fix: python tests failing when client on same thread

`command` is a shell builtin that doesn't exist as a standalone binary on
Linux (only macOS has /usr/bin/command as a wrapper). When babashka tries
to execute `command -v git` directly via process/shell, it fails on Linux
because there's no `command` binary to run.

Using `which` instead works on both platforms since it's an actual binary.

.claude/skills/_shared/clojure-style-guide.md

@@ -42,7 +42,7 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 
 - Break up functions > 20 lines
 - Lines ≤ 120 characters
-- No blank lines within definition forms (except pairwise `let`/`cond`)
+- No blank non-comment lines within definition forms (except pairwise `let`/`cond`)
 
 ## Style Conventions
 

.claude/skills/clojure-review/SKILL.md

@@ -61,7 +61,7 @@ Use this to scan through changes efficiently:
 - [ ] Everything `^:private` unless used elsewhere
 - [ ] No `declare` when avoidable (public functions near end)
 - [ ] Functions under 20 lines when possible
-- [ ] No blank lines within definition forms (except pairwise constructs in `let`/`cond`)
+- [ ] No blank, non-comment lines within definition forms (except pairwise constructs in `let`/`cond`)
 - [ ] Lines ≤ 120 characters
 
 ### Tests

.clj-kondo/config/modules/config.edn

@@ -10,7 +10,7 @@
 ;; ## `team`:
 ;;
 ;; The team that owns this module. This has to match one of the team names in `.github/team.json` EXACTLY. You can
-;; run [metabase.core.modules-test/all-modules-have-teams-test]] to make sure you did this correctly.
+;; run [[metabase.core.modules-test/all-modules-have-teams-test]] to make sure you did this correctly.
 ;;
 ;; ## `api`:
 ;;
@@ -39,6 +39,17 @@
 ;; 2. A set of module symbols. This is the list of modules that are allowed to be referenced. An empty set means no
 ;;    other modules are allowed to be referenced; this is the default for any modules that aren't listed here.
 ;;
+;; ## `friends`:
+;;
+;; 'Friend' in the C++ sense; set of modules that are allowed free access into the internals of this module including
+;; namespaces that are not `:api` namespaces. This is useful when writing modules that are 'extensions' of other
+;; modules, for example `enterprise/search` might be enterprise extensions of `search`, or `search-rest` might be the
+;; REST API component for `search`.
+;;
+;;    search
+;;    {...
+;;     :friends #{enterprise/search search-rest}}
+;;
 ;; ## Tips
 ;;
 ;; PRO TIP: Check out the [[dev.deps-graph]] namespace for helpful tools to see where a module is used externally, and
@@ -147,8 +158,7 @@
            metabase.api.settings
            metabase.api.util
            metabase.api.util.handlers}
-   :uses #{api-routes
-           config
+   :uses #{config
            events
            models
            settings
@@ -368,7 +378,8 @@
 
   collections-rest
   {:team "UX West"
-   :api  #{metabase.collections-rest.api}
+   :api  #{metabase.collections-rest.api
+           metabase.collections-rest.init}
    :uses #{api
            app-db
            collections
@@ -383,6 +394,7 @@
            queries
            request
            revisions
+           settings
            upload
            util}}
 
@@ -499,7 +511,8 @@
    :api  #{metabase.documents.api
            metabase.documents.core
            metabase.documents.init
-           metabase.documents.prose-mirror}
+           metabase.documents.prose-mirror
+           metabase.documents.schema}
    :uses #{activity-feed
            api
            app-db
@@ -702,19 +715,13 @@
   lib
   {:team "Querying"
    :api  #{metabase.lib.binning
-           metabase.lib.binning.util
-           metabase.lib.card
-           metabase.lib.computed ; temporarily so that `qp.compile` can use it as lib memoization evolves
            metabase.lib.convert  ; Only so [[metabase.queries.models.card]] can set dynamic vars.
            metabase.lib.core
            metabase.lib.equality
            metabase.lib.field
-           metabase.lib.field.resolution
-           metabase.lib.filter
            metabase.lib.filter.desugar.jvm ; only so [[metabase.legacy-mbql.jvm-util]] can use defined regexes
            metabase.lib.hierarchy
            metabase.lib.init
-           metabase.lib.join.util
            metabase.lib.metadata
            metabase.lib.metadata.cached-provider
            metabase.lib.metadata.column
@@ -738,25 +745,28 @@
            metabase.lib.schema.join
            metabase.lib.schema.literal
            metabase.lib.schema.mbql-clause
+           metabase.lib.schema.measure
            metabase.lib.schema.metadata
            metabase.lib.schema.metadata.fingerprint
            metabase.lib.schema.middleware-options
-           metabase.lib.schema.order-by
            metabase.lib.schema.parameter
            metabase.lib.schema.ref
            metabase.lib.schema.settings
            metabase.lib.schema.template-tag
            metabase.lib.schema.temporal-bucketing
            metabase.lib.schema.util
+           metabase.lib.schema.validate
            metabase.lib.temporal-bucket
            metabase.lib.types.isa
            metabase.lib.util
            metabase.lib.util.match
            metabase.lib.walk}
    :uses #{config
+           graph
            legacy-mbql
            types
-           util}}
+           util}
+   :friends #{query-processor}}
 
   lib-be
   {:team "Querying"
@@ -791,6 +801,18 @@
            settings
            util}}
 
+  measures
+  {:team "Querying"
+   :api  #{metabase.measures.api}
+   :uses #{api
+           events
+           lib
+           lib-be
+           models
+           permissions
+           search
+           util}}
+
   model-persistence
   {:team "Querying"
    :api  #{metabase.model-persistence.api
@@ -952,8 +974,10 @@
            app-db
            classloader
            config
+           events
            internal-stats
            settings
+           task
            util}}
 
   product-feedback
@@ -1042,6 +1066,7 @@
            config
            content-verification
            dashboards
+           documents
            events
            lib
            lib-be
@@ -1254,11 +1279,11 @@
            metabase.segments.schema}
    :uses #{api
            events
-           legacy-mbql
            lib
            lib-be
            models
            permissions
+           remote-sync
            search
            util
            xrays}}
@@ -1364,6 +1389,7 @@
            permissions
            premium-features
            settings
+           system
            util}}
 
   startup
@@ -1426,6 +1452,8 @@
            metabase.task-history.core
            metabase.task-history.init}
    :uses #{api
+           app-db
+           config
            models
            permissions
            premium-features
@@ -1611,6 +1639,7 @@
            permissions
            premium-features
            query-processor
+           remote-sync
            search
            util
            warehouses}}
@@ -1621,6 +1650,7 @@
    :uses #{analytics
            api
            app-db
+           config
            database-routing
            driver
            events
@@ -1636,7 +1666,6 @@
            upload
            util
            warehouse-schema
-           warehouses-rest
            xrays}}
 
   warehouses
@@ -1754,6 +1783,7 @@
            premium-features
            query-permissions
            query-processor
+           remote-sync
            util
            warehouses
            enterprise/impersonation}}
@@ -1948,7 +1978,9 @@
            metabase-enterprise.dependencies.init}
    :uses #{analyze
            api
+           app-db
            collections
+           config
            documents
            driver
            events
@@ -1961,10 +1993,12 @@
            premium-features
            queries
            query-processor
+           request
            revisions
            settings
            task
-           util}}
+           util
+           enterprise/transforms}}
 
   enterprise/email
   {:team "UX West"
@@ -2198,6 +2232,7 @@
            appearance
            collections
            config
+           events
            logger
            models
            plugins
@@ -2283,10 +2318,12 @@
            metabase-enterprise.transforms.init
            metabase-enterprise.transforms.instrumentation
            metabase-enterprise.transforms.interface
+           metabase-enterprise.transforms.schema
            metabase-enterprise.transforms.util}
    :uses #{analytics
            api
            app-db
+           channel
            collections
            driver
            events
@@ -2297,6 +2334,7 @@
            queries
            query-processor
            request
+           revisions
            search
            settings
            sync

.clj-kondo/macros/metabase/server/statistics_handler_test.clj

@@ -1,9 +1,6 @@
 (ns macros.metabase.server.statistics-handler-test)
 
 (defmacro with-server
-  [_ _ [connector chan-start-handle chan-finish-handle chan-done-request] & body]
-  `(let [~connector          nil
-         ~chan-start-handle  nil
-         ~chan-finish-handle nil
-         ~chan-done-request  nil]
+  [[_hold-chan _hit-chan] & body]
+  `(let []
      ~@body))

.clj-kondo/src/hooks/common/modules.clj

@@ -31,7 +31,7 @@
                 second
                 symbol))))
 
-(defn module-api-namespaces
+(defn- module-api-namespaces
   "Set of API namespace symbols for a given module. `:any` means you can use anything, there are no API namespaces for
   this module (yet). If unspecified, the default is just the `<module>.core` namespace."
   [config module]
@@ -51,6 +51,12 @@
           (symbol (str ns-prefix ".core"))
           (symbol (str ns-prefix ".init"))}))))
 
+(defn- module-friends
+  [config module]
+  "Set of modules that are `:friends` of `module`, i.e. allowed to use *any* namespace from the module, not just the
+  designated [[module-api-namespaces]]."
+  (set (get-in config [:metabase/modules module :friends])))
+
 (defn allowed-modules
   "Set of namespace symbols that `module` is allowed to use. `:any` means it's allowed to use anything."
   [config module]
@@ -61,11 +67,13 @@
     (or (= allowed-modules :any)
         (contains? (set allowed-modules) required-module))))
 
-(defn allowed-module-namespace? [config ns-symb]
+(defn- allowed-module-namespace? [config current-module ns-symb]
   (let [module                (module ns-symb)
-        module-api-namespaces (module-api-namespaces config module)]
+        module-api-namespaces (module-api-namespaces config module)
+        module-friends        (module-friends config module)]
     (or (empty? module-api-namespaces)
-        (contains? module-api-namespaces ns-symb))))
+        (contains? module-api-namespaces ns-symb)
+        (contains? module-friends current-module))))
 
 (defn usage-error
   "Find usage errors when a `required-namespace` is required in the `current-module`. Returns a string describing the
@@ -81,7 +89,7 @@
                 current-module
                 current-module)
 
-        (not (allowed-module-namespace? config required-namespace))
+        (not (allowed-module-namespace? config current-module required-namespace))
         (format "Namespace %s is not an allowed external API namespace for the %s module. [:metabase/modules %s :api]"
                 required-namespace
                 required-module

.clj-kondo/test/hooks/clojure/core/ns_test.clj

@@ -43,6 +43,17 @@
            '{:metabase/modules {api    {:uses #{search}}
                                 search {:api  #{metabase.search.core}}}}))))
 
+(deftest ^:parallel module-checker-friends-test
+  (is (= []
+         (lint-modules
+          '(ns metabase.search-rest.api
+             (:require
+              [metabase.search.config :as search.config]
+              [metabase.search.core :as search]))
+          '{:metabase/modules {search      {:api     #{metabase.search.core}
+                                            :friends #{search-rest}}
+                               search-rest {:uses #{search}}}}))))
+
 (deftest ^:parallel module-checker-api-namespaces-ignore-test
   (is (empty? (lint-modules
                '(ns metabase.api.search

.codespellignore

@@ -1,23 +1,35 @@
-Brite
 afterAll
 ags
 altho
+Brite
 cancelation
 cancelations
+caracteres
+copyin
 datas
 edn
 eduction
+hasTable
 hasTables
 horizontalX
 horizontalY
 juxt
 methodd
+nd
 notIn
+optionA
+ot
 pass-thru
+requestor
+re-use
+re-used
 ser
 serieses
 sortings
+titel
 trs
 trsn
 tru
 trun
+unparseable
+withs

.codespellrc

@@ -1,3 +1,24 @@
 [codespell]
-skip = *.csv,*.edn,*.geojson,*.json,*.tsv,*.xml,docs/developers-guide/drivers/driver-tests.md,docs/developers-guide/e2e-tests.md,docs/questions/query-builder/expressions-list.md,docs/questions/visualizations/country-codes.md,e2e/test/scenarios/admin/i18n/content-translation/constants.ts,frontend/src/cljs,frontend/src/metabase/querying/expressions/tokenizer/lezer.js,frontend/src/metabase/static-viz/constants/char-sizes.ts,frontend/src/metabase/visualizations/lib/mapping_codes.ts,modules/drivers/mongo/src/metabase/driver/mongo/operators.clj
+skip =
+    *.csv,
+    *.edn,
+    *.geojson,
+    *.json,
+    *.tsv,
+    *.unit.spec.*,
+    *.xml,
+    docs/developers-guide/drivers/driver-tests.md,
+    docs/developers-guide/e2e-tests.md,
+    docs/questions/query-builder/expressions-list.md,
+    docs/questions/visualizations/country-codes.md,
+    e2e/test/scenarios/admin/i18n/content-translation/constants.ts,
+    frontend/src/cljs,
+    frontend/src/metabase/querying/expressions/tokenizer/lezer.js,
+    frontend/src/metabase/query_builder/components/NativeQueryEditor/CodeMirrorEditor/language.ts,
+    frontend/src/metabase/static-viz/constants/char-sizes.ts,
+    frontend/src/metabase/visualizations/lib/mapping_codes.ts,
+    frontend/*/mocks/*,
+    modules/drivers/mongo/src/metabase/driver/mongo/operators.clj,
+    src/metabase/analyze/classifiers/name.clj,
+    src/metabase/util/currency.cljc,
 ignore-words = .codespellignore

.github/ISSUE_TEMPLATE/epic.md

@@ -1,23 +0,0 @@
----
-name: Epic (Internal Use)
-about: This issue is used to track a feature/project that may span several days
-  to weeks to implement. This is used by the core Metabase team to project plan
-  and manage work.
-title: "[Epic] Title"
-labels: ".Epic"
----
-
-### Links
-
-- [product doc](LINK_TO_PRODUCT_DOC)
-- [technical design doc](LINK_TO_TECHNICAL_DESIGN_DOC)
-- [testing plan](LINK_TO_TESTING_PLAN)
-- feature branch: `BRANCH_NAME`
-- issue links: _related issues, if any_
-
-### Implementation Plan
-
-```[tasklist]
-#### Milestone 1
-- [ ] _Add tasks here_
-```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -7,16 +7,13 @@ assignees: ''
 
 ---
 
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+**What problem will this feature request solve?**
 
-**Describe the solution you'd like**
+**Describe the solution you'd like.**
 A clear and concise description of what you want to happen.
 
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
+**How does this feature request impact you?**
+For example, is it a minor inconvenience, or does it block important work?
 
-**How important is this feature to you?**
-
-**Additional context**
+**Additional information**
 Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/task.md

@@ -1,14 +0,0 @@
----
-name: Task (Internal Use)
-about: This issue is used to track a smaller feature/task that does not require
-  being broken down to milestones. This is used by the core Metabase team to
-  project plan and manage work.
-labels: ".Task"
-
----
-
-**Context**
-
-
-- issue links: _related issues if any_
-

.github/PULL_REQUEST_TEMPLATE.md

@@ -25,3 +25,4 @@ _Upload a demo video or before/after screenshots if sensible or remove the secti
 ### Checklist
 
 - [ ] Tests have been added/updated to cover changes in this PR
+- [ ] If adding new Loki tests: they pass [stress testing](https://github.com/metabase/metabase/actions/workflows/loki-stress-test-flake-fix.yml)

.github/actions/maximize-disk-space/action.yml

@@ -0,0 +1,19 @@
+name: Maximize disk space
+description: Removes unused stuff from GH runner
+
+runs:
+  using: "composite"
+  steps:
+    - name: Maximize build space
+      shell: bash
+      run: |
+        echo "-- Dotnet"
+        sudo rm -rf /usr/share/dotnet
+        echo "-- Android"
+        sudo rm -rf /usr/local/lib/android
+        echo "-- Haskell"
+        sudo rm -rf /opt/ghc
+        echo "-- CodeQL"
+        sudo rm -rf /opt/hostedtoolcache/CodeQL
+
+        df -h

.github/actions/test-driver/action.yml

@@ -13,54 +13,21 @@ inputs:
     required: false
     description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
 
-outputs:
-  quarantine-skipped:
-    description: Whether the driver test was skipped due to quarantine
-    value: ${{ steps.check-driver.outputs.skip }}
-
 runs:
   using: "composite"
   steps:
-    - name: Check if driver is ignored
-      id: check-driver
-      shell: bash
-      run: |
-        # If DRIVERS env var is not set, proceed with tests
-        if [ -z "$DRIVERS" ]; then
-          echo "No DRIVERS env var set. Proceeding with tests."
-          echo "skip=false" >> $GITHUB_OUTPUT
-          exit 0
-        fi
-
-        # Fetch CI config and check if driver should be skipped
-        curl -sSf -o ci-test-config.json https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json || true
-
-        # Check if the driver is in the ignored list (gracefully handle missing/invalid config)
-        IS_IGNORED=$(jq --arg driver "$DRIVERS" '.ignored.drivers // [] | contains([$driver])' ci-test-config.json 2>/dev/null || echo "false")
-
-        if [ "$IS_IGNORED" = "true" ]; then
-          echo "⚠️  Driver '$DRIVERS' is in the ignored list. Skipping tests."
-          echo "View the ignored list here: https://github.com/metabase/ci-test-config/blob/master/ci-test-config.json"
-          echo "skip=true" >> $GITHUB_OUTPUT
-        else
-          echo "Driver '$DRIVERS' is not ignored. Proceeding with tests."
-          echo "skip=false" >> $GITHUB_OUTPUT
-        fi
-
     - name: Prepare back-end environment
-      if: steps.check-driver.outputs.skip != 'true'
       uses: ./.github/actions/prepare-backend
     - name: Prepare front-end environment
-      if: ${{ steps.check-driver.outputs.skip != 'true' && inputs.build-static-viz == 'true' }}
+      if: ${{ inputs.build-static-viz == 'true' }}
       uses: ./.github/actions/prepare-frontend
     - name: Build static viz frontend
-      if: ${{ steps.check-driver.outputs.skip != 'true' && inputs.build-static-viz == 'true' }}
+      if: ${{ inputs.build-static-viz == 'true' }}
       run: yarn build-static-viz
       shell: bash
       env:
         MB_EDITION: ee
     - name: Test database driver
-      if: steps.check-driver.outputs.skip != 'true'
       run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash
       id: run-test
@@ -73,7 +40,7 @@ runs:
       # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
       # test.outcome gives us access to the result before `continue-on-error` overrides it and sets it to 'success'.
       # We want test reports even if the test step gets cancelled (e.g. times out), hence we match anything that is not a 'success'.
-      if: ${{ steps.run-test.outcome != 'success' && steps.check-driver.outputs.skip != 'true' }}
+      if: ${{ steps.run-test.outcome != 'success' }}
       with:
         path: "target/junit/**/*_test.xml"
         name: JUnit Test Report ${{ inputs.junit-name }}
@@ -82,7 +49,7 @@ runs:
         list-tests: failed
         fail-on-error: false
     - name: Upload Logs on Failure
-      if: always() && steps.run-test.outcome != 'success' && steps.check-driver.outputs.skip != 'true'
+      if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v4
       with:
         name: ${{ format('test-logs-{0}{1}', github.job, (inputs.logs-artifact-suffix == '' || inputs.logs-artifact-suffix == null) && '' || format('-{0}', inputs.logs-artifact-suffix)) }}

