
+  x)

.clj-kondo/src/hooks/clojure/core/defmulti.clj

@@ -2,6 +2,7 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.string :as str]
+   [hooks.clojure.core.def]
    [hooks.common]))
 
 (defn- check-arglists [report-node arglists]
@@ -49,4 +50,5 @@
 
 (defn lint-defmulti [x]
   (defmulti-check-for-arglists-metadata (:node x))
+  (hooks.clojure.core.def/lint-def* x)
   x)

.clj-kondo/src/hooks/clojure/core/defn.clj

@@ -2,6 +2,7 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.string :as str]
+   [hooks.clojure.core.def]
    [hooks.common]))
 
 (defn- end-with-exclamation?
@@ -50,6 +51,11 @@
     (non-thread-safe-form-should-end-with-exclamation* node config))
   {:node node})
 
+(defn lint-defn [x]
+  (non-thread-safe-form-should-end-with-exclamation x)
+  (hooks.clojure.core.def/lint-def* x)
+  x)
+
 (comment
   (require '[clj-kondo.core :as clj-kondo])
   (def form (str '(defmacro a

.clj-kondo/src/hooks/common/modules.clj

@@ -75,6 +75,15 @@
         (contains? module-api-namespaces ns-symb)
         (contains? module-friends current-module))))
 
+(defn- rest-module? [module]
+  (str/ends-with? module "-rest"))
+
+(defn- routes-module? [module]
+  (str/ends-with? module "-routes"))
+
+(defn- core-module? [module]
+  (str/ends-with? module "core"))
+
 (defn usage-error
   "Find usage errors when a `required-namespace` is required in the `current-module`. Returns a string describing the
   error type if there is one, otherwise `nil` if there are no errors."
@@ -93,4 +102,15 @@
         (format "Namespace %s is not an allowed external API namespace for the %s module. [:metabase/modules %s :api]"
                 required-namespace
                 required-module
-                required-module)))))
+                required-module)
+
+        ;; (for now) rest modules are allowed to use one another; `routes` is ok because it collects routes together
+        ;; and `core` is ok because [[metabase.core.init]] might need to init some of the `-routes` modules'
+        ;; namespaces
+        (and (not ((some-fn rest-module? routes-module? core-module?) current-module))
+             (rest-module? required-module))
+        (format "Do not use -rest modules (%s) in non-rest modules (%s) -- move things from %s to %s if needed"
+                required-module
+                current-module
+                required-module
+                (symbol (str/replace required-module #"-rest$" "")))))))

.clj-kondo/src/hooks/metabase/settings/models/setting.clj

@@ -55,7 +55,6 @@
      help-link-custom-destination
      instance-creation
      is-hosted?
-     is-metabot-enabled
      jdbc-data-warehouse-max-connection-pool-size
      jdbc-data-warehouse-unreturned-connection-timeout-seconds
      jwt-attribute-email

.cljfmt.edn

@@ -90,6 +90,7 @@
   metabase-enterprise.test/with-gtaps!                                                        [[:inner 0]]
   metabase-enterprise.test/with-gtaps-for-user!                                               [[:inner 0]]
   metabase-enterprise.test/with-user-attributes                                               [[:block 2]]
+  metabase-enterprise.workspaces.models.workspace-log/track!                                  [[:block 2]]
   metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled       [[:block 0]]
   metabase.actions.test-util/with-actions                                                     [[:block 1]]
   metabase.actions.test-util/with-actions-disabled                                            [[:block 0]]
@@ -119,7 +120,10 @@
   metabase.dashboards.models.dashboard-test/with-dash-in-collection                           [[:inner 0]]
   metabase.driver-api.core/match                                                              [[:inner 0]]
   metabase.driver-api.core/match-one                                                          [[:inner 0]]
+  metabase.driver-api.core/match-lite                                                         [[:inner 0]]
+  metabase.driver-api.core/match-many                                                         [[:inner 0]]
   metabase.driver-api.core/replace                                                            [[:inner 0]]
+  metabase.driver-api.core/replace-lite                                                       [[:inner 0]]
   metabase.driver-api.core/replace-in                                                         [[:inner 0]]
   metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                       [[:default]]
   metabase.driver.druid.client/DELETE                                                         [[:default]]
@@ -133,6 +137,7 @@
   metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                       [[:block 1]]
   metabase.driver.sql.query-processor/apply-top-level-clause                                  [[:default]]
   metabase.driver/with-driver                                                                 [[:block 1]]
+  metabase.driver/with-swapped-connection-details                                             [[:block 2]]
   metabase.embedding-rest.api.embed-test/do-response-formats                                  [[:block 1]]
   metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
   metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-card-referencing     [[:block 3]]
@@ -154,8 +159,9 @@
   metabase.lib.util.match/match                                                               [[:inner 0]]
   metabase.lib.util.match/match-one                                                           [[:inner 0]]
   metabase.lib.util.match/match-lite                                                          [[:inner 0]]
-  metabase.lib.util.match/match-lite-recursive                                                [[:inner 0]]
+  metabase.lib.util.match/match-many                                                          [[:inner 0]]
   metabase.lib.util.match/replace                                                             [[:inner 0]]
+  metabase.lib.util.match/replace-lite                                                        [[:inner 0]]
   metabase.lib.util.match/replace-in                                                          [[:inner 0]]
   metabase.models.interface/define-batched-hydration-method                                   [[:inner 0]]
   metabase.models.interface/define-simple-hydration-method                                    [[:inner 0]]

.devcontainer/Dockerfile

@@ -1,10 +1,11 @@
 FROM mcr.microsoft.com/vscode/devcontainers/java:21
 
-# Set up nodesource, install node, yarn, fontconfig for static viz, rlwrap for dev ergonomics
+# Set up nodesource, install node, bun, fontconfig for static viz, rlwrap for dev ergonomics
 
 RUN ( curl -fsSL https://deb.nodesource.com/setup_22.x | bash ) \
   && export DEBIAN_FRONTEND=noninteractive \
-  && apt-get update && apt-get -y install --no-install-recommends nodejs yarn rlwrap fontconfig
+  && apt-get update && apt-get -y install --no-install-recommends nodejs rlwrap fontconfig \
+  && npm install -g bun
 
 # install Clojure
 RUN curl https://download.clojure.org/install/linux-install-1.12.0.1488.sh | bash

.dir-locals.el

@@ -61,6 +61,7 @@
   (eval . (put-clojure-indent 'u/prog1                         1))
   (eval . (put-clojure-indent 'u/select-keys-when              '(:form)))
   (eval . (put-clojure-indent 'with-meta                       '(:form)))
+  (eval . (put-clojure-indent 'ws.log/track!                   2))
   ;; these ones have to be done with `define-clojure-indent' for now because of upstream bug
   ;; https://github.com/clojure-emacs/clojure-mode/issues/600 once that's resolved we should use `put-clojure-indent'
   ;; instead. Please don't add new entries unless they don't work with `put-clojure-indent'

.env.example

@@ -100,7 +100,7 @@ METASTORE_DEV_SERVER_URL="https://token-check.staging.metabase.com"
 #
 # The whole environment is already orchestrated via deps.edn using :e2e alias.
 # Treat it as a source of truth for JVM flags and ENVs whether you decide to run
-# backend on your own, or using `yarn test-cypress` (local test runner).
+# backend on your own, or using `bun run test-cypress` (local test runner).
 #
 # You don't _have to_ export any of these vars (except for the tokens below).
 # Things will still work.
@@ -118,6 +118,9 @@ MB_EDITION="ee"
 # MB_JETTY_HOST="localhost"
 # MB_JETTY_PORT=4000
 
+# Frontend dev server port (for hot reload). Must match the port used by `yarn build-hot`.
+# MB_FRONTEND_DEV_PORT=8080
+
 # 3.2 E2E Local Runner Setup
 # ------------------------------------------------------------------------------
 

.eslintignore

@@ -1,6 +0,0 @@
-frontend/src/cljs
-frontend/src/cljs_release
-e2e/support/cypress_sample_database.js
-e2e/support/cypress_sample_instance_data.js
-frontend/src/metabase-types/openapi/types.gen.ts
-e2e/embedding-sdk-host-apps

.eslintrc.js

@@ -1,356 +0,0 @@
-/* eslint-disable import/no-commonjs */
-/* eslint-disable no-undef */
-
-const path = require("path");
-
-// `postcss-modules` lints css modules class names, but it currently crashes
-// eslint on vscode. If you use webstorm or want to run the lint for the cli, you
-// can use this flag to enable it. This is set to true in CI
-const shouldLintCssModules =
-  process.env.LINT_CSS_MODULES === "true" || process.env.CI;
-const plugins = ["react", "no-only-tests", "ttag", "i18next"];
-if (shouldLintCssModules) {
-  plugins.push("postcss-modules");
-}
-
-module.exports = {
-  ignorePatterns: ["!.storybook"],
-  rules: {
-    strict: [2, "never"],
-    "no-undef": 2,
-    "no-var": 1,
-    "no-unused-vars": [
-      "error",
-      {
-        vars: "all",
-        args: "none",
-        varsIgnorePattern: "^_.+$",
-        ignoreRestSiblings: true,
-      },
-    ],
-    "no-empty": [1, { allowEmptyCatch: true }],
-    // Note: adding this rule to a eslint config file in a subfolder will remove
-    // *not* carry over the restricted imports from parent folders, you will
-    // need to copy them over
-    "no-restricted-imports": [
-      "error",
-      {
-        paths: [
-          {
-            name: "moment",
-            message: "Moment is deprecated, please use dayjs",
-          },
-          {
-            name: "moment-timezone",
-            message: "Moment is deprecated, please use dayjs",
-          },
-        ],
-      },
-    ],
-    curly: [1, "all"],
-    eqeqeq: [1, "smart"],
-    "import/no-duplicates": ["warn", { considerQueryString: true }],
-    "import/no-default-export": 2,
-    "import/no-named-as-default": 0,
-    "import/no-commonjs": 1,
-    "import/order": [
-      "error",
-      {
-        "newlines-between": "always",
-        alphabetize: {
-          order: "asc",
-          orderImportKind: "asc",
-          caseInsensitive: false,
-        },
-        groups: [
-          "builtin",
-          "external",
-          "internal",
-          "parent",
-          "sibling",
-          "index",
-        ],
-        warnOnUnassignedImports: false,
-      },
-    ],
-    "sort-imports": [
-      "error",
-      {
-        // allows this rule to work with import/order
-        ignoreDeclarationSort: true,
-      },
-    ],
-    "no-console": [2, { allow: ["warn", "error", "errorBuffer"] }],
-    "react/no-is-mounted": 2,
-    "react/prefer-es6-class": 2,
-    "react/display-name": 1,
-    "react/prop-types": 2,
-    "react/no-did-mount-set-state": 0,
-    "react/no-did-update-set-state": 0,
-    "react/no-find-dom-node": 0,
-    "react/no-children-prop": 2,
-    "react/no-string-refs": 2,
-    "react/no-unescaped-entities": 2,
-    "react/jsx-no-target-blank": 2,
-    "react/jsx-key": 2,
-    "react/forbid-component-props": [2, { forbid: ["sx"] }],
-    "react-hooks/exhaustive-deps": ["warn"],
-    "prefer-const": [1, { destructuring: "all" }],
-    "no-restricted-globals": ["error", "close"],
-    "no-useless-escape": 0,
-    "no-only-tests/no-only-tests": [
-      "error",
-      {
-        block: [
-          "describe",
-          "it",
-          "context",
-          "test",
-          "tape",
-          "fixture",
-          "serial",
-          "Feature",
-          "Scenario",
-          "Given",
-          "And",
-          "When",
-          "Then",
-        ],
-      },
-    ],
-    complexity: ["error", { max: 55 }],
-    ...(shouldLintCssModules
-      ? {
-          "postcss-modules/no-undef-class": "error",
-        }
-      : {}),
-  },
-  globals: {
-    before: true,
-    cy: true,
-    Cypress: true,
-  },
-  env: {
-    browser: true,
-    es2020: true,
-    commonjs: true,
-    jest: true,
-    "jest/globals": true,
-  },
-  parser: "babel-eslint",
-  plugins,
-  extends: [
-    "eslint:recommended",
-    "plugin:react/recommended",
-    "plugin:react/jsx-runtime",
-    "plugin:react-hooks/recommended",
-    "plugin:import/errors",
-    "plugin:import/warnings",
-    "plugin:import/typescript",
-    "plugin:depend/recommended",
-    "plugin:storybook/recommended",
-    "plugin:i18next/recommended",
-  ],
-  settings: {
-    "import/internal-regex": "^metabase/|^metabase-lib/",
-    "import/resolver": {
-      webpack: {
-        config: path.resolve(__dirname, "./rspack.main.config.js"),
-        typescript: true,
-      },
-    },
-    "import/ignore": ["\\.css$"],
-    react: {
-      version: "detect",
-    },
-    "postcss-modules": {
-      baseDir: "./frontend/src",
-    },
-  },
-  parserOptions: {
-    ecmaFeatures: {
-      legacyDecorators: true,
-    },
-  },
-  overrides: [
-    {
-      files: ["*.js", "*.jsx", "*.ts", "*.tsx"],
-      rules: {
-        "jtag-missing-key": "error",
-        "no-unconditional-metabase-links-render": "error",
-        "no-color-literals": "error",
-        "no-literal-metabase-strings": "error",
-        "no-oss-reinitialize-import": "error",
-        "depend/ban-dependencies": [
-          "error",
-          {
-            allowed: [
-              "underscore",
-              "moment",
-              "lodash.orderby",
-              "lodash.debounce",
-            ],
-          },
-        ],
-      },
-    },
-    {
-      files: [
-        "*.unit.spec.*",
-        "frontend/src/metabase/admin/**/*",
-        "frontend/src/metabase/setup/**/*",
-        "enterprise/frontend/src/metabase-enterprise/whitelabel/**/*",
-        "enterprise/frontend/src/metabase-enterprise/embedding/**/*",
-        "frontend/lint/**/*",
-        "*.stories.*",
-        "**/.storybook/*",
-        "stories-data.*",
-        "e2e/**/*",
-        "**/tests/*",
-        "release/**/*",
-        "rspack.config.js",
-        "rspack.main.config.js",
-        "rspack.embedding-sdk-package.config.js",
-        "rspack.embedding-sdk-bundle.config.js",
-      ],
-      rules: {
-        "no-color-literals": "off",
-        "no-unconditional-metabase-links-render": "off",
-        "no-literal-metabase-strings": "off",
-      },
-    },
-    {
-      files: [
-        "*.unit.spec.*",
-        "frontend/lint/**/*",
-        "*.stories.*",
-        "stories-data.*",
-        "e2e/**/*",
-        "**/tests/*",
-        "release/**/*",
-        "rspack.main.config.js",
-      ],
-      rules: {
-        "i18next/no-literal-string": "off",
-      },
-    },
-    {
-      extends: ["plugin:@typescript-eslint/recommended"],
-      files: ["*.ts", "*.tsx"],
-      parser: "@typescript-eslint/parser",
-      plugins: ["@typescript-eslint"],
-      rules: {
-        "prefer-rest-params": "off",
-        "react/prop-types": "off", // TypeScript handles prop validation
-        "@typescript-eslint/explicit-module-boundary-types": "off",
-        "@typescript-eslint/no-inferrable-types": "off",
-        "@typescript-eslint/no-explicit-any": "off",
-        "@typescript-eslint/no-this-alias": "off",
-        "@typescript-eslint/consistent-type-imports": [
-          "error",
-          {
-            fixStyle: "inline-type-imports",
-          },
-        ],
-        "@typescript-eslint/no-import-type-side-effects": "error",
-        "@typescript-eslint/no-unused-vars": [
-          "error",
-          {
-            argsIgnorePattern: "^_.+$",
-            varsIgnorePattern: "^_.+$",
-            ignoreRestSiblings: true,
-            destructuredArrayIgnorePattern: "^_.+$",
-          },
-        ],
-        // This was introduced in 6.0.0
-        "@typescript-eslint/no-unsafe-declaration-merging": "off",
-      },
-    },
-    {
-      extends: [
-        "plugin:jest/recommended",
-        "plugin:jest-dom/recommended",
-        "plugin:testing-library/react",
-        "plugin:jest-formatting/recommended",
-      ],
-      plugins: ["jest", "jest-dom", "testing-library", "jest-formatting"],
-      files: [
-        "*.unit.spec.ts",
-        "*.unit.spec.tsx",
-        "*.unit.spec.js",
-        "*.unit.spec.jsx",
-      ],
-      rules: {
-        "jest/valid-title": ["error", { ignoreTypeOfDescribeName: true }],
-        "jest/expect-expect": [
-          "error",
-          {
-            assertFunctionNames: ["expect*", "assert*"],
-            additionalTestBlockFunctions: [],
-          },
-        ],
-      },
-    },
-    {
-      // Enable jest formatting for cypress tests too, the plugin logic just works
-      extends: ["plugin:jest-formatting/recommended"],
-      files: ["*.cy.spec.ts", "*.cy.spec.js"],
-    },
-    {
-      files: ["frontend/src/**/*"],
-      rules: {
-        "no-restricted-syntax": [
-          "error",
-          {
-            selector: "Literal[value=/mb-base-color-/]",
-            message:
-              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
-          },
-        ],
-      },
-    },
-    {
-      files: ["frontend/src/metabase/**/*"],
-      rules: {
-        "no-restricted-syntax": [
-          "error",
-          {
-            selector: "Literal[value=/mb-base-color-/]",
-            message:
-              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
-          },
-        ],
-      },
-    },
-    {
-      files: ["frontend/src/metabase/query_builder/**/*"],
-      rules: {
-        "import/no-cycle": "error",
-      },
-    },
-    {
-      files: ["docs/**/snippets/**/*.{ts,tsx,js,jsx}"],
-      rules: {
-        "@typescript-eslint/no-unused-vars": "off",
-        "@typescript-eslint/no-var-requires": "off",
-        "import/no-commonjs": "off",
-        "import/no-default-export": "off",
-        "import/order": "off",
-        "import/no-unresolved": "off",
-        "no-color-literals": "off",
-      },
-    },
-    {
-      files: ["frontend/build/**/*.js"],
-      rules: {
-        "import/no-commonjs": "off",
-      },
-    },
-    {
-      files: ["**/*.stories.tsx", "**/preview.tsx"],
-      rules: {
-        "import/no-default-export": "off",
-      },
-    },
-  ],
-};

.gitattributes

@@ -1,7 +1,9 @@
-# Custom merge driver for YAML migration files
-# Treats each changeset as an atomic unit to avoid conflicts within changesets
+# Custom merge driver for per-release YAML migration files.
+# Treats each changeset as an atomic unit to avoid conflicts within changesets.
+# Only applies to per-release *_update_migrations.yaml files — directory-based
+# migrations (e.g. 060/*.yaml) have one file per migration and don't need this.
 # Execute this in your shell to enable custom merge driver:
 # echo '\n[include]\npath=../.gitconfig' >> .git/config
 #
 # TODO (Bryan 12/12/25) -- reenable this when we can completely verify correctness
-# resources/migrations/*.yaml merge=yaml-migrations
+# resources/migrations/*_update_migrations.yaml merge=yaml-migrations

.gitconfig

@@ -1,7 +1,5 @@
 # execute this in your shell to enable custom merge driver:
 # echo '\n[include]\npath=../.gitconfig' >> .git/config
-#
-# TODO (Bryan 12/12/25) -- reenable this when we can completely verify correctness
-# [merge "yaml-migrations"]
-#     name = YAML migration changeset-aware merge
-#     driver = mage -merge-yaml-migrations %O %A %B %L %P
+[merge "yaml-migrations"]
+    name = Per-release YAML migration changeset-aware merge
+    driver = bin/mage -merge-yaml-migrations %O %A %B %L %P

.github/CODEOWNERS

@@ -1,266 +1,30 @@
 # Before changing this file, make sure you have read how we use it:
 # https://www.notion.so/metabase/Pull-Request-Code-Review-Guide-374f05df889748b69d67af753f9bc9b8?pvs=4#36550c04ceab40b5a8b8bee6264b090c
 