.github/scripts/generate-llms-txt.js

@@ -0,0 +1,317 @@
+const fs = require("fs");
+const path = require("path");
+
+const REPO = "metabase/metabase";
+const OUTPUT_FILE = "llms.txt";
+
+// Sections to generate llms-<name>-full.txt for.
+// Each section can define a preamble (introductory content before the main docs).
+const LLMS_FULL_TO_GENERATE = [
+  {
+    section: "embedding",
+    getPreamble: (branch) =>
+      aboveVersion(branch, 57) ? getModularEmbeddingGotchaNotes() : "",
+  },
+];
+
+/**
+ * List directory recursively to get markdown files
+ *
+ * @param {string} docsPath - full path to docs directory
+ * @returns {Array} list of markdown file objects with fullPath and relativePath
+ */
+function getMarkdownFilesList(docsPath) {
+  if (!fs.existsSync(docsPath)) {
+    console.error(`Error: Docs directory '${docsPath}' does not exist`);
+    process.exit(1);
+  }
+
+  const entries = fs.readdirSync(docsPath, {
+    recursive: true,
+    withFileTypes: true,
+  });
+
+  return entries
+    .filter((entry) => {
+      return (
+        entry.isFile() &&
+        // Only markdown files
+        entry.name.endsWith(".md") &&
+        // Ignore README.md
+        entry.name !== "README.md" &&
+        // Ignore node_modules and hidden directories
+        !entry.parentPath
+          .split(path.sep)
+          .some((dir) => dir === "node_modules" || dir.startsWith("."))
+      );
+    })
+    .map((entry) => {
+      const fullPath = path
+        .join(entry.parentPath, entry.name)
+        .replace(/\\/g, "/");
+
+      const relativePath = path
+        .relative(docsPath, fullPath)
+        .replace(/\\/g, "/");
+
+      return { fullPath, relativePath };
+    });
+}
+
+/**
+ * Generate llms.txt file with links to all markdown files in docs/
+ *
+ * @param {string} branch - branch name (e.g. 'master' or 'release-x.58.x')
+ * @param {Array} files - list of all markdown file objects
+ * @param {Array<Object>} sectionsConfig - list of section config objects to generate complete references for
+ */
+function generateLlmsTxt(branch, files, sectionsConfig) {
+  const baseUrl = `https://raw.githubusercontent.com/${REPO}/refs/heads/${branch}`;
+
+  const filesToExtract = files
+    // Files in embedding/sdk/api/snippets does not exist in the repo.
+    .filter(
+      (file) => !file.relativePath.startsWith("embedding/sdk/api/snippets"),
+    );
+
+  const entries = filesToExtract.map((file) => {
+    const content = fs.readFileSync(file.fullPath, "utf8");
+    const title = extractTitle(content, file.relativePath);
+    const url = `${baseUrl}/docs/${file.relativePath}`;
+
+    return { title, url, path: file.relativePath };
+  });
+
+  // Generate table of contents entries
+  const tableOfContents = entries.map(
+    (entry) => `- [${entry.title}](${entry.url})`,
+  );
+
+  // Generate complete references entries
+  const completeReferences = sectionsConfig
+    .filter((config) =>
+      files.some((file) => file.relativePath.startsWith(`${config.section}/`)),
+    )
+    .map((config) => {
+      const capitalized =
+        config.section.charAt(0).toUpperCase() + config.section.slice(1);
+      return `- [${capitalized} - Complete Reference](${baseUrl}/llms-${config.section}-full.txt)`;
+    });
+
+  // Generate llms.txt content using template literal
+  const content = `# Metabase Documentation
+Metabase - The simplest, fastest way to get business intelligence and analytics to everyone in your company.
+
+## Table of Contents
+
+${tableOfContents.join("\n")}
+
+## Complete References
+
+These files are very large and are around 90,000 tokens. Do not use by default unless the context window is huge or RAG is supported in your editor.
+
+${completeReferences.join("\n")}
+`;
+
+  fs.writeFileSync(OUTPUT_FILE, content, "utf8");
+
+  console.log(
+    `✅ Generated ${OUTPUT_FILE} with ${entries.length} markdown files`,
+  );
+  console.log(`   Branch: ${branch}`);
+  console.log(`   Base URL: ${baseUrl}`);
+}
+
+/**
+ * Generate llms-full.txt files for specified sections
+ *
+ * @param {string} branch - branch name (e.g., 'master', 'release-x.58.x')
+ * @param {Array} files - list of all markdown file objects
+ * @param {Array<Object>} sectionsConfig - list of section config objects to generate full files for
+ */
+function generateLlmsFullFiles(branch, files, sectionsConfig) {
+  const baseUrl = `https://raw.githubusercontent.com/${REPO}/refs/heads/${branch}`;
+
+  sectionsConfig.forEach((config) => {
+    generateLlmsFullTxt(branch, config, files, baseUrl);
+  });
+}
+
+/**
+ * LLMs are likely to pay attention to the very first lines.
+ *
+ * We add the most important context for LLMs to avoid
+ * confusion and pitfalls like out-of-date APIs in trained data.
+ *
+ * @returns {string} Markdown formatted gotcha notes
+ */
+function getModularEmbeddingGotchaNotes() {
+  return `> **Important Version Notes**
+>
+> Watch out for these deprecated props and gotchas for Metabase 57 onwards, for modular embedding:
+>
+> 1. \`config\` prop on MetabaseProvider no longer exist - it is replaced by \`authConfig\`.
+> 2. \`authProviderUri\` field no longer exist.
+> 3. \`jwtProviderUri\` optional field only exists in v58+. This is used to make JWT auth faster by skipping the \`GET /auth/sso\` discovery request. Not needed for initial implementation.
+> 4. \`fetchRequestToken\` is not needed by default. This is only used to customize how the SDK fetches the request token.
+> 5. Numeric IDs must be integers not strings, e.g. \`dashboardId={1}\`. When the ID is retrieved from the URL and it is numeric, convert it to an integer via \`parseInt\` before passing it to the SDK. IDs can also be strings for entity ids, so you should not parse all IDs as numbers if entity ids are also to be expected.
+`;
+}
+
+/**
+ * Generate llms-full.txt file for a specific section
+ * @param {string} branch - The branch name
+ * @param {Object} config - Section config object with section name and optional getPreamble function
+ * @param {Array} files - Array of all markdown file objects
+ * @param {string} baseUrl - Base URL for raw GitHub links
+ */
+function generateLlmsFullTxt(branch, config, files, baseUrl) {
+  const { section, getPreamble } = config;
+
+  // Filter docs for this section
+  const sectionFiles = files.filter((file) =>
+    file.relativePath.startsWith(`${section}/`),
+  );
+
+  if (sectionFiles.length === 0) {
+    console.log(`   Skipping llms-full.txt for ${section} (no files found)`);
+    return;
+  }
+
+  // Build content
+  const sectionCapitalized = section.charAt(0).toUpperCase() + section.slice(1);
+  const header = `# Metabase ${sectionCapitalized} - Complete Reference for AI agents
+
+> Table of contents: ${baseUrl}/${OUTPUT_FILE}
+
+`;
+
+  // Add preamble if provided (e.g., version-specific notes, warnings)
+  const preamble = getPreamble ? getPreamble(branch) : "";
+
+  // Concatenate all documents
+  const docs = sectionFiles
+    .map((file) => readAndCleanMarkdown(file.fullPath))
+    .join("\n");
+
+  // Write llms-full.txt file at repo root
+  const content = header + preamble + "\n" + docs;
+  const llmsFullPath = `llms-${section}-full.txt`;
+  fs.writeFileSync(llmsFullPath, content, "utf8");
+
+  console.log(
+    `✅ Generated ${llmsFullPath} with ${sectionFiles.length} documents`,
+  );
+}
+
+/**
+ * Extract title from markdown file frontmatter or filename.
+ *
+ * We try to extract the title in this order: 1) YAML frontmatter
+ * 2) first H1 heading, and 3) the Markdown file name.
+ *
+ * Example Markdown and frontmatter format:
+ * ```markdown
+ * ---
+ * title: "Getting Started"
+ * description: "A guide"
+ * ---
+ * # Getting Started
+ * ```
+ *
+ * @param {string} content - file content
+ * @param {string} filePath - relative file path
+ * @returns {string} title of content
+ */
+function extractTitle(content, filePath) {
+  // Try to extract title from YAML frontmatter
+  // First, match against the YAML frontmatter delimiter `---`
+  const frontmatterMatch = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n/);
+
+  if (frontmatterMatch) {
+    // Then, match against the title property
+    // Example: `title: "My Page"`
+    const frontmatter = frontmatterMatch[1];
+    const titleMatch = frontmatter.match(/^title:\s*(.+)$/m);
+
+    // Remove quotes if present
+    if (titleMatch) {
+      return titleMatch[1].trim().replace(/^["']|["']$/g, "");
+    }
+  }
+
+  // Try to extract title from first H1 heading
+  // Example: `# My Page`
+  const h1Match = content.match(/^#\s+(.+)$/m);
+
+  if (h1Match) {
+    return h1Match[1].trim();
+  }
+
+  // Fallback to filename, e.g. `my-page.md`
+  const filename = path.basename(filePath, ".md");
+
+  // Convert kebab-case or snake_case to Title Case
+  // `my-page.md` would become "My Page"
+  return filename
+    .split(/[-_]/)
+    .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+    .join(" ");
+}
+
+/**
+ * Read and clean markdown file content
+ *
+ * @param {string} filePath - full path to the markdown file
+ * @returns {string} cleaned markdown content with separator
+ */
+function readAndCleanMarkdown(filePath) {
+  let content = fs.readFileSync(filePath, "utf8");
+
+  // Strip YAML frontmatter
+  content = content.replace(/^---\s*\n[\s\S]*?\n---\s*\n/, "");
+
+  // Strip Jekyll/Liquid template syntax
+  content = content.replace(/\{%.*?%\}/g, "");
+  content = content.replace(/\{\{.*?\}\}/g, "");
+
+  return `${content.trim()}\n\n---\n`;
+}
+
+/**
+ * Check if branch version is above target version
+ * @param {string} branch - Branch name (e.g., 'master', 'release-x.58.x')
+ * @param {number} targetVersion - Target version number
+ * @returns {boolean}
+ */
+function aboveVersion(branch, targetVersion) {
+  if (branch === "master") {
+    return true;
+  }
+
+  // Parse version from release branch like "release-x.58.x" -> 58
+  const match = branch.match(/release-x\.(\d+)\.x/);
+  if (!match) {
+    return false;
+  }
+
+  const version = parseInt(match[1], 10);
+
+  return version >= targetVersion;
+}
+
+// Main execution
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  const docsPath = args[0] || "docs";
+  const branch = args[1] || "master";
+
+  const resolvedDocsPath = path.resolve(docsPath);
+  const markdownFiles = getMarkdownFilesList(resolvedDocsPath);
+
+  // Sort all files upfront for consistent ordering across all generated files
+  markdownFiles.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+
+  generateLlmsTxt(branch, markdownFiles, LLMS_FULL_TO_GENERATE);
+  generateLlmsFullFiles(branch, markdownFiles, LLMS_FULL_TO_GENERATE);
+}

.github/team.json

@@ -93,7 +93,9 @@
         "alxnddr",
         "bpander",
         "andsalves",
-        "gantoreno"
+        "gantoreno",
+        "kevinkelleher12",
+        "undrfined"
       ]
     },
     {

.github/workflows/claude-docs-review.yml

@@ -95,6 +95,8 @@ jobs:
 
             Use the docs-review skill to review all changed documentation files for compliance with the Metabase writing style guide.
 
+            IMPORTANT: Only review markdown files (.md and .mdx). Skip any .txt files or other non-markdown files.
+
             DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
 
           claude_args: |

.github/workflows/codespell.yml

@@ -3,17 +3,21 @@ name: Codespell
 on:
   push:
     branches:
-      - 'master'
-      - 'release-**'
+      - "master"
+      - "release-**"
   pull_request:
 
 jobs:
   codespell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: codespell-project/actions-codespell@v1
+      - uses: actions/checkout@v4
+      - uses: codespell-project/actions-codespell@v2
         with:
-          # keep this list in sync with the list in `mage/src/mage/codespell.yml`
+          # keep this list in sync with the list in `mage/src/mage/codespell.clj`
           path: >-
             docs
+            enterprise
+            frontend
+            modules/drivers
+            src

.github/workflows/docs-release-generate.yml

@@ -8,7 +8,7 @@ on:
       target_branch:
         description: "Target branch for documentation update"
         required: false
-        default: "release-x.57.x"
+        default: "release-x.58.x"
         type: string
 
 jobs:
@@ -16,6 +16,6 @@ jobs:
     name: Call documentation update for release branch
     uses: ./.github/workflows/docs-generate-base.yml
     with:
-      target_branch: ${{ inputs.target_branch || 'release-x.57.x' }}
+      target_branch: ${{ inputs.target_branch || 'release-x.58.x' }}
     secrets:
       automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers.yml

@@ -12,12 +12,52 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # This job will determine if the tier 3 driver tests should be skipped.
-  # It will always run first.
+  # This job determines which driver tests should run based on PR context.
+  # All decision logic is consolidated in mage driver-decisions.
   determine-driver-skips:
     runs-on: ubuntu-latest
     outputs:
-      skip: ${{ steps.check-branch-and-files-changed.outputs.skip }}
+      # All driver run decisions (from mage driver-decisions)
+      h2-should-run: ${{ steps.driver-decisions.outputs.h2-should-run }}
+      athena-should-run: ${{ steps.driver-decisions.outputs.athena-should-run }}
+      bigquery-should-run: ${{ steps.driver-decisions.outputs.bigquery-should-run }}
+      clickhouse-should-run: ${{ steps.driver-decisions.outputs.clickhouse-should-run }}
+      databricks-should-run: ${{ steps.driver-decisions.outputs.databricks-should-run }}
+      druid-should-run: ${{ steps.driver-decisions.outputs.druid-should-run }}
+      druid-jdbc-should-run: ${{ steps.driver-decisions.outputs.druid-jdbc-should-run }}
+      mongo-should-run: ${{ steps.driver-decisions.outputs.mongo-should-run }}
+      mongo-ssl-should-run: ${{ steps.driver-decisions.outputs.mongo-ssl-should-run }}
+      mongo-sharded-cluster-should-run: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-should-run }}
+      mysql-mariadb-should-run: ${{ steps.driver-decisions.outputs.mysql-mariadb-should-run }}
+      oracle-should-run: ${{ steps.driver-decisions.outputs.oracle-should-run }}
+      postgres-should-run: ${{ steps.driver-decisions.outputs.postgres-should-run }}
+      presto-jdbc-should-run: ${{ steps.driver-decisions.outputs.presto-jdbc-should-run }}
+      redshift-should-run: ${{ steps.driver-decisions.outputs.redshift-should-run }}
+      snowflake-should-run: ${{ steps.driver-decisions.outputs.snowflake-should-run }}
+      sparksql-should-run: ${{ steps.driver-decisions.outputs.sparksql-should-run }}
+      sqlite-should-run: ${{ steps.driver-decisions.outputs.sqlite-should-run }}
+      sqlserver-should-run: ${{ steps.driver-decisions.outputs.sqlserver-should-run }}
+      vertica-should-run: ${{ steps.driver-decisions.outputs.vertica-should-run }}
+      # Per-driver quarantine conflict flags (set when driver is quarantined but has file changes)
+      athena-quarantine-conflict: ${{ steps.driver-decisions.outputs.athena-quarantine-conflict }}
+      bigquery-quarantine-conflict: ${{ steps.driver-decisions.outputs.bigquery-quarantine-conflict }}
+      clickhouse-quarantine-conflict: ${{ steps.driver-decisions.outputs.clickhouse-quarantine-conflict }}
+      databricks-quarantine-conflict: ${{ steps.driver-decisions.outputs.databricks-quarantine-conflict }}
+      druid-quarantine-conflict: ${{ steps.driver-decisions.outputs.druid-quarantine-conflict }}
+      druid-jdbc-quarantine-conflict: ${{ steps.driver-decisions.outputs.druid-jdbc-quarantine-conflict }}
+      mongo-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-quarantine-conflict }}
+      mongo-ssl-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-ssl-quarantine-conflict }}
+      mongo-sharded-cluster-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-quarantine-conflict }}
+      mysql-mariadb-quarantine-conflict: ${{ steps.driver-decisions.outputs.mysql-mariadb-quarantine-conflict }}
+      oracle-quarantine-conflict: ${{ steps.driver-decisions.outputs.oracle-quarantine-conflict }}
+      postgres-quarantine-conflict: ${{ steps.driver-decisions.outputs.postgres-quarantine-conflict }}
+      presto-jdbc-quarantine-conflict: ${{ steps.driver-decisions.outputs.presto-jdbc-quarantine-conflict }}
+      redshift-quarantine-conflict: ${{ steps.driver-decisions.outputs.redshift-quarantine-conflict }}
+      snowflake-quarantine-conflict: ${{ steps.driver-decisions.outputs.snowflake-quarantine-conflict }}
+      sparksql-quarantine-conflict: ${{ steps.driver-decisions.outputs.sparksql-quarantine-conflict }}
+      sqlite-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlite-quarantine-conflict }}
+      sqlserver-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlserver-quarantine-conflict }}
+      vertica-quarantine-conflict: ${{ steps.driver-decisions.outputs.vertica-quarantine-conflict }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -26,29 +66,26 @@ jobs:
         run: |
           # Fetch the base branch to ensure its history is available for diffing
           git fetch --depth=1 origin ${{ github.event.pull_request.base.ref }}:${{ github.event.pull_request.base.ref }}
-          # Only run this if it's a pull request and the base ref exists
-      - name: Check if driver tests should run
-        id: check-branch-and-files-changed
+      - name: Determine which drivers should run
+        id: driver-decisions
         run: |
-          IS_MASTER_OR_RELEASE="${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}"
-          echo "Is master or release: ${IS_MASTER_OR_RELEASE}"
-
-          if [[ "${IS_MASTER_OR_RELEASE}" == "true" ]]; then
-            echo "skip=false" >> $GITHUB_OUTPUT
-            echo "Merging into master or a release branch. All driver tests will run."
-          else
-            echo "Checking for changes in relevant modules..."
-            if ./bin/mage can-skip-driver-tests "${{ github.event.pull_request.base.ref }}"; then
-              echo 'skip=true' >> $GITHUB_OUTPUT
-            else
-              echo 'skip=false' >> $GITHUB_OUTPUT
-            fi
-          fi
+          # All decision logic is in mage - it analyzes module dependencies,
+          # branch context, labels, and file changes to decide what runs.
+          MAGE_ARGS=(
+            --git-ref="${{ github.event.pull_request.base.ref || 'master' }}"
+            --is-master-or-release="${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}"
+            --pr-labels="${{ join(github.event.pull_request.labels.*.name, ',') }}"
+            --skip="${{ inputs.skip }}"
+          )
+          # First call: show human-readable output for debugging
+          ./bin/mage -driver-decisions "${MAGE_ARGS[@]}"
+          # Second call: output only key=value lines for GITHUB_OUTPUT
+          ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> $GITHUB_OUTPUT
         shell: bash
 