+# @metabase/core-backend-querying-platform
+src/metabase/lib @metabase/core-backend-querying-platform
+src/metabase/lib_be @metabase/core-backend-querying-platform
+src/metabase/query_processor @metabase/core-backend-querying-platform
+
+# @metabase/graphy
+src/metabase/graph @metabase/graphy
+enterprise/backend/src/metabase_enterprise/dependencies @metabase/graphy
+enterprise/frontend/src/metabase-enterprise/dependencies @metabase/graphy
+
+# @metabase/embedding
 enterprise/frontend/src/embedding-sdk-package @metabase/embedding
 enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
 enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
 frontend/src/metabase/embedding-sdk @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
-frontend/src/metabase/ui @metabase/core-frontend-ux-west
-# snowplow/* @metabase/data
-src/metabase/analytics/prometheus.clj @metabase/cloud-ops
-.github @metabase/devexp
-.clj-kondo @metabase/devexp
-deps.edn @metabase/backend-developers
 
+# @metabase/tech-writers
 docs @metabase/tech-writers
 docs/developers-guide # exclude from tech-writer ownership
 
-#
-# Backend modules <=> teams that own them
-#
+# @metabase/devexp
+.github @metabase/devexp
 
-# modules/drivers @metabase/drivers
-src/metabase/driver/sql_jdbc/actions.clj       @metabase/core-ux-east
-test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/api @metabase/devexp
-# enterprise/backend/test/metabase_enterprise/api @metabase/devexp
-
-# enterprise/backend/src/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/billing @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/billing @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/cache @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/cache @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/core @metabase/devexp
-# enterprise/backend/test/metabase_enterprise/core @metabase/devexp
-
-# enterprise/backend/src/metabase_enterprise/dashboard_subscription_filters @metabase/core-ux-east
-# enterprise/backend/test/metabase_enterprise/dashboard_subscription_filters @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
-
-# # enterprise/backend/src/metabase_enterprise/llm
-# # enterprise/backend/test/metabase_enterprise/llm
-
-# enterprise/backend/src/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/scim @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/scim @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/search ...
-# enterprise/backend/test/metabase_enterprise/search ...
-
-# enterprise/backend/src/metabase_enterprise/serialization @metabase/core-ux-east
-# enterprise/backend/test/metabase_enterprise/serialization @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/sso @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/sso @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/stale @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/stale @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/stats @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/stats @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/task @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/task @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
-
-src/metabase/actions @metabase/core-ux-east
-test/metabase/actions @metabase/core-ux-east
-
-# src/metabase/activity_feed @metabase/core-backend-admin-webapp
-# test/metabase/activity_feed @metabase/core-backend-admin-webapp
-
-# src/metabase/analytics @metabase/core-backend-admin-webapp
-# test/metabase/analytics @metabase/core-backend-admin-webapp
-
-# src/metabase/analyze @metabase/drivers
-# test/metabase/analyze @metabase/drivers
-
-# src/metabase/api @metabase/devexp
-# test/metabase/api @metabase/devexp
-
-# src/metabase/audit @metabase/core-backend-admin-webapp
-# test/metabase/audit @metabase/core-backend-admin-webapp
-
-# src/metabase/auth_provider @metabase/core-backend-admin-webapp
-# test/metabase/auth_provider @metabase/core-backend-admin-webapp
-
-# src/metabase/bookmarks @metabase/core-backend-admin-webapp
-# test/metabase/bookmarks @metabase/core-backend-admin-webapp
-
-# src/metabase/cmd @metabase/devexp
-# test/metabase/cmd @metabase/devexp
-
-# src/metabase/channel @metabase/core-ux-east
-# test/metabase/channel @metabase/core-ux-east
-
-# src/metabase/cloud_migration ...
-# test/metabase/cloud_migration ...
-
-# src/metabase/cmd @metabase/devexp
-# test/metabase/cmd @metabase/devexp
-
-# src/metabase/config @metabase/devexp
-# test/metabase/config @metabase/devexp
-
-# src/metabase/core @metabase/devexp
-# test/metabase/core @metabase/devexp
-
-# src/metabase/db @metabase/core-backend-admin-webapp
-# test/metabase/db @metabase/core-backend-admin-webapp
-
-# src/metabase/driver @metabase/drivers
-# test/metabase/driver @metabase/drivers
-
-# src/metabase/eid_translation @metabase/core-backend-admin-webapp
-# test/metabase/eid_translation @metabase/core-backend-admin-webapp
-
-# src/metabase/embed @metabase/embedding
-# test/metabase/embed @metabase/embedding
-
-# src/metabase/events @metabase/devexp
-# test/metabase/events @metabase/devexp
-
-# src/metabase/formatter @metabase/core-backend-querying
-# test/metabase/formatter @metabase/core-backend-querying
-
-# src/metabase/indexed_entities @metabase/core-backend-querying
-# test/metabase/indexed_entities @metabase/core-backend-querying
-
-# src/metabase/integrations ...
-# test/metabase/integrations ...
-
-# src/metabase/legacy_mbql @metabase/core-backend-querying
-# test/metabase/legacy_mbql @metabase/core-backend-querying
-
-# src/metabase/lib @metabase/core-backend-querying
-# test/metabase/lib @metabase/core-backend-querying
-
-# src/metabase/logger @metabase/devexp
-# test/metabase/logger @metabase/devexp
-
-# src/metabase/login_history @metabase/core-backend-admin-webapp
-# test/metabase/login_history @metabase/core-backend-admin-webapp
-
-# src/metabase/model_persistence @metabase/core-backend-querying
-# test/metabase/model_persistence @metabase/core-backend-querying
-
-# src/metabase/models @metabase/devexp
-# test/metabase/models @metabase/devexp
-
-# src/metabase/moderation @metabase/core-backend-admin-webapp
-# test/metabase/moderation @metabase/core-backend-admin-webapp
-
-# src/metabase/notification @metabase/core-ux-east
-# test/metabase/notification @metabase/core-ux-east
-
-# src/metabase/permissions @metabase/core-backend-admin-webapp
-# test/metabase/permissions @metabase/core-backend-admin-webapp
-
-# src/metabase/plugins @metabase/devexp
-# test/metabase/plugins @metabase/devexp
-
-# src/metabase/premium_features @metabase/core-backend-admin-webapp
-# test/metabase/premium_features @metabase/core-backend-admin-webapp
-
-# src/metabase/public_settings @metabase/core-backend-admin-webapp
-# test/metabase/public_settings @metabase/core-backend-admin-webapp
-
-# src/metabase/public_sharing @metabase/core-backend-admin-webapp
-# test/metabase/public_sharing @metabase/core-backend-admin-webapp
-
-# src/metabase/pulse @metabase/core-ux-east
-# test/metabase/pulse @metabase/core-ux-east
-
-# src/metabase/query_analysis @metabase/core-backend-querying
-# test/metabase/query_analysis @metabase/core-backend-querying
-
-# src/metabase/query_processor @metabase/core-backend-querying
-# test/metabase/query_processor @metabase/core-backend-querying
-
-# src/metabase/request @metabase/devexp
-# test/metabase/request @metabase/devexp
-
-# src/metabase/revisions @metabase/core-backend-admin-webapp
-# test/metabase/revisions @metabase/core-backend-admin-webapp
-
-# src/metabase/sample_data @metabase/core-backend-admin-webapp
-# test/metabase/sample_data @metabase/core-backend-admin-webapp
-
-# src/metabase/search ...
-# test/metabase/search ...
-
-# src/metabase/segments @metabase/core-backend-querying
-# test/metabase/segments @metabase/core-backend-querying
-
-# src/metabase/server @metabase/devexp
-# test/metabase/server @metabase/devexp
-
-# src/metabase/session @metabase/core-backend-admin-webapp
-# test/metabase/session @metabase/core-backend-admin-webapp
-
-# src/metabase/setup @metabase/core-backend-admin-webapp
-# test/metabase/setup @metabase/core-backend-admin-webapp
-
-# src/metabase/sso @metabase/core-backend-admin-webapp
-# test/metabase/sso @metabase/core-backend-admin-webapp
-
-# src/metabase/sync @metabase/drivers
-# test/metabase/sync @metabase/drivers
-
-# src/metabase/task @metabase/devexp
-# test/metabase/task @metabase/devexp
-
-# src/metabase/tiles @metabase/core-backend-dashviz
-# test/metabase/tiles @metabase/core-backend-dashviz
-
-# src/metabase/timeline @metabase/core-backend-dashviz
-# test/metabase/timeline @metabase/core-backend-dashviz
-
-# src/metabase/types @metabase/core-backend-querying
-# test/metabase/types @metabase/core-backend-querying
-
-# src/metabase/upload @metabase/core-backend-admin-webapp
-# test/metabase/upload @metabase/core-backend-admin-webapp
-
-# src/metabase/user_key_value @metabase/core-backend-admin-webapp
-# test/metabase/user_key_value @metabase/core-backend-admin-webapp
-
-# src/metabase/util @metabase/devexp
-# test/metabase/util @metabase/devexp
-
-# src/metabase/xrays @metabase/core-backend-querying
-# test/metabase/xrays @metabase/core-backend-querying
+# @metabase/cloud-ops
+src/metabase/analytics/prometheus.clj @metabase/cloud-ops

.github/PULL_REQUEST_TEMPLATE/cypress_repro.md

@@ -5,7 +5,7 @@ PENDING CI / PENDING REVIEW / READY _(choose one and update accordingly)_
 - Reproduces #XXXXX
 
 ### How to test this manually?
-- `yarn test-cypress`
+- `bun run test-cypress`
 - `relative/path/to/the/file`
 > _(For still unfixed bug)_
 - Replace `it.skip()` with `it.only()` to run the test in isolation

.github/actions/fetch-artifact/action.yml

@@ -2,9 +2,16 @@ name: Fetch artifact
 description: Fetches a specific artifact and downloads it to the current directory
 
 inputs:
-  name:
-    description: The name of the artifact to fetch
+  commit:
+    description: Commit SHA for the artifact
     required: true
+  edition:
+    description: Metabase edition (ee or oss)
+    required: true
+  release:
+    description: Whether this is a release artifact (uses metabase-release- prefix)
+    required: false
+    default: "false"
   output-name:
     description: Optional custom name for the output jar file (defaults to metabase.jar)
     required: false
@@ -25,25 +32,44 @@ runs:
         script: | # js
           const fs = require('fs');
 
+          const isRelease = "${{ inputs.release }}" === "true";
+          const prefix = isRelease ? "metabase-release" : "metabase";
+          const artifactName = `${prefix}-${{ inputs.edition }}-${{ inputs.commit }}-uberjar`;
+          console.log(`Looking for artifact: ${artifactName}`);
+
           const artifacts = await github.rest.actions.listArtifactsForRepo({
             owner: context.repo.owner,
             repo: context.repo.repo,
-            name: "${{ inputs.name }}",
+            name: artifactName,
             per_page: 1,
           });
 
           if (!artifacts.data?.artifacts?.[0]?.id) {
-            throw new Error(`No artifacts found for ${{ inputs.name }}`);
+            core.setFailed(`No artifacts found for ${artifactName}`);
+            return;
           }
 
           const artifact_id = artifacts.data.artifacts[0].id;
 
-          const download = await github.rest.actions.downloadArtifact({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            artifact_id: artifact_id,
-            archive_format: 'zip',
-          });
+          let download;
+          const maxAttempts = 3;
+          for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+              download = await github.rest.actions.downloadArtifact({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                artifact_id: artifact_id,
+                archive_format: 'zip',
+              });
+              break;
+            } catch (err) {
+              console.log(`Attempt ${attempt}/${maxAttempts} failed: ${err.message}`);
+              if (attempt === maxAttempts) throw err;
+              const delay = attempt * 15000; // 15s, 30s
+              console.log(`Retrying in ${delay / 1000}s...`);
+              await new Promise(r => setTimeout(r, delay));
+            }
+          }
 
           fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
 

.github/actions/get-cache-keys/action.yml

@@ -7,9 +7,15 @@ outputs:
   m2-cache-key:
     description: "The cache key for the Maven cache."
     value: ${{ steps.keys-factory.outputs.m2-cache-key }}
+  m2-restore-key:
+    description: "The fallback restore key prefix for the Maven cache."
+    value: ${{ steps.keys-factory.outputs.m2-restore-key }}
   node-cache-key:
     description: "The cache key for the Node.js cache."
     value: ${{ steps.keys-factory.outputs.node-cache-key }}
+  node-restore-key:
+    description: "The fallback restore key prefix for the Node.js cache."
+    value: ${{ steps.keys-factory.outputs.node-restore-key }}
   eslint-cache-key:
     description: "The cache key for Eslint cache"
     value: ${{ steps.keys-factory.outputs.eslint-cache-key }}
@@ -31,7 +37,9 @@ runs:
         CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
 
         echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> $GITHUB_OUTPUT
         echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> $GITHUB_OUTPUT
         echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
         echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
       shell: bash

.github/actions/prepare-backend/action.yml

@@ -1,14 +1,13 @@
 name: Prepare back-end environment
 description: |
   Prepare the backend. Installs jdk, Clojure, and fetches the cache for m2.
-  The CI config fetches `ci-test-config.json` from master and lets us ignore tests at the var level if they are flaking.
 inputs:
   java-version:
     required: true
-    default: '21'
+    default: "21"
   clojure-version:
     required: true
-    default: '1.12.0.1488'
+    default: "1.12.0.1488"
 
 runs:
   using: "composite"
@@ -17,18 +16,33 @@ runs:
       uses: actions/setup-java@v4
       with:
         java-version: ${{ inputs.java-version }}
-        distribution: 'temurin'
+        distribution: "temurin"
     - name: Install Clojure CLI
       shell: bash
-      continue-on-error: true
       run: |
-        curl -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh &&
-        sudo bash ./linux-install-${{ inputs.clojure-version }}.sh
+        for attempt in 1 2 3; do
+          curl --retry 3 --retry-delay 5 --fail -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh \
+            && sudo bash ./linux-install-${{ inputs.clojure-version }}.sh \
+            && break
+          echo "::warning::Clojure install attempt $attempt failed, retrying in 10s..."
+          sleep 10
+        done
+        if ! clojure --version; then
+          echo "::error::Clojure CLI installation failed after 3 attempts"
+          exit 1
+        fi
 
     - name: Get M2 cache key
       uses: ./.github/actions/get-cache-keys
       id: get-cache-keys
 
+    - name: Install uv (for Python package installation)
+      uses: astral-sh/setup-uv@v7
+      with:
+        enable-cache: false
+        version: "0.10.2" # keep in sync with mise.toml
+        github-token: ${{ github.token }}
+
     - name: Restore M2 cache
       uses: actions/cache/restore@v4
       with:
@@ -36,3 +50,5 @@ runs:
           ~/.m2
           ~/.gitlibs
         key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.m2-restore-key }}

.github/actions/prepare-cypress/action.yml

@@ -3,7 +3,7 @@ description: Cypress preparation steps
 
 inputs:
   working-directory:
-    description: "Optional working directory for yarn commands"
+    description: "Optional working directory for bun commands"
     required: false
     default: "."
 
@@ -15,11 +15,10 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Install Chrome v111
-      uses: browser-actions/setup-chrome@v1
+    - name: Install Chrome v144
+      uses: browser-actions/setup-chrome@v2
       with:
-        # https://chromium.cypress.io/linux/stable/111.0.5563.146
-        chrome-version: 1097615
+        chrome-version: 144
       id: setup-chrome
 
     - name: Get cache keys
@@ -34,9 +33,9 @@ runs:
 
     - name: Ensure that Cypress executable is ready
       run: |
-        yarn cypress install
-        yarn cypress cache path
-        yarn cypress cache list
-        yarn cypress verify
+        bun run cypress install
+        bun run cypress cache path
+        bun run cypress cache list
+        bun run cypress verify
       shell: bash
       working-directory: ${{ inputs.working-directory }}

.github/actions/prepare-frontend/action.yml

@@ -11,11 +11,10 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Prepare Node.js
-      uses: actions/setup-node@v4
+    - name: Prepare Node + Bun environment
+      uses: ./.github/actions/prepare-node-bun
       with:
-        node-version: ${{ inputs.node-version }} # this overrides, if present
-        node-version-file: ".nvmrc"
+        node-version: ${{ inputs.node-version }}
 
     - name: Get cache keys
       uses: ./.github/actions/get-cache-keys
@@ -28,13 +27,15 @@ runs:
           ~/.m2
           ~/.gitlibs
         key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.m2-restore-key }}
 
-    - name: Get yarn cache directory
-      id: yarn-cache-dir
+    - name: Get bun cache directory
+      id: bun-cache
       run: |
-        YARN_CACHE_DIR=$(yarn cache dir)
-        echo "Yarn cache directory: $YARN_CACHE_DIR"
-        echo "dir=$YARN_CACHE_DIR" >> $GITHUB_OUTPUT
+        BUN_CACHE_DIR=$(bun pm cache)
+        echo "Bun cache directory: $BUN_CACHE_DIR"
+        echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
       shell: bash
 
     - name: Restore node_modules cache
@@ -42,17 +43,19 @@ runs:
       id: node-modules-cache
       with:
         path: |
-          ${{ steps.yarn-cache-dir.outputs.dir }}
+          ${{ steps.bun-cache.outputs.dir }}
           node_modules
         key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.node-restore-key }}
 
     # postinstall lifecycle hook can be dangerous in CI so we only run it locally (see package.json)
     # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
     # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
     - name: Clean install
-      run: yarn install --frozen-lockfile --prefer-offline
+      run: bun install --frozen-lockfile
       shell: bash
     - name: Patch frontend dependencies
       if: inputs.apply-patches == 'true'
-      run: yarn patch-package
+      run: bun run patch-package
       shell: bash

.github/actions/prepare-node-bun/action.yml

@@ -0,0 +1,20 @@
+name: Prepare Node + Bun environment
+description: "Set up Node.js and Bun for CI jobs"
+inputs:
+  node-version:
+    description: "The version of Node.js to use, overriding .nvmrc"
+    required: false
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        node-version-file: ".nvmrc"
+
+    - name: Install bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: "1.3.7"
+        token: ${{ github.token }}

.github/actions/prepare-release-scripts/action.yml

@@ -0,0 +1,14 @@
+name: Prepare Release Scripts
+description: Set up bun and build release scripts
+
+runs:
+  using: composite
+  steps:
+    - uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: "1.3.7"
+        token: ${{ github.token }}
+
+    - name: Build release scripts
+      shell: bash
+      run: cd ${{ github.workspace }}/release && bun install --frozen-lockfile && bun run build

.github/actions/prepare-shoppy-e2e/action.yml

@@ -0,0 +1,132 @@
+name: Prepare Shoppy E2E environment
+description: Shared setup steps for Shoppy E2E tests (regular and synthetic)
+
+inputs:
+  commit:
+    description: "Commit SHA for artifact retrieval"
+    required: true
+  sample-app-branch-name:
+    description: "Branch name for the sample app"
+    required: true
+  sample-app-environment:
+    description: "Environment (production/development)"
+    required: true
+  staging-mb-all-features-token:
+    description: "Staging MB all features token"
+    required: true
+  shoppy-iam-role:
+    description: "Shoppy IAM role for AWS credentials"
+    required: true
+  shoppy-metabase-app-db-s3-bucket:
+    description: "S3 bucket for Shoppy app DB dump"
+    required: true
+  shoppy-metabase-app-db-s3-key:
+    description: "S3 key for Shoppy app DB dump"
+    required: true
+  shoppy-metabase-app-db-user:
+    description: "Shoppy Metabase app DB user"
+    required: true
+  shoppy-metabase-app-db-database:
+    description: "Shoppy Metabase app DB database"
+    required: true
+  metastore-dev-server-url:
+    description: "Metastore dev server URL"
+    required: true
+  shoppy-datadog-application-id:
+    description: "Shoppy Datadog application ID"
+    required: true
+  shoppy-datadog-client-token:
+    description: "Shoppy Datadog client token"
+    required: true
+
+outputs:
+  chrome-path:
+    description: "Path to Chrome executable"
+    value: ${{ steps.cypress-prep.outputs.chrome-path }}
+  sample_app_branch_exists:
+    description: "Whether the sample app branch exists"
+    value: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists }}
+
+runs:
+  using: "composite"
+  steps:
+    - uses: ./.github/actions/maximize-disk-space
+
+    # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
+    - name: Set up Docker Compose
+      uses: docker/setup-compose-action@v1
+      with:
+        version: latest
+
+    - name: Retrieve uberjar artifact for ee
+      uses: ./.github/actions/fetch-artifact
+      with:
+        commit: ${{ inputs.commit }}
+        edition: ee
+        extract-path: "target/uberjar"
+        output-name: "metabase.jar"
+
+    - name: Retrieve Embedding SDK dist artifact
+      uses: actions/download-artifact@v4
+      with:
+        name: embedding-sdk-${{ inputs.commit }}
+        path: ${{ github.workspace }}/resources/embedding-sdk
+
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+
+    - name: Prepare Cypress environment
+      id: cypress-prep
+      uses: ./.github/actions/prepare-cypress
+
+    - name: Check if sample app branch exists
+      id: check-sample-app-branch
+      shell: bash
+      env:
+        SAMPLE_APP_BRANCH_NAME: ${{ inputs.sample-app-branch-name }}
+      run: |
+        REPO_URL="https://github.com/metabase/shoppy.git"
+        echo "Checking if branch '${SAMPLE_APP_BRANCH_NAME}' exists in ${REPO_URL}..."
+        if git ls-remote --exit-code --heads "$REPO_URL" "${SAMPLE_APP_BRANCH_NAME}"; then
+          echo "sample_app_branch_exists=true" >> $GITHUB_OUTPUT
+        else
+          echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Configure AWS credentials
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-to-assume: ${{ inputs.shoppy-iam-role }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
+        aws-region: us-east-1
+
+    - name: Download Shoppy's App DB PostgreSQL dump from S3
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      shell: bash
+      run: |
+        aws s3 cp s3://${{ inputs.shoppy-metabase-app-db-s3-bucket }}/${{ inputs.shoppy-metabase-app-db-s3-key }} ./e2e/tmp/db_dumps/shoppy_metabase_app_db_dump.sql
+
+    - name: Prepare and launch Shoppy containers
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      shell: bash
+      env:
+        SAMPLE_APP_BRANCH_NAME: ${{ inputs.sample-app-branch-name }}
+        SAMPLE_APP_ENVIRONMENT: ${{ inputs.sample-app-environment }}
+        CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ inputs.staging-mb-all-features-token }}
+        METASTORE_DEV_SERVER_URL: ${{ inputs.metastore-dev-server-url }}
+        METABASE_APP_DB_USER: ${{ inputs.shoppy-metabase-app-db-user }}
+        METABASE_APP_DB: ${{ inputs.shoppy-metabase-app-db-database }}
+        SHOPPY_DATADOG_APPLICATION_ID: ${{ inputs.shoppy-datadog-application-id }}
+        SHOPPY_DATADOG_CLIENT_TOKEN: ${{ inputs.shoppy-datadog-client-token }}
+        SHOPPY_DATADOG_SITE: "us5.datadoghq.com"
+        SHOPPY_DATADOG_ENV: "staging"
+      run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts shoppy-e2e
+
+    - name: Prune build cache
+      shell: bash
+      run: docker builder prune -af
+
+    - name: Log free disk space
+      shell: bash
+      run: df -h /

.github/actions/prepare-uberjar-artifact/action.yml

@@ -2,9 +2,10 @@ name: Prepare Uberjar Artifact
 description: Prepare and upload Metabase JAR as a GitHub artifact.
 
 inputs:
-  name:
-    required: true
-    description: Artifact name
+  edition:
+    required: false
+    default: "ee"
+    description: Metabase edition (ee or oss)
 
 runs:
   using: "composite"
@@ -18,7 +19,7 @@ runs:
     - name: Upload JARs as artifact
       uses: actions/upload-artifact@v4
       with:
-        name: ${{ inputs.name }}
+        name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
         path: |
           ./target/uberjar/metabase.jar
           ./COMMIT-ID

.github/actions/sdk-bundle-size-check/action.yml

@@ -0,0 +1,110 @@
+name: Embedding SDK Bundle Size Check
+description: |
+  Downloads the current branch's uberjar and builds the base ref's
+  embedding-sdk.js from source, compares their sizes,
+  and sets output if the size change exceeds the threshold.
+
+inputs:
+  edition:
+    description: 'Metabase edition (ee or oss)'
+    required: true
+  base-ref-commit:
+    description: 'Commit SHA of the base ref (e.g. merge base).'
+    required: true
+  threshold-percent:
+    description: 'Percent threshold for bundle size change'
+    required: true
+
+outputs:
+  status:
+    description: "Bundle size status: increased, decreased, or stable"
+    value: ${{ steps.compare.outputs.status }}
+  size_change_percent:
+    description: "size change percent (positive = increase, negative = decrease)"
+    value: ${{ steps.compare.outputs.size_change_percent }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare backend
+      uses: ./.github/actions/prepare-backend
+    - name: Prepare frontend
+      uses: ./.github/actions/prepare-frontend
+    - name: Download current uberjar
+      uses: actions/download-artifact@v4
+      with:
+        name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+        path: temp/current-uberjar
+    - name: Extract embedding-sdk bundles from current uberjar
+      shell: bash
+      run: |
+        # Try new layout first (app/embedding-sdk/legacy/), fall back to old layout (app/embedding-sdk.js)
+        unzip -j temp/current-uberjar/target/uberjar/metabase.jar \
+          "frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" \
+          -d temp/current-bundle 2>/dev/null || \
+        unzip -j temp/current-uberjar/target/uberjar/metabase.jar \
+          "frontend_client/app/embedding-sdk.js" \
+          -d temp/current-bundle
+
+        # Extract chunks directory if it exists (new layout only)
+        mkdir -p temp/current-chunks
+        unzip -j temp/current-uberjar/target/uberjar/metabase.jar \
+          "frontend_client/app/embedding-sdk/chunks/*" \
+          -d temp/current-chunks 2>/dev/null || true
+    - name: Checkout base ref
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.base-ref-commit }}
+        path: temp/base-ref-src
+    - name: Build base-ref embedding-sdk.js
+      shell: bash
+      run: |
+        cd temp/base-ref-src
+        bun install
+        MB_EDITION=${{ inputs.edition }} bun run build-release
+    - name: Compare sizes and set output
+      id: compare
+      shell: bash
+      run: |
+        # --- Legacy (monolithic) bundle comparison ---
+        current_size=$(wc -c < temp/current-bundle/embedding-sdk.js) || { echo "::error::Failed to read current bundle"; exit 1; }
+
+        # Base ref: try new layout first, fall back to old
+        if [ -f "temp/base-ref-src/resources/frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" ]; then
+          base_ref_size=$(wc -c < "temp/base-ref-src/resources/frontend_client/app/embedding-sdk/legacy/embedding-sdk.js")
+        else
+          base_ref_size=$(wc -c < "temp/base-ref-src/resources/frontend_client/app/embedding-sdk.js")
+        fi
+        [ "$current_size" -gt 0 ] && [ "$base_ref_size" -gt 0 ] || { echo "::error::Bundle file is empty"; exit 1; }
+
+        diff=$((current_size - base_ref_size))
+        percent=$(( diff * 100 / base_ref_size ))
+
+        echo "=== Legacy (monolithic) bundle ==="
+        echo "Current size: $current_size bytes"
+        echo "Base ref size: $base_ref_size bytes"
+        echo "Difference: $diff bytes ($percent%)"
+
+        threshold="${{ inputs.threshold-percent }}"
+        if [ "$percent" -gt "$threshold" ]; then
+          status="increased"
+        elif [ "$percent" -lt "$(( -threshold ))" ]; then
+          status="decreased"
+        else
+          status="stable"
+        fi
+
+        echo "status=$status" >> $GITHUB_OUTPUT
+        echo "size_change_percent=$percent" >> $GITHUB_OUTPUT
+
+        # --- Chunked bundle (informational) ---
+        if ls temp/current-chunks/*.js 1>/dev/null 2>&1; then
+          chunks_size=$(cat temp/current-chunks/*.js | wc -c)
+          echo ""
+          echo "=== Chunked bundle (bootstrap + chunks) ==="
+          echo "Total chunked size: $chunks_size bytes"
+          echo "chunks_size=$chunks_size" >> $GITHUB_OUTPUT
+        else
+          echo ""
+          echo "No chunked bundle found (expected on master)"
+        fi

.github/actions/test-driver/action.yml

@@ -12,6 +12,15 @@ inputs:
   logs-artifact-suffix:
     required: false
     description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
+  edition:
+    required: false
+    default: 'ee'
+    description: Edition to test (oss or ee)
+
+outputs:
+  test-outcome:
+    description: "The outcome of the test run (success, failure, cancelled, skipped)"
+    value: ${{ steps.run-test.outcome }}
 
 runs:
   using: "composite"
@@ -23,12 +32,12 @@ runs:
       uses: ./.github/actions/prepare-frontend
     - name: Build static viz frontend
       if: ${{ inputs.build-static-viz == 'true' }}
-      run: yarn build-static-viz
+      run: bun run build-static-viz
       shell: bash
       env:
         MB_EDITION: ee
     - name: Test database driver
-      run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
+      run: clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash
       id: run-test
       # Trunk Quarantine controls the final state of the run in the CI!
@@ -52,7 +61,7 @@ runs:
       if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v4
       with:
-        name: ${{ format('test-logs-{0}{1}', github.job, (inputs.logs-artifact-suffix == '' || inputs.logs-artifact-suffix == null) && '' || format('-{0}', inputs.logs-artifact-suffix)) }}
+        name: ${{ format('test-logs-{0}{1}', github.job, inputs.logs-artifact-suffix && format('-{0}', inputs.logs-artifact-suffix) || '') }}
         path: logs/test-log.json
         retention-days: 1
       # Failing to upload the artifact should never affect the outcome of the whole test run.

.github/actions/upload-test-results/action.yml

@@ -21,6 +21,8 @@ inputs:
   variant:
     required: false
     default: ""
+  previous-step-outcome:
+    required: true
 
 runs:
   using: "composite"
@@ -57,3 +59,4 @@ runs:
         dry-run: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == true }} # quarantine, but do not upload results
         token: ${{ inputs.trunk-api-token }}
         use-cache: true
+        previous-step-outcome: ${{ inputs.previous-step-outcome }}

.github/copilot-instructions.md

@@ -1,52 +1,55 @@
 # Metabase Developer Assistant Instructions
 
-## Frontend Development
+For detailed coding standards and conventions, see `CLAUDE.md` and the skills in `.claude/skills/`.
 
-### Repository Structure
+## Code Review Standards
 
-```
-frontend/src/
-├── metabase/           # Main application components and pages
-├── metabase-lib/       # Query building and data modeling utilities
-├── metabase-types/     # TypeScript type definitions
-└── metabase/ui/        # Design system components
+Review focus areas: Security → Performance → Testing → Documentation (in priority order)
 
-e2e/                    # Cypress end-to-end tests
-frontend/test/          # Jest unit tests
-```
+When reviewing code, use these emoji prefixes to categorize feedback:
+- 🔒 Security concerns
+- ⚡ Performance opportunities
+- 🧹 Cleanup needs
+- 📚 Documentation gaps
+- 🚨 Blocking issues
+- 💭 Clarification questions
 
-### Technology Stack
+### Security Critical Issues
 
-- **Framework**: React 18 with TypeScript
-- **State**: Redux Toolkit
-- **Styling**: CSS Modules (preferred) > Emotion styled-components
-- **UI**: `metabase/ui` components built with Mantine v8
-- **Build**: Rspack (primary), Webpack (legacy)
-- **Testing**: Jest + React Testing Library, Cypress
+- Check for hardcoded secrets, API keys, or credentials
+- Look for SQL injection and XSS vulnerabilities
+- Verify proper input validation and sanitization
+- Review authentication and authorization logic
+- Ensure enterprise features use the plugin system (no enterprise code in OSS)
 
-### Coding Standards
+### Performance Red Flags
 
-#### Component Preferences
+- Identify N+1 database query problems
+- Spot inefficient loops and algorithmic issues
+- Check for memory leaks and resource cleanup
+- Review caching opportunities for expensive operations
 
-- Prefer `metabase/ui`components over `metabase/common/components`
-- Use `.tsx` for components, `.ts` for utilities
+### Code Quality Essentials
 
-#### Styling
+- Functions should be focused and appropriately sized
+- Use clear, descriptive naming conventions
+- Ensure proper error handling throughout
+- Remove dead code and unused imports
 
-ALWAYS prefer Mantine style props,then CSS modules. DO NOT suggest styled components, they are deprecated.
+### Review Style
 
-#### TypeScript Migration
+- Only flag actual issues worth mentioning
+- Do not post "looks good" comments or congratulate following conventions
+- Be specific and actionable in feedback
+- Explain the "why" behind recommendations
+- Ask clarifying questions when code intent is unclear
 
-When heavily editing `.js`/`.jsx` files, create a separate PR to convert to TypeScript first, then implement changes.
+### Review Format
 
-#### Enterprise Features
+- Condense feedback into as few comments as possible
+- Prefer a single summary comment over dozens of inline comments
+- Only use inline comments for critical issues that require immediate attention
+- For non-critical issues, link to the specific line from the summary instead
+- Delete all stale comments and summaries on each new push or CI run
 
-Enterprise functionality MUST use the plugin system. It is very important to not expose enterprise code in the OSS version.
-
-#### Testing Requirements
-
-All PRs should include tests. Prefer Unit tests over E2E tests.
-
-#### Localization
-
-All user-facing strings MUST be localized using the ttag library. Localized strings should be complete phrases, do not concatenate a few separately localized strings. You should add context to strings where the meaning of the string might not be obvious in isolation: e.g. "Home" might have different words in some languages depending on whether you're talking about a dwelling or the landing page for a website.
+Language-specific rules are in `.github/instructions/*.instructions.md`.

.github/file-paths.yaml

@@ -26,11 +26,11 @@ frontend_ci: &frontend_ci
   - ".github/workflows/frontend.yml"
 
 frontend_configs: &frontend_configs
-  - "yarn.lock"
+  - "bun.lock"
   - "**/tsconfig*.json"
   - "package.json"
   - "babel.config.json"
-  - ".eslintrc.js"
+  - "eslint.config.mjs"
   - "postcss.config.js"
   - "rspack.config.js"
   - "rspack.main.config.js"
@@ -85,7 +85,9 @@ backend_ci: &backend_ci
 
 backend_presto_kerberos:
   - "**/presto_jdbc/**"
+  - "**/presto-jdbc/**" # the driver module has a hyphen. underscores are classpaths
   - "**/presto_jdbc.clj"
+  - "**/presto_jdbc_test.clj"
   - ".github/workflows/presto-kerberos-integration-test.yml"
 
 backend_sources: &backend_sources
@@ -197,3 +199,15 @@ cljs:
   - *shared_specs
   - ".github/workflows/cljs.yml"
   - "shadow-cljs.edn"
+
+openapi:
+  - ".github/workflows/openapi.yml"
+  - "src/metabase/api/**"
+  - "src/metabase/api_routes/**"
+  - "src/metabase/*_rest/api.clj"
+  - "src/metabase/*/api.clj"
+  - "src/metabase/*/api/*.clj"
+  - "enterprise/backend/src/metabase_enterprise/**/api.clj"
+  - "enterprise/backend/src/metabase_enterprise/**/api/*.clj"
+  - "resources/openapi/**"
+  - "package.json"

.github/instructions/clojure.instructions.md

@@ -0,0 +1,9 @@
+---
+applyTo: "**/*.{clj,cljs,cljc}"
+---
+
+# Clojure/ClojureScript Code Review
+
+When reviewing Clojure or ClojureScript code, apply the guidelines in these files:
+- `.claude/skills/_shared/clojure-style-guide.md`
+- `.claude/skills/clojure-review/SKILL.md`

.github/instructions/docs.instructions.md

@@ -0,0 +1,9 @@
+---
+applyTo: "docs/**/*.md"
+---
+
+# Documentation Review
+
+When reviewing documentation, apply the guidelines in these files:
+- `.claude/skills/_shared/metabase-style-guide.md`
+- `.claude/skills/docs-review/SKILL.md`

.github/instructions/typescript.instructions.md

@@ -0,0 +1,11 @@
+---
+applyTo: "**/*.{ts,tsx,js,jsx}"
+---
+
+# TypeScript/JavaScript Code Review
+
+When reviewing TypeScript or JavaScript code, apply the guidelines in these files:
+
+- `.claude/skills/typescript-review/SKILL.md`
+- `docs/developers-guide/frontend.md`
+- `frontend/CLAUDE.md`

.github/scripts/build-cross-version-matrix.js

@@ -0,0 +1,52 @@
+// This script is used in .github/workflows/cross-version.yml
+// to generate a matrix for cross-version migration testing
+
+/**
+ * Generate a CI matrix for cross-version migration testing (EE only).
+ *
+ * Creates pairs of [source, target] for testing HEAD against the last N
+ * minor versions in both upgrade and downgrade directions.
+ *
+ * @param {number} currentVersion - The current major version number (e.g., 59)
+ * @param {number} count - Number of previous minor versions to test against (default: 3)
+ * @returns {{ config: Array<{ source: string, target: string }> }}
+ *
+ * @example
+ * buildMatrix(59)
+ * // Returns:
+ * // {
+ * //   config: [
+ * //     { source: "HEAD", target: "v1.59.x" },
+ * //     { source: "v1.59.x", target: "HEAD" },
+ * //     { source: "HEAD", target: "v1.58.x" },
+ * //     { source: "v1.58.x", target: "HEAD" },
+ * //     { source: "HEAD", target: "v1.57.x" },
+ * //     { source: "v1.57.x", target: "HEAD" },
+ * //   ]
+ * // }
+ */
+function buildCrossVersionMatrix(currentVersion, count = 3) {
+  if (!Number.isInteger(currentVersion) || currentVersion < 1) {
+    throw new Error(
+      `Invalid currentVersion: ${currentVersion}. Must be a positive integer.`,
+    );
+  }
+
+  if (!Number.isInteger(count) || count < 1) {
+    throw new Error(`Invalid count: ${count}. Must be a positive integer.`);
+  }
+
+  const config = Array.from({ length: count }, (_, i) => currentVersion - i)
+    .filter((majorVersion) => majorVersion >= 1)
+    .flatMap((majorVersion) => {
+      const version = `v1.${majorVersion}.x`;
+      return [
+        { source: "HEAD", target: version },
+        { source: version, target: "HEAD" },
+      ];
+    });
+
+  return { config };
+}
+
+module.exports = { buildCrossVersionMatrix };