   be-tests-athena-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.athena-should-run == 'true' || needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -65,6 +102,16 @@ jobs:
       MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY }}
     name: Athena
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Athena driver is quarantined but you changed files in modules/drivers/athena/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Athena tests, add the label: break-quarantine-athena"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Athena driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Athena driver
       id: test-driver
@@ -76,7 +123,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -88,7 +135,7 @@ jobs:
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' || needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -116,6 +163,16 @@ jobs:
       MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
     name: BigQuery ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::BigQuery driver is quarantined but you changed files in modules/drivers/bigquery-cloud-sdk/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run BigQuery tests, add the label: break-quarantine-bigquery"
+        echo ""
+        echo "If you merge without testing, you risk breaking the BigQuery driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -131,7 +188,7 @@ jobs:
         logs-artifact-suffix: ${{ matrix.job.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -149,7 +206,7 @@ jobs:
 
   be-tests-clickhouse-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.clickhouse-should-run == 'true' || needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -173,6 +230,16 @@ jobs:
       MB_CLICKHOUSE_TEST_NGINX_PORT: 8127
     name: Clickhouse ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::ClickHouse driver is quarantined but you changed files in modules/drivers/clickhouse/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run ClickHouse tests, add the label: break-quarantine-clickhouse"
+        echo ""
+        echo "If you merge without testing, you risk breaking the ClickHouse driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -203,7 +270,7 @@ jobs:
         logs-artifact-suffix: ${{ matrix.job.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -221,7 +288,7 @@ jobs:
 
   be-tests-druid-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.druid-should-run == 'true' || needs.determine-driver-skips.outputs.druid-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -236,6 +303,16 @@ jobs:
           CLUSTER_SIZE: nano-quickstart
     name: Druid (Legacy)
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.druid-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Druid driver is quarantined but you changed files in modules/drivers/druid/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Druid tests, add the label: break-quarantine-druid"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Druid driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Druid driver
       id: test-driver
@@ -247,7 +324,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -259,7 +336,7 @@ jobs:
 
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -274,6 +351,16 @@ jobs:
           CLUSTER_SIZE: nano-quickstart
     name: Druid (JDBC)
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Druid JDBC driver is quarantined but you changed files in modules/drivers/druid-jdbc/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Druid JDBC tests, add the label: break-quarantine-druid-jdbc"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Druid JDBC driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Druid JDBC driver
       id: test-driver
@@ -285,7 +372,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -297,7 +384,7 @@ jobs:
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -312,6 +399,16 @@ jobs:
       MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
     name: Databricks
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Databricks driver is quarantined but you changed files in modules/drivers/databricks/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Databricks tests, add the label: break-quarantine-databricks"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Databricks driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Databricks driver
       id: test-driver
@@ -323,7 +420,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -335,7 +432,7 @@ jobs:
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -351,6 +448,16 @@ jobs:
       MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
     name: Databricks (Multi-Catalog)
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Databricks driver is quarantined but you changed files in modules/drivers/databricks/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Databricks tests, add the label: break-quarantine-databricks"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Databricks driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Databricks driver with multi-catalog
       id: test-driver
@@ -362,7 +469,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -373,7 +480,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-h2:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -391,7 +499,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -403,7 +511,7 @@ jobs:
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-should-run == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -521,7 +629,7 @@ jobs:
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
-        if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+        if: always()
         with:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
@@ -539,7 +647,7 @@ jobs:
 
   be-tests-mongo:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -576,6 +684,16 @@ jobs:
           MONGO_INITDB_ROOT_PASSWORD: metasample123
     name: ${{ matrix.version.name }} ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::MongoDB driver is quarantined but you changed files in modules/drivers/mongo/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run MongoDB tests, add the label: break-quarantine-mongo"
+        echo ""
+        echo "If you merge without testing, you risk breaking the MongoDB driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -591,7 +709,7 @@ jobs:
         logs-artifact-suffix: ${{ matrix.job.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -609,7 +727,7 @@ jobs:
 
   be-tests-mongo-ssl:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -627,6 +745,16 @@ jobs:
       MB_TEST_MONGO_REQUIRES_SSL: true
     name: "${{ matrix.version.name }} (SSL)"
     steps:
+      - name: Fail on quarantine conflict
+        if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
+        run: |
+          echo "::error::MongoDB SSL driver is quarantined but you changed files in modules/drivers/mongo/"
+          echo ""
+          echo "Your changes will NOT be tested because the driver is currently quarantined."
+          echo "To run MongoDB SSL tests, add the label: break-quarantine-mongo-ssl"
+          echo ""
+          echo "If you merge without testing, you risk breaking the MongoDB SSL driver!"
+          exit 1
       - uses: actions/checkout@v4
       - name: Spin up Mongo docker container
         run: >-
@@ -663,7 +791,7 @@ jobs:
             :only-tags [:mb/driver-tests]
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
-        if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+        if: always()
         with:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
@@ -675,7 +803,7 @@ jobs:
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -688,6 +816,16 @@ jobs:
           - "27017:17017"
     name: MongoDB Sharded Cluster
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::MongoDB Sharded Cluster driver is quarantined but you changed files in modules/drivers/mongo/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run MongoDB Sharded Cluster tests, add the label: break-quarantine-mongo-sharded-cluster"
+        echo ""
+        echo "If you merge without testing, you risk breaking the MongoDB Sharded Cluster driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test MongoDB driver (Sharded cluster)
       id: test-driver
@@ -698,7 +836,7 @@ jobs:
           :only metabase.driver.mongo.sharded-cluster-test
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -710,7 +848,7 @@ jobs:
 
   be-tests-oracle:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.oracle-should-run == 'true' || needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -761,6 +899,16 @@ jobs:
           - "1521:${{ matrix.version.port }}"
     name: ${{ matrix.version.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Oracle driver is quarantined but you changed files in modules/drivers/oracle/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Oracle tests, add the label: break-quarantine-oracle"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Oracle driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test ${{ matrix.version.name }}
       id: test-driver
@@ -773,7 +921,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -785,7 +933,7 @@ jobs:
 
   be-tests-postgres:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.postgres-should-run == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -876,7 +1024,7 @@ jobs:
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
-        if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+        if: always()
         with:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
@@ -894,7 +1042,7 @@ jobs:
 
   be-tests-presto-jdbc-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -917,6 +1065,16 @@ jobs:
         env:
           JAVA_TOOL_OPTIONS: "-Xmx2g"
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Presto JDBC driver is quarantined but you changed files in modules/drivers/presto-jdbc/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Presto JDBC tests, add the label: break-quarantine-presto-jdbc"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Presto JDBC driver!"
+        exit 1
     - uses: actions/checkout@v4
     - uses: ./.github/actions/await-port
       with:
@@ -953,7 +1111,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -965,7 +1123,7 @@ jobs:
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' || needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -1010,6 +1168,16 @@ jobs:
       MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
     name: ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Redshift driver is quarantined but you changed files in modules/drivers/redshift/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Redshift tests, add the label: break-quarantine-redshift"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Redshift driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1027,7 +1195,7 @@ jobs:
         logs-artifact-suffix: ${{ matrix.job.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: ${{ !matrix.job.skip && !cancelled() && steps.test-driver.outputs.quarantine-skipped != 'true' }}
+      if: ${{ !matrix.job.skip && !cancelled() }}
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -1045,7 +1213,7 @@ jobs:
 
   be-tests-snowflake-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.snowflake-should-run == 'true' || needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -1083,6 +1251,16 @@ jobs:
       MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
     name: Snowflake ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Snowflake driver is quarantined but you changed files in modules/drivers/snowflake/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Snowflake tests, add the label: break-quarantine-snowflake"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Snowflake driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1098,7 +1276,7 @@ jobs:
         logs-artifact-suffix: ${{ matrix.job.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -1116,7 +1294,7 @@ jobs:
 
   be-tests-sparksql-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.sparksql-should-run == 'true' || needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -1129,6 +1307,16 @@ jobs:
           - "10000:10000"
     name: Spark SQL
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::SparkSQL driver is quarantined but you changed files in modules/drivers/sparksql/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run SparkSQL tests, add the label: break-quarantine-sparksql"
+        echo ""
+        echo "If you merge without testing, you risk breaking the SparkSQL driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Spark driver
       id: test-driver
@@ -1140,7 +1328,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -1152,7 +1340,7 @@ jobs:
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.sqlite-should-run == 'true' || needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -1160,6 +1348,16 @@ jobs:
       DRIVERS: sqlite
     name: SQLite
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::SQLite driver is quarantined but you changed files in modules/drivers/sqlite/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run SQLite tests, add the label: break-quarantine-sqlite"
+        echo ""
+        echo "If you merge without testing, you risk breaking the SQLite driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test SQLite driver
       id: test-driver
@@ -1171,7 +1369,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -1183,7 +1381,7 @@ jobs:
 
   be-tests-sqlserver:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.sqlserver-should-run == 'true' || needs.determine-driver-skips.outputs.sqlserver-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     strategy:
@@ -1222,6 +1420,16 @@ jobs:
           MSSQL_MEMORY_LIMIT_MB: 1024
     name: ${{ matrix.version.name }} ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.sqlserver-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::SQL Server driver is quarantined but you changed files in modules/drivers/sqlserver/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run SQL Server tests, add the label: break-quarantine-sqlserver"
+        echo ""
+        echo "If you merge without testing, you risk breaking the SQL Server driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1237,7 +1445,7 @@ jobs:
         logs-artifact-suffix: ${{ matrix.version.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -1294,7 +1502,7 @@ jobs:
 
   login-to-ecr:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -1324,7 +1532,7 @@ jobs:
 
   be-tests-vertica-ee:
     needs: [determine-driver-skips, login-to-ecr]
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -1340,6 +1548,16 @@ jobs:
           password: ${{ needs.login-to-ecr.outputs.docker_password }}
     name: Vertica
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Vertica driver is quarantined but you changed files in modules/drivers/vertica/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Vertica tests, add the label: break-quarantine-vertica"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Vertica driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Make plugins directory
       run: mkdir plugins
@@ -1353,7 +1571,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -76,19 +76,15 @@ jobs:
     timeout-minutes: 60
     name: Stress test E2E flake fix
     env:
-      DISPLAY: ""
-      MB_RUN_MODE: e2e
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+      TERM: xterm
+      TZ: US/Pacific # to make Node match the instance tz
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      MB_SNOWPLOW_AVAILABLE: true
-      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
       MB_EDITION: ${{ inputs.mb_edition }}
       CYPRESS_ENABLE_NETWORK_THROTTLING: ${{ inputs.enable_network_throttling }}
-      TERM: xterm
-      TZ: US/Pacific # to make node match the instance tz
     steps:
       - uses: actions/checkout@v4
         with:
@@ -114,7 +110,6 @@ jobs:
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
 

.github/workflows/e2e-test.yml

@@ -29,6 +29,15 @@ on:
         required: false
         type: number
 
+env:
+  DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+  TERM: xterm
+  TZ: US/Pacific # to make Node match the instance tz
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
+  PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+  JOB_NAME: ${{ inputs.name }}
+
 jobs:
   e2e-tests:
     runs-on: ${{ inputs.runner }}
@@ -36,21 +45,12 @@ jobs:
     name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
     env:
       MB_EDITION: ${{ inputs.edition }}
-      DISPLAY: ""
-      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-      JOB_NAME: ${{ inputs.name }}
       # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
       # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
     steps:
       - uses: actions/checkout@v4
         with:
@@ -113,6 +113,7 @@ jobs:
         run: node e2e/runner/run_cypress_ci.js snapshot
 
       - name: Run auto-split Cypress tests on ${{ inputs.name }}
+        id: split-e2e
         if: ${{ !inputs.specs }}
         env:
           SPLIT: ${{ inputs.total_chunks }}
@@ -136,6 +137,7 @@ jobs:
         continue-on-error: true
 
       - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
+        id: tagged-e2e
         if: ${{ inputs.specs }}
         shell: bash
         env:
@@ -168,7 +170,8 @@ jobs:
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4
-        if: failure()
+        if: |
+          !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure')
         with:
           name: cypress-recording-${{ inputs.name }}-${{ inputs.edition }}
           path: |
@@ -178,10 +181,12 @@ jobs:
 
       - name: Upload Failed Tests
         uses: actions/upload-artifact@v4
-        if: failure()
+        if: |
+          !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure')
         with:
           name: failed-tests-${{ inputs.name }}-${{ inputs.edition }}
           path: ./cypress/test-results
+          if-no-files-found: ignore
 
       - name: Extract chunk-specific changed timings
         id: extract-timings

.github/workflows/embedding-sdk-component-tests.yml

@@ -3,6 +3,12 @@ name: Embedding SDK Component Tests
 on:
   workflow_call:
 
+env:
+  DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+  TERM: xterm
+  TZ: US/Pacific # to make Node match the instance tz
+  MB_EDITION: "ee"
+
 jobs:
   sdk-component-tests:
     name: "SDK component tests (React ${{ matrix.react-version }})"
@@ -13,17 +19,12 @@ jobs:
         react-version: [18, 19]
       fail-fast: false
     env:
-      MB_EDITION: ee
-      DISPLAY: ""
       # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
       # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
 
     steps:
       - uses: actions/checkout@v4
@@ -149,8 +150,6 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 45
     env:
-      MB_EDITION: ee
-      DISPLAY: ""
       MB_RUN_MODE: "e2e"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
@@ -159,9 +158,6 @@ jobs:
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
 
     steps:
       - name: Check out the code from the previous commit

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -3,6 +3,14 @@ name: "[NOT REQUIRED] SDK Compatibility tests"
 on:
   workflow_call:
 
+env:
+  DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+  TERM: xterm
+  TZ: US/Pacific # to make Node match the instance tz
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
+  PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+  MB_EDITION: ee
 jobs:
   get-sample-apps-data:
     runs-on: ubuntu-22.04
@@ -100,15 +108,9 @@ jobs:
     name: e2e-sample-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
       MB_EDITION: ee
-      DISPLAY: ""
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
-      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
       MB_RUN_MODE: e2e
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
       SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
       SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
@@ -117,6 +119,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: ./.github/actions/maximize-disk-space
+
       # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
       - name: Set up Docker Compose
         uses: docker/setup-compose-action@v1
@@ -237,14 +241,7 @@ jobs:
     timeout-minutes: 45
     name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
-      MB_EDITION: ee
-      DISPLAY: ""
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
-      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
       HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
       id-token: write