.github/scripts/build-cross-version-matrix.unit.spec.js

@@ -0,0 +1,242 @@
+const { buildCrossVersionMatrix } = require("./build-cross-version-matrix");
+
+describe("buildCrossVersionMatrix", () => {
+  describe("default behavior", () => {
+    it("should generate matrix with 3 versions by default", () => {
+      const result = buildCrossVersionMatrix(59);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.59.x" },
+          { source: "v1.59.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.58.x" },
+          { source: "v1.58.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.57.x" },
+          { source: "v1.57.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should use EE prefix (v1)", () => {
+      const result = buildCrossVersionMatrix(50);
+      expect(result.config[0].target).toBe("v1.50.x");
+      expect(result.config[1].source).toBe("v1.50.x");
+    });
+
+    it("should create pairs in both directions (upgrade and downgrade)", () => {
+      const result = buildCrossVersionMatrix(59);
+      const entries = result.config;
+
+      // Check HEAD -> version (upgrade test)
+      expect(entries.filter((e) => e.source === "HEAD")).toHaveLength(3);
+      // Check version -> HEAD (downgrade test)
+      expect(entries.filter((e) => e.target === "HEAD")).toHaveLength(3);
+    });
+  });
+
+  describe("custom count", () => {
+    it("should generate matrix with custom count", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+      expect(result.config).toHaveLength(10); // 5 versions × 2 directions
+      expect(result.config).toEqual([
+        { source: "HEAD", target: "v1.59.x" },
+        { source: "v1.59.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.58.x" },
+        { source: "v1.58.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.57.x" },
+        { source: "v1.57.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.56.x" },
+        { source: "v1.56.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.55.x" },
+        { source: "v1.55.x", target: "HEAD" },
+      ]);
+    });
+
+    it("should generate matrix with count=1", () => {
+      const result = buildCrossVersionMatrix(59, 1);
+      expect(result.config).toHaveLength(2);
+      expect(result.config).toEqual([
+        { source: "HEAD", target: "v1.59.x" },
+        { source: "v1.59.x", target: "HEAD" },
+      ]);
+    });
+
+    it("should generate matrix with large count", () => {
+      const result = buildCrossVersionMatrix(59, 10);
+      expect(result.config).toHaveLength(20);
+
+      // Check first and last entries
+      expect(result.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+      expect(result.config[18]).toEqual({
+        source: "HEAD",
+        target: "v1.50.x",
+      });
+      expect(result.config[19]).toEqual({
+        source: "v1.50.x",
+        target: "HEAD",
+      });
+    });
+  });
+
+  describe("edge cases", () => {
+    it("should handle version 1", () => {
+      const result = buildCrossVersionMatrix(1);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.1.x" },
+          { source: "v1.1.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should stop when version would go below 1", () => {
+      const result = buildCrossVersionMatrix(2, 5);
+      // Can only generate v1.2.x and v1.1.x (2 versions, not 5)
+      expect(result.config).toHaveLength(4);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.2.x" },
+          { source: "v1.2.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.1.x" },
+          { source: "v1.1.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should handle high version numbers", () => {
+      const result = buildCrossVersionMatrix(100, 2);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.100.x" },
+          { source: "v1.100.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.99.x" },
+          { source: "v1.99.x", target: "HEAD" },
+        ],
+      });
+    });
+  });
+
+  describe("error handling", () => {
+    it("should throw for undefined currentVersion", () => {
+      expect(() => buildCrossVersionMatrix()).toThrow(
+        "Invalid currentVersion: undefined. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for non-integer currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(59.5)).toThrow(
+        "Invalid currentVersion: 59.5. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for zero currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(0)).toThrow(
+        "Invalid currentVersion: 0. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for negative currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(-1)).toThrow(
+        "Invalid currentVersion: -1. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for NaN currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(NaN)).toThrow(
+        "Invalid currentVersion: NaN. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for non-integer count", () => {
+      expect(() => buildCrossVersionMatrix(59, 2.5)).toThrow(
+        "Invalid count: 2.5. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for zero count", () => {
+      expect(() => buildCrossVersionMatrix(59, 0)).toThrow(
+        "Invalid count: 0. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for negative count", () => {
+      expect(() => buildCrossVersionMatrix(59, -1)).toThrow(
+        "Invalid count: -1. Must be a positive integer.",
+      );
+    });
+  });
+
+  describe("matrix structure for GitHub Actions", () => {
+    it("should return object with config array", () => {
+      const result = buildCrossVersionMatrix(59);
+      expect(result).toHaveProperty("config");
+      expect(Array.isArray(result.config)).toBe(true);
+    });
+
+    it("should produce valid JSON for GitHub Actions", () => {
+      const result = buildCrossVersionMatrix(59);
+      const json = JSON.stringify(result);
+      expect(() => JSON.parse(json)).not.toThrow();
+
+      const parsed = JSON.parse(json);
+      expect(parsed.config).toHaveLength(6);
+      expect(parsed.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+    });
+
+    it("should have consistent entry structure", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+
+      result.config.forEach((entry) => {
+        expect(entry).toHaveProperty("source");
+        expect(entry).toHaveProperty("target");
+        expect(typeof entry.source).toBe("string");
+        expect(typeof entry.target).toBe("string");
+        // Either source or target should be HEAD
+        expect(entry.source === "HEAD" || entry.target === "HEAD").toBeTruthy();
+      });
+    });
+  });
+
+  describe("version ordering", () => {
+    it("should generate versions in descending order", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+      const versions = result.config
+        .filter((e) => e.source === "HEAD")
+        .map((e) => e.target);
+
+      expect(versions).toEqual([
+        "v1.59.x",
+        "v1.58.x",
+        "v1.57.x",
+        "v1.56.x",
+        "v1.55.x",
+      ]);
+    });
+
+    it("should interleave upgrade and downgrade tests", () => {
+      const result = buildCrossVersionMatrix(59, 2);
+
+      expect(result.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+      expect(result.config[1]).toEqual({
+        source: "v1.59.x",
+        target: "HEAD",
+      });
+      expect(result.config[2]).toEqual({
+        source: "HEAD",
+        target: "v1.58.x",
+      });
+      expect(result.config[3]).toEqual({
+        source: "v1.58.x",
+        target: "HEAD",
+      });
+    });
+  });
+});

.github/scripts/csv-to-mb.js

@@ -0,0 +1,41 @@
+/**
+ * jsonData must be in the format:
+ * [
+ *   { column1: value1, column2: value2, ... },
+ *   { column1: value3, column2: value4, ... },
+ *   ...
+ * ]
+ */
+function jsonToCsvFormData(jsonData) {
+  const formData = new FormData();
+  const csvHeader = Object.keys(jsonData[0]).join(',') + '\n';
+  const csvContent = jsonData.map(row =>
+    Object.values(row).map(value => `"${String(value).replace(/"/g, '""')}"`).join(',')
+  ).join('\n');
+
+  const blob = new Blob([csvHeader + csvContent], { type: 'text/csv' });
+  formData.append('file', blob, 'data.csv');
+
+  return formData;
+}
+
+function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append' }) {
+  const formData = jsonToCsvFormData(jsonData);
+  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
+
+  return fetch(`${baseUrl}/api/table/${tableId}/${operation}`, {
+    method: 'POST',
+    headers: {
+      "x-api-key": process.env.API_KEY
+    },
+    body: formData
+  })
+  .then(response => {
+    if (!response.ok) {
+      throw new Error(`Upload failed`);
+    }
+    return { success: true };
+  });
+}
+
+module.exports = { uploadCsvToMb };

.github/scripts/generate-llms-txt.js

@@ -1,317 +0,0 @@
-const fs = require("fs");
-const path = require("path");
-
-const REPO = "metabase/metabase";
-const OUTPUT_FILE = "llms.txt";
-
-// Sections to generate llms-<name>-full.txt for.
-// Each section can define a preamble (introductory content before the main docs).
-const LLMS_FULL_TO_GENERATE = [
-  {
-    section: "embedding",
-    getPreamble: (branch) =>
-      aboveVersion(branch, 57) ? getModularEmbeddingGotchaNotes() : "",
-  },
-];
-
-/**
- * List directory recursively to get markdown files
- *
- * @param {string} docsPath - full path to docs directory
- * @returns {Array} list of markdown file objects with fullPath and relativePath
- */
-function getMarkdownFilesList(docsPath) {
-  if (!fs.existsSync(docsPath)) {
-    console.error(`Error: Docs directory '${docsPath}' does not exist`);
-    process.exit(1);
-  }
-
-  const entries = fs.readdirSync(docsPath, {
-    recursive: true,
-    withFileTypes: true,
-  });
-
-  return entries
-    .filter((entry) => {
-      return (
-        entry.isFile() &&
-        // Only markdown files
-        entry.name.endsWith(".md") &&
-        // Ignore README.md
-        entry.name !== "README.md" &&
-        // Ignore node_modules and hidden directories
-        !entry.parentPath
-          .split(path.sep)
-          .some((dir) => dir === "node_modules" || dir.startsWith("."))
-      );
-    })
-    .map((entry) => {
-      const fullPath = path
-        .join(entry.parentPath, entry.name)
-        .replace(/\\/g, "/");
-
-      const relativePath = path
-        .relative(docsPath, fullPath)
-        .replace(/\\/g, "/");
-
-      return { fullPath, relativePath };
-    });
-}
-
-/**
- * Generate llms.txt file with links to all markdown files in docs/
- *
- * @param {string} branch - branch name (e.g. 'master' or 'release-x.58.x')
- * @param {Array} files - list of all markdown file objects
- * @param {Array<Object>} sectionsConfig - list of section config objects to generate complete references for
- */
-function generateLlmsTxt(branch, files, sectionsConfig) {
-  const baseUrl = `https://raw.githubusercontent.com/${REPO}/refs/heads/${branch}`;
-
-  const filesToExtract = files
-    // Files in embedding/sdk/api/snippets does not exist in the repo.
-    .filter(
-      (file) => !file.relativePath.startsWith("embedding/sdk/api/snippets"),
-    );
-
-  const entries = filesToExtract.map((file) => {
-    const content = fs.readFileSync(file.fullPath, "utf8");
-    const title = extractTitle(content, file.relativePath);
-    const url = `${baseUrl}/docs/${file.relativePath}`;
-
-    return { title, url, path: file.relativePath };
-  });
-
-  // Generate table of contents entries
-  const tableOfContents = entries.map(
-    (entry) => `- [${entry.title}](${entry.url})`,
-  );
-
-  // Generate complete references entries
-  const completeReferences = sectionsConfig
-    .filter((config) =>
-      files.some((file) => file.relativePath.startsWith(`${config.section}/`)),
-    )
-    .map((config) => {
-      const capitalized =
-        config.section.charAt(0).toUpperCase() + config.section.slice(1);
-      return `- [${capitalized} - Complete Reference](${baseUrl}/llms-${config.section}-full.txt)`;
-    });
-
-  // Generate llms.txt content using template literal
-  const content = `# Metabase Documentation
-Metabase - The simplest, fastest way to get business intelligence and analytics to everyone in your company.
-
-## Table of Contents
-
-${tableOfContents.join("\n")}
-
-## Complete References
-
-These files are very large and are around 90,000 tokens. Do not use by default unless the context window is huge or RAG is supported in your editor.
-
-${completeReferences.join("\n")}
-`;
-
-  fs.writeFileSync(OUTPUT_FILE, content, "utf8");
-
-  console.log(
-    `✅ Generated ${OUTPUT_FILE} with ${entries.length} markdown files`,
-  );
-  console.log(`   Branch: ${branch}`);
-  console.log(`   Base URL: ${baseUrl}`);
-}
-
-/**
- * Generate llms-full.txt files for specified sections
- *
- * @param {string} branch - branch name (e.g., 'master', 'release-x.58.x')
- * @param {Array} files - list of all markdown file objects
- * @param {Array<Object>} sectionsConfig - list of section config objects to generate full files for
- */
-function generateLlmsFullFiles(branch, files, sectionsConfig) {
-  const baseUrl = `https://raw.githubusercontent.com/${REPO}/refs/heads/${branch}`;
-
-  sectionsConfig.forEach((config) => {
-    generateLlmsFullTxt(branch, config, files, baseUrl);
-  });
-}
-
-/**
- * LLMs are likely to pay attention to the very first lines.
- *
- * We add the most important context for LLMs to avoid
- * confusion and pitfalls like out-of-date APIs in trained data.
- *
- * @returns {string} Markdown formatted gotcha notes
- */
-function getModularEmbeddingGotchaNotes() {
-  return `> **Important Version Notes**
->
-> Watch out for these deprecated props and gotchas for Metabase 57 onwards, for modular embedding:
->
-> 1. \`config\` prop on MetabaseProvider no longer exist - it is replaced by \`authConfig\`.
-> 2. \`authProviderUri\` field no longer exist.
-> 3. \`jwtProviderUri\` optional field only exists in v58+. This is used to make JWT auth faster by skipping the \`GET /auth/sso\` discovery request. Not needed for initial implementation.
-> 4. \`fetchRequestToken\` is not needed by default. This is only used to customize how the SDK fetches the request token.
-> 5. Numeric IDs must be integers not strings, e.g. \`dashboardId={1}\`. When the ID is retrieved from the URL and it is numeric, convert it to an integer via \`parseInt\` before passing it to the SDK. IDs can also be strings for entity ids, so you should not parse all IDs as numbers if entity ids are also to be expected.
-`;
-}
-
-/**
- * Generate llms-full.txt file for a specific section
- * @param {string} branch - The branch name
- * @param {Object} config - Section config object with section name and optional getPreamble function
- * @param {Array} files - Array of all markdown file objects
- * @param {string} baseUrl - Base URL for raw GitHub links
- */
-function generateLlmsFullTxt(branch, config, files, baseUrl) {
-  const { section, getPreamble } = config;
-
-  // Filter docs for this section
-  const sectionFiles = files.filter((file) =>
-    file.relativePath.startsWith(`${section}/`),
-  );
-
-  if (sectionFiles.length === 0) {
-    console.log(`   Skipping llms-full.txt for ${section} (no files found)`);
-    return;
-  }
-
-  // Build content
-  const sectionCapitalized = section.charAt(0).toUpperCase() + section.slice(1);
-  const header = `# Metabase ${sectionCapitalized} - Complete Reference for AI agents
-
-> Table of contents: ${baseUrl}/${OUTPUT_FILE}
-
-`;
-
-  // Add preamble if provided (e.g., version-specific notes, warnings)
-  const preamble = getPreamble ? getPreamble(branch) : "";
-
-  // Concatenate all documents
-  const docs = sectionFiles
-    .map((file) => readAndCleanMarkdown(file.fullPath))
-    .join("\n");
-
-  // Write llms-full.txt file at repo root
-  const content = header + preamble + "\n" + docs;
-  const llmsFullPath = `llms-${section}-full.txt`;
-  fs.writeFileSync(llmsFullPath, content, "utf8");
-
-  console.log(
-    `✅ Generated ${llmsFullPath} with ${sectionFiles.length} documents`,
-  );
-}
-
-/**
- * Extract title from markdown file frontmatter or filename.
- *
- * We try to extract the title in this order: 1) YAML frontmatter
- * 2) first H1 heading, and 3) the Markdown file name.
- *
- * Example Markdown and frontmatter format:
- * ```markdown
- * ---
- * title: "Getting Started"
- * description: "A guide"
- * ---
- * # Getting Started
- * ```
- *
- * @param {string} content - file content
- * @param {string} filePath - relative file path
- * @returns {string} title of content
- */
-function extractTitle(content, filePath) {
-  // Try to extract title from YAML frontmatter
-  // First, match against the YAML frontmatter delimiter `---`
-  const frontmatterMatch = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n/);
-
-  if (frontmatterMatch) {
-    // Then, match against the title property
-    // Example: `title: "My Page"`
-    const frontmatter = frontmatterMatch[1];
-    const titleMatch = frontmatter.match(/^title:\s*(.+)$/m);
-
-    // Remove quotes if present
-    if (titleMatch) {
-      return titleMatch[1].trim().replace(/^["']|["']$/g, "");
-    }
-  }
-
-  // Try to extract title from first H1 heading
-  // Example: `# My Page`
-  const h1Match = content.match(/^#\s+(.+)$/m);
-
-  if (h1Match) {
-    return h1Match[1].trim();
-  }
-
-  // Fallback to filename, e.g. `my-page.md`
-  const filename = path.basename(filePath, ".md");
-
-  // Convert kebab-case or snake_case to Title Case
-  // `my-page.md` would become "My Page"
-  return filename
-    .split(/[-_]/)
-    .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
-    .join(" ");
-}
-
-/**
- * Read and clean markdown file content
- *
- * @param {string} filePath - full path to the markdown file
- * @returns {string} cleaned markdown content with separator
- */
-function readAndCleanMarkdown(filePath) {
-  let content = fs.readFileSync(filePath, "utf8");
-
-  // Strip YAML frontmatter
-  content = content.replace(/^---\s*\n[\s\S]*?\n---\s*\n/, "");
-
-  // Strip Jekyll/Liquid template syntax
-  content = content.replace(/\{%.*?%\}/g, "");
-  content = content.replace(/\{\{.*?\}\}/g, "");
-
-  return `${content.trim()}\n\n---\n`;
-}
-
-/**
- * Check if branch version is above target version
- * @param {string} branch - Branch name (e.g., 'master', 'release-x.58.x')
- * @param {number} targetVersion - Target version number
- * @returns {boolean}
- */
-function aboveVersion(branch, targetVersion) {
-  if (branch === "master") {
-    return true;
-  }
-
-  // Parse version from release branch like "release-x.58.x" -> 58
-  const match = branch.match(/release-x\.(\d+)\.x/);
-  if (!match) {
-    return false;
-  }
-
-  const version = parseInt(match[1], 10);
-
-  return version >= targetVersion;
-}
-
-// Main execution
-if (require.main === module) {
-  const args = process.argv.slice(2);
-  const docsPath = args[0] || "docs";
-  const branch = args[1] || "master";
-
-  const resolvedDocsPath = path.resolve(docsPath);
-  const markdownFiles = getMarkdownFilesList(resolvedDocsPath);
-
-  // Sort all files upfront for consistent ordering across all generated files
-  markdownFiles.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-
-  generateLlmsTxt(branch, markdownFiles, LLMS_FULL_TO_GENERATE);
-  generateLlmsFullFiles(branch, markdownFiles, LLMS_FULL_TO_GENERATE);
-}

.github/team.json

@@ -4,21 +4,23 @@
       "name": "Querying",
       "label": ".Team/Querying",
       "members": [
-        "ranquild",
-        "romeovs",
         "bshepherdson",
         "metamben",
-        "wzimrin",
-        "ericnormand",
-        "galdre"
+        "rileythomp",
+        "camsual"
       ]
     },
     {
-      "name": "Drivers",
-      "label": ".Team/Drivers",
+      "name": "Graphy",
+      "label": ".Team/Graphy",
       "members": [
-        "snoe",
-        "rileythomp"
+        "ranquild",
+        "romeovs",
+        "ericnormand",
+        "galdre",
+        "dpsutton",
+        "escherize",
+        "bgrabow"
       ]
     },
     {
@@ -43,9 +45,6 @@
       "name": "DevEx",
       "label": ".Team/DevEx",
       "members": [
-        "camsaul",
-        "dpsutton",
-        "escherize",
         "fraserdrops",
         "nemanjaglumac"
       ]
@@ -62,7 +61,8 @@
         "tsplude",
         "lbrdnk",
         "piranha",
-        "crisptrutski"
+        "crisptrutski",
+        "undrfined"
       ]
     },
     {
@@ -86,16 +86,12 @@
         "eliotmetabase",
         "npfitz",
         "johnswanson",
-        "iethree",
         "nvoxland",
         "edpaget",
         "deniskaber",
         "alxnddr",
-        "bpander",
         "andsalves",
-        "gantoreno",
-        "kevinkelleher12",
-        "undrfined"
+        "kevinkelleher12"
       ]
     },
     {
@@ -112,6 +108,16 @@
         "uladzimirdev",
         "egorgrushin"
       ]
+    },
+    {
+      "name": "Growth Eng",
+      "label": ".Team/GrowthEng",
+      "members": [
+        "iethree",
+        "bpander",
+        "gantoreno",
+        "losrebellos"
+      ]
     }
   ]
 }

.github/workflows/app-db.yml

@@ -15,14 +15,14 @@ jobs:
   be-tests-mariadb:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: MariaDB 10.2
-            junit-name: be-tests-mariadb-10-2-ee
-            image: circleci/mariadb:10.2.23
+          - name: MariaDB 10.6
+            junit-name: be-tests-mariadb-10-6-ee
+            image: circleci/mariadb:10.6
             env:
               enable-ssl-tests: 'false'
           - name: MariaDB Latest
@@ -100,11 +100,12 @@ jobs:
       MB_MYSQL_SSL_TEST_USER: metabase
       MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
     # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
-    # "be-tests-mariadb-10-2-ee (0)"
+    # "be-tests-mariadb-10-6-ee (0)"
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -123,18 +124,19 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mysql:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: MySQL 8.0
-            junit-name: be-tests-mysql-8-0-ee
-            image: cimg/mysql:8.0
+          - name: MySQL 8.4
+            junit-name: be-tests-mysql-8-4-ee
+            image: cimg/mysql:8.4
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -222,11 +224,12 @@ jobs:
       AWS_ACCESS_KEY_ID: ${{ secrets.AWS_AURORA_IAM_ACCESS_KEY_ID }}
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
     # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
-    # "be-tests-mariadb-10-2-ee (0)"
+    # "be-tests-mariadb-10-6-ee (0)"
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -245,18 +248,19 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-postgres:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: Postgres 12.x
+          - name: Postgres 14.x
             junit-name: postgres-ee
-            docker-image: postgres:12-alpine
+            docker-image: postgres:14-alpine
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -336,6 +340,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -354,6 +359,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   app-db-tests-result:
     needs:

.github/workflows/backend-cloverage.yml

@@ -1,12 +1,34 @@
 name: Backend-Cloverage
 
+# Module lists are generated dynamically by listing source directories.
+# The setup-oss and setup-ee jobs list folders in src/metabase/ and
+# enterprise/backend/src/metabase_enterprise/ respectively, convert
+# underscores to dashes (for Clojure namespace convention), and output
+# as JSON arrays for the matrix jobs to consume.
+#
+# jq flags: -R (raw string input), -s (slurp all lines into one string),
+# -c (compact single-line output for GitHub Actions).
+
 on:
   workflow_dispatch:
-  schedule:
-    - cron: '0 10 * * 1-5' # every weekday at 5am US eastern time
+  # re-enable once we figure out the correctness of the reports in DEV-1104
+  # schedule:
+  #   - cron: '0 10 * * 1-5' # every weekday at 5am US eastern time
 
 jobs:
+  setup-oss:
+    runs-on: ubuntu-22.04
+    outputs:
+      modules: ${{ steps.get-modules.outputs.modules }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: get-modules
+        run: |
+          modules=$(ls -1d src/metabase/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "modules=$modules" >> $GITHUB_OUTPUT
+
   be-linter-cloverage:
+    needs: setup-oss
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
@@ -14,96 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        modules:
-          - actions
-          - activity-feed
-          - analytics
-          - analyze
-          - api
-          - api-keys
-          - api-routes
-          - app-db
-          - appearance
-          - audit-app
-          - auth-provider
-          - batch-processing
-          - bookmarks
-          - bug-reporting
-          - cache
-          - channel
-          - classloader
-          - cloud-migration
-          - cmd
-          - collections
-          - config
-          - connection-pool
-          - content-translation
-          - content-verification
-          - core
-          - dashboards
-          - database-routing
-          - driver
-          - driver-api
-          - eid-translation
-          - embedding
-          - events
-          - formatter
-          - geojson
-          - glossary
-          - graph
-          - indexed-entities
-          - internal-stats
-          - legacy-mbql
-          - lib
-          - lib-be
-          - logger
-          - login-history
-          - model-persistence
-          - models
-          - native-query-snippets
-          - notification
-          - parameters
-          - permissions
-          - pivot
-          - plugins
-          - premium-features
-          - product-feedback
-          - public-sharing
-          - pulse
-          - queries
-          - query-permissions
-          - query-processor
-          - remote-sync
-          - request
-          - revisions
-          - sample-data
-          - search
-          - secrets
-          - segments
-          - server
-          - session
-          - settings
-          - setup
-          - sso
-          - startup
-          - store-api
-          - sync
-          - system
-          - task
-          - task-history
-          - testing-api
-          - tiles
-          - timeline
-          - types
-          - upload
-          - user-key-value
-          - users
-          - util
-          - version
-          - view-log
-          - warehouse-schema
-          - warehouses
-          - xrays
+        modules: ${{ fromJson(needs.setup-oss.outputs.modules) }}
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
@@ -112,7 +45,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Build static viz frontend
-        run: yarn build-static-viz
+        run: bun run build-static-viz
         env:
           MB_EDITION: ee
       - name: Collect the test coverage
@@ -130,7 +63,19 @@ jobs:
           files: ./target/coverage/codecov.json
           flags: back-end
 
+  setup-ee:
+    runs-on: ubuntu-22.04
+    outputs:
+      modules: ${{ steps.get-modules.outputs.modules }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: get-modules
+        run: |
+          modules=$(ls -1d enterprise/backend/src/metabase_enterprise/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "modules=$modules" >> $GITHUB_OUTPUT
+
   be-linter-cloverage-enterprise:
+    needs: setup-ee
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
@@ -138,53 +83,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        modules:
-          - action-v2
-          - advanced-config
-          - advanced-permissions
-          - ai-entity-analysis
-          - ai-sql-fixer
-          - ai-sql-generation
-          - analytics
-          - api
-          - audit-app
-          - auth-provider
-          - billing
-          - bookmarks
-          - cache
-          - cloud-add-ons
-          - comments
-          - content-translation
-          - content-verification
-          - core
-          - dashboard-subscription-filters
-          - database-replication
-          - database-routing
-          - dependencies
-          - documents
-          - email
-          - embedding-hub
-          - gsheets
-          - harbormaster
-          - impersonation
-          - internal-stats
-          - llm
-          - metabot-v3
-          - permission-debug
-          - premium-features
-          - public-sharing
-          - remote-sync
-          - sandbox
-          - scim
-          - search
-          - semantic-search
-          - serialization
-          - snippet-collections
-          - sso
-          - stale
-          - transforms
-          - transforms-python
-          - upload-management
+        modules: ${{ fromJson(needs.setup-ee.outputs.modules) }}
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
@@ -193,7 +92,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Build static viz frontend
-        run: yarn build-static-viz
+        run: bun run build-static-viz
         env:
           MB_EDITION: ee
       - name: Collect the test coverage

.github/workflows/backend.yml

@@ -36,10 +36,22 @@ jobs:
       - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
         name: Run Eastwood linter
 
+  be-linter-eastwood-test:
+    if: ${{ !inputs.skip }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    name: Eastwood (test)
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood/test
+        name: Run Eastwood linter on tests
+
   be-tests:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -104,7 +116,7 @@ jobs:
         with:
           java-version: "${{ matrix.java-version }}"
       - name: Build static-viz frontend
-        run: yarn build-static-viz
+        run: bun run build-static-viz
         env:
           MB_EDITION: ${{ matrix.job.edition }}
 
@@ -130,6 +142,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-java-tests.outcome }}
 
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@v1
@@ -183,6 +196,7 @@ jobs:
   be-tests-result:
     needs:
       - be-linter-eastwood
+      - be-linter-eastwood-test
       - be-linter-clj-kondo
       - be-cljfmt
       - be-check

.github/workflows/build-for-release.yml

@@ -19,9 +19,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Send build start message
         uses: actions/github-script@v7
         env:
@@ -79,9 +81,11 @@ jobs:
         exit 1
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Version
       uses: actions/github-script@v7
       id: canonical_version
@@ -121,9 +125,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         fetch-depth: 0  # IMPORTANT! to get all the branches
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Branch
       uses: actions/github-script@v7
       id: release_branch
@@ -135,12 +141,13 @@ jobs:
           const releaseBranch = getReleaseBranch(version);
           return releaseBranch;
     - name: Ensure that the specified commit exists in the ${{ steps.release_branch.outputs.result }} release branch
-      run: |
+      run: | # bash
         RELEASE_BRANCH=${{ steps.release_branch.outputs.result }}
         git checkout $RELEASE_BRANCH
         git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
           && echo "Commit found in correct release branch" \
           || (echo "Commit not found in correct release branch" && exit 1)
+        git checkout -
 
   get-build-requirements:
     runs-on: ubuntu-22.04
@@ -152,9 +159,11 @@ jobs:
     steps:
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get build dependencies
       uses: actions/github-script@v7
       id: dependencies

.github/workflows/cache-generator.yml

@@ -82,7 +82,7 @@ jobs:
 
       # Frontend preparation and caches
       # `prepare-frontend` action (1) prepares Node.js and (2) fetches the node_modules cache if it exists.
-      # It then (3) runs `yarn install --frozen-lockfile --prefer-offline` which ensures the local cache is fully populated.
+      # It then (3) runs `bun install --frozen-lockfile` which ensures the local cache is fully populated.
       # IMPORTANT: Caching node_modules after patches are already applied will break any PR that attempts to either:
       #   - upgrade a patched library
       #   - change a patch
@@ -92,31 +92,31 @@ jobs:
         with:
           apply-patches: "false"
 
-      - name: Get yarn cache directory
-        id: yarn-cache-dir
+      - name: Get bun cache directory
+        id: bun-cache
         run: |
-          YARN_CACHE_DIR=$(yarn cache dir)
-          echo "Yarn cache directory: $YARN_CACHE_DIR"
-          echo "dir=$YARN_CACHE_DIR" >> $GITHUB_OUTPUT
+          BUN_CACHE_DIR=$(bun pm cache)
+          echo "Bun cache directory: $BUN_CACHE_DIR"
+          echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
 
       - name: Ensure that Cypress executable is ready
         run: |
-          yarn cypress install
-          yarn cypress cache path
-          yarn cypress cache list
-          yarn cypress verify
+          bun run cypress install
+          bun run cypress cache path
+          bun run cypress cache list
+          bun run cypress verify
         shell: bash
 
       # Run Prettier to populate its cache (stored in node_modules/.cache/prettier)
       # so it gets saved as part of the node_modules cache below
       - name: Run Prettier to populate cache
-        run: yarn lint-prettier-pure
+        run: bun run lint-prettier-pure
 
       - name: Update node_modules cache
         uses: ./.github/actions/update-cache
         with:
           path: |
-            ${{ steps.yarn-cache-dir.outputs.dir }}
+            ${{ steps.bun-cache.outputs.dir }}
             node_modules
           key: ${{ env.NODE_CACHE_KEY }}
 
@@ -128,10 +128,10 @@ jobs:
 
       # ESLint cache (requires both backend and frontend)
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
 
       - name: Run ESLint to populate cache
-        run: yarn lint-eslint-pure
+        run: bun run lint-eslint-pure
 
       - name: Update eslint cache
         uses: ./.github/actions/update-cache

.github/workflows/check-milestone.yml

@@ -26,11 +26,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
+          sparse-checkout: |
+            release
+            .github
           fetch-depth: ${{ env.isNewReleaseBranch == 'false' && 3 || 0 }} # we need the full history to get all the commit messages
           ref: master # we want the logic from master, even though we're triggering on a release branch
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - uses: actions/github-script@v7
         if: ${{ env.isNewReleaseBranch == 'false' }}
         name: Set milestone for single commit

.github/workflows/chromatic.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Compile CLJS
-        run: NODE_ENV=development yarn build-pure:cljs
+        run: NODE_ENV=development bun run build-pure:cljs
       - name: Publish to Chromatic
         uses: chromaui/action@v10.2.0
         env:

.github/workflows/claude-code-bug-fix.yml

@@ -230,6 +230,12 @@ jobs:
           mkdir -p .claude-scratchpad
           echo "Scratchpad directory created for Claude's temporary verification files"
 
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+
       - name: Generate GitHub App Token for Claude
         uses: actions/create-github-app-token@v1
         id: claude-app-token
@@ -244,7 +250,7 @@ jobs:
           github_token: ${{ steps.claude-app-token.outputs.token }}
           prompt: ${{ env.BUG_FIX_PROMPT }}
           claude_args: |
-            --allowedTools "Bash(yarn test-unit*),Bash(yarn lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
+            --allowedTools "Bash(bun run test-unit*),Bash(bun run lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
             --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"
 
       - name: Clean up scratchpad directory

.github/workflows/claude-code-review.yaml

@@ -1,98 +0,0 @@
-name: "Claude Code Review"
-
-on:
-  pull_request:
-    types:
-      - closed
-      - synchronize
-      - labeled
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-code-review
-  cancel-in-progress: true
-
-jobs:
-  review:
-    if: |
-      (
-        github.event.action == 'closed' &&
-        github.event.pull_request.merged == true
-      ) ||
-      contains(github.event.pull_request.labels.*.name, 'Claude Code Review')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
-          persist-credentials: false
-
-      # Apparently comments on specific lines and top-level comments about the PR as a whole are TWO TOTALLY DIFFERENT
-      # TYPES OF THINGS. So we have to fetch and delete separately.
-      - name: Delete old Claude PR review comments
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        shell: bash
-        run: |
-          # Get old comment IDs from the bot
-          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          echo "Deleting line comments: $old_line_comment_ids"
-          # Delete each comment
-          for id in $old_line_comment_ids; do
-            gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
-            echo "Deleted line comment $id"
-          done
-          # Get old top-level comment IDs (technically "issue" comments on the PR?)
-          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          echo "Deleting top-level comments: $old_top_level_comment_ids"
-          # Delete each comment
-          for id in $old_top_level_comment_ids; do
-            gh api -X DELETE "/repos/$REPO/issues/comments/$id"
-            echo "Deleted top-level comment $id"
-          done
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-          permission-contents: read       # Required for reading repository files and PR diffs
-          permission-pull-requests: write # Required for creating inline comments and PR comments
-
-      - name: Fetch Community Clojure Style Guide
-        run: >-
-          curl https://raw.githubusercontent.com/bbatsov/clojure-style-guide/refs/heads/master/README.adoc -o CLOJURE_STYLE_GUIDE.adoc
-
-      - uses: anthropics/claude-code-action@v1
-        timeout-minutes: 10
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Review this pull request for compliance with project coding standards and conventions.
-
-            **Use the appropriate review skill based on the file types changed:**
-            - Use clojure-review for Clojure/ClojureScript files
-            - Use typescript-review for TypeScript/JavaScript files
-            - Follow the review guidelines and checklists in each skill
-
-            DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
-
-            Note: The PR branch is already checked out in the current working directory.
-
-            Use `gh pr comment` for top-level feedback.
-            Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
-            Only post GitHub comments - don't submit review text as messages.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),ReadFile(CLOJURE_STYLE_GUIDE.adoc)"

.github/workflows/claude-docs-review.yml

@@ -1,103 +0,0 @@
-name: "Claude Docs Review"
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-    paths:
-      - 'docs/**/*.md'
-      - 'docs/**/*.mdx'
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: 'PR number to review'
-        required: true
-        type: number
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-docs-review
-  cancel-in-progress: true
-
-jobs:
-  review:
-    runs-on: ubuntu-latest
-    if: github.event.pull_request.draft == false
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
-          persist-credentials: false
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-          permission-contents: read       # Required for reading repository files and PR diffs
-          permission-pull-requests: write # Required for creating inline comments and PR comments
-
-      - name: Delete old Claude docs review comments
-        env:
-          GH_TOKEN: ${{ steps.claude-app-token.outputs.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
-        shell: bash
-        run: |
-          # Delete pending reviews first (these can be deleted entirely)
-          pending_review_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/reviews" --jq '.[] | select(.user.login=="metabase-bot[bot]" and .state=="PENDING") | .id')
-          if [ -n "$pending_review_ids" ]; then
-            echo "Deleting pending reviews: $pending_review_ids"
-            for id in $pending_review_ids; do
-              gh api -X DELETE "/repos/$REPO/pulls/$PR_NUMBER/reviews/$id"
-              echo "Deleted pending review $id"
-            done
-          fi
-
-          # Delete individual inline comments from submitted reviews (can't delete the review itself)
-          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          if [ -n "$old_line_comment_ids" ]; then
-            echo "Deleting line comments: $old_line_comment_ids"
-            for id in $old_line_comment_ids; do
-              gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
-              echo "Deleted line comment $id"
-            done
-          fi
-
-          # Delete top-level review comments
-          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          if [ -n "$old_top_level_comment_ids" ]; then
-            echo "Deleting top-level comments: $old_top_level_comment_ids"
-            for id in $old_top_level_comment_ids; do
-              gh api -X DELETE "/repos/$REPO/issues/comments/$id"
-              echo "Deleted top-level comment $id"
-            done
-          fi
-
-      - uses: anthropics/claude-code-action@v1
-        timeout-minutes: 10
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          show_full_output: true
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
-
-            Review the documentation changes in this pull request.
-
-            Use the docs-review skill to review all changed documentation files for compliance with the Metabase writing style guide.
-
-            IMPORTANT: Only review markdown files (.md and .mdx). Skip any .txt files or other non-markdown files.
-
-            DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
-
-          claude_args: |
-            --allowedTools "Skill,mcp__github__get_pull_request,mcp__github__get_pull_request_files,mcp__github__create_pending_pull_request_review,mcp__github__get_pull_request_diff,mcp__github__add_comment_to_pending_review,mcp__github__add_pull_request_review_comment_to_pending_review,mcp__github__delete_pending_pull_request_review,mcp__github__submit_pending_pull_request_review"

.github/workflows/cljs.yml

@@ -39,4 +39,4 @@ jobs:
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
     - name: Run Cljs tests
-      run: yarn run test-cljs
+      run: bun run test-cljs

.github/workflows/codespell.yml

@@ -43,27 +43,35 @@ jobs:
           app-id: ${{ secrets.METABASE_BOT_APP_ID }}
           private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
 
+      - name: Build Claude prompt
+        if: steps.codespell_check.outcome == 'failure'
+        run: |
+          cat > /tmp/claude_prompt.txt << 'PROMPT_HEADER'
+          You are tasked with fixing spelling errors detected by codespell in this repository.
+
+          ## Codespell Output
+          The following spelling errors were detected:
+          ```
+          PROMPT_HEADER
+          cat codespell_output.txt >> /tmp/claude_prompt.txt
+          cat >> /tmp/claude_prompt.txt << 'PROMPT_FOOTER'
+          ```
+
+          ## Instructions
+          1. **Review the codespell output and identify reported spelling errors** - The usual format codespell uses is `typo ==> correction`
+          2. **Fix every spelling error** - Use the Edit tool to fix each misspelling with the suggested correction
+             - If codespell suggests multiple corrections, choose the most appropriate one based on context
+
+          Human reviewers will verify the changes before merging, so fix all errors reported by codespell.
+          PROMPT_FOOTER
+
       - name: Fix spelling errors with Claude Code
         if: steps.codespell_check.outcome == 'failure'
         uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ steps.claude-app-token.outputs.token }}
-          prompt: |
-            You are tasked with fixing spelling errors detected by codespell in this repository.
-
-            ## Codespell Output
-            The following spelling errors were detected:
-            ```
-            $(cat codespell_output.txt)
-            ```
-
-            ## Instructions
-            1. **Review the codespell output and identify reported spelling errors** - The usual format codespell uses is `typo ==> correction`
-            2. **Fix every spelling error** - Use the Edit tool to fix each misspelling with the suggested correction
-               - If codespell suggests multiple corrections, choose the most appropriate one based on context
-
-            Human reviewers will verify the changes before merging, so fix all errors reported by codespell.
+          prompt_file: /tmp/claude_prompt.txt
           claude_args: |
             --allowedTools "Write,Read,Glob,Grep,Edit,MultiEdit,Bash(cat*),Bash(ls*)"
             --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"

.github/workflows/containerize-jar.yml

@@ -4,8 +4,10 @@ run-name: Containerize ${{ inputs.tag }} Uberjar
 on:
   workflow_call:
     inputs:
-      artifact-name:
+      edition:
+        description: Metabase edition (ee or oss)
         type: string
+        required: true
       repo:
         description: owner and repo like "metabase/metabase"
         type: string
@@ -15,14 +17,18 @@ on:
         type: string
       release:
         type: string
-        default: 'true'
+        default: 'false'
       build-args:
         type: string
   workflow_dispatch:
     inputs:
-      artifact-name:
-        description: usually something like "metabase-release-{{ edition }}-{{ hash }}-uberjar"
-        type: string
+      edition:
+        description: Metabase edition (ee or oss)
+        type: choice
+        options:
+          - ee
+          - oss
+        required: true
       repo:
         description: docker owner and repo like "metabase/metabase"
         type: string
@@ -32,6 +38,13 @@ on:
       commit:
         description: the full commit hash
         type: string
+      release:
+        description: Whether this is a release artifact (uses metabase-release- prefix)
+        type: choice
+        options:
+          - "false"
+          - "true"
+        default: "false"
 
 jobs:
   containerize:
@@ -45,12 +58,14 @@ jobs:
         fetch-depth: 0
       # we want the dockerfile from the commit we're building
     - run: git checkout ${{ inputs.commit }} -- bin/docker
-    - name: Retrieve test build uberjar artifact
+    - name: Retrieve uberjar artifact
       uses: ./.github/actions/fetch-artifact
       with:
-        name: ${{ inputs.artifact-name }}
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        commit: ${{ inputs.commit }}
+        edition: ${{ inputs.edition }}
+        release: ${{ inputs.release }}
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get platforms
       id: platforms
       uses: actions/github-script@v7

.github/workflows/containerize-uberjar.yml

@@ -55,13 +55,13 @@ jobs:
     uses: ./.github/workflows/containerize-jar.yml
     secrets: inherit
     with:
-      artifact-name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
-      commit: ${{ github.event.inputs.commit || github.sha }}
+      edition: ${{ matrix.edition }}
+      commit: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
       tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
       release: "false"
       build-args: |
-        GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.sha }}
+        GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
 
   run-trivy:
     needs: [get-container-info, containerize]
@@ -74,7 +74,7 @@ jobs:
       - name: Check out the code
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.inputs.commit || github.sha }}
+          ref: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@0.29.0
         env:

.github/workflows/coverage.yml

@@ -17,7 +17,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
       - name: Run frontend unit tests
         run: |
-          yarn run test-unit \
+          bun run test-unit \
             --silent \
             --coverage \
             --testTimeout=60000