.github/workflows/llms-txt-generate.yml

@@ -0,0 +1,198 @@
+name: Generate llms.txt file
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.57.0)'
+        type: string
+        required: true
+      branch:
+        description: 'Target branch (e.g. release-x.57.x)'
+        type: string
+        required: true
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.57.0)'
+        type: string
+        required: true
+      branch:
+        description: 'Target branch (e.g. release-x.57.x)'
+        type: string
+        required: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  check-version:
+    name: Check if minor or major release
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      should_generate: ${{ steps.check.outputs.should_generate }}
+      target_branch: ${{ steps.check.outputs.target_branch }}
+      version: ${{ steps.check.outputs.version }}
+    steps:
+      - name: Check version
+        id: check
+        run: |
+          VERSION="${{ inputs.version }}"
+          BRANCH="${{ inputs.branch }}"
+
+          # Extract version number (e.g., v0.57.0 -> 0.57.0)
+          VERSION_NUM="${VERSION#v}"
+
+          # Count dots to determine version type
+          # Metabase format: v0.MAJOR.MINOR (3 segments) or v0.MAJOR.MINOR.PATCH (4 segments)
+          DOT_COUNT=$(echo "$VERSION_NUM" | tr -cd '.' | wc -c | tr -d ' ')
+
+          # Only proceed if this is a minor or major release (3 segments)
+          # Examples of minor/major releases: v0.57.8, v0.59.0
+          # Skip for patch releases (4 segments): v0.57.8.1
+          # Note: This is a safety check even though the workflow should only be called
+          # for minor/major releases, just in case the workflow is dispatched manually.
+          if [ "$DOT_COUNT" -eq 3 ]; then
+            echo "⏭️  This is a patch release ($VERSION). Skipping llms.txt generation."
+            echo "should_generate=false" >> $GITHUB_OUTPUT
+          else
+            echo "✅ This is a minor or major release ($VERSION). Proceeding with llms.txt generation for branch: $BRANCH"
+            echo "should_generate=true" >> $GITHUB_OUTPUT
+          fi
+
+          echo "target_branch=$BRANCH" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+  generate-llms-txt:
+    name: Generate llms.txt
+    needs: check-version
+    if: needs.check-version.outputs.should_generate == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    steps:
+
+      - name: Get the generate-llms-txt.js node script via sparse checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          ref: ${{ github.ref }}
+          sparse-checkout: |
+            .github/scripts
+          path: workflow-scripts
+
+      - name: Checkout target branch for docs
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          ref: ${{ needs.check-version.outputs.target_branch }}
+          path: metabase
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Generate llms.txt
+        id: generate
+        run: |
+          node workflow-scripts/.github/scripts/generate-llms-txt.js metabase/docs ${{ needs.check-version.outputs.target_branch }}
+
+      - name: Sanity check generated files
+        run: |
+          if [ ! -f "llms.txt" ]; then
+            echo "❌ Error: llms.txt was not generated"
+            exit 1
+          fi
+
+          if [ ! -f "llms-embedding-full.txt" ]; then
+            echo "❌ Error: llms-embedding-full.txt was not generated"
+            exit 1
+          fi
+
+          # Check that llms.txt contains URLs with the expected GitHub raw URL prefix
+          URL_COUNT=$(grep -o "https://raw.githubusercontent.com/metabase/metabase/refs/heads/${{ needs.check-version.outputs.target_branch }}/docs" llms.txt | wc -l)
+          if [ "$URL_COUNT" -lt 10 ]; then
+            echo "❌ Error: llms.txt appears to be malformed. Found only $URL_COUNT URLs (expected at least 10)"
+            exit 1
+          fi
+
+          echo "✅ Both llms.txt and llms-embedding-full.txt were generated successfully"
+          echo "✅ llms.txt contains $URL_COUNT documentation URLs"
+
+      - name: Set up git configuration
+        working-directory: metabase
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          BRANCH_NAME="llms-txt/auto-update-${{ needs.check-version.outputs.target_branch }}-$(date +%Y%m%d-%H%M%S)"
+          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
+          echo "Branch name will be: $BRANCH_NAME"
+
+      - name: Copy generated files to metabase repo
+        run: |
+          cp llms.txt metabase/
+          cp llms-embedding-full.txt metabase/
+
+      - name: Create Pull Request
+        id: create_pr
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          path: metabase
+          branch: ${{ env.BRANCH_NAME }}
+          base: ${{ needs.check-version.outputs.target_branch }}
+          commit-message: |
+            Update llms.txt and llms-full.txt (${{ needs.check-version.outputs.target_branch }})
+
+            Regenerated llms.txt to include all markdown files from the docs/ directory.
+            Also generated llms-full.txt files for the embedding section.
+
+            🤖 Generated automatically by llms-txt-generate workflow
+
+            Co-Authored-By: GitHub Actions <actions@github.com>
+          committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
+          author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
+          title: "[chore] Update llms.txt for ${{ needs.check-version.outputs.target_branch }}"
+          body: |
+            ## Summary
+            This PR contains automatically generated updates to `llms.txt` and `llms-embedding-full.txt` files, triggered by a minor or major release.
+
+            ## Changes
+            - The `llms.txt` file has been regenerated to include all markdown files from the `docs/` directory.
+            - The `llms-embedding-full.txt` file has been generated for the embedding section (concatenated documentation for RAG).
+
+            ## Generation
+            These files were generated using:
+            - Script: `.github/scripts/generate-llms-txt.js`
+            - Branch: `${{ needs.check-version.outputs.target_branch }}`
+            - Base URL: `https://raw.githubusercontent.com/metabase/metabase/refs/heads/${{ needs.check-version.outputs.target_branch }}`
+
+            Please review the changes and merge if they look correct.
+
+            🤖 Generated automatically by the `llms-txt-generate` workflow.
+
+            Co-Authored-By: GitHub Actions <actions@github.com>
+          labels: |
+            Type:Documentation
+            no-backport
+          add-paths: |
+            llms.txt
+            llms-embedding-full.txt
+
+      - name: Auto approve PR
+        if: steps.create_pr.outputs.pull-request-number != ''
+        working-directory: metabase
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr review "${{ steps.create_pr.outputs.pull-request-number }}" --approve --body "Auto-approved by llms-txt-generate workflow"
+
+      - name: Auto merge PR
+        if: steps.create_pr.outputs.pull-request-number != ''
+        working-directory: metabase
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: |
+          gh pr merge "${{ steps.create_pr.outputs.pull-request-number }}" --auto --squash

.github/workflows/loki-stress-test-flake-fix.yml

@@ -0,0 +1,114 @@
+name: Loki Visual Stress Test Flake Fix
+
+on:
+  workflow_dispatch:
+    inputs:
+      stories_filter:
+        description: "Regex pattern to filter stories (e.g. 'DataGrid' or 'static-viz|viz')"
+        type: string
+        required: true
+      burn_in:
+        description: "Number of times to run the test (e.g. 50)"
+        type: string
+        required: true
+        default: "50"
+
+jobs:
+  workflow-summary:
+    name: Stress test inputs
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - name: Generate workflow summary
+        run: |
+          echo '**Inputs:**' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `stories_filter`: ${{ inputs.stories_filter }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
+
+  stress-test-loki:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    name: Stress test Loki visual tests
+    services:
+      docker:
+        image: docker:19.03.12
+        options: --privileged
+        ports:
+          - 2376:2376
+        env:
+          DOCKER_TLS_CERTDIR: /certs
+        volumes:
+          - /var/run/docker.sock:/var/run/docker.sock
+          - /tmp/docker-certs:/certs/client
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Prepare frontend environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+
+      - name: Compile CLJS
+        run: NODE_ENV=development yarn build-pure:cljs
+
+      - name: Build Storybook (once)
+        run: yarn build-storybook
+
+      - name: Stress-test Loki "${{ inputs.stories_filter }}" ${{ inputs.burn_in }} times
+        run: |
+          BURN_IN=${{ inputs.burn_in }}
+          STORIES_FILTER='${{ inputs.stories_filter }}'
+
+          echo "Running Loki visual tests $BURN_IN times for stories matching: $STORIES_FILTER"
+          echo ""
+
+          FAILED=0
+          for i in $(seq 1 $BURN_IN); do
+            echo "=========================================="
+            echo "Run $i of $BURN_IN"
+            echo "=========================================="
+
+            if yarn test-visual:loki \
+              --reactUri file:./storybook-static \
+              --verboseRenderer \
+              --storiesFilter "$STORIES_FILTER"; then
+              echo "✅ Run $i passed"
+            else
+              echo "❌ Run $i FAILED"
+              FAILED=$((FAILED + 1))
+
+              mkdir -p .loki/failures/run-$i
+              cp -r .loki/difference/* .loki/failures/run-$i/ 2>/dev/null || true
+            fi
+            echo ""
+          done
+
+          echo "=========================================="
+          echo "Summary: $((BURN_IN - FAILED))/$BURN_IN passed, $FAILED failed"
+          echo "=========================================="
+
+          if [ $FAILED -gt 0 ]; then
+            echo "::error::$FAILED out of $BURN_IN runs failed"
+            exit 1
+          fi
+
+      - name: Generate Visual Report on Failure
+        if: failure()
+        run: yarn test-visual:loki-report
+
+      - name: Upload Artifact
+        id: artifact-upload-step
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: loki-stress-test-report
+          include-hidden-files: true
+          path: .loki/
+          if-no-files-found: ignore

.github/workflows/release.yml

@@ -424,6 +424,19 @@ jobs:
               }
             });
 
+  # updates the llms.txt asynchronously.
+  # release does not need to wait for this PR to be merged,
+  # because the llms.txt is in the main git repo.
+  trigger-update-llms-txt:
+    # do not trigger llms.txt update on automatic patch releases
+    if: ${{ !inputs.auto }}
+    needs: add-extra-tags
+    uses: ./.github/workflows/llms-txt-generate.yml
+    secrets: inherit
+    with:
+      version: ${{ inputs.version }}
+      branch: ${{ github.ref_name }}
+
   draft-release-notes:
     if: ${{ !inputs.auto }}
     needs: add-extra-tags

.github/workflows/snyk.yml

@@ -3,15 +3,15 @@ name: "Snyk"
 on:
   push:
     branches:
-      - 'master'
-      - 'release-**'
+      - "master"
+      - "release-**"
     paths:
-      - '**/deps.edn'
-      - '**/package.json'
-      - '.github/workflows/snyk.yml'
-      - '.github/scripts/write-poms.sh'
+      - "**/deps.edn"
+      - "**/package.json"
+      - ".github/workflows/snyk.yml"
+      - ".github/scripts/write-poms.sh"
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
 
 jobs:
   # Generate pom.xml files for all Maven projects
@@ -45,26 +45,6 @@ jobs:
             file: yarn.lock
             package-manager: yarn
             category: main-frontend-yarn
-          - name: Embedding SDK Template
-            file: bin/embedding-sdk/templates/yarn.lock
-            package-manager: yarn
-            category: embedding-sdk-template
-          - name: E2E Angular 20 Host App
-            file: e2e/embedding-sdk-host-apps/angular-20-host-app/package-lock.json
-            package-manager: npm
-            category: e2e-angular-host
-          - name: E2E Next 15 App Router
-            file: e2e/embedding-sdk-host-apps/next-15-app-router-host-app/package-lock.json
-            package-manager: npm
-            category: e2e-next-app-router
-          - name: E2E Next 15 Pages Router
-            file: e2e/embedding-sdk-host-apps/next-15-pages-router-host-app/package-lock.json
-            package-manager: npm
-            category: e2e-next-pages-router
-          - name: E2E Vite 6 Host App
-            file: e2e/embedding-sdk-host-apps/vite-6-host-app/package-lock.json
-            package-manager: npm
-            category: e2e-vite-host
           - name: Release Helper
             file: release/yarn.lock
             package-manager: yarn

.github/workflows/translation-update.yml

@@ -15,8 +15,8 @@ jobs:
       BRANCH_NAME: update-translations-${{ github.run_id }}
       CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
       CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
-      GITHUB_TOKEN: ${{ github.token }}
-      GH_TOKEN: ${{ github.token }}
+      GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+      GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -107,7 +107,7 @@ jobs:
       - name: Auto approve PR
         uses: juliangruber/approve-pull-request-action@v1
         with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          github-token: ${{ github.token }}
           number: ${{ steps.create_pr.outputs.pr_number }}
 
       - name: Enable Pull Request Automerge

.github/workflows/whitespace.yml

@@ -16,5 +16,5 @@ jobs:
     - uses: actions/checkout@v4
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
-    - run: clojure -T:whitespace-linter lint
+    - run: clojure -T:whitespace-linter lint :whitespace-linter/progress-bar false
       name: Run Whitespace Linter

.gitignore

@@ -21,7 +21,8 @@
 /*.mv.db
 /*.trace.db
 /.babel_cache
-/.env
+/.env*
+!/.env.example
 /.envrc
 /.lein-env
 /.lein-failures

.husky/pre-commit

@@ -1,6 +1,3 @@
-#!/bin/sh
-. "$(dirname "$0")/_/husky.sh"
-
 yarn precommit
 
 # Run the formatter
@@ -9,4 +6,4 @@ yarn precommit
 # ATM, you can manually run ./bin/cljfmt_staged.sh if you want to format locally staged files and inspect after.
 # ./bin/cljfmt_staged.sh
 
-./hooks/pre-commit.nocommit
+./hooks/pre-commit.nocommit

.storybook/preview.tsx

@@ -120,8 +120,8 @@ function CssVariables() {
       Theming-specific CSS variables.
       These CSS variables are not part of the core design system colors.
     **/
-        --mb-color-bg-dashboard: var(--mb-color-bg-white);
-        --mb-color-bg-dashboard-card: var(--mb-color-bg-white);
+        --mb-color-bg-dashboard: var(--mb-color-background-primary);
+        --mb-color-bg-dashboard-card: var(--mb-color-background-primary);
       }
 
       /* For Embed frame questions to render properly */

README.md

@@ -97,7 +97,7 @@ This repository contains the source code for both the Open Source edition of Met
 
 See [LICENSE.txt](./LICENSE.txt) for details.
 
-Unless otherwise noted, all files © 2025 Metabase, Inc.
+Unless otherwise noted, all files © 2026 Metabase, Inc.
 
 ## Community
 

bb.edn

@@ -1,15 +1,15 @@
 {:min-bb-version "1.12.212"
  ;; we put path as bin, and everything is in the ./mage subdirectory,
  ;; so the namespaces are mage.cli, mage.format, etc.
- :paths          ["mage/src" "mage/test" "bin/lint-migrations-file/src"]
- :deps           {dev.weavejester/cljfmt     {:mvn/version "0.15.3"} ;; run cljfmt from bb
-                  io.github.paintparty/bling {:mvn/version "0.8.8"} ;; printing bells and whistles
-                  medley/medley              {:mvn/version "1.3.0"} ;; utilities
-                  metosin/malli              {:mvn/version "0.17.0"} ;; data validation
-                  mvxcvi/puget               {:mvn/version "1.3.4"} ;; pretty printing
-                  org.babashka/json          {:mvn/version "0.1.6"} ;; json parsing
-                  table/table                {:mvn/version "0.5.0"} ;; table printing
-                  }
+ :paths ["mage/src" "mage/test" "bin/lint-migrations-file/src"]
+ :deps {dev.weavejester/cljfmt {:mvn/version "0.15.3"} ;; run cljfmt from bb
+        io.github.paintparty/bling {:mvn/version "0.8.8"} ;; printing bells and whistles
+        medley/medley {:mvn/version "1.3.0"} ;; utilities
+        metosin/malli {:mvn/version "0.17.0"} ;; data validation
+        mvxcvi/puget {:mvn/version "1.3.4"} ;; pretty printing
+        org.babashka/json {:mvn/version "0.1.6"} ;; json parsing
+        table/table {:mvn/version "0.5.0"} ;; table printing
+        }
  :tasks
  {:requires [[mage.cli :as cli]
              [mage.color :as c]]
@@ -21,214 +21,220 @@
                     (cons 'do body))))
 
   alias
-  {:doc        "Installs 'mage' alias and autocomplete"
-   :examples   [["./bin/mage alias" "Prints instructions to install the 'mage' alias and autocomplete"]
-                ["./bin/mage alias install fish" "Installs mage alias for fish shell"]
-                ["./bin/mage alias print zsh" "Prints shell script to put into .zshrc for zsh users"]]
-   :requires   [[mage.alias :as alias]]
+  {:doc "Installs 'mage' alias and autocomplete"
+   :examples [["./bin/mage alias" "Prints instructions to install the 'mage' alias and autocomplete"]
+              ["./bin/mage alias install fish" "Installs mage alias for fish shell"]
+              ["./bin/mage alias print zsh" "Prints shell script to put into .zshrc for zsh users"]]
+   :requires [[mage.alias :as alias]]
    :arg-schema [:or
                 [:tuple [:enum {:name "shell-type"} "bash" "zsh" "fish"]]
                 [:tuple [:enum {:name "mode"} "install" "print"]
-                        [:enum {:name "shell-type"} "bash" "zsh" "fish"]]]
-   :task       (task! (alias/instructions parsed))}
+                 [:enum {:name "shell-type"} "bash" "zsh" "fish"]]]
+   :task (task! (alias/instructions parsed))}
 
   cljfmt-staged
-  {:doc      "Runs cljfmt on staged files"
+  {:doc "Runs cljfmt on staged files"
    :requires [[mage.format :as format]]
    :examples [["./bin/mage cljfmt-staged" "Format staged files"]
               ["./bin/mage cljfmt-staged -c" "Check staged files"]]
-   :options  [["-c" "--force-check" "Check staged files"]]
-   :task     (task! (format/staged parsed))}
+   :options [["-c" "--force-check" "Check staged files"]]
+   :task (task! (format/staged parsed))}
 
   cljfmt-files
-  {:doc        "Runs cljfmt on the given files/directories"
-   :requires   [[mage.format :as format]]
-   :examples   [["./bin/mage cljfmt-files src/metabase/events.clj" "Format events.clj"]
-                ["./bin/mage cljfmt-files src" "Format all files in src"]
-                ["./bin/mage cljfmt-files -c src" "Check all files in src"]]
-   :options    [["-c" "--force-check" "Check staged files"]]
+  {:doc "Runs cljfmt on the given files/directories"
+   :requires [[mage.format :as format]]
+   :examples [["./bin/mage cljfmt-files src/metabase/events.clj" "Format events.clj"]
+              ["./bin/mage cljfmt-files src" "Format all files in src"]
+              ["./bin/mage cljfmt-files -c src" "Check all files in src"]]
+   :options [["-c" "--force-check" "Check staged files"]]
    :arg-schema [:sequential [:string {:name "file-or-directory"
                                       :description "Files or directories to format."}]]
-   :task       (task! (format/files parsed))}
+   :task (task! (format/files parsed))}
 