.github/workflows/cross-branch-migrations.yml

@@ -38,7 +38,7 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
-  migrations-postgres-12-ee:
+  migrations-postgres-14-ee:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     env:
@@ -50,7 +50,7 @@ jobs:
       MB_DB_USER: circle_test
     services:
       postgres:
-        image: postgres:12-alpine
+        image: postgres:14-alpine
         ports:
           - "5432:5432"
         env:
@@ -90,7 +90,7 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
-  migrations-mysql-8-0-ee:
+  migrations-mysql-8-4-ee:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     env:
@@ -102,7 +102,7 @@ jobs:
       MB_DB_USER: root
     services:
       mysql:
-        image: cimg/mysql:8.0
+        image: cimg/mysql:8.4
         ports:
           - "3306:3306"
     steps:
@@ -138,7 +138,7 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
-  migrations-mariadb-10-2-ee:
+  migrations-mariadb-10-6-ee:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     env:
@@ -150,7 +150,7 @@ jobs:
       MB_DB_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:10.2.23
+        image: circleci/mariadb:10.6
         ports:
           - "3306:3306"
     steps:

.github/workflows/cross-version.yml

@@ -0,0 +1,102 @@
+name: Cross-Version Migration Tests
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_version:
+        description: "Source version (e.g., v1.58.6 or HEAD)"
+        required: true
+        type: string
+      target_version:
+        description: "Target version (e.g., v1.58.7 or HEAD)"
+        required: true
+        type: string
+
+  pull_request:
+    paths:
+      - "cross-version/**"
+      - ".github/workflows/cross-version.yml"
+      - ".github/scripts/build-cross-version-matrix.js"
+
+  schedule:
+    # Run nightly at 3 AM UTC
+    - cron: "0 3 * * *"
+
+jobs:
+  # Generate matrix for scheduled/PR runs
+  generate-matrix:
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+
+      - name: Generate version matrix
+        id: set-matrix
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { buildCrossVersionMatrix } = require('${{ github.workspace }}/.github/scripts/build-cross-version-matrix');
+            const { config } = buildCrossVersionMatrix(${{ vars.CURRENT_VERSION }});
+            const matrix = JSON.stringify({ include: config });
+            core.setOutput("matrix", matrix);
+            console.log("matrix:", matrix);
+
+  # Matrix-based tests for scheduled/PR runs
+  test-matrix:
+    if: github.event_name != 'workflow_dispatch'
+    needs: generate-matrix
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
+      fail-fast: false
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Run cross-version test
+        env:
+          CURRENT_VERSION: ${{ vars.CURRENT_VERSION }}
+        run: |
+          cd cross-version
+          ./test.sh --source "${{ matrix.source }}" --target "${{ matrix.target }}"
+
+      - name: Show logs on failure
+        if: failure()
+        run: |
+          cd cross-version
+          docker compose logs metabase || true
+          docker compose logs postgres || true
+
+  # Manual test for workflow_dispatch
+  test-manual:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Run cross-version test
+        env:
+          CURRENT_VERSION: ${{ vars.CURRENT_VERSION }}
+        run: |
+          cd cross-version
+          ./test.sh --source "${{ inputs.source_version }}" --target "${{ inputs.target_version }}"
+
+      - name: Show logs on failure
+        if: failure()
+        run: |
+          cd cross-version
+          docker compose logs metabase || true
+          docker compose logs postgres || true

.github/workflows/disabled-drivers-slack-notification.yml

@@ -0,0 +1,79 @@
+name: Disabled Drivers Slack Notification
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 9 * * 1" # every Monday at 9:00 UTC
+
+jobs:
+  notify-disabled-drivers:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/Jod
+
+      - name: Install Slack SDK
+        run: npm install @slack/web-api
+
+      - name: Check disabled drivers and notify Slack
+        uses: actions/github-script@v7
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: |
+            const { WebClient } = require('@slack/web-api');
+
+            // Fetch the config
+            const response = await fetch('https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json');
+            const config = await response.json();
+
+            const drivers = config.ignored?.drivers || [];
+            const lastUpdated = config.metadata?.last_updated || 'unknown';
+            const reason = config.metadata?.reason || 'No reason provided';
+
+            if (drivers.length === 0) {
+              console.log('No drivers are currently disabled. Skipping Slack notification.');
+              return;
+            }
+
+            if (!process.env.SLACK_BOT_TOKEN) {
+              throw new Error('SLACK_BOT_TOKEN is required');
+            }
+
+            const slack = new WebClient(process.env.SLACK_BOT_TOKEN);
+
+            await slack.chat.postMessage({
+              channel: 'engineering-ci',
+              text: 'CI Disabled Drivers Report',
+              blocks: [
+                {
+                  type: 'section',
+                  text: {
+                    type: 'mrkdwn',
+                    text: `:no_entry: *CI Disabled Drivers*\n${drivers.map(d => `\`${d}\``).join('  ')}`
+                  },
+                  accessory: {
+                    type: 'button',
+                    text: {
+                      type: 'plain_text',
+                      text: 'View Config',
+                      emoji: true
+                    },
+                    url: 'https://github.com/metabase/ci-test-config/blob/master/ci-test-config.json'
+                  }
+                },
+                {
+                  type: 'context',
+                  elements: [
+                    {
+                      type: 'mrkdwn',
+                      text: `${reason} · :clock1: *${lastUpdated}*`
+                    }
+                  ]
+                }
+              ]
+            });
+
+            console.log('Slack notification sent successfully');

.github/workflows/docs-release-generate.yml

@@ -8,7 +8,7 @@ on:
       target_branch:
         description: "Target branch for documentation update"
         required: false
-        default: "release-x.58.x"
+        default: "release-x.59.x"
         type: string
 
 jobs:
@@ -16,6 +16,6 @@ jobs:
     name: Call documentation update for release branch
     uses: ./.github/workflows/docs-generate-base.yml
     with:
-      target_branch: ${{ inputs.target_branch || 'release-x.58.x' }}
+      target_branch: ${{ inputs.target_branch || 'release-x.59.x' }}
     secrets:
       automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers-stress-test.yml

@@ -109,7 +109,7 @@ jobs:
         junit-name: 'be-tests-druid-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
-  be-tests-mariadb-10-2-ee:
+  be-tests-mariadb-10-6-ee:
     if: inputs.driver == 'Maria DB'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
@@ -124,15 +124,15 @@ jobs:
       MB_MYSQL_TEST_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:10.2.23
+        image: circleci/mariadb:10.6
         ports:
           - "3306:3306"
     steps:
     - uses: actions/checkout@v4
-    - name: Test MariaDB driver (10.2)
+    - name: Test MariaDB driver (10.6)
       uses: ./.github/actions/test-driver
       with:
-        junit-name: 'be-tests-mariadb-10-2-ee'
+        junit-name: 'be-tests-mariadb-10-6-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mariadb-latest-ee:
@@ -298,7 +298,7 @@ jobs:
         junit-name: 'be-tests-mongo-latest-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
-  be-tests-mysql-8-0-ee:
+  be-tests-mysql-8-4-ee:
     if: inputs.driver == 'MySQL'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
@@ -313,15 +313,15 @@ jobs:
       MB_MYSQL_TEST_USER: root
     services:
       mysql:
-        image: cimg/mysql:8.0
+        image: cimg/mysql:8.4
         ports:
           - "3306:3306"
     steps:
     - uses: actions/checkout@v4
-    - name: Test MySQL driver (8.0)
+    - name: Test MySQL driver (8.4)
       uses: ./.github/actions/test-driver
       with:
-        junit-name: 'be-tests-mysql-8-0-ee'
+        junit-name: 'be-tests-mysql-8-4-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mysql-latest-ee:
@@ -438,7 +438,7 @@ jobs:
       MB_POSTGRESQL_TEST_USER: mb_test
     services:
       postgres:
-        image: postgres:12-alpine
+        image: postgres:14-alpine
         ports:
           - "5432:5432"
         env:
@@ -447,7 +447,7 @@ jobs:
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
     - uses: actions/checkout@v4
-    - name: Test Postgres driver (12)
+    - name: Test Postgres driver (14)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-postgres-ee'

.github/workflows/drivers.yml

@@ -72,11 +72,14 @@ jobs:
           # All decision logic is in mage - it analyzes module dependencies,
           # branch context, labels, and file changes to decide what runs.
           MAGE_ARGS=(
-            --git-ref="${{ github.event.pull_request.base.ref || 'master' }}"
+            --git-ref="${{ github.event.pull_request.base.ref || github.ref_name }}"
             --is-master-or-release="${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}"
             --pr-labels="${{ join(github.event.pull_request.labels.*.name, ',') }}"
             --skip="${{ inputs.skip }}"
           )
+          echo "Running:"
+          echo "./bin/mage -driver-decisions ${MAGE_ARGS[@]}"
+          echo ""
           # First call: show human-readable output for debugging
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}"
           # Second call: output only key=value lines for GITHUB_OUTPUT
@@ -87,7 +90,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.athena-should-run == 'true' || needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: athena
@@ -132,6 +135,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
@@ -147,11 +151,10 @@ jobs:
               :only-tags [:mb/driver-tests]
               :exclude-tags [:mb/transforms-python-test]
               :fail-fast? true
-# DS 2025-09-26 temporarily disabled while we diagnose flakes
-#          - name: Transforms Python Tests
-#            test-args: >-
-#              :only-tags [:mb/transforms-python-test]
-#            needs-python-runner: true
+          - name: Transforms Python Tests
+            test-args: >-
+              :only-tags [:mb/transforms-python-test]
+            needs-python-runner: true
     env:
       CI: 'true'
       DRIVERS: bigquery-cloud-sdk
@@ -198,6 +201,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -209,7 +213,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.clickhouse-should-run == 'true' || needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -280,6 +284,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -291,7 +296,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.druid-should-run == 'true' || needs.determine-driver-skips.outputs.druid-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: druid
@@ -334,12 +339,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: druid-jdbc
@@ -382,12 +388,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -430,12 +437,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -479,12 +487,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-h2:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
     name: H2
@@ -509,19 +518,52 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+
+  be-tests-h2-oss:
+    needs: determine-driver-skips
+    if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    env:
+      CI: 'true'
+    name: H2 (OSS)
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test H2 driver (OSS)
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-h2-oss'
+        edition: 'oss'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+          :exclude-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-should-run == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: MariaDB 10.2
-            junit-name: be-tests-mariadb-10-2-ee
-            image: circleci/mariadb:10.2.23
+          - name: MariaDB 10.6
+            junit-name: be-tests-mariadb-10-6-ee
+            image: circleci/mariadb:10.6
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -531,9 +573,9 @@ jobs:
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
-          - name: MySQL 8.0
-            junit-name: be-tests-mysql-8-0-ee
-            image: mysql:8.0
+          - name: MySQL 8.4
+            junit-name: be-tests-mysql-8-4-ee
+            image: mysql:8.4
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -639,6 +681,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -650,7 +693,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -719,6 +762,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -730,7 +774,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -801,12 +845,13 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: mongo
@@ -846,12 +891,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-oracle:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.oracle-should-run == 'true' || needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -931,19 +977,20 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-postgres:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.postgres-should-run == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: Postgres 12.x
+          - name: Postgres 14.x
             junit-name: postgres-ee
-            docker-image: postgres:12-alpine
+            docker-image: postgres:14-alpine
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -1020,6 +1067,7 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: 'be-tests-${{ matrix.version.junit-name }}'
+          logs-artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
@@ -1034,6 +1082,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -1045,7 +1094,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: presto-jdbc
@@ -1121,12 +1170,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' || needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -1205,6 +1255,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1226,12 +1277,10 @@ jobs:
               :only-tags [:mb/driver-tests]
               :exclude-tags [:mb/transforms-python-test]
               :fail-fast? true
-
-# DS 2025-09-26 temporarily disabled while we diagnose flakes
-#          - name: Transforms Python Tests
-#            test-args: >-
-#              :only-tags [:mb/transforms-python-test]
-#            needs-python-runner: true
+          - name: Transforms Python Tests
+            test-args: >-
+              :only-tags [:mb/transforms-python-test]
+            needs-python-runner: true
     env:
       CI: 'true'
       DRIVERS: snowflake
@@ -1287,6 +1336,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1298,7 +1348,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.sparksql-should-run == 'true' || needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: sparksql
@@ -1339,12 +1389,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.sqlite-should-run == 'true' || needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: sqlite
@@ -1380,6 +1431,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-sqlserver:
     needs: determine-driver-skips
@@ -1456,6 +1508,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1468,7 +1521,7 @@ jobs:
   #   needs: determine-driver-skips
   #   if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
   #   runs-on: ubuntu-latest
-  #   timeout-minutes: 60
+  #   timeout-minutes: 40
   #   env:
   #     CI: 'true'
   #     DRIVERS: starburst
@@ -1536,7 +1589,7 @@ jobs:
     needs: [determine-driver-skips, login-to-ecr]
     if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: vertica
@@ -1582,6 +1635,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   drivers-tests-result:
     needs:

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -115,14 +115,14 @@ jobs:
 
       - name: Build Embedding SDK package
         if: ${{ needs.determine-test-type.outputs.type == 'component' }}
-        run: yarn build-embedding-sdk-package
+        run: bun run build-embedding-sdk-package
 
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
 
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
 
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start

.github/workflows/e2e-test.yml

@@ -41,12 +41,13 @@ env:
 jobs:
   e2e-tests:
     runs-on: ${{ inputs.runner }}
-    timeout-minutes: 45
+    timeout-minutes: 40
     name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
     env:
       MB_EDITION: ${{ inputs.edition }}
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
+      # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
+      # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
@@ -79,7 +80,8 @@ jobs:
       - name: Retrieve uberjar artifact for ${{ inputs.edition }}
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ${{ inputs.edition }}
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 
@@ -105,7 +107,7 @@ jobs:
         run: echo "specs=$(cat failed-specs)" >> $GITHUB_ENV
 
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
 
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
@@ -170,6 +172,7 @@ jobs:
           # Related to Trunk uploader
           variant: e2e-tests
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ inputs.specs && steps.tagged-e2e.outcome || steps.split-e2e.outcome }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/embedding-sdk-component-tests.yml

@@ -19,8 +19,9 @@ jobs:
         react-version: [18, 19]
       fail-fast: false
     env:
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
+      # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
+      # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
@@ -45,7 +46,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 
@@ -80,6 +82,7 @@ jobs:
         run: ./bin/embedding-sdk/change-react-version.bash ${{ matrix.react-version }}
 
       - name: Run component tests for Embedding SDK
+        id: run-tests
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: node e2e/runner/run_cypress_ci.js component
@@ -95,6 +98,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
       - name: "SDK component tests > Upload Cypress Artifacts upon failure"
         uses: actions/upload-artifact@v4
@@ -152,8 +156,9 @@ jobs:
     env:
       MB_RUN_MODE: "e2e"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
+      # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
+      # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
@@ -194,7 +199,8 @@ jobs:
         id: download-uberjar
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ steps.get-commit-sha.outputs.sha }}-uberjar
+          commit: ${{ steps.get-commit-sha.outputs.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
         continue-on-error: true # do not break the whole job if this step doesn't succeed
@@ -228,6 +234,7 @@ jobs:
             --spec "e2e/snapshot-creators/default.cy.snap.js"
 
       - name: Run component tests for Embedding SDK
+        id: run-tests
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
@@ -245,6 +252,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -9,7 +9,6 @@ env:
   TZ: US/Pacific # to make Node match the instance tz
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-  PR_NUMBER: ${{ github.event.pull_request.number || '' }}
   MB_EDITION: ee
 jobs:
   get-sample-apps-data:
@@ -21,12 +20,7 @@ jobs:
       TEST_SUITES: |
         [
           "metabase-nodejs-react-sdk-embedding-sample-e2e",
-          "metabase-nextjs-sdk-embedding-sample-e2e",
-          "shoppy-e2e"
-        ]
-      TEST_SUITES_TO_RUN_IN_MASTER_ONLY: |
-        [
-          "shoppy-e2e"
+          "metabase-nextjs-sdk-embedding-sample-e2e"
         ]
       SAMPLE_APP_MAIN_BRANCH_NAME: "main"
       SAMPLE_APP_STABLE_RELEASE_BRANCH_NAME_SUFFIX: "stable"
@@ -36,8 +30,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
 
       - name: Build sample app compatibility data
         uses: actions/github-script@v7
@@ -50,7 +44,6 @@ jobs:
             } = require('${{ github.workspace }}/release/dist/index.cjs');
 
             const testSuites = JSON.parse(process.env.TEST_SUITES);
-            const testSuitesToRunInMasterOnly = JSON.parse(process.env.TEST_SUITES_TO_RUN_IN_MASTER_ONLY);
 
             const ref = '${{ github.base_ref || github.ref }}';
             const branchName = ref.replace(/^refs\/heads\//, '');
@@ -74,19 +67,16 @@ jobs:
               const sampleAppBranchName = `${currentBranchVersion}-${{ env.SAMPLE_APP_STABLE_RELEASE_BRANCH_NAME_SUFFIX }}`
 
               const shouldRunTestsForVersion = (currentReleaseVersion - currentBranchVersion) <= (supportedReleasesCount - 1);
-              const releaseBranchTestSuites = testSuites.filter(testSuite => !testSuitesToRunInMasterOnly.includes(testSuite));
 
               return {
                 branch_name: sampleAppBranchName,
-                matrix: shouldRunTestsForVersion
-                  ? releaseBranchTestSuites
-                  : []
+                matrix: shouldRunTestsForVersion ? testSuites : [],
               };
             }
 
             return {
               branch_name: '',
-              matrix: []
+              matrix: [],
             };
 
   # In order to check compatibility between Sample Apps and Embedding SDK, the job for each sample app:
@@ -98,6 +88,7 @@ jobs:
   e2e-sample-apps-tests:
     needs: [get-sample-apps-data]
     strategy:
+      fail-fast: false
       matrix:
         test_suite: ${{ fromJSON(needs.get-sample-apps-data.outputs.matrix) }}
         environment: ["production", "development"]
@@ -137,7 +128,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 
@@ -167,28 +159,8 @@ jobs:
             echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
           fi
 
-      - name: Configure AWS credentials
-        if: ${{ matrix.test_suite == 'shoppy-e2e' }}
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.SHOPPY_IAM_ROLE }}
-          role-session-name: GitHub_to_AWS_via_FederatedOIDC
-          aws-region: us-east-1
-
-      - name: Download Shoppy's App DB PostgreSQL dump from S3
-        if: ${{ matrix.test_suite == 'shoppy-e2e' }}
-        run: |
-          aws s3 cp s3://${{ secrets.SHOPPY_METABASE_APP_DB_S3_BUCKET }}/${{ secrets.SHOPPY_METABASE_APP_DB_S3_KEY }} ./e2e/tmp/db_dumps/shoppy_metabase_app_db_dump.sql
-
-      - name: Prepare and launch Sample Apps for shoppy-e2e test suite
-        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite == 'shoppy-e2e' }}
-        env:
-          METABASE_APP_DB_USER: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
-          METABASE_APP_DB: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
-        run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts shoppy-e2e
-
-      - name: Prepare and launch Sample Apps for other test suites
-        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite != 'shoppy-e2e' }}
+      - name: Prepare and launch Sample Apps
+        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
         run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts ${{ matrix.test_suite }}
 
       - name: Prune build cache
@@ -209,7 +181,7 @@ jobs:
         uses: actions/upload-artifact@v4
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
         with:
-          name: cypress-recording-sample-app-${{ matrix.test_suite }}-latest
+          name: cypress-recording-sample-app-${{ matrix.test_suite }}-${{ matrix.environment }}-latest
           path: |
             ./e2e/tmp/${{ steps.get-sample-app-name.outputs.sample_app_name }}/cypress
           if-no-files-found: ignore
@@ -219,6 +191,150 @@ jobs:
         run: |
           exit 1
 