   cljfmt-all
-  {:doc      "Runs cljfmt on all (clojure) files"
+  {:doc "Runs cljfmt on all (clojure) files"
    :requires [[mage.format :as format]]
    :examples [["./bin/mage cljfmt-all" "Format all files"]]
-   :options  [["-c" "--force-check" "Check staged files"]]
-   :task     (task! (format/all parsed))}
+   :options [["-c" "--force-check" "Check staged files"]]
+   :task (task! (format/all parsed))}
 
   cljfmt-updated
-  {:doc        "Runs cljfmt on all (Clojure) files relative to a git ref (default HEAD)"
-   :requires   [[mage.format :as format]]
-   :examples   [["./bin/mage cljfmt-updated" "Format updated files relative to HEAD"]
-                ["./bin/mage cljfmt-updated master" "Format updated files relative to master"]]
-   :options    [["-c" "--force-check" "Check staged files"]]
+  {:doc "Runs cljfmt on all (Clojure) files relative to a git ref (default HEAD)"
+   :requires [[mage.format :as format]]
+   :examples [["./bin/mage cljfmt-updated" "Format updated files relative to HEAD"]
+              ["./bin/mage cljfmt-updated master" "Format updated files relative to master"]]
+   :options [["-c" "--force-check" "Check staged files"]]
    :arg-schema [:or [:tuple] [:tuple [:string {:name "git-ref" :description "Git ref to compare against"}]]]
-   :task       (task! (format/updated parsed))}
+   :task (task! (format/updated parsed))}
 
   kondo
-  {:doc      "Runs Kondo against a file, directory, or everything we usually lint"
+  {:doc "Runs Kondo against a file, directory, or everything we usually lint"
    :examples [["./bin/mage kondo" "run Kondo against everything we usually lint"]
               ["./bin/mage kondo src/metabase/db.clj" "run Kondo against a file"]
               ["./bin/mage kondo src/metabase/db.clj src/metabase/config.clj" "run Kondo against 2 files"]
               ["./bin/mage kondo src/metabase/api/macros" "run Kondo against a directory"]]
    :requires [[mage.kondo :as kondo]]
-   :task     (task! (kondo/kondo (:arguments parsed)))}
+   :task (task! (kondo/kondo (:arguments parsed)))}
 
   kondo-updated
-  {:doc      "Runs kondo against files changed compared to a git ref"
+  {:doc "Runs kondo against files changed compared to a git ref"
    :examples [["./bin/mage kondo-updated" "run Kondo on files with changes relative to HEAD"]
               ["./bin/mage kondo-updated master" "run Kondo on files with changes relative to master"]]
    :requires [[mage.kondo :as kondo]]
-   :task     (task! (kondo/kondo-updated (:arguments parsed)))}
+   :task (task! (kondo/kondo-updated (:arguments parsed)))}
 
   check
-  {:doc      "Checks whether we can compile all source files (and finds circular dependencies)"
+  {:doc "Checks whether we can compile all source files (and finds circular dependencies)"
    :examples [["./bin/mage check"]]
    :requires [[mage.check]]
-   :task     (task! (mage.check/check (:arguments parsed)))}
+   :task (task! (mage.check/check (:arguments parsed)))}
 
   codespell
-  {:doc      "Check for misspellings in the source code."
+  {:doc "Check for misspellings in the source code."
    :examples [["./bin/mage codespell"]]
    :requires [[mage.codespell]]
-   :task     (task! (mage.codespell/codespell (:arguments parsed)))}
+   :task (task! (mage.codespell/codespell (:arguments parsed)))}
 
   codespell-interactive
-  {:doc      "Check for misspellings in the source code, and interactively prompt to fix them."
+  {:doc "Check for misspellings in the source code, and interactively prompt to fix them."
    :examples [["./bin/mage codespell-interactive"]]
    :requires [[mage.codespell]]
-   :task     (task! (mage.codespell/codespell-interactive (:arguments parsed)))}
+   :task (task! (mage.codespell/codespell-interactive (:arguments parsed)))}
 
   start-maildev
-  {:doc      "Start Maildev"
+  {:doc "Start Maildev"
    :examples [["./bin/mage start-maildev -h" "print help for start-maildev"]]
    :requires [[mage.start-maildev :as start-maildev]]
-   :task     (task! (start-maildev/start-maildev!))}
+   :task (task! (start-maildev/start-maildev!))}
+
+  start-python-runner
+  {:doc      "Start python-runner container with internal Moto S3 server for Python transforms"
+   :examples [["./bin/mage start-python-runner" "start python-runner with internal S3"]]
+   :requires [[mage.start-python-runner :as start-python-runner]]
+   :task     (task! (start-python-runner/start-python-runner!))}
 
   start-db
-  {:doc        "Start a db on a default port in docker"
-   :examples   [["./bin/mage start-db postgres latest" "start the latest postgres db we support"]
-                ["./bin/mage start-db mysql oldest" "start the oldest mysql db we support"]]
-   :requires   [[mage.start-db :as start-db]]
+  {:doc "Start a db on a default port in docker"
+   :examples [["./bin/mage start-db postgres latest" "start the latest postgres db we support"]
+              ["./bin/mage start-db mysql oldest" "start the oldest mysql db we support"]]
+   :requires [[mage.start-db :as start-db]]
    :arg-schema [:tuple
                 [:enum {:name "db"} :postgres :mysql :mariadb :mongo]
                 [:enum {:name "relative-version"} :oldest :latest]]
-   :db-info      {:postgres {:ports {:oldest 5432  :latest 5433}  :eol-url "https://endoflife.date/api/postgres.json"}
-                  :mysql    {:ports {:oldest 3308  :latest 3309}  :eol-url "https://endoflife.date/api/mysql.json"}
-                  :mariadb  {:ports {:oldest 3306  :latest 3307}  :eol-url "https://endoflife.date/api/mariadb.json"}
-                  :mongo    {:ports {:oldest 27017 :latest 27018} :eol-url "https://endoflife.date/api/mongodb.json"}}
-   :usage-fn   start-db/usage
-   :task       (task!
-                (let [[db version] (:arguments parsed)]
-                  (start-db/start-db (:db-info (current-task)) db version)))}
+   :db-info {:postgres {:ports {:oldest 5432 :latest 5433} :eol-url "https://endoflife.date/api/postgres.json"}
+             :mysql {:ports {:oldest 3308 :latest 3309} :eol-url "https://endoflife.date/api/mysql.json"}
+             :mariadb {:ports {:oldest 3306 :latest 3307} :eol-url "https://endoflife.date/api/mariadb.json"}
+             :mongo {:ports {:oldest 27017 :latest 27018} :eol-url "https://endoflife.date/api/mongodb.json"}}
+   :usage-fn start-db/usage
+   :task (task!
+          (let [[db version] (:arguments parsed)]
+            (start-db/start-db (:db-info (current-task)) db version)))}
 
   nrepl
-  {:doc      "Starts the babashka nrepl: helpful for mage development"
+  {:doc "Starts the babashka nrepl: helpful for mage development"
    :requires [[babashka.nrepl.server :as nrepl.server]
               [mage.color :as c]]
    :examples [["./bin/mage nrepl" "Starts the nrepl server"]
               ["./bin/mage nrepl --port 50506" "Starts the nrepl server"]
               ["./bin/mage nrepl -p 50506" "Starts the nrepl server"]]
-   :options  [["-p" "--port PORT" "optionally provide a port to run the nrepl server on" :default 1667 :parse-fn Integer/parseInt]]
-   :task     (task!
-              (let [{:keys [port]} (:options parsed)]
-                (spit ".nrepl-port" port)
-                (nrepl.server/start-server! {:port port})
-                (deref (promise))))}
+   :options [["-p" "--port PORT" "optionally provide a port to run the nrepl server on" :default 1667 :parse-fn Integer/parseInt]]
+   :task (task!
+          (let [{:keys [port]} (:options parsed)]
+            (spit ".nrepl-port" port)
+            (nrepl.server/start-server! {:port port})
+            (deref (promise))))}
 
   lint-migrations
-  {:doc        "Lint migrations files"
-   :requires   [[lint-migrations-file]
-                [babashka.process :as p]]
-   :examples   [["./bin/mage lint-migrations" "Lint all migrations and print report"]]
-   :task       (do (cli/parse! (current-task))
-                   (p/shell "bin/pre-lint-migrations-file.sh")
-                   (lint-migrations-file/-main))}
+  {:doc "Lint migrations files"
+   :requires [[lint-migrations-file]
+              [babashka.process :as p]]
+   :examples [["./bin/mage lint-migrations" "Lint all migrations and print report"]]
+   :task (do (cli/parse! (current-task))
+             (p/shell "bin/pre-lint-migrations-file.sh")
+             (lint-migrations-file/-main))}
 
   jar-download
-  {:doc        "Download (and optionally run) jar for a metabase version or branch"
-   :examples   [["./bin/mage jar-download 50" "Download the latest enterprise version of release 50 to ~/path/to/my/metabase/jars"]
-                ["./bin/mage jar-download 1.45.2 -r" "Download and run metabase_1.45.2.jar"]
-                ["./bin/mage jar-download 1.45.2 -d ~/path/to/my/jars" "Download metabase_1.45.2.jar to ~/path/to/my/jars, deleting if it exists"]
-                ["./bin/mage jar-download master --run --port 3001" "Download and run the latest master branch jar on port 3001"]
-                ["JARS=~/my-stuff ./bin/mage jar-download 1.45.2" "Download metabase_1.45.2.jar to ~/my-stuff"]
-                ["./bin/mage jar-download v1.56.0-beta -r" "Download and run metabase_1.56.0-beta.jar"]]
-   :requires   [[mage.jar-download :as jar-download]]
-   :options    [["-r" "--run" "run the new jar after downloading it"]
-                ["-e" "--env-file FILE" "you can optionally provide a lein-env file to specify the environment to use when running the jar."]
-                ["-d" "--delete" "delete the old jar if found, by default does not re-download it"]
-                ["-p" "--port PORT" "you can optionally provide a port to run the jar on, if not, we use a sane port."]]
+  {:doc "Download (and optionally run) jar for a metabase version or branch"
+   :examples [["./bin/mage jar-download 50" "Download the latest enterprise version of release 50 to ~/path/to/my/metabase/jars"]
+              ["./bin/mage jar-download 1.45.2 -r" "Download and run metabase_1.45.2.jar"]
+              ["./bin/mage jar-download 1.45.2 -d ~/path/to/my/jars" "Download metabase_1.45.2.jar to ~/path/to/my/jars, deleting if it exists"]
+              ["./bin/mage jar-download master --run --port 3001" "Download and run the latest master branch jar on port 3001"]
+              ["JARS=~/my-stuff ./bin/mage jar-download 1.45.2" "Download metabase_1.45.2.jar to ~/my-stuff"]
+              ["./bin/mage jar-download v1.56.0-beta -r" "Download and run metabase_1.56.0-beta.jar"]]
+   :requires [[mage.jar-download :as jar-download]]
+   :options [["-r" "--run" "run the new jar after downloading it"]
+             ["-e" "--env-file FILE" "you can optionally provide a lein-env file to specify the environment to use when running the jar."]
+             ["-d" "--delete" "delete the old jar if found, by default does not re-download it"]
+             ["-p" "--port PORT" "you can optionally provide a port to run the jar on, if not, we use a sane port."]]
    :arg-schema [:or
                 [:tuple [:string {:name "version"}]]
                 [:tuple [:string {:name "version"}] [:string {:name "path"}]]]
-   :usage-fn  (fn [_]
-                (-> "Version can have the following forms:"
-                    (str "\n  -" (c/green "50")  " for the latest enterprise version of release 50")
-                    (str "\n  -" (c/green "1.45.2")  " for a specific version")
-                    (str "\n  -" (c/green "master")  " for the latest jar created for master")
-                    (str "\n  -" (c/green "any-branch-with-a-pr")  " for the latest uberjar created for that branch")
-                    (str "\n  -" (c/green "1.56.0-beta") " for a specific beta version")
-                    (str "\n\nnote: If you get an error about 'Invalid or corrupt jarfile', run this command again with --delete.")))
-   :task       (task! (jar-download/jar-download parsed))}
+   :usage-fn (fn [_]
+               (-> "Version can have the following forms:"
+                   (str "\n  -" (c/green "50") " for the latest enterprise version of release 50")
+                   (str "\n  -" (c/green "1.45.2") " for a specific version")
+                   (str "\n  -" (c/green "master") " for the latest jar created for master")
+                   (str "\n  -" (c/green "any-branch-with-a-pr") " for the latest uberjar created for that branch")
+                   (str "\n  -" (c/green "1.56.0-beta") " for a specific beta version")
+                   (str "\n\nnote: If you get an error about 'Invalid or corrupt jarfile', run this command again with --delete.")))
+   :task (task! (jar-download/jar-download parsed))}
 
   setup-stats-repl
   {:doc "Connect to the stats repl"
    :examples [["./bin/mage connect-stats-repl" "Connects to the stats repl"]]
    :requires [[mage.stats-repl :as stats-repl]]
-   :task     (stats-repl/connect (cli/parse! (current-task)))}
+   :task (stats-repl/connect (cli/parse! (current-task)))}
 
   notify
-  {:doc      "Send notification for a comment (that already exists)"
+  {:doc "Send notification for a comment (that already exists)"
    :requires [[mage.be-dev :refer [nrepl-eval]]]
-   :options  [["-c" "--comment-id ID" "Notify about this comment id"]
-              ["-p" "--port PORT" "Port to use for the task, defaults to value in .nrepl-port"]]
+   :options [["-c" "--comment-id ID" "Notify about this comment id"]
+             ["-p" "--port PORT" "Port to use for the task, defaults to value in .nrepl-port"]]
    :examples [["./bin/mage notify -c 1234" "Notify about comment with id 1234"]
               ["./bin/mage notify --comment-id 5678 --port 59498" "Notify about comment with id 5678 on nrepl port 59498"]]
-   :task     (let [opts (:options (cli/parse! (current-task)))
+   :task (let [opts (:options (cli/parse! (current-task)))
                    ;; note: no quoting -> expect it to be int
-                   code (format "(notify-comment-id! %d)" (parse-long (:comment-id opts)))]
-               (if (:port opts)
-                 (nrepl-eval "metabase.comments.core" code (:port opts))
-                 (nrepl-eval "metabase.comments.core" code)))}
+               code (format "(notify-comment-id! %d)" (parse-long (:comment-id opts)))]
+           (if (:port opts)
+             (nrepl-eval "metabase.comments.core" code (:port opts))
+             (nrepl-eval "metabase.comments.core" code)))}
 
   run-tests
-  {:doc        "Quickly run tests locally. Pass dirs/files as arguments to run them."
-   :examples   [["./bin/mage run-tests" "launch interactive test picker"]
-                ["./bin/mage run-tests test/metabase/db" "run tests in test/metabase/db"]
-                ["./bin/mage run-tests test/metabase/logger test/metabase/api_keys" "run tests in test/metabase/logger and src/metabase/api_keys"]
-                ["./bin/mage run-tests test/metabase/config_test.clj" "run all tests in the metabase.config-test namespace"]]
+  {:doc "Quickly run tests locally. Pass dirs/files as arguments to run them."
+   :examples [["./bin/mage run-tests" "launch interactive test picker"]
+              ["./bin/mage run-tests test/metabase/db" "run tests in test/metabase/db"]
+              ["./bin/mage run-tests test/metabase/logger test/metabase/api_keys" "run tests in test/metabase/logger and src/metabase/api_keys"]
+              ["./bin/mage run-tests test/metabase/config_test.clj" "run all tests in the metabase.config-test namespace"]]
    ;; TODO: add option to select files as well as dirs from fzf with styles
-   :options    [["-s" "--selecting STYLE" "Style of test selection" :default "all"]
+   :options [["-s" "--selecting STYLE" "Style of test selection" :default "all"]
                 ;; all, file, dir
-                ["-p" "--port PORT" "Port to use for the task, defaults to value in .nrepl-port"]]
+             ["-p" "--port PORT" "Port to use for the task, defaults to value in .nrepl-port"]]
    :arg-schema [:sequential
                 {:details "If none are given, you will be prompted to select directories recursively from test/ and enterprise/backend/test/"}
                 [:string {:name "file-or-dir" :description "Files or directories (recursive) to test"}]]
-   :requires   [[mage.quick-test-runner :as qtr]] 
-   :task       (task! (qtr/go parsed))}
+   :requires [[mage.quick-test-runner :as qtr]]
+   :task (task! (qtr/go parsed))}
 
   affected-modules
-  {:doc      "Which backend modules have changes?"
+  {:doc "Which backend modules have changes?"
    :examples [["./bin/mage affected-modules master" "prints changes compared to `master`"]
               ["./bin/mage affected-modules"]]
    :arg-schema [:or [:tuple] [:tuple [:string {:name "git-ref"}]]]
    :requires [[mage.modules]]
-   :task     (task! (mage.modules/cli-print-affected-modules (:arguments parsed)))}
+   :task (task! (mage.modules/cli-print-affected-modules (:arguments parsed)))}
 
   can-skip-driver-tests
-  {:doc      "Can we skip driver tests for this branch?"
+  {:doc "Can we skip driver tests for this branch?"
    :examples [["./bin/mage can-skip-driver-tests master" "Returns zero (success) if we can skip driver tests based on changes related to `master`"]
               ["./bin/mage can-skip-driver-tests" "Returns zero (success) if we can skip driver tests based on changes? (defaults to master)"]]
    :requires [[mage.modules]]
-   :task     (task! (mage.modules/cli-can-skip-driver-tests (:arguments parsed)))}
+   :task (task! (mage.modules/cli-can-skip-driver-tests (:arguments parsed)))}
 
   ls
-  {:doc      "List all mage public and private tasks"
+  {:doc "List all mage public and private tasks"
    :examples [["./bin/mage ls" "List all tasks"]]
    :requires [[mage.util :as u]]
-   :task     (task! (u/print-tasks parsed))}
+   :task (task! (u/print-tasks parsed))}
 
   analytics:setup
   {:doc "Set up usage analytics development mode"
@@ -267,18 +273,51 @@
    :examples [["./bin/mage doctor" "Run all health checks"]]
    :requires [[mage.doctor :as doctor]]
    :task (task! (doctor/doctor!))}
-  
+
   ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
   ;; Private Tasks:
   ;; These tasks are more for internal tooling, e.g. for use from git hooks etc.
   ;; - hidden from `./bin/mage` listing and `bb tasks`, these all - start with a `-`
 
+  -driver-decisions
+  {:doc "Determine which driver tests should run based on PR context. Outputs decisions for all drivers."
+   :examples [["./bin/mage -driver-decisions --git-ref=master --is-master-or-release=false --pr-labels= --skip=false" "Determine driver decisions for a PR"]
+              ["./bin/mage -driver-decisions --pr-labels=ci:all-cloud-drivers" "Run all cloud drivers via label"]
+              ["./bin/mage -driver-decisions --github-output-only" "Output only GITHUB_OUTPUT format (for CI)"]]
+   :usage-fn
+   (fn [_]
+     (->>
+      ["# How we decide to run a driver's tests. For each driver, we check these conditions in order (first match wins):"
+       " |----------|-------------------------------------|--------|-------------------------------------------|"
+       " | Priority | Condition                           | Result | Reason                                    |"
+       " |----------|-------------------------------------|--------|-------------------------------------------|"
+       " | 1        | Global skip (no backend changes)    | SKIP   | workflow skip (no backend changes)        |"
+       " | 2        | Driver is :h2                       | RUN    | H2 always runs                            |"
+       " | 3        | Driver is quarantined               | SKIP   | driver is quarantined                     |"
+       " | 3(a)     | ...and has break-quarantine-X label | RUN    | anti-quarantine label present             |"
+       " | 4        | On master or release branch         | RUN    | master/release branch                     |"
+       " | 5        | Cloud driver + ci:all-cloud-drivers | RUN    | ci:all-cloud-drivers label                |"
+       " | 6        | Cloud driver + its files changed    | RUN    | driver files changed                      |"
+       " | 7        | Cloud driver, no relevant changes   | SKIP   | no relevant changes for cloud driver      |"
+       " | 8        | Driver deps affected by changes     | RUN    | driver module affected by shared code     |"
+       " | 9        | Self-hosted driver, not affected    | SKIP   | driver module not affected                |"
+       " |----------|-------------------------------------|--------|-------------------------------------------|"
+       ""] (str/join "\n")))
+   :options [[nil "--git-ref REF" "The git ref to compute changed modules against"]
+             [nil "--is-master-or-release MASTER_OR_RELEASE"]
+             [nil "--pr-labels PR_LABELS" "Comma delimited labels on the pr"]
+             [nil "--skip SKIP"]
+             [nil "--github-output-only" "Only output GITHUB_OUTPUT format (no human-readable output)"]]
+   :requires [[clojure.string :as str]
+              [mage.modules]]
+   :task (task! (mage.modules/-main parsed))}
+
   -install-merge-drivers
   {:doc "Installs custom git merge drivers for YAML migration files."
    :requires [[mage.util :as u]
               [clojure.string :as str]]
    :task (task!
-          (let [git-dir (u/sh "git rev-parse --git-dir")
+          (let [git-dir (u/sh "git rev-parse --git-common-dir")
                 git-config-file (str git-dir "/config")
                 the-include (str "\n"
                                  "[include]\n"
@@ -293,7 +332,7 @@
    :requires [[clojure.string :as str]
               [mage.util :as u]]
    :task (task!
-          (let [git-dir (u/sh "git rev-parse --git-dir")
+          (let [git-dir (u/sh "git rev-parse --git-common-dir")
                 git-config-file (str git-dir "/config")
                 the-include (str "\n"
                                  "[include]\n"
@@ -313,38 +352,38 @@
                 [:string {:name "base" :description "ancestor's version (base)"}]
                 [:string {:name "ours" :description "current version (ours)"}]
                 [:string {:name "theirs" :description "other branch's version (theirs)"}]
-                [:int    {:name "conflict-marker-size" :description "conflict marker size" :min 0}]
+                [:int {:name "conflict-marker-size" :description "conflict marker size" :min 0}]
                 [:string {:name "file-path" :description "file path"}]]
    :requires [[mage.merge-yaml-migrations]]
    :task (task! (mage.merge-yaml-migrations/-main parsed))}
-  
+
   -play
-  {:doc        "Play sounds from mage.sound"
-   :examples   [["./bin/mage -play success" "play success sound"] ["./bin/mage -play s" "play success sound"]
-                ["./bin/mage -play error" "play error sound"]     ["./bin/mage -play e" "play error sound"]
-                ["./bin/mage -play ping" "play ping sound"]       ["./bin/mage -play p" "play ping sound"]
-                ["./bin/mage -play warning" "play warning sound"] ["./bin/mage -play w" "play warning sound"]]
-   :requires   [[mage.sound :as sound]]
+  {:doc "Play sounds from mage.sound"
+   :examples [["./bin/mage -play success" "play success sound"] ["./bin/mage -play s" "play success sound"]
+              ["./bin/mage -play error" "play error sound"] ["./bin/mage -play e" "play error sound"]
+              ["./bin/mage -play ping" "play ping sound"] ["./bin/mage -play p" "play ping sound"]
+              ["./bin/mage -play warning" "play warning sound"] ["./bin/mage -play w" "play warning sound"]]
+   :requires [[mage.sound :as sound]]
    :arg-schema [:tuple [:enum "s" "success" "e" "error" "p" "ping" "w" "warning"]]
-   :task       (task! (case (first (:arguments parsed))
-                        ("s" "success") (sound/success)
-                        ("e" "error")   (sound/error)
-                        ("p" "ping")    (sound/ping)
-                        ("w" "warning") (sound/warning)))}
-  
+   :task (task! (case (first (:arguments parsed))
+                  ("s" "success") (sound/success)
+                  ("e" "error") (sound/error)
+                  ("p" "ping") (sound/ping)
+                  ("w" "warning") (sound/warning)))}
+
   -token-scan
-  {:doc        "Security token scanner for detecting leaked API keys and secrets"
-   :examples   [["./bin/mage -token-scan deps.edn bb.edn" "Scan specific files"]
-                ["./bin/mage -token-scan -v deps.edn" "Scan with verbose output"]
-                ["./bin/mage -token-scan -a" "Scan all files in the project"]]
-   :requires   [[mage.token-scan :as token-scan]]
-   :options    [["-a" "--all-files" "Scan all files in the project"]
-                ["-v" "--verbose" "Verbose output"]]
+  {:doc "Security token scanner for detecting leaked API keys and secrets"
+   :examples [["./bin/mage -token-scan deps.edn bb.edn" "Scan specific files"]
+              ["./bin/mage -token-scan -v deps.edn" "Scan with verbose output"]
+              ["./bin/mage -token-scan -a" "Scan all files in the project"]]
+   :requires [[mage.token-scan :as token-scan]]
+   :options [["-a" "--all-files" "Scan all files in the project"]
+             ["-v" "--verbose" "Verbose output"]]
    :arg-schema [:sequential [:string {:description "Files to scan"}]]
-   :task       (task! (token-scan/run-scan parsed))}
+   :task (task! (token-scan/run-scan parsed))}
 
   -repl
-  {:doc      "Eval a string of clojure code in the backend dev server"
+  {:doc "Eval a string of clojure code in the backend dev server"
    :requires [[babashka.process :as process]
               [mage.color :as c]
               [mage.be-dev :refer [nrepl-eval]]]
@@ -356,16 +395,16 @@
                "Evaluate a keyword inside a namespace"]]
    :options [["-n" "--namespace NAMESPACE" "Namespace to use for the task"]
              ["-p" "--port PORT" "Port to use for the task, defaults to value in .nrepl-port"]]
-   :task     (let [parsed (cli/parse! (current-task))
-                   code (first (:arguments parsed))
-                   port (or (:port (:options parsed))
-                            (slurp ".nrepl-port")
-                            (throw (ex-info (c/red "No port specified, and no .nrepl-port file found.") {:babashka/exit 1})))
-                   nns (or (:namespace (:options parsed)) "user")]
-               (nrepl-eval nns code port))}
+   :task (let [parsed (cli/parse! (current-task))
+               code (first (:arguments parsed))
+               port (or (:port (:options parsed))
+                        (slurp ".nrepl-port")
+                        (throw (ex-info (c/red "No port specified, and no .nrepl-port file found.") {:babashka/exit 1})))
+               nns (or (:namespace (:options parsed)) "user")]
+           (nrepl-eval nns code port))}
 
   -check-readable
-  {:doc      "Check that code is readable parens a file"
+  {:doc "Check that code is readable parens a file"
    :requires [[mage.readability-check :as readability]]
    :arg-schema [:or
                 [:tuple [:string {:name "file"
@@ -379,60 +418,59 @@
                "Check file for readability"]
               ["./bin/mage -check-readable dev/src/dev.clj 300"
                "Check top level form containing line 300 for readability"]]
-   :task     (let [{:keys [arguments]} (cli/parse! (current-task))]
-               (apply readability/check arguments))}
+   :task (let [{:keys [arguments]} (cli/parse! (current-task))]
+           (apply readability/check arguments))}
 
   ;; Uncomment this if you want to play with the example calculator task:
-  #_#_
-  -example-calculator
-  {;; `:doc` is a short docstring for the task, will be listed in `./bin/mage -h` and other help info.
+  #_#_-example-calculator
+    {;; `:doc` is a short docstring for the task, will be listed in `./bin/mage -h` and other help info.
    ;; Keep these short, they need to fit on one line in the output from `./bin/mage -h`.
-   :doc        "The example calculator's task docstring"
+     :doc "The example calculator's task docstring"
    ;; examples get printed out when you pass -h or --help.
-   :examples   [["./bin/mage -example-calculator 1 + 99" "evaluates to 100"]
+     :examples [["./bin/mage -example-calculator 1 + 99" "evaluates to 100"]
                 ["./bin/mage -example-calculator 100 - 99" "evaluates to 1"]]
    ;; The task is the actual code that runs when you run the task.
-   :task       (task!
-                (println "Parsed input:") (u/pp parsed)
-                (let [{:keys [arguments data]} parsed
-                      [a op b]                 arguments]
-                  (println a (name op) b "=" (c/blue (({:+ + :- -} op) a b)))))
+     :task (task!
+            (println "Parsed input:") (u/pp parsed)
+            (let [{:keys [arguments data]} parsed
+                  [a op b] arguments]
+              (println a (name op) b "=" (c/blue (({:+ + :- -} op) a b)))))
    ;; (optional) `:require` lazily libraries for just your task:
-   :requires   [[mage.color :as c]
+     :requires [[mage.color :as c]
                 [mage.util :as u]]
    ;; (optional) `:options` are passed to [[clojure.tools.cli/parse-opts]].
    ;; See: https://clojure.github.io/tools.cli/index.html#clojure.tools.cli/parse-opts
-   :options    [["-n" "--negate" "Negate the result of the calculation"]
-                ["-a" "--also-add N" "Add N to the result of the calculation"]]
+     :options [["-n" "--negate" "Negate the result of the calculation"]
+               ["-a" "--also-add N" "Add N to the result of the calculation"]]
    ;; (optional) `:arg-schema` is a malli schema for the arguments passed to the task, after the options
-   :arg-schema [:tuple [:int {:name "number-a"}] [:enum {:name "operation"} :+ :-] [:int {:name "number-b"}]]
+     :arg-schema [:tuple [:int {:name "number-a"}] [:enum {:name "operation"} :+ :-] [:int {:name "number-b"}]]
    ;; (optional) `:usage-fn` is a function called with the current-task map.
    ;; Returns a string containing extra-detailed usage information.
-   :usage-fn   (fn [{:keys [doc] :as _task}]
+     :usage-fn (fn [{:keys [doc] :as _task}]
                  (str "Optional extra usage information, for explicit callouts.\n"
                       "Reversed docstring: '" (c/green (apply str (reverse doc))) "'"))
    ;; (optional) Any other keys are completely allowed. Put things to lookup or that you want to be easy to change
    ;; here. These will be returned from `(current-task)`. See: start-db for an example of using `:ports` to define a
    ;; top-level map of ports. If something should be easily accessible in the task, put it here.
-   :data       {:a [:b :c] :b [:d]}}
+     :data {:a [:b :c] :b [:d]}}
 
-  -test {:doc      "run all mage tests"
+  -test {:doc "run all mage tests"
          :requires [[clojure.string :as str]
                     [clojure.test]
                     [mage.core-test] ;; loads the actual tests
                     [mage.util :as u]]
          :arg-schema [:sequential [:string {:name "test-matching-pattern"}]]
-         :task     (let [{:keys [arguments]} (task! parsed)
-                         pattern (if (seq arguments)
-                                   (str "^mage\\..*(" (str/join "|" arguments) ").*")
-                                   "^mage\\..*")
-                         _ (u/debug ["test regex matching pattern" pattern])
-                         results (clojure.test/run-all-tests (re-pattern pattern))]
-                     (if (zero? (+ (:fail results) (:error results)))
-                       (println (c/green "All mage tests passed!"))
-                       (do
-                         (println (c/red "Some mage tests failed."))
-                         (u/exit 1))))}
+         :task (let [{:keys [arguments]} (task! parsed)
+                     pattern (if (seq arguments)
+                               (str "^mage\\..*(" (str/join "|" arguments) ").*")
+                               "^mage\\..*")
+                     _ (u/debug ["test regex matching pattern" pattern])
+                     results (clojure.test/run-all-tests (re-pattern pattern))]
+                 (if (zero? (+ (:fail results) (:error results)))
+                   (println (c/green "All mage tests passed!"))
+                   (do
+                     (println (c/red "Some mage tests failed."))
+                     (u/exit 1))))}
 
   ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
   ;; Personal Tasks:
@@ -441,14 +479,14 @@
   ;; `./bin/mage` listing.
 
   -escherize-pr-summary
-  {:doc      "Print a day's PR summary for the metabase/metabase repo"
+  {:doc "Print a day's PR summary for the metabase/metabase repo"
    :requires [[mage.escherize.pr-summary :as eps]]
    :examples [["./bin/mage -escherize-pr-summary | pbcopy" "Copy your daily"]]
-   :task     (task! (eps/summarize-prs parsed))}
+   :task (task! (eps/summarize-prs parsed))}
 
   -escherize-fix-whitespace
   {:doc "Removes all lines like '^<space>+$' from files in glob pattern."
    :requires [[mage.escherize.fix-whitespace :as fix-whitespace]]
    :examples [["mage -escherize-fix-whitespace '**/*.clj{,c,s}'" "Removes all lines like '  ' from all clj files"]]
    :arg-schema [:sequential [:string {:name "glob-pattern" :description "Glob pattern to match files"}]]
-   :task     (task! (fix-whitespace/run-clean parsed))}}}
+   :task (task! (fix-whitespace/run-clean parsed))}}}

bin/build/src/build_drivers/lint_manifest_file.clj

@@ -47,7 +47,15 @@
                       :merge-map ::connection-property-map))
 (s/def ::merge-map (spell/keys :req-un [::merge]))
 
+(s/def ::container-style-type #{"grid" "component"})
+(s/def ::container-style (s/cat :type ::container-style-type :value string?))
+(s/def ::fields (s/coll-of ::connection-property))
+(s/def ::group-map (spell/keys :req-un [::container-style ::fields]))
+(s/def ::group-property (spell/keys :req-un [::group]))
+(s/def ::group ::group-map)
+
 (s/def ::connection-property (s/or :merge-with ::merge-map
+                                   :group-with ::group-property
                                    :property-name ::raw-property-name-ref
                                    :property-map (s/merge (spell/keys :req-un [::name]) ::connection-property-map)))
 

cmd/mb-proxy/main.go

@@ -1,711 +0,0 @@
-// mb-proxy: Caddy Admin API helper for per-branch Metabase routing.
-// Example usage:
-//
-//	go run ./cmd/mb-proxy add --host my-branch.metabase.localhost --frontend 3001 --backend 3002
-//	go run ./cmd/mb-proxy add --host my-branch.metabase.localhost --backend 4000
-//	go run ./cmd/mb-proxy remove --host my-branch.metabase.localhost
-//	go run ./cmd/mb-proxy list
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"strings"
-	"time"
-)
-
-const (
-	defaultAdminURL = "http://127.0.0.1:2019"
-)
-
-type registry struct {
-	Entries map[string]registryEntry `json:"entries"`
-}
-
-type registryEntry struct {
-	Host     string `json:"host"`
-	Server   string `json:"server"`
-	Frontend string `json:"frontend,omitempty"`
-	Backend  string `json:"backend,omitempty"`
-	Updated  string `json:"updated"`
-}
-
-type caddyClient struct {
-	baseURL string
-	client  *http.Client
-}
-
-type httpServer struct {
-	Listen []string `json:"listen"`
-}
-
-func main() {
-	if len(os.Args) < 2 {
-		fail(errors.New("expected subcommand: add | remove | list"))
-	}
-
-	fmt.Fprintf(os.Stderr, "[mb-proxy] subcommand=%s\n", os.Args[1])
-
-	switch os.Args[1] {
-	case "add":
-		addCmd(os.Args[2:])
-	case "remove":
-		removeCmd(os.Args[2:])
-	case "list":
-		listCmd(os.Args[2:])
-	case "ports":
-		portsCmd(os.Args[2:])
-	default:
-		fail(fmt.Errorf("unknown subcommand %q (expected add | remove | list)", os.Args[1]))
-	}
-}
-
-func addCmd(args []string) {
-	fs := flag.NewFlagSet("add", flag.ExitOnError)
-	var host, frontend, backend, admin, server, stateDir string
-	fs.StringVar(&host, "host", "", "Fully-qualified host (e.g. feature-x.metabase.localhost)")
-	fs.StringVar(&frontend, "frontend", "", "Frontend/WebSocket port (optional; requires --backend)")
-	fs.StringVar(&backend, "backend", "", "Backend port (required)")
-	fs.StringVar(&admin, "admin", envOrDefault("MB_PROXY_ADMIN", defaultAdminURL), "Caddy Admin API base URL (http://127.0.0.1:2019 or unix:///path)")
-	fs.StringVar(&server, "server", os.Getenv("MB_PROXY_SERVER"), "Caddy HTTP server name (optional; auto-detected if empty)")
-	fs.StringVar(&stateDir, "state-dir", os.Getenv("MB_PROXY_STATE_DIR"), "State directory (optional; auto-resolved if empty)")
-	fs.Parse(args)
-
-	if host == "" {
-		fail(errors.New("--host is required"))
-	}
-	if backend == "" {
-		fail(errors.New("--backend is required"))
-	}
-	if frontend != "" && backend == "" {
-		fail(errors.New("--frontend requires --backend"))
-	}
-
-	stateDir, err := resolveStateDir(stateDir)
-	if err != nil {
-		fail(err)
-	}
-	fmt.Fprintf(os.Stderr, "[mb-proxy] state_dir=%s\n", stateDir)
-	if err := os.MkdirAll(stateDir, 0o700); err != nil {
-		fail(fmt.Errorf("create state dir: %w", err))
-	}
-
-	unlock, err := lockState(stateDir)
-	if err != nil {
-		fail(err)
-	}
-	defer func() {
-		fmt.Fprintf(os.Stderr, "[mb-proxy] unlocking state\n")
-		unlock()
-	}()
-
-	reg, err := loadRegistry(stateDir)
-	if err != nil {
-		fail(err)
-	}
-
-	client, err := newCaddyClient(admin)
-	if err != nil {
-		fail(err)
-	}
-
-	serverName, err := resolveServerName(client, server)
-	if err != nil {
-		fail(err)
-	}
-
-	routes, err := client.getRoutes(serverName)
-	if err != nil {
-		fail(err)
-	}
-
-	newRoute := buildRoute(host, frontend, backend)
-	existingIdx := findRouteIndexForHost(routes, host)
-
-	if existingIdx >= 0 {
-		fmt.Fprintf(os.Stderr, "[mb-proxy] updating route host=%s server=%s index=%d\n", host, serverName, existingIdx)
-		if err := client.putRoute(serverName, existingIdx, newRoute); err != nil {
-			fail(err)
-		}
-		fmt.Printf("Updated route for %s on server %s (index %d)\n", host, serverName, existingIdx)
-	} else {
-		fmt.Fprintf(os.Stderr, "[mb-proxy] creating route host=%s server=%s\n", host, serverName)
-		if err := client.postRoute(serverName, newRoute); err != nil {
-			fail(err)
-		}
-		fmt.Printf("Added route for %s on server %s\n", host, serverName)
-	}
-
-	reg.Entries[host] = registryEntry{
-		Host:     host,
-		Server:   serverName,
-		Frontend: frontend,
-		Backend:  backend,
-		Updated:  time.Now().Format(time.RFC3339),
-	}
-	if err := saveRegistry(stateDir, reg); err != nil {
-		fail(err)
-	}
-}
-
-func removeCmd(args []string) {
-	fs := flag.NewFlagSet("remove", flag.ExitOnError)
-	var host, admin, server, stateDir string
-	fs.StringVar(&host, "host", "", "Fully-qualified host to remove")
-	fs.StringVar(&admin, "admin", envOrDefault("MB_PROXY_ADMIN", defaultAdminURL), "Caddy Admin API base URL")
-	fs.StringVar(&server, "server", os.Getenv("MB_PROXY_SERVER"), "Caddy HTTP server name (optional)")
-	fs.StringVar(&stateDir, "state-dir", os.Getenv("MB_PROXY_STATE_DIR"), "State directory (optional)")
-	fs.Parse(args)
-
-	if host == "" {
-		fail(errors.New("--host is required"))
-	}
-
-	stateDir, err := resolveStateDir(stateDir)
-	if err != nil {
-		fail(err)
-	}
-	fmt.Fprintf(os.Stderr, "[mb-proxy] state_dir=%s\n", stateDir)
-	if err := os.MkdirAll(stateDir, 0o700); err != nil {
-		fail(fmt.Errorf("create state dir: %w", err))
-	}
-
-	unlock, err := lockState(stateDir)
-	if err != nil {
-		fail(err)
-	}
-	defer func() {
-		fmt.Fprintf(os.Stderr, "[mb-proxy] unlocking state\n")
-		unlock()
-	}()
-
-	reg, err := loadRegistry(stateDir)
-	if err != nil {
-		fail(err)
-	}
-
-	client, err := newCaddyClient(admin)
-	if err != nil {
-		fail(err)
-	}
-
-	serverName := server
-	if serverName == "" {
-		if entry, ok := reg.Entries[host]; ok && entry.Server != "" {
-			serverName = entry.Server
-		}
-	}
-	serverName, err = resolveServerName(client, serverName)
-	if err != nil {
-		fail(err)
-	}
-
-	routes, err := client.getRoutes(serverName)
-	if err != nil {
-		fail(err)
-	}
-	idx := findRouteIndexForHost(routes, host)
-	if idx >= 0 {
-		fmt.Fprintf(os.Stderr, "[mb-proxy] deleting route host=%s server=%s index=%d\n", host, serverName, idx)
-		if err := client.deleteRoute(serverName, idx); err != nil {
-			fail(err)
-		}
-		fmt.Printf("Removed route for %s (index %d) from server %s\n", host, idx, serverName)
-	} else {
-		fmt.Printf("No route found for %s on server %s (nothing to remove)\n", host, serverName)
-	}
-
-	delete(reg.Entries, host)
-	if err := saveRegistry(stateDir, reg); err != nil {
-		fail(err)
-	}
-
-	if len(reg.Entries) == 0 {
-		if err := stopCaddy(); err != nil {
-			fmt.Fprintf(os.Stderr, "Warning: failed to stop Caddy (no hosts remaining): %v\n", err)
-		} else {
-			fmt.Println("Stopped Caddy (no hosts remaining)")
-		}
-	}
-}
-
-func listCmd(args []string) {
-	fs := flag.NewFlagSet("list", flag.ExitOnError)
-	var stateDir string
-	fs.StringVar(&stateDir, "state-dir", os.Getenv("MB_PROXY_STATE_DIR"), "State directory (optional)")
-	fs.Parse(args)
-
-	stateDir, err := resolveStateDir(stateDir)
-	if err != nil {
-		fail(err)
-	}
-	fmt.Fprintf(os.Stderr, "[mb-proxy] state_dir=%s\n", stateDir)
-	reg, err := loadRegistry(stateDir)
-	if err != nil {
-		fail(err)
-	}
-	if len(reg.Entries) == 0 {
-		fmt.Println("No hosts registered.")
-		return
-	}
-	for host, entry := range reg.Entries {
-		target := entry.Backend
-		if target == "" {
-			target = "(none)"
-		}
-		fmt.Printf("%s -> %s (server=%s", host, target, entry.Server)
-		if entry.Frontend != "" {
-			fmt.Printf(", frontend=%s", entry.Frontend)
-		}
-		fmt.Printf(", updated=%s)\n", entry.Updated)
-	}
-}
-
-func portsCmd(args []string) {
-	fs := flag.NewFlagSet("ports", flag.ExitOnError)
-	var count int
-	fs.IntVar(&count, "count", 1, "Number of free ports to return")
-	fs.Parse(args)
-
-	if count <= 0 {
-		fail(errors.New("--count must be >= 1"))
-	}
-
-	ports, err := getFreePorts(count)
-	if err != nil {
-		fail(err)
-	}
-	fmt.Println(strings.Join(ports, " "))
-}
-
-func getFreePorts(n int) ([]string, error) {
-	var listeners []net.Listener
-	var ports []string
-	for i := 0; i < n; i++ {
-		ln, err := net.Listen("tcp", "127.0.0.1:0")
-		if err != nil {
-			for _, l := range listeners {
-				_ = l.Close()
-			}
-			return nil, fmt.Errorf("get free port: %w", err)
-		}
-		listeners = append(listeners, ln)
-		_, portStr, err := net.SplitHostPort(ln.Addr().String())
-		if err != nil {
-			for _, l := range listeners {
-				_ = l.Close()
-			}
-			return nil, fmt.Errorf("parse port: %w", err)
-		}
-		if _, err := strconv.Atoi(portStr); err != nil {
-			for _, l := range listeners {
-				_ = l.Close()
-			}
-			return nil, fmt.Errorf("invalid port: %w", err)
-		}
-		ports = append(ports, portStr)
-	}
-	for _, l := range listeners {
-		_ = l.Close()
-	}
-	return ports, nil
-}
-
-func resolveStateDir(override string) (string, error) {
-	if override != "" {
-		return override, nil
-	}
-	if v := os.Getenv("MB_PROXY_STATE_DIR"); v != "" {
-		return v, nil
-	}
-	if v := os.Getenv("XDG_STATE_HOME"); v != "" {
-		return filepath.Join(v, "mb-proxy"), nil
-	}
-	if runtime.GOOS == "darwin" {
-		home, err := os.UserHomeDir()
-		if err != nil {
-			return "", err
-		}
-		return filepath.Join(home, "Library", "Application Support", "mb-proxy"), nil
-	}
-	if home, err := os.UserHomeDir(); err == nil {
-		return filepath.Join(home, ".local", "state", "mb-proxy"), nil
-	}
-	return filepath.Join(os.TempDir(), "mb-proxy"), nil
-}
-
-func lockState(stateDir string) (func(), error) {
-	lockPath := filepath.Join(stateDir, "registry.lock")
-	deadline := time.Now().Add(5 * time.Second)
-	staleAfter := 30 * time.Second
-	fmt.Fprintf(os.Stderr, "[mb-proxy] acquiring lock at %s\n", lockPath)
-	for {
-		err := os.Mkdir(lockPath, 0o700)
-		if err == nil {
-			fmt.Fprintf(os.Stderr, "[mb-proxy] lock acquired\n")
-			return func() { _ = os.Remove(lockPath) }, nil
-		}
-		if !errors.Is(err, os.ErrExist) {
-			return nil, fmt.Errorf("lock state: %w", err)
-		}
-
-		// Handle stale locks: if the lock dir is old, remove it and retry.
-		info, statErr := os.Stat(lockPath)
-		if statErr == nil {
-			if time.Since(info.ModTime()) > staleAfter {
-				fmt.Fprintf(os.Stderr, "[mb-proxy] removing stale lock (age=%s)\n", time.Since(info.ModTime()))
-				_ = os.Remove(lockPath)
-				continue
-			}
-		}
-
-		if time.Now().After(deadline) {
-			return nil, errors.New("timed out waiting for registry lock")
-		}
-		time.Sleep(100 * time.Millisecond)
-	}
-}
-
-func loadRegistry(stateDir string) (registry, error) {
-	path := filepath.Join(stateDir, "registry.json")
-	r := registry{Entries: map[string]registryEntry{}}
-	data, err := os.ReadFile(path)
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return r, nil
-		}
-		return r, fmt.Errorf("read registry: %w", err)
-	}
-	if len(data) == 0 {
-		return r, nil
-	}
-	if err := json.Unmarshal(data, &r); err != nil {
-		return r, fmt.Errorf("parse registry: %w", err)
-	}
-	if r.Entries == nil {
-		r.Entries = map[string]registryEntry{}
-	}
-	return r, nil
-}
-
-func saveRegistry(stateDir string, r registry) error {
-	path := filepath.Join(stateDir, "registry.json")
-	tmp := path + ".tmp"
-	data, err := json.MarshalIndent(r, "", "  ")
-	if err != nil {
-		return fmt.Errorf("serialize registry: %w", err)
-	}
-	if err := os.WriteFile(tmp, data, 0o600); err != nil {
-		return fmt.Errorf("write registry: %w", err)
-	}
-	return os.Rename(tmp, path)
-}
-
-func envOrDefault(key, fallback string) string {
-	if v := os.Getenv(key); v != "" {
-		return v
-	}
-	return fallback
-}
-
-func newCaddyClient(admin string) (*caddyClient, error) {
-	if admin == "" {
-		admin = defaultAdminURL
-	}
-	if strings.HasPrefix(admin, "unix://") || strings.HasPrefix(admin, "unix:") {
-		socket := strings.TrimPrefix(admin, "unix://")
-		socket = strings.TrimPrefix(socket, "unix:")
-		tr := &http.Transport{
-			DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
-				return net.Dial("unix", socket)
-			},
-		}
-		return &caddyClient{baseURL: "http://unix", client: &http.Client{Transport: tr, Timeout: 5 * time.Second}}, nil
-	}
-	return &caddyClient{baseURL: strings.TrimRight(admin, "/"), client: &http.Client{Timeout: 5 * time.Second}}, nil
-}
-
-func (c *caddyClient) get(path string) (*http.Response, error) {
-	req, err := http.NewRequest("GET", c.baseURL+path, nil)
-	if err != nil {
-		return nil, err
-	}
-	return c.client.Do(req)
-}
-
-func (c *caddyClient) postJSON(path string, body any) (*http.Response, error) {
-	data, err := json.Marshal(body)
-	if err != nil {
-		return nil, err
-	}
-	req, err := http.NewRequest("POST", c.baseURL+path, bytes.NewReader(data))
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	return c.client.Do(req)
-}
-
-func (c *caddyClient) putJSON(path string, body any) (*http.Response, error) {
-	data, err := json.Marshal(body)
-	if err != nil {
-		return nil, err
-	}
-	req, err := http.NewRequest("PUT", c.baseURL+path, bytes.NewReader(data))
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	return c.client.Do(req)
-}
-
-func (c *caddyClient) delete(path string) (*http.Response, error) {
-	req, err := http.NewRequest("DELETE", c.baseURL+path, nil)
-	if err != nil {
-		return nil, err
-	}
-	return c.client.Do(req)
-}
-
-func ensureSuccess(resp *http.Response, body []byte) error {
-	if resp.StatusCode >= 200 && resp.StatusCode < 300 {
-		return nil
-	}
-	return fmt.Errorf("caddy admin responded %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
-}
-
-func (c *caddyClient) getServers() (map[string]httpServer, error) {
-	resp, err := c.get("/config/apps/http/servers")
-	if err != nil {
-		return nil, fmt.Errorf("fetch servers: %w", err)
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	if resp.StatusCode == http.StatusNotFound {
-		return map[string]httpServer{}, nil
-	}
-	if err := ensureSuccess(resp, body); err != nil {
-		return nil, err
-	}
-	var servers map[string]httpServer
-	if err := json.Unmarshal(body, &servers); err != nil {
-		return nil, fmt.Errorf("parse servers: %w", err)
-	}
-	return servers, nil
-}
-
-func (c *caddyClient) getRoutes(server string) ([]map[string]any, error) {
-	resp, err := c.get("/config/apps/http/servers/" + server + "/routes")
-	if err != nil {
-		return nil, fmt.Errorf("fetch routes: %w", err)
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	if resp.StatusCode == http.StatusNotFound {
-		return []map[string]any{}, nil
-	}
-	if err := ensureSuccess(resp, body); err != nil {
-		return nil, err
-	}
-	var routes []map[string]any
-	if len(body) == 0 {
-		return []map[string]any{}, nil
-	}
-	if err := json.Unmarshal(body, &routes); err != nil {
-		return nil, fmt.Errorf("parse routes: %w", err)
-	}
-	return routes, nil
-}
-
-func (c *caddyClient) postRoute(server string, route map[string]any) error {
-	resp, err := c.postJSON("/config/apps/http/servers/"+server+"/routes", route)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	return ensureSuccess(resp, body)
-}
-
-func (c *caddyClient) putRoute(server string, idx int, route map[string]any) error {
-	resp, err := c.putJSON(fmt.Sprintf("/config/apps/http/servers/%s/routes/%d", server, idx), route)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	return ensureSuccess(resp, body)
-}
-
-func (c *caddyClient) deleteRoute(server string, idx int) error {
-	resp, err := c.delete(fmt.Sprintf("/config/apps/http/servers/%s/routes/%d", server, idx))
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	if resp.StatusCode == http.StatusNotFound {
-		return nil
-	}
-	return ensureSuccess(resp, body)
-}
-
-func resolveServerName(client *caddyClient, override string) (string, error) {
-	if override != "" {
-		return override, nil
-	}
-	servers, err := client.getServers()
-	if err != nil {
-		return "", err
-	}
-	if len(servers) == 0 {
-		return "", errors.New("no HTTP servers configured in Caddy; start Caddy with your base config first")
-	}
-	for name, srv := range servers {
-		for _, ln := range srv.Listen {
-			if strings.Contains(ln, ":80") {
-				return name, nil
-			}
-		}
-	}
-	for name := range servers {
-		return name, nil
-	}
-	return "", errors.New("no HTTP server found")
-}
-
-func findRouteIndexForHost(routes []map[string]any, host string) int {
-	for i, r := range routes {
-		matchVal, ok := r["match"]
-		if !ok {
-			continue
-		}
-		matchSlice, ok := matchVal.([]any)
-		if !ok {
-			continue
-		}
-		for _, m := range matchSlice {
-			mm, ok := m.(map[string]any)
-			if !ok {
-				continue
-			}
-			hostVal, ok := mm["host"]
-			if !ok {
-				continue
-			}
-			hostSlice, ok := hostVal.([]any)
-			if !ok {
-				continue
-			}
-			for _, h := range hostSlice {
-				if hs, ok := h.(string); ok && hs == host {
-					return i
-				}
-			}
-		}
-	}
-	return -1
-}
-
-func buildRoute(host, frontend, backend string) map[string]any {
-	var innerRoutes []map[string]any
-
-	// Preflight (OPTIONS)
-	innerRoutes = append(innerRoutes, map[string]any{
-		"match": []map[string]any{{"method": []string{"OPTIONS"}}},
-		"handle": []map[string]any{
-			corsHeaders(true),
-			{"handler": "static_response", "status_code": 204},
-		},
-		"terminal": true,
-	})
-
-	// Websocket route to frontend if provided
-	if frontend != "" {
-		innerRoutes = append(innerRoutes, map[string]any{
-			"match": []map[string]any{{
-				"header": map[string]any{
-					"Connection": []string{"*Upgrade*"},
-					"Upgrade":    []string{"websocket"},
-				},
-			}},
-			"handle": []map[string]any{
-				corsHeaders(false),
-				reverseProxyHandler(frontend),
-			},
-			"terminal": true,
-		})
-	}
-
-	// Default route to backend
-	innerRoutes = append(innerRoutes, map[string]any{
-		"handle": []map[string]any{
-			corsHeaders(false),
-			reverseProxyHandler(backend),
-		},
-	})
-
-	return map[string]any{
-		"match":    []map[string]any{{"host": []string{host}}},
-		"handle":   []map[string]any{{"handler": "subroute", "routes": innerRoutes}},
-		"terminal": true,
-	}
-}
-
-func corsHeaders(preflight bool) map[string]any {
-	set := map[string]any{
-		"Access-Control-Allow-Origin":      []string{"{http.request.header.origin}"},
-		"Access-Control-Expose-Headers":    []string{"Authorization"},
-		"Access-Control-Allow-Credentials": []string{"true"},
-		"Vary":                             []string{"Origin"},
-	}
-	if preflight {
-		set["Access-Control-Allow-Methods"] = []string{"GET, POST, PUT, PATCH, DELETE"}
-		set["Access-Control-Max-Age"] = []string{"3600"}
-	}
-	return map[string]any{
-		"handler": "headers",
-		"response": map[string]any{
-			"set": set,
-		},
-	}
-}
-
-func reverseProxyHandler(portOrAddress string) map[string]any {
-	target := portOrAddress
-	if !strings.Contains(target, ":") {
-		target = "127.0.0.1:" + target
-	}
-	return map[string]any{
-		"handler": "reverse_proxy",
-		"upstreams": []map[string]any{
-			{"dial": target},
-		},
-	}
-}
-
-func fail(err error) {
-	fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-	os.Exit(1)
-}
-
-func stopCaddy() error {
-	cmd := exec.Command("caddy", "stop")
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("caddy stop: %w (%s)", err, strings.TrimSpace(string(out)))
-	}
-	return nil
-}

deps.edn

@@ -4,10 +4,7 @@
  ;; !!                                   PLEASE KEEP THESE ORGANIZED ALPHABETICALLY                                  !!
  ;; !!                                   AND ADD A COMMENT EXPLAINING THEIR PURPOSE                                  !!
  ;; !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
- {amalloy/ring-buffer                       {:mvn/version "1.3.1"               ; fixed length queue implementation, used in log buffering
-                                             :exclusions  [org.clojure/clojure
-                                                           org.clojure/clojurescript]}
-  amalloy/ring-gzip-middleware              {:mvn/version "0.1.4"}              ; Ring middleware to GZIP responses if client can handle it
+ {amalloy/ring-gzip-middleware              {:mvn/version "0.1.4"}              ; Ring middleware to GZIP responses if client can handle it
   babashka/fs                               {:mvn/version "0.5.27"}             ; Portable filesystem operations
   bigml/histogram                           {:mvn/version "5.0.0"               ; Histogram data structure
                                              :exclusions  [junit/junit]}
@@ -104,7 +101,8 @@
                                                           org.bouncycastle/bcprov-jdk18on]}
   metabase/throttle                         {:mvn/version "1.0.2"}              ; Tools for throttling access to API endpoints and other code pathways
   methodical/methodical                     {:mvn/version "1.0.127"}            ; drop-in replacements for Clojure multimethods and adds several advanced features
-  metosin/malli                             {:mvn/version "0.20.0"}             ; Data-driven Schemas for Clojure/Script and babashka
+  metosin/malli                             {:git/url "https://github.com/metabase/malli" ; Data-driven Schemas for Clojure/Script and babashka
+                                             :git/sha "b4a2d78647a049870b316753d7aae7fb4ade3ae5"} ; patched to resolve an issue causing OOM
   net.cgrand/macrovich                      {:mvn/version "0.2.2"}              ; utils for writing macros for both Clojure & ClojureScript
   net.clojars.wkok/openai-clojure           {:mvn/version "0.23.0"
                                              :exclusions  [lambdaisland/uri]}   ; OpenAI

dev/src/dev/deps_graph.clj

@@ -313,13 +313,28 @@
                 [k (into (sorted-set) (map :namespace) v)]))
          (group-by :depends-on-namespace (external-usages deps module-symb)))))
 
-(defn externally-used-namespaces
-  "All namespaces from a module that are used outside that module."
-  ([module-symb]
-   (externally-used-namespaces (dependencies) module-symb))
+(defn module-friends
+  "`:friends` of the module from the Kondo config -- these are allowed to freely use all namespaces in the module, not
+  just `:api` ones.
 
-  ([deps module-symb]
-   (into (sorted-set) (map :depends-on-namespace) (external-usages deps module-symb))))
+    (module-friends (kondo-config) 'lib)
+    ;; => #{query-processor}"
+  [kondo-config module-symb]
+  (get-in kondo-config [module-symb :friends]))
+
+(declare kondo-config)
+
+(defn externally-used-namespaces-ignoring-friends
+  "All namespaces from a module that are used outside that module, excluding usages by `:friends` of the module."
+  ([module-symb]
+   (externally-used-namespaces-ignoring-friends (dependencies) (kondo-config) module-symb))
+
+  ([deps kondo-config module-symb]
+   (let [friends (module-friends kondo-config module-symb)]
+     (into (sorted-set)
+           (comp (remove #(contains? friends (:module %)))
+                 (map :depends-on-namespace))
+           (external-usages deps module-symb)))))
 
 (defn module-dependencies
   "Build a graph of module => set of modules it directly depends on."
@@ -412,12 +427,12 @@
 (defn generate-config
   "Generate the Kondo config that should go in `.clj-kondo/config/modules/config.edn`."
   ([]
-   (generate-config (dependencies)))
+   (generate-config (dependencies) (kondo-config)))
 
-  ([deps]
+  ([deps kondo-config]
    (into (sorted-map)
          (map (fn [[module uses]]
-                [module {:api  (externally-used-namespaces deps module)
+                [module {:api  (externally-used-namespaces-ignoring-friends deps kondo-config module)
                          :uses uses}]))
          (module-dependencies deps))))
 
@@ -447,12 +462,13 @@
    (kondo-config-diff (dependencies)))
 
   ([deps]
-   (-> (ddiff/diff
-        (update-vals (kondo-config) #(dissoc % :team))
-        (generate-config deps))
-       ddiff/minimize
-       kondo-config-diff-ignore-any
-       ddiff/minimize)))
+   (let [kondo-config (kondo-config)]
+     (-> (ddiff/diff
+          (update-vals kondo-config #(dissoc % :team :friends))
+          (generate-config deps kondo-config))
+         ddiff/minimize
+         kondo-config-diff-ignore-any
+         ddiff/minimize))))
 
 (defn print-kondo-config-diff
   "Print the diff between how the config would look if regenerated with [[generate-config]] versus how it looks in

dev/src/dev/migrate.clj

@@ -142,7 +142,7 @@
     clojure -M:migrate rollback id \"v40.00.001\" ;; rollback to a specific migration with id
     clojure -M:migrate rollback last-deployment   ;; rollback the last deployment
     clojure -M:migrate status                     ;; print the latest migration id
-    clojure -M:migrate reset-checksums.           ;; sets the checkums to what they would be if migrated from the current changelog"
+    clojure -M:migrate reset-checksums.           ;; sets the checksums to what they would be if migrated from the current changelog"
 
   [& args]
   (let [[cmd & migration-args] args]

dev/src/dev/model_tracking.clj

@@ -22,7 +22,6 @@
    [toucan2.tools.before-update :as t2.before-update]
    [toucan2.util :as t2.util]))
 
-
 (def changes*
   "An atom to store all the changes of models that we currently track."
   (atom {}))
@@ -79,7 +78,7 @@
                            :update
                            (into {} (t2/changes row-or-instance))
                            (into {} row-or-instance))
-                        clean-change)
+                         clean-change)
         path       [(t2/table-name model) action]]
     ;; ideally this should be debug, but for some reasons this doesn't get logged
     (on-change path change-info)
@@ -96,7 +95,7 @@
   [;; will be better if we could use after-insert to get the inserted id, but toucan2 doesn't define a multimethod for after-insert
    [#'t2.before-insert/before-insert :after :insert ::t2.before-insert/before-insert]
    [#'t2.before-update/before-update :after :update ::t2.before-update/before-update]
-   ;; we do :before aux-method instead of :after for delete bacause the after method has input is number of affected rows
+   ;; we do :before aux-method instead of :after for delete because the after method has input is number of affected rows
    [#'t2.before-delete/before-delete :before :delete ::t2.before-delete/before-delete]])
 
 (defn- track-one!

docs/ai/metabot.md

@@ -19,6 +19,7 @@ To set up Metabot, see [Metabot settings](./settings.md).
 
 Metabot can help you to:
 
+- [AI exploration](#ai-exploration).
 - [Create a chart using the query builder](#how-metabot-uses-the-query-builder) from a natural language query.
 - [Generate SQL in the native editor](../questions/native-editor/writing-sql.md) from natural language. (Currently, only SQL is supported.)
 - [Edit SQL directly in the native editor](#inline-sql-editing).
@@ -101,16 +102,29 @@ When you get an error in a SQL query, you can click the **Have Metabot fix it**
 You can ask Metabot to generate or edit code in the SQL editor, without using the [chat sidebar](#the-metabot-chat-sidebar):
 
 1. Open the [SQL editor](../questions/native-editor/writing-sql.md).
-2. Press Cmd+; on Mac or Ctrl+; on Windows.
+2. Press Cmd+shift+i on Mac or Ctrl+shift+i on Windows.
 3. Describe the SQL you want to generate or modify.
 4. Review the generated code and accept or reject it.
 
+Once you start typing or editing your SQL, you can continue using the keyboard shortcut to refine your code.
+
 ## Navigating after Metabot creates a chart
 
 If Metabot creates a query or takes you to a new item but you want to return to the previous screen, you can navigate using your browser's back button.
 
 You can also save any chart that Metabot creates to a dashboard or collection.
 
+## AI exploration
+
+![AI exploration](./images/ai-exploration.png)
+
+Use **AI exploration** to start a new conversation with Metabot when you don’t already have a chart, question, or query to work from.
+
+Open it from **+ New → AI exploration**, then ask a question or pick one of the suggested prompts.
+
+When answering questions in AI exploration, Metabot searches a limited set of content instead of your entire Metabase. Admins can set a **Collection for natural language querying** to scope AI exploration to a specific collection and its subcollections. You can still refer to content outside that scope by explicitly @-mentioning it in your prompt. See [Metabot AI settings](../ai/settings.md) for more details.
+
+
 ## Giving feedback on Metabot responses
 
 When you hover over Metabot's responses, you'll see options to give feedback.

docs/ai/settings.md

@@ -36,6 +36,14 @@ Admins on Pro and Enterprise plans can tell Metabot to only work with [models](.
 
 Restricting Metabot to verified models and metrics (and only models and metrics) helps Metabot produce more reliable answers, since you know someone has at least vetted the data Metabot can use.
 
+## Collection for natural language querying
+
+Select a collection (including its subcollections) to limit which collections Metabot searches during [AI exploration](../ai/metabot.md#ai-exploration).
+
+This setting only affects conversations started from **+ New → AI exploration**.
+
+People can still @-mention items outside of this collection when prompting in AI exploration. Metabot can also see the person's current context (for example, Metabot will know about the dashboard they're currently viewing, even if the dashboard is outside the selected collection).
+
 ## When embedding Metabot, you can pick a collection for Metabot to have access to
 
 When embedding Metabot in your app, you can select a collection for Metabot:

docs/configuring-metabase/config-template.md

@@ -106,6 +106,7 @@ config:
     bcc-enabled: true
     breakout-bin-width: 10.0
     breakout-bins-num: 8
+    can-run-adhoc-query-check-threshold: 250
     check-for-updates: true
     config-from-file-sync-databases: true
     custom-formatting: {}
@@ -161,7 +162,7 @@ config:
     index-update-thread-count: 2
     install-analytics-database: true
     jdbc-data-warehouse-max-connection-pool-size: 15
-    jdbc-networkout-timeout-ms: 1800000
+    jdbc-network-timeout-ms: 1800000
     jwt-attribute-email: email
     jwt-attribute-firstname: first_name
     jwt-attribute-groups: groups
@@ -221,6 +222,7 @@ config:
     redirect-all-requests-to-https: false
     remote-sync-auto-import: false
     remote-sync-auto-import-rate: 5
+    remote-sync-check-changes-cache-ttl-seconds: 60
     remote-sync-task-time-limit-ms: 300000
     report-timezone: null
     reset-token-ttl-hours: 48

docs/configuring-metabase/environment-variables.md

@@ -293,6 +293,13 @@ When using the default binning strategy for a field of type Coordinate (such as
 
 When using the default binning strategy and a number of bins is not provided, this number will be used as the default.
 
+### `MB_CAN_RUN_ADHOC_QUERY_CHECK_THRESHOLD`
+
+- Type: integer
+- Default: `250`
+
+Maximum number of cards to compute can_run_adhoc_query for. When the number of cards exceeds this threshold, can_run_adhoc_query will return true for all cards without computing actual permissions. Set to 0 to always compute permissions. This only affects how cards are displayed in the query builder and does not affect actual permission enforcement.
+
 ### `MB_CHECK_FOR_UPDATES`
 
 - Type: boolean
@@ -340,6 +347,7 @@ Whether or not the use of custom GeoJSON is enabled.
 
 - Type: boolean
 - Default: `false`
+- [Exported as](../installation-and-operation/serialization.md): `custom-homepage`.
 - [Configuration file name](./config-file.md): `custom-homepage`
 
 Pick one of your dashboards to serve as homepage. Users without dashboard access will be directed to the default homepage.
@@ -348,6 +356,7 @@ Pick one of your dashboards to serve as homepage. Users without dashboard access
 
 - Type: integer
 - Default: `null`
+- [Exported as](../installation-and-operation/serialization.md): `custom-homepage-dashboard`.
 - [Configuration file name](./config-file.md): `custom-homepage-dashboard`
 
 ID of dashboard to use as a homepage.
@@ -810,7 +819,7 @@ Change this to a higher value if you notice that regular usage consumes all or c
   For setting the maximum,
   see [MB_APPLICATION_DB_MAX_CONNECTION_POOL_SIZE](#mb_application_db_max_connection_pool_size).
 
-### `MB_JDBC_NETWORKOUT_TIMEOUT_MS`
+### `MB_JDBC_NETWORK_TIMEOUT_MS`
 
 - Type: integer
 - Default: `1800000`
@@ -1360,6 +1369,14 @@ Whether to automatically import from the remote git repository. Only applies if
 
 If remote-sync-type is :read-only and remote-sync-auto-import is true, the rate (in minutes) at which to check for updates to import. Defaults to 5.
 
+### `MB_REMOTE_SYNC_CHECK_CHANGES_CACHE_TTL_SECONDS`
+
+- Type: integer
+- Default: `60`
+- [Configuration file name](./config-file.md): `remote-sync-check-changes-cache-ttl-seconds`
+
+Time-to-live in seconds for the remote changes check cache. Default is 60 seconds.
+
 ### `MB_REMOTE_SYNC_TASK_TIME_LIMIT_MS`
 
 - Type: integer

docs/dashboards/subscriptions.md

@@ -1,8 +1,8 @@
 ---
 title: Dashboard subscriptions
 redirect_from:
-  - /docs/latest/users-guide/dashboard-subscriptions
-  - /docs/latest/enterprise-guide/dashboards-subscriptions
+- /docs/latest/users-guide/dashboard-subscriptions
+- /docs/latest/enterprise-guide/dashboards-subscriptions
 ---
 
 # Dashboard subscriptions
@@ -79,7 +79,7 @@ If you check this box, Metabase will drop any visualization settings applied to
 
 Here you can specify which questions Metabase should attach results for. If you don't select any questions, Metabase won't send any attachments.
 
-The attached files will include up to 1 048 575 rows by default (Excel's row limit for spreadsheets). If you're self-hosting Metabase, you can adjust this row limit by setting the environment variable [`MB_ATTACHMENT_ROW_LIMIT`](../configuring-metabase/environment-variables.md#mb_attachment_row_limit). To change this row limit on your Metabase Cloud instance, you can [contact us](https://www.metabase.com/help-premium) and request a different row limit.
+The attached files will include up to 1 048 575 rows by default (Excel's row limit for spreadsheets). If you're self-hosting Metabase, you can adjust this row limit by setting the environment variable [ `MB_ATTACHMENT_ROW_LIMIT` ](../configuring-metabase/environment-variables.md#mb_attachment_row_limit). To change this row limit on your Metabase Cloud instance, you can [contact us](https://www.metabase.com/help-premium) and request a different row limit.
 
 ### Send only attachments (no charts)
 
@@ -139,6 +139,10 @@ See [Notification permissions](../permissions/notifications.md).
 
 See [Remove Metabase branding from exports](../questions/exporting-results.md#remove-metabase-branding-from-exports).
 
+## Subscriptions in embedded dashboards exclude links
+
+Since people viewing embedded dashboards likely don't have direct access to your Metabase, Metabase will omit the links to Metabase items in subscriptions sent from embedded dashboards. That way people don't get broken links in their email. See [embedded dashboards](../embedding/components.md).
+
 ## Further reading
 
 - [Alerts](../questions/alerts.md)

docs/data-modeling/editable-tables.md

@@ -17,7 +17,6 @@ Currently, editable tables are available for the following databases:
 
 - PostgreSQL
 - MySQL
-- Metabase Sample Database
 
 ## Setting up editable tables