+  # Shoppy e2e tests run separately using the shared composite action for setup.
+  e2e-shoppy-tests:
+    needs: [get-sample-apps-data]
+    strategy:
+      fail-fast: false
+      matrix:
+        environment: ["production", "development"]
+    if: |
+      !cancelled() && needs.get-sample-apps-data.result == 'success' &&
+      (github.ref == 'refs/heads/master' || github.base_ref == 'master')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-sample-app-shoppy-e2e-tests-${{ matrix.environment }}-bundle
+    env:
+      MB_EDITION: ee
+      MB_RUN_MODE: e2e
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+      SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Shoppy E2E environment
+        uses: ./.github/actions/prepare-shoppy-e2e
+        id: shoppy-prep
+        with:
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          sample-app-branch-name: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+          sample-app-environment: ${{ matrix.environment }}
+          staging-mb-all-features-token: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+          shoppy-iam-role: ${{ secrets.SHOPPY_IAM_ROLE }}
+          shoppy-metabase-app-db-s3-bucket: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_BUCKET }}
+          shoppy-metabase-app-db-s3-key: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_KEY }}
+          shoppy-metabase-app-db-user: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
+          shoppy-metabase-app-db-database: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
+          metastore-dev-server-url: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+          shoppy-datadog-application-id: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_APPLICATION_ID }}
+          shoppy-datadog-client-token: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_CLIENT_TOKEN }}
+
+      - name: Run e2e tests for Shoppy
+        id: run-e2e-tests
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
+        continue-on-error: true
+        env:
+          CYPRESS_BROWSER: ${{ steps.shoppy-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js shoppy-e2e
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        with:
+          name: cypress-recording-sample-app-shoppy-e2e-${{ matrix.environment }}-latest
+          path: |
+            ./e2e/tmp/shoppy/cypress
+          if-no-files-found: ignore
+
+      - name: Fail job if tests failed
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        run: |
+          exit 1
+
+  # Synthetic monitoring tests run only on master merges, in parallel with the regular e2e tests.
+  # They use the shoppy production environment and include performance measurement tests.
+  e2e-shoppy-synthetic-tests:
+    needs: [get-sample-apps-data]
+    if: |
+      !cancelled() && needs.get-sample-apps-data.result == 'success' &&
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/master'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-shoppy-synthetic-monitoring-tests
+    env:
+      MB_EDITION: ee
+      MB_RUN_MODE: e2e
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+      SAMPLE_APP_ENVIRONMENT: production
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Shoppy E2E environment
+        uses: ./.github/actions/prepare-shoppy-e2e
+        id: shoppy-prep
+        with:
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          sample-app-branch-name: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+          sample-app-environment: production
+          staging-mb-all-features-token: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+          shoppy-iam-role: ${{ secrets.SHOPPY_IAM_ROLE }}
+          shoppy-metabase-app-db-s3-bucket: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_BUCKET }}
+          shoppy-metabase-app-db-s3-key: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_KEY }}
+          shoppy-metabase-app-db-user: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
+          shoppy-metabase-app-db-database: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
+          metastore-dev-server-url: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+          shoppy-datadog-application-id: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_APPLICATION_ID }}
+          shoppy-datadog-client-token: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_CLIENT_TOKEN }}
+
+      - name: Get merged PR number
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
+        id: get-merged-pr-number
+        run: |
+          PR=$(gh api repos/${{ github.repository }}/commits/${{ github.sha }}/pulls --jq '.[0].number' 2>/dev/null || echo "")
+          if [ -z "$PR" ] || [ "$PR" = "null" ]; then
+            echo "number=" >> "$GITHUB_OUTPUT"
+          else
+            echo "number=$PR" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run synthetic monitoring tests
+        id: run-e2e-tests
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
+        continue-on-error: true
+        env:
+          CYPRESS_BROWSER: ${{ steps.shoppy-prep.outputs.chrome-path }}
+          PR_NUMBER: ${{ steps.get-merged-pr-number.outputs.number }}
+          INCLUDE_SYNTHETIC_MONITORING_TESTS: "true"
+        run: node e2e/runner/run_cypress_ci.js shoppy-e2e
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        with:
+          name: cypress-recording-shoppy-synthetic-tests-latest
+          path: |
+            ./e2e/tmp/shoppy/cypress
+          if-no-files-found: ignore
+
+      - name: Fail job if tests failed
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        run: |
+          exit 1
+
   # The job checks integration of the Embedding SDK with consumer's apps that use different frameworks/bundlers,
   # or when we want to test some tricky integration cases like conflicting types.
   # The job
@@ -228,6 +344,7 @@ jobs:
   # For more details see `Embedding SDK integration tests with Host Apps` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
   e2e-host-apps-tests:
     strategy:
+      fail-fast: false
       matrix:
         test_suite:
           [
@@ -252,7 +369,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 

.github/workflows/embedding-sdk-package-build.yml

@@ -23,7 +23,7 @@ jobs:
           # Remove the matchers to not report false positives on every PR
           # unrelated to embedding (EMB-765)
           echo "::remove-matcher owner=tsc::"
-          yarn build-embedding-sdk-package
+          bun run build-embedding-sdk-package
       - name: Prepare Embedding SDK artifact
         uses: actions/upload-artifact@v4
         with:

.github/workflows/embedding-sdk.yml

@@ -23,6 +23,10 @@ on:
         description: "Whether to run host and sample apps compatibility tests."
         required: true
         type: boolean
+      bundle-size-check:
+        description: "Whether to run bundle size check."
+        required: true
+        type: boolean
       skip:
         description: Whether to skip running tests due to one of the artifacts failing to build.
         required: true
@@ -47,7 +51,7 @@ jobs:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
       - name: Run frontend embedding SDK snippets type check
-        run: yarn run embedding-sdk:cli-snippets:type-check
+        run: bun run embedding-sdk:cli-snippets:type-check
 
   embedding-sdk-docs-snippets-type-check:
     if: inputs.docs-snippets-type-check && !inputs.skip
@@ -63,7 +67,7 @@ jobs:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
       - name: Run frontend embedding SDK snippets type check
-        run: yarn run embedding-sdk:docs-snippets:type-check
+        run: bun run embedding-sdk:docs-snippets:type-check
 
   embedding-sdk-api-documentation-generation-validation:
     if: inputs.documentation-validation && !inputs.skip
@@ -86,7 +90,7 @@ jobs:
         shell: bash
         run: |
           set -o pipefail
-          yarn embedding-sdk:docs:generate:pure --emit none 2>&1 \
+          bun run embedding-sdk:docs:generate:pure --emit none 2>&1 \
           | tee /dev/stdout \
           | tee >( tail -n 10 \
           | sed '1s/^/output<<EOF\n/' \
@@ -98,14 +102,14 @@ jobs:
         with:
           remove-previous-comment: true
           add-new-comment: ${{ steps.docs-generation.outcome == 'failure' && contains(steps.docs-generation.outputs.output, 'not included in the documentation') }}
-          message: "📝 Some exported types from `@metabase/embedding-sdk-react` reference other types that are not exported, i.e. internal types.<br><br>The internal type reference breaks API documentation generation for the SDK and also may unexpectedly increase the output size of the type declaration file.<br><br>Please check the CI logs to find the name of such type.<br><br>- If a type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, refactor types to prevent referencing other types that are not exported from SDK.<br><br>You can run `yarn embedding-sdk:docs:generate` locally to  verify that the issue has been resolved."
+          message: "📝 Some exported types from `@metabase/embedding-sdk-react` reference other types that are not exported, i.e. internal types.<br><br>The internal type reference breaks API documentation generation for the SDK and also may unexpectedly increase the output size of the type declaration file.<br><br>Please check the CI logs to find the name of such type.<br><br>- If a type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, refactor types to prevent referencing other types that are not exported from SDK.<br><br>You can run `bun run embedding-sdk:docs:generate` locally to  verify that the issue has been resolved."
           include-log: true
       - name: Comment on PR if 'Failed to resolve link' error happens
         uses: ./.github/actions/notify-pull-request
         with:
           remove-previous-comment: true
           add-new-comment: ${{ steps.docs-generation.outcome == 'failure' && contains(steps.docs-generation.outputs.output, 'Failed to resolve link') }}
-          message: "📝 A typedoc `{@link <TYPE_NAME>}` annotation is found that can't be resolved.<br><br>Most likely it happens when the referenced type is not exported. Please check the CI logs to find the name of such type.<br><br>- If a referenced in `{@link}` type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, change types to prevent unexported type reference in `{@link}` annotation.<br><br>You can run `yarn embedding-sdk:docs:generate` locally to verify that the issue has been resolved."
+          message: "📝 A typedoc `{@link <TYPE_NAME>}` annotation is found that can't be resolved.<br><br>Most likely it happens when the referenced type is not exported. Please check the CI logs to find the name of such type.<br><br>- If a referenced in `{@link}` type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, change types to prevent unexported type reference in `{@link}` annotation.<br><br>You can run `bun run embedding-sdk:docs:generate` locally to verify that the issue has been resolved."
           include-log: true
       - name: Fail Job
         if: ${{ steps.docs-generation.outcome == 'failure' }}
@@ -124,8 +128,59 @@ jobs:
     uses: ./.github/workflows/embedding-sdk-host-sample-apps-tests.yml
     secrets: inherit
 
+  embedding-sdk-bundle-size-check:
+    if: inputs.bundle-size-check
+    continue-on-error: true
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    env:
+      BUNDLE_SIZE_THRESHOLD_PERCENT: 2
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/sdk-bundle-size-check
+        id: compare
+        with:
+          edition: ee
+          base-ref-commit: ${{ github.event.pull_request.base.sha }}
+          threshold-percent: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
+
+      - name: Comment on PR if bundle size has increased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.status == 'increased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "⚠️ Embedding SDK bundle size increased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). Please contact Embedding team."
+          include-log: false
+
+      - name: Send notification to Slack via Zapier
+        if: success() && steps.compare.outputs.status == 'increased'
+        shell: bash
+        env:
+          ZAPIER_WEBHOOK_URL: ${{ secrets.EMBEDDING_ZAPIER_WEBHOOK_URL }}
+          SIZE_CHANGE_PERCENT: ${{ steps.compare.outputs.size_change_percent }}
+          BUNDLE_SIZE_THRESHOLD_PERCENT: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          curl -s -X POST "$ZAPIER_WEBHOOK_URL" \
+            -d "⚠️ Embedding SDK bundle size increased by ${SIZE_CHANGE_PERCENT}% (threshold: ${BUNDLE_SIZE_THRESHOLD_PERCENT}%)
+
+          PR #${PR_NUMBER} ${PR_TITLE} (${PR_URL})"
+
+      - name: Comment on PR if bundle size has decreased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.status == 'decreased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "🎉 Embedding SDK bundle size decreased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
+          include-log: false
+
   embedding-sdk-tests-result:
     needs:
+      - embedding-sdk-bundle-size-check
       - embedding-sdk-cli-snippets-type-check
       - embedding-sdk-docs-snippets-type-check
       - embedding-sdk-api-documentation-generation-validation

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -44,12 +44,12 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Build cljs
-        run: yarn build:cljs
+        run: bun run build:cljs
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
         run: |
           for i in {1..${{ github.event.inputs.burn_in }}}; do
-            yarn jest --runInBand --ci --silent --no-cache \
-              --testPathPattern '${{ github.event.inputs.spec }}' \
+            bun run jest --runInBand --ci --silent --no-cache \
+              --testPathPatterns '${{ github.event.inputs.spec }}' \
               --testNamePattern '${{ github.event.inputs.grep }}'
             if [[ "$?" != 0 ]]; then
               echo "Failed after $i attempts" && break;

.github/workflows/frontend.yml

@@ -46,15 +46,15 @@ jobs:
           key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
 
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
       - name: Find CSS variables that are used but never defined
-        run: yarn find-never-defined-css-variables
+        run: bun run find-never-defined-css-variables
       - name: Run Prettier formatting linter
-        run: yarn run lint-prettier-pure
+        run: bun run lint-prettier-pure
       - name: Run ESLint linter
-        run: yarn run lint-eslint-pure
+        run: bun run lint-eslint-pure
       - name: Run CSS linter
-        run: yarn run lint-css
+        run: bun run lint-css
 
   fe-type-check:
     if: ${{ !inputs.skip }}
@@ -66,9 +66,9 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-      - run: yarn build-pure:cljs
+      - run: bun run build-pure:cljs
         name: Compile CLJS
-      - run: yarn type-check-pure
+      - run: bun run type-check-pure
         name: Check types
 
   fe-tests-unit:
@@ -90,7 +90,8 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run frontend unit tests
-        run: yarn run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
+        id: fe-tests
+        run: bun run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
         # Trunk Quarantine controls the final state of the run in the CI!
         # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
         # whether to fail or to pass the whole job, based on the quarantine list.
@@ -106,6 +107,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.fe-tests.outcome }}
 
   fe-tests-timezones:
     if: ${{ !inputs.skip }}
@@ -118,7 +120,7 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run frontend timezones tests
-        run: yarn run test-timezones
+        run: bun run test-timezones
 
   fe-tests-result:
     needs:

.github/workflows/fuzzing.yml

@@ -1,56 +0,0 @@
-name: Fuzzing
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-    paths:
-      - "frontend/src/metabase/querying/expressions/**"
-  pull_request:
-    paths:
-      - "frontend/src/metabase/querying/expressions/**"
-
-jobs:
-  fe-fuzz-lexifier:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/pratt/fuzz.lexifier.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the lexifier
-
-  fe-fuzz-compiler:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.compiler.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the custom expression compiler
-
-  fe-fuzz-string-quoting:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.string.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the custom expression string quoter

.github/workflows/js-stats-update.yml

@@ -0,0 +1,51 @@
+name: JS Stats Update
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: 40 1 * * 4 # every Thursday at 1:40
+
+jobs:
+  js-stats:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: get JS file count
+        id: get-js-file-count
+        run: |
+          oss=$(find ./frontend/src/metabase -type f -name "*.js" -o -name "*.jsx" | wc -l)
+          ee=$(find ./enterprise/frontend/src/metabase-enterprise -type f -name "*.js" -o -name "*.jsx" | wc -l)
+
+          echo $(($oss+$ee)) javascript files
+
+          echo "JS_FILES=$(($oss+$ee))" >> $GITHUB_OUTPUT
+      - name: Upload count to Stats
+        uses: actions/github-script@v7
+        env:
+          JS_FILES: ${{ steps.get-js-file-count.outputs.JS_FILES }}
+          API_KEY: ${{ secrets.STATS_API_KEY }}
+        with:
+          script: | # js
+            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
+
+            console.log("JS_FILES", Number(process.env.JS_FILES));
+
+            const data = [
+              {
+                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+                'Js files': Number(process.env.JS_FILES),
+              }
+            ];
+
+            uploadCsvToMb({
+              baseUrl: 'https://stats.metabase.com',
+              tableId: 73270,
+              jsonData: data,
+              mode: 'append',
+            }).then(() => {
+              console.log('Data uploaded successfully');
+            }).catch((error) => {
+              console.error('Error uploading data:', error);
+              process.exit(1);
+            });

.github/workflows/llms-txt-generate.yml

@@ -1,198 +0,0 @@
-name: Generate llms.txt file
-
-on:
-  workflow_call:
-    inputs:
-      version:
-        description: 'Metabase version (e.g. v0.57.0)'
-        type: string
-        required: true
-      branch:
-        description: 'Target branch (e.g. release-x.57.x)'
-        type: string
-        required: true
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Metabase version (e.g. v0.57.0)'
-        type: string
-        required: true
-      branch:
-        description: 'Target branch (e.g. release-x.57.x)'
-        type: string
-        required: true
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  check-version:
-    name: Check if minor or major release
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    outputs:
-      should_generate: ${{ steps.check.outputs.should_generate }}
-      target_branch: ${{ steps.check.outputs.target_branch }}
-      version: ${{ steps.check.outputs.version }}
-    steps:
-      - name: Check version
-        id: check
-        run: |
-          VERSION="${{ inputs.version }}"
-          BRANCH="${{ inputs.branch }}"
-
-          # Extract version number (e.g., v0.57.0 -> 0.57.0)
-          VERSION_NUM="${VERSION#v}"
-
-          # Count dots to determine version type
-          # Metabase format: v0.MAJOR.MINOR (3 segments) or v0.MAJOR.MINOR.PATCH (4 segments)
-          DOT_COUNT=$(echo "$VERSION_NUM" | tr -cd '.' | wc -c | tr -d ' ')
-
-          # Only proceed if this is a minor or major release (3 segments)
-          # Examples of minor/major releases: v0.57.8, v0.59.0
-          # Skip for patch releases (4 segments): v0.57.8.1
-          # Note: This is a safety check even though the workflow should only be called
-          # for minor/major releases, just in case the workflow is dispatched manually.
-          if [ "$DOT_COUNT" -eq 3 ]; then
-            echo "⏭️  This is a patch release ($VERSION). Skipping llms.txt generation."
-            echo "should_generate=false" >> $GITHUB_OUTPUT
-          else
-            echo "✅ This is a minor or major release ($VERSION). Proceeding with llms.txt generation for branch: $BRANCH"
-            echo "should_generate=true" >> $GITHUB_OUTPUT
-          fi
-
-          echo "target_branch=$BRANCH" >> $GITHUB_OUTPUT
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-  generate-llms-txt:
-    name: Generate llms.txt
-    needs: check-version
-    if: needs.check-version.outputs.should_generate == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-
-      - name: Get the generate-llms-txt.js node script via sparse checkout
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          ref: ${{ github.ref }}
-          sparse-checkout: |
-            .github/scripts
-          path: workflow-scripts
-
-      - name: Checkout target branch for docs
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          ref: ${{ needs.check-version.outputs.target_branch }}
-          path: metabase
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Generate llms.txt
-        id: generate
-        run: |
-          node workflow-scripts/.github/scripts/generate-llms-txt.js metabase/docs ${{ needs.check-version.outputs.target_branch }}
-
-      - name: Sanity check generated files
-        run: |
-          if [ ! -f "llms.txt" ]; then
-            echo "❌ Error: llms.txt was not generated"
-            exit 1
-          fi
-
-          if [ ! -f "llms-embedding-full.txt" ]; then
-            echo "❌ Error: llms-embedding-full.txt was not generated"
-            exit 1
-          fi
-
-          # Check that llms.txt contains URLs with the expected GitHub raw URL prefix
-          URL_COUNT=$(grep -o "https://raw.githubusercontent.com/metabase/metabase/refs/heads/${{ needs.check-version.outputs.target_branch }}/docs" llms.txt | wc -l)
-          if [ "$URL_COUNT" -lt 10 ]; then
-            echo "❌ Error: llms.txt appears to be malformed. Found only $URL_COUNT URLs (expected at least 10)"
-            exit 1
-          fi
-
-          echo "✅ Both llms.txt and llms-embedding-full.txt were generated successfully"
-          echo "✅ llms.txt contains $URL_COUNT documentation URLs"
-
-      - name: Set up git configuration
-        working-directory: metabase
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          BRANCH_NAME="llms-txt/auto-update-${{ needs.check-version.outputs.target_branch }}-$(date +%Y%m%d-%H%M%S)"
-          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
-          echo "Branch name will be: $BRANCH_NAME"
-
-      - name: Copy generated files to metabase repo
-        run: |
-          cp llms.txt metabase/
-          cp llms-embedding-full.txt metabase/
-
-      - name: Create Pull Request
-        id: create_pr
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          path: metabase
-          branch: ${{ env.BRANCH_NAME }}
-          base: ${{ needs.check-version.outputs.target_branch }}
-          commit-message: |
-            Update llms.txt and llms-full.txt (${{ needs.check-version.outputs.target_branch }})
-
-            Regenerated llms.txt to include all markdown files from the docs/ directory.
-            Also generated llms-full.txt files for the embedding section.
-
-            🤖 Generated automatically by llms-txt-generate workflow
-
-            Co-Authored-By: GitHub Actions <actions@github.com>
-          committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-          author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-          title: "[chore] Update llms.txt for ${{ needs.check-version.outputs.target_branch }}"
-          body: |
-            ## Summary
-            This PR contains automatically generated updates to `llms.txt` and `llms-embedding-full.txt` files, triggered by a minor or major release.
-
-            ## Changes
-            - The `llms.txt` file has been regenerated to include all markdown files from the `docs/` directory.
-            - The `llms-embedding-full.txt` file has been generated for the embedding section (concatenated documentation for RAG).
-
-            ## Generation
-            These files were generated using:
-            - Script: `.github/scripts/generate-llms-txt.js`
-            - Branch: `${{ needs.check-version.outputs.target_branch }}`
-            - Base URL: `https://raw.githubusercontent.com/metabase/metabase/refs/heads/${{ needs.check-version.outputs.target_branch }}`
-
-            Please review the changes and merge if they look correct.
-
-            🤖 Generated automatically by the `llms-txt-generate` workflow.
-
-            Co-Authored-By: GitHub Actions <actions@github.com>
-          labels: |
-            Type:Documentation
-            no-backport
-          add-paths: |
-            llms.txt
-            llms-embedding-full.txt
-
-      - name: Auto approve PR
-        if: steps.create_pr.outputs.pull-request-number != ''
-        working-directory: metabase
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh pr review "${{ steps.create_pr.outputs.pull-request-number }}" --approve --body "Auto-approved by llms-txt-generate workflow"
-
-      - name: Auto merge PR
-        if: steps.create_pr.outputs.pull-request-number != ''
-        working-directory: metabase
-        env:
-          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-        run: |
-          gh pr merge "${{ steps.create_pr.outputs.pull-request-number }}" --auto --squash

.github/workflows/loki-stress-test-flake-fix.yml

@@ -1,10 +1,15 @@
 name: Loki Visual Stress Test Flake Fix
 
 on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'frontend/**/*.stories.tsx'
+      - 'enterprise/frontend/**/*.stories.tsx'
   workflow_dispatch:
     inputs:
-      stories_filter:
-        description: "Regex pattern to filter stories (e.g. 'DataGrid' or 'static-viz|viz')"
+      story_files:
+        description: "Comma-separated story file paths relative to repo root"
         type: string
         required: true
       burn_in:
@@ -14,22 +19,96 @@ on:
         default: "50"
 
 jobs:
+  detect-changed-stories:
+    name: Detect changed stories
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      story_files: ${{ steps.detect.outputs.story_files }}
+      should_run: ${{ steps.detect.outputs.should_run }}
+    steps:
+      - name: Detect changed story files
+        id: detect
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          validate_paths() {
+            local files="$1"
+            for file in $(echo "$files" | tr ',' '\n'); do
+              file=$(echo "$file" | xargs)  # trim whitespace
+              if [[ -z "$file" ]]; then
+                continue
+              fi
+              if [[ ! "$file" =~ ^(frontend/|enterprise/frontend/).+\.stories\. ]]; then
+                echo "::error::Invalid story path: $file"
+                echo "Paths must start with 'frontend/' or 'enterprise/frontend/' and contain '.stories.'"
+                return 1
+              fi
+            done
+            return 0
+          }
+
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            FILES=$(echo "${{ inputs.story_files }}" | tr ',' '\n' | xargs -n1 | paste -sd',')
+            if ! validate_paths "$FILES"; then
+              exit 1
+            fi
+            echo "story_files=$FILES" >> $GITHUB_OUTPUT
+            echo "should_run=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          FILES=$( \
+            gh pr view ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --json files --jq '.files[].path' \
+            | grep '\.stories\.tsx$' \
+            | xargs -n1 \
+            | sort -u \
+            | paste -sd',' \
+          )
+
+          if [[ -z "$FILES" ]]; then
+            echo "No changed story files found"
+            echo "should_run=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          if ! validate_paths "$FILES"; then
+            exit 1
+          fi
+
+          echo "Changed story files: $FILES"
+          echo "story_files=$FILES" >> $GITHUB_OUTPUT
+          echo "should_run=true" >> $GITHUB_OUTPUT
+
   workflow-summary:
-    name: Stress test inputs
+    name: Summary
+    needs: detect-changed-stories
+    if: needs.detect-changed-stories.outputs.should_run == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
         run: |
-          echo '**Inputs:**' >> $GITHUB_STEP_SUMMARY
+          echo '## Loki Stress Test' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
-          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `stories_filter`: ${{ inputs.stories_filter }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
+          echo '**Branch:** `${{ github.head_ref || github.ref_name }}`' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
-          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
+          echo '**Story files:**' >> $GITHUB_STEP_SUMMARY
+          echo '${{ needs.detect-changed-stories.outputs.story_files }}' | tr ',' '\n' | while read -r file; do
+            echo "- \`$file\`" >> $GITHUB_STEP_SUMMARY
+          done
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo '**Burn-in:** ${{ inputs.burn_in || 50 }} runs' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo 'Triggered by PR #${{ github.event.pull_request.number }} from @${{ github.event.pull_request.user.login }}' >> $GITHUB_STEP_SUMMARY
+          else
+            echo 'Triggered manually by @${{ github.actor }}' >> $GITHUB_STEP_SUMMARY
+          fi
 
   stress-test-loki:
+    needs: detect-changed-stories
+    if: needs.detect-changed-stories.outputs.should_run == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 60
     name: Stress test Loki visual tests
@@ -56,17 +135,20 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Compile CLJS
-        run: NODE_ENV=development yarn build-pure:cljs
+        run: NODE_ENV=development bun run build-pure:cljs
 
-      - name: Build Storybook (once)
-        run: yarn build-storybook
+      - name: Build Storybook
+        run: bun run build-storybook
+        env:
+          STORYBOOK_STORIES_FILTER: ${{ needs.detect-changed-stories.outputs.story_files }}
 
-      - name: Stress-test Loki "${{ inputs.stories_filter }}" ${{ inputs.burn_in }} times
+      - name: Stress-test Loki
         run: |
-          BURN_IN=${{ inputs.burn_in }}
-          STORIES_FILTER='${{ inputs.stories_filter }}'
+          BURN_IN=${{ inputs.burn_in || '50' }}
+          STORY_FILES='${{ needs.detect-changed-stories.outputs.story_files }}'
 
-          echo "Running Loki visual tests $BURN_IN times for stories matching: $STORIES_FILTER"
+          echo "Story files: $STORY_FILES"
+          echo "Running Loki $BURN_IN times"
           echo ""
 
           FAILED=0
@@ -75,10 +157,9 @@ jobs:
             echo "Run $i of $BURN_IN"
             echo "=========================================="
 
-            if yarn test-visual:loki \
+            if bun run test-visual:loki \
               --reactUri file:./storybook-static \
-              --verboseRenderer \
-              --storiesFilter "$STORIES_FILTER"; then
+              --verboseRenderer; then
               echo "✅ Run $i passed"
             else
               echo "❌ Run $i FAILED"
@@ -101,10 +182,9 @@ jobs:
 
       - name: Generate Visual Report on Failure
         if: failure()
-        run: yarn test-visual:loki-report
+        run: bun run test-visual:loki-report
 
       - name: Upload Artifact
-        id: artifact-upload-step
         if: failure()
         uses: actions/upload-artifact@v4
         with:

.github/workflows/loki-update.yml

@@ -22,10 +22,10 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
 
       - name: Update Loki Snapshots
-        run: yarn test-visual:loki:ci || yarn test-visual:loki-approve-diff && yarn test-visual:loki-prune
+        run: bun run test-visual:loki:ci || bun run test-visual:loki-approve-diff && bun run test-visual:loki-prune
 
       - name: Check for changes
         id: check-changes

.github/workflows/loki.yml

@@ -49,14 +49,14 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Compile CLJS
-        run: NODE_ENV=development yarn build-pure:cljs
+        run: NODE_ENV=development bun run build-pure:cljs
 
       - name: Run Loki Visual Tests
-        run: yarn test-visual:loki:ci
+        run: bun run test-visual:loki:ci
 
       - name: Generate Visual Report on Failure
         if: failure()
-        run: yarn test-visual:loki-report
+        run: bun run test-visual:loki-report
 
       - name: Upload Artifact
         id: artifact-upload-step

.github/workflows/mage.yml

@@ -2,9 +2,6 @@ name: Mage Tests
 
 on:
   pull_request:
-    paths:
-      - "mage/**"
-      - "bb.edn"
 
 jobs:
   # run mage tests even if the rest of be isnt needed

.github/workflows/minimal-tests.yml

@@ -30,9 +30,9 @@ jobs:
     needs: check-label
     if: needs.check-label.outputs.should-run == 'true'
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
-      CI: 'true'
+      CI: "true"
       DRIVERS: postgres
       MB_DB_TYPE: postgres
       MB_DB_PORT: 5432
@@ -53,10 +53,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test Postgres App DB
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: true
-          junit-name: 'minimal-be-tests-postgres-ee'
+          junit-name: "minimal-be-tests-postgres-ee"
           test-args: >-
             :only '["test" "enterprise/backend/test"]'
             :exclude-tags '[:mb/driver-tests :mb/transforms-python-test]'
@@ -73,15 +74,16 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   # Postgres driver tests
   postgres-driver-test:
     needs: check-label
     if: needs.check-label.outputs.should-run == 'true'
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
-      CI: 'true'
+      CI: "true"
       DRIVERS: postgres
       MB_DB_TYPE: postgres
       MB_DB_PORT: 5432
@@ -102,9 +104,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test Postgres Driver
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
-          junit-name: 'minimal-be-tests-postgres-driver-ee'
+          junit-name: "minimal-be-tests-postgres-driver-ee"
           test-args: >-
             :only-tags [:mb/driver-tests]
             :exclude-tags [:mb/transforms-python-test]
@@ -119,6 +122,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   # Frontend unit tests
   frontend-unit-tests:
@@ -137,7 +141,8 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run frontend unit tests
-        run: yarn run test-unit --silent
+        id: run-tests
+        run: bun run test-unit --silent
         continue-on-error: true
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
@@ -150,6 +155,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
   # Summary job
   minimal-tests-result:

.github/workflows/module-boundaries-stats.yml

@@ -0,0 +1,78 @@
+name: Module Boundaries Stats
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: 40 1 * * 5 # every Friday at 1:40
+
+jobs:
+  module-boundaries-stats:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: get module boundary stats
+        id: get-stats
+        run: |
+          NAMED_MODULES=$(node --input-type=module -e "
+            import { elements } from './frontend/lint/module-boundaries.mjs';
+            const named = elements.filter(e => !['shared/other', 'app/misc', 'other'].includes(e.type));
+          ")
+
+          NAMED_DIRS=$(node --input-type=module -e "
+            import { elements } from './frontend/lint/module-boundaries.mjs';
+            const dirs = new Set();
+            for (const el of elements) {
+              const m = el.pattern.match(/^frontend\/src\/metabase\/(\w[\w-]*)\//)
+              if (m) dirs.add(m[1]);
+            }
+          ")
+          TOTAL_DIRS=$(ls -d frontend/src/metabase/*/ | xargs -I{} basename {} | wc -l | tr -d ' ')
+          NAMED_COUNT=$(echo "$NAMED_DIRS" | grep -c . || true)
+          UNMODULED=$(($TOTAL_DIRS - $NAMED_COUNT))
+
+          VIOLATIONS=$(bun run module-boundaries 2>&1 | grep -o '✖ [0-9]* problems' | grep -o '[0-9]*' || echo "0")
+
+          echo "$NAMED_MODULES modules, $UNMODULED unmoduled folders, $VIOLATIONS violations"
+
+          echo "NAMED_MODULES=$NAMED_MODULES" >> $GITHUB_OUTPUT
+          echo "UNMODULED=$UNMODULED" >> $GITHUB_OUTPUT
+          echo "VIOLATIONS=$VIOLATIONS" >> $GITHUB_OUTPUT
+      - name: Upload stats
+        uses: actions/github-script@v7
+        env:
+          NAMED_MODULES: ${{ steps.get-stats.outputs.NAMED_MODULES }}
+          UNMODULED: ${{ steps.get-stats.outputs.UNMODULED }}
+          VIOLATIONS: ${{ steps.get-stats.outputs.VIOLATIONS }}
+          API_KEY: ${{ secrets.STATS_API_KEY }}
+        with:
+          script: | # js
+            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
+
+            console.log("NAMED_MODULES", Number(process.env.NAMED_MODULES));
+            console.log("UNMODULED", Number(process.env.UNMODULED));
+            console.log("VIOLATIONS", Number(process.env.VIOLATIONS));
+
+            const data = [
+              {
+                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+                'Modules': Number(process.env.NAMED_MODULES),
+                'Unmoduled folders': Number(process.env.UNMODULED),
+                'Violations': Number(process.env.VIOLATIONS),
+              }
+            ];
+
+            uploadCsvToMb({
+              baseUrl: 'https://stats.metabase.com',
+              tableId: 75146,
+              jsonData: data,
+              mode: 'append',
+            }).then(() => {
+              console.log('Data uploaded successfully');
+            }).catch((error) => {
+              console.error('Error uploading data:', error);
+              process.exit(1);
+            });

.github/workflows/openapi-check.yml

@@ -22,10 +22,8 @@ jobs:
           token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           # fetch full git history to allow fetching the latest base branch commit and comparing changes
           fetch-depth: 0
-      - name: Setup Node.js 22
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22.x
+      - name: Prepare Node + Bun environment
+        uses: ./.github/actions/prepare-node-bun
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Generate version.properties

.github/workflows/openapi.yml

@@ -0,0 +1,44 @@
+name: Validate OpenAPI
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-**'
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      openapi: ${{ steps.changes.outputs.openapi }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  validate-openapi:
+    needs: files-changed
+    if: needs.files-changed.outputs.openapi == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Generate OpenAPI spec
+        run: bun run generate-openapi
+      - name: Validate OpenAPI spec
+        run: bun run lint-openapi

.github/workflows/perf-test.yml

@@ -29,7 +29,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
       - name: Move uberjar to bin/docker

.github/workflows/pr-env-close-unlabel.yml

@@ -5,8 +5,8 @@ on:
     types: [ closed, unlabeled ]
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
 
 jobs:
   pr-env:

.github/workflows/pr-env-destroy-manual.yml

@@ -0,0 +1,29 @@
+name: PR Env Destroy (Manual)
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to destroy environment for'
+        required: true
+        type: string
+      self_hosting:
+        description: 'Self-hosting stack'
+        type: boolean
+        default: false
+
+jobs:
+  approve:
+    runs-on: ubuntu-latest
+    environment: pr-env-admin
+    steps:
+      - name: Approved
+        run: echo "Destroying PR environment for PR #${{ inputs.pr_number }}"
+
+  destroy:
+    needs: approve
+    uses: ./.github/workflows/pr-env-destroy.yml
+    secrets: inherit
+    with:
+      self_hosting: ${{ inputs.self_hosting }}
+      pr_number: ${{ inputs.pr_number }}

.github/workflows/pr-env-destroy.yml

@@ -9,6 +9,13 @@ on:
         required: false
         type: boolean
         default: false
+      pr_number:
+        description: 'PR number (required for manual dispatch)'
+        required: false
+        type: string
+
+env:
+  PR_NUMBER: ${{ inputs.pr_number || github.event.number }}
 
 jobs:
   destroy_pr:
@@ -62,8 +69,8 @@ jobs:
       - name: Destroy PR Review ENV
         if: ${{ !inputs.self_hosting }}
         run: |
-          kubectl delete metabase -n hosting-pr${{ github.event.number }} hosting-pr${{ github.event.number }}
-          kubectl delete ns hosting-pr${{ github.event.number }}
+          kubectl delete metabase -n hosting-pr${{ env.PR_NUMBER }} hosting-pr${{ env.PR_NUMBER }}
+          kubectl delete ns hosting-pr${{ env.PR_NUMBER }}
       - name: Setup Helm
         if: ${{ inputs.self_hosting }}
         uses: azure/setup-helm@v4
@@ -72,8 +79,8 @@ jobs:
       - name: Destroy PR Review ENV (self-hosting)
         if: ${{ inputs.self_hosting }}
         run: |
-          helm uninstall hosting-pr${{ github.event.number }} --namespace hosting-pr${{ github.event.number }} || true
-          kubectl delete ns hosting-pr${{ github.event.number }} || true
+          helm uninstall hosting-pr${{ env.PR_NUMBER }} --namespace hosting-pr${{ env.PR_NUMBER }} || true
+          kubectl delete ns hosting-pr${{ env.PR_NUMBER }} || true
       - name: Setup psql client
         run: |
           sudo apt-get update
@@ -85,4 +92,4 @@ jobs:
           -h ${{ secrets.PR_ENV_DB_HOST }} \
           -U ${{ secrets.PR_ENV_DB_USER }} \
           -d ${{ secrets.PR_ENV_DB_NAME }} \
-          -c "DROP DATABASE IF EXISTS hosting_pr${{ github.event.number }};"
+          -c "DROP DATABASE IF EXISTS hosting_pr${{ env.PR_NUMBER }};"

.github/workflows/pr-env.yml

@@ -40,7 +40,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
       - name: Move uberjar to bin/docker

.github/workflows/pre-release.yml

@@ -30,12 +30,15 @@ jobs:
     outputs:
       run_mode: ${{ fromJson(steps.config.outputs.result).runMode }}
       dev_server: ${{ fromJson(steps.config.outputs.result).metastoreDevServer }}
+      package_manager: ${{ fromJson(steps.config.outputs.result).packageManager }}
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       # note: this block can be removed after we stop needing to be able to test versions before v55
       - name: Get test mode config
         id: config
@@ -48,13 +51,17 @@ jobs:
             // with v55 and later we use enterprise tokens that mirror actual Metabase plans
             const MULTIPLE_TEST_TOKEN_THRESHOLD = 55;
 
+            // Versions before v59 used yarn, v59 and later use bun
+            const BUN_PACKAGE_MANAGER_THRESHOLD = 59;
+
             const version = '${{ inputs.version }}';
             const majorVersion = Number(getMajorVersion(version));
             const oldTestToken = majorVersion < MULTIPLE_TEST_TOKEN_THRESHOLD;
 
             return ({
               runMode: oldTestToken ? 'prod' : 'e2e',
-              metastoreDevServer: oldTestToken ? '' : '${{ vars.METASTORE_DEV_SERVER_URL }}'
+              metastoreDevServer: oldTestToken ? '' : '${{ vars.METASTORE_DEV_SERVER_URL }}',
+              packageManager: majorVersion < BUN_PACKAGE_MANAGER_THRESHOLD ? 'yarn' : 'bun',
             });
 
   release-artifact:
@@ -71,10 +78,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: .github
-      - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
+      - name: Retrieve release uberjar artifact for ${{ matrix.edition }}
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
+          commit: ${{ inputs.commit }}
+          edition: ${{ matrix.edition }}
+          release: "true"
 
       - name: Extract version number from  version.properties
         id: version-properties
@@ -168,6 +177,8 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
+      - name: Compile CLJS
+        run: ${{ needs.test-mode-config.outputs.package_manager }} run build-pure:cljs
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
@@ -228,32 +239,42 @@ jobs:
     uses: ./.github/workflows/containerize-jar.yml
     secrets: inherit
     with:
-      artifact-name: metabase-release-oss-${{ inputs.commit }}-uberjar
+      edition: oss
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}
       tag: ${{ needs.release-artifact.outputs.oss_version }}-${{ inputs.commit }}
+      release: "true"
 
   containerize-ee:
     needs: release-artifact
     uses: ./.github/workflows/containerize-jar.yml
     secrets: inherit
     with:
-      artifact-name: metabase-release-ee-${{ inputs.commit }}-uberjar
+      edition: ee
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}
       tag: ${{ needs.release-artifact.outputs.ee_version }}-${{ inputs.commit }}
+      release: "true"
 
   tests-complete-message:
     if: always()
     runs-on: ubuntu-22.04
-    needs: [run-sanity-check, check-uberjar-health, containerize-ee, containerize-oss]
+    needs:
+      [
+        run-sanity-check,
+        check-uberjar-health,
+        containerize-ee,
+        containerize-oss,
+      ]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Send tests complete message
         uses: actions/github-script@v7
         env:

.github/workflows/release-embedding-sdk.yml

@@ -44,10 +44,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
+          sparse-checkout: |
+            release
+            .github
 
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
 
       - name: Cache build scripts
         uses: actions/upload-artifact@v4
@@ -178,8 +180,8 @@ jobs:
         with:
           ref: ${{ inputs.branch }}
 
-      - name: Prepare build scripts
-        run: yarn --cwd release --frozen-lockfile && yarn --cwd release build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
 
       - name: Get current SDK version
         id: current-sdk-version
@@ -256,7 +258,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Run unit tests
-        run: yarn embedding-sdk:test-unit
+        run: bun run embedding-sdk:test-unit
 
   build-sdk:
     needs: [test, determine-sdk-version]
@@ -282,10 +284,10 @@ jobs:
           ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ needs.determine-sdk-version.outputs.sdk_version }}
 
       - name: Build SDK package
-        run: yarn run build-embedding-sdk-package
+        run: bun run build-embedding-sdk-package
 
       - name: Generate SDK package.json in the build directory
-        run: yarn run embedding-sdk:generate-package
+        run: bun run embedding-sdk:generate-package
 
       - name: Upload built SDK package as artifact
         uses: actions/upload-artifact@v4

.github/workflows/release-log.yml

@@ -38,10 +38,10 @@ jobs:
         with:
           ref: master # this only works on master
           fetch-depth: 0 # we want all branches and tags
-      - name: Install Dependencies
-        run: yarn --cwd release --frozen-lockfile && npm i -g tsx
-      - name: Build release scripts
-        run: yarn --cwd release build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+      - name: Install tsx
+        run: npm i -g tsx
       - name: Get version number
         uses: actions/github-script@v7
         with: