updated docs

Co-authored-by: Alex Yarosh <alexandra@metabase.com>

.clj-kondo/config.edn

@@ -1,49 +1,215 @@
 ;; -*- comment-column: 100; -*-
 {:config-paths ["macros" "src"]
  :linters
- {:aliased-namespace-symbol     {:level :warning}
-  :invalid-arity                {:skip-args [metabase.lib.util.match/match]} ; TODO (cam): can we fix these?
+ {
+  ;;
+  ;; enabled optional linters (these are disabled by default)
+  ;;
+
+  :aliased-namespace-symbol     {:level :warning}
+  :case-symbol-test             {:level :warning}
+  :condition-always-true        {:level :warning}
+  :def-fn                       {:level :warning}
+  :dynamic-var-not-earmuffed    {:level :warning}
+  :equals-expected-position     {:level :warning, :only-in-test-assertion true}
   :keyword-binding              {:level :warning}
   :main-without-gen-class       {:level :warning}
+  :minus-one                    {:level :warning}
   :misplaced-docstring          {:level :warning}
   :missing-body-in-when         {:level :warning}
   :missing-docstring            {:level :warning}
   :missing-else-branch          {:level :warning}
   :namespace-name-mismatch      {:level :warning}
   :non-arg-vec-return-type-hint {:level :warning}
+  :plus-one                     {:level :warning}
   :reduce-without-init          {:level :warning}
+  :redundant-call               {:level :warning}
   :redundant-fn-wrapper         {:level :warning}
-  :refer-all                    {:level :warning, :exclude [clojure.test]}
+  :self-requiring-namespace     {:level :warning}
   :single-key-in                {:level :warning}
+  :unsorted-imports             {:level :warning}
   :unsorted-required-namespaces {:level :warning}
-  :unused-referred-var          {:exclude {compojure.core [GET DELETE POST PUT]}}
+  :unused-alias                 {:level :warning}
   :use                          {:level :warning}
   :warn-on-reflection           {:level :warning}
 
-  :metabase/defsetting-must-specify-export                             {:level :warning}
-  :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests {:level :warning}
-  :metabase/mbql-query-first-arg                                       {:level :warning}
-  :metabase/missing-test-expr-requires-in-cljs                         {:level :warning}
-  :metabase/require-shape-checker                                      {:level :warning}
-  :metabase/test-helpers-use-non-thread-safe-functions                 {:level :warning}
-  :metabase/validate-deftest                                           {:level :warning}
-  :metabase/validate-logging                                           {:level :warning}
+  ;;
+  ;; other disabled-by-default linters it would be nice to enable soon
+  ;;
+
+  ;; TODO (cam): most of these either have a ton of things that need to be fixed or cause issues
+  ;; with [[metabase.lib.util.match/match]] and friends -- we need to write a custom hook for those macros so Kondo
+  ;; can understand them.
+
+  #_:docstring-leading-trailing-whitespace
+  #_:equals-false
+  #_:equals-true
+  #_:used-underscored-binding
 
   ;;
   ;; disabled linters
   ;;
 
-  :unexpected-recur         {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
-  :used-underscored-binding {:level :off} ; false positives: see https://github.com/clj-kondo/clj-kondo/issues/2152
+  :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
+  :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
 
   ;;
-  ;; TODO (cam): here are some more linters we should experiment with enabling -- some might be useful.
+  ;; globally-enabled custom linters
+  ;;
+  :metabase/defsetting-must-specify-export             {:level :warning}
+  :metabase/mbql-query-first-arg                       {:level :warning}
+  :metabase/missing-test-expr-requires-in-cljs         {:level :warning}
+  :metabase/require-shape-checker                      {:level :warning}
+  :metabase/test-helpers-use-non-thread-safe-functions {:level :warning}
+  :metabase/validate-logging                           {:level :warning}
+  :metabase/validate-mb-driver-tests                   {:level :warning}
+  :metabase/validate-mb-once                           {:level :warning}
+
+  :metabase/validate-deftest
+  {:level :warning
+
+   ;; calling these functions will result in an error in tests marked `^:parallel`
+   ;;
+   ;; TODO -- these should all be made thread safe if possible or renamed so they end in `!`. Then we can remove them
+   ;; from this list because by default anything ending in `!` is considered to be thread-unsafe
+   :parallel/unsafe
+   #{clojure.core/alter-var-root
+     clojure.core/with-redefs
+     clojure.core/with-redefs-fn
+     metabase.actions.test-util/with-actions
+     metabase.actions.test-util/with-actions-disabled
+     metabase.actions.test-util/with-actions-enabled
+     metabase.actions.test-util/with-actions-test-data
+     metabase.actions.test-util/with-actions-test-data-and-actions-enabled
+     metabase.actions.test-util/with-actions-test-data-tables
+     metabase.analytics.snowplow-test/with-fake-snowplow-collector
+     metabase.email-test/with-expected-messages
+     metabase.email-test/with-fake-inbox
+     metabase.test.data.users/with-group
+     metabase.test.data.users/with-group-for-user
+     metabase.test.data/with-empty-h2-app-db
+     metabase.test.util.log/with-log-level
+     metabase.test.util.misc/with-single-admin-user
+     metabase.test.util/with-all-users-permission
+     metabase.test.util/with-discarded-collections-perms-changes
+     metabase.test.util/with-env-keys-renamed-by
+     metabase.test.util/with-locale
+     metabase.test.util/with-model-cleanup
+     metabase.test.util/with-non-admin-groups-no-root-collection-for-namespace-perms
+     metabase.test.util/with-non-admin-groups-no-root-collection-perms
+     metabase.test.util/with-temp-env-var-value
+     metabase.test.util/with-temp-vals-in-db
+     metabase.test.util/with-temporary-raw-setting-values
+     metabase.test.util/with-temporary-setting-values
+     metabase.test.util/with-user-in-groups
+     metabase.test/with-actions
+     metabase.test/with-actions-disabled
+     metabase.test/with-actions-enabled
+     metabase.test/with-actions-test-data
+     metabase.test/with-actions-test-data-and-actions-enabled
+     metabase.test/with-actions-test-data-tables
+     metabase.test/with-all-users-permission
+     metabase.test/with-discarded-collections-perms-changes
+     metabase.test/with-empty-h2-app-db
+     metabase.test/with-env-keys-renamed-by
+     metabase.test/with-expected-messages
+     metabase.test/with-fake-inbox
+     metabase.test/with-group
+     metabase.test/with-group-for-user
+     metabase.test/with-locale
+     metabase.test/with-log-level
+     metabase.test/with-model-cleanup
+     metabase.test/with-non-admin-groups-no-root-collection-for-namespace-perms
+     metabase.test/with-non-admin-groups-no-root-collection-perms
+     metabase.test/with-single-admin-user
+     metabase.test/with-temp-env-var-value
+     metabase.test/with-temp-vals-in-db
+     metabase.test/with-temporary-raw-setting-values
+     metabase.test/with-temporary-setting-values
+     metabase.test/with-user-in-groups}
+
+   ;; these functions are allowed in `^:parallel` tests even tho they end in `!`
+   :parallel/safe
+   #{clojure.core/assoc!
+     clojure.core/compare-and-set!
+     clojure.core/conj!
+     clojure.core/disj!
+     clojure.core/dissoc!
+     clojure.core/persistent!
+     clojure.core/pop!
+     clojure.core/reset!
+     clojure.core/reset-vals!
+     clojure.core/run!
+     clojure.core/swap!
+     clojure.core/swap-vals!
+     clojure.core/volatile!
+     clojure.core/vreset!
+     clojure.core/vswap!
+     clojure.core.async/<!
+     clojure.core.async/<!!
+     clojure.core.async/>!
+     clojure.core.async/>!!
+     clojure.core.async/alt!
+     clojure.core.async/alt!!
+     clojure.core.async/alts!
+     clojure.core.async/alts!!
+     clojure.core.async/close!
+     clojure.core.async/ioc-alts!
+     clojure.core.async/offer!
+     clojure.core.async/onto-chan!
+     clojure.core.async/onto-chan!!
+     clojure.core.async/poll!
+     clojure.core.async/put!
+     clojure.core.async/take!
+     clojure.core.async/to-chan!
+     clojure.core.async/to-chan!!
+     metabase.channel.core/send!
+     metabase.driver.sql-jdbc.execute/execute-prepared-statement!
+     metabase.models.notification/create-notification!
+     metabase.pulse.send/send-pulse!
+     metabase.query-processor.store/store-database!
+     ;; Safe in tests, where we typically use a private, temporary index per thread.
+     metabase.search.core/reindex!
+     metabase.util/run-count!
+     next.jdbc/execute!}}
+
+  :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests
+  {:level      :warning
+   :max-length 180}
+
+  ;; this is not enabled here, it is enabled below only for specific namespaces.
+  :metabase/disallow-hardcoded-driver-names-in-tests
+  ;; don't include `:h2` since that will probably lead to a mountain of tests where we are specifically testing
+  ;; middleware or compilation behavior with just H2 since it's the default.
+  {:drivers #{ ;; core drivers
+              #_:h2
+              :postgres
+              :mysql
+              ;; module drivers
+              :athena
+              :bigquery-cloud-sdk
+              :databricks
+              :druid
+              :druid-jdbc
+              :googleanalytics
+              :hive-like
+              :mongo
+              :oracle
+              :presto-jdbc
+              :redshift
+              :snowflake
+              :sparksql
+              :sqlite
+              :sqlserver
+              :vertica}}
+
+  ;;
+  ;; misc config for built-in linters
   ;;
 
-  ;; :docstring-leading-trailing-whitespace {:level :warning}
-  ;; :docstring-no-summary                  {:level :warning}
-  ;; :shadowed-var                          {:level :warning}
-  ;; :def-fn                                {:level :warning}
+  :invalid-arity       {:skip-args [metabase.lib.util.match/match]} ; TODO (cam): can we fix these?
+  :refer-all           {:level :warning, :exclude [clojure.test]}
+  :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
   :unresolved-symbol
   {:exclude
@@ -113,6 +279,7 @@
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
+   cheshire.core          {:message "Use metabase.util.json instead of cheshire.core directly."}
    clojure.tools.logging  {:message "Use metabase.util.log instead of clojure.tools.logging directly"}
    grouper.core           {:message "Use metabase.util.grouper instead of grouper.core"}
    honeysql.core          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
@@ -151,7 +318,7 @@
     metabase.analytics             #{metabase.analytics.prometheus
                                      metabase.analytics.snowplow
                                      metabase.analytics.stats
-                                     metabase.analytics.sdk}                                      ; TODO -- consolidate these into a real API namespace.
+                                     metabase.analytics.sdk}                                        ; TODO -- consolidate these into a real API namespace.
     metabase.analyze               #{metabase.analyze}
     metabase.api                   #{metabase.api.common
                                      metabase.api.dataset
@@ -163,7 +330,9 @@
     metabase.audit                 #{metabase.audit}
     metabase.bootstrap             #{metabase.bootstrap}
     metabase.cmd                   #{}                                                              ; there are no namespaces here since you shouldn't be using this in any other module.
-    metabase.channel               #{metabase.channel.core}
+    metabase.channel               #{metabase.channel.core
+                                     metabase.channel.render.core
+                                     metabase.channel.template.core}
     metabase.config                #{metabase.config}
     metabase.core                  #{metabase.core.initialization-status}                           ; TODO -- only namespace used outside of EE, this probably belongs in `metabase.server` anyway since that's the only place it's used.
     metabase.db                    #{metabase.db
@@ -172,7 +341,8 @@
                                      metabase.db.setup}                                             ; TODO these are only calling `metabase.db.setup/setup-db!` and there's a slightly different version in `metabase.db`
     metabase.driver                :any                                                             ; TODO -- 19 namespaces!!!! CRY
     metabase.email                 #{metabase.email
-                                     metabase.email.messages}                                       ; TODO -- consolidate these into a real API namespace.
+                                     metabase.email.messages
+                                     metabase.email.result-attachment}                              ; TODO -- consolidate these into a real API namespace.
     metabase.embed                 #{metabase.embed.settings}
     metabase.events                #{metabase.events}
     metabase.formatter             #{metabase.formatter}
@@ -190,47 +360,38 @@
     metabase.metabot               #{metabase.metabot}
     metabase.models                :any                                                             ; TODO -- scream, 62 namespaces used elsewhere, but to be fair a lot of these don't *need* to be required.
     metabase.moderation            #{metabase.moderation}
+    metabase.notification          #{metabase.notification.core
+                                     metabase.notification.payload.core}
     metabase.permissions           #{metabase.permissions.util}                                     ; TODO -- this is currently the only namespace in this module. Give it a real API namespace?
     metabase.plugins               #{metabase.plugins
                                      metabase.plugins.classloader}                                  ; TODO -- not 100% sure the classloader belongs here
     metabase.public-settings       #{metabase.public-settings
                                      metabase.public-settings.premium-features}
-    metabase.pulse                 #{metabase.pulse
-                                     metabase.pulse.markdown
-                                     metabase.pulse.parameters
-                                     metabase.pulse.preview
-                                     metabase.pulse.render
-                                     metabase.pulse.render.image-bundle
-                                     metabase.pulse.render.js-svg
-                                     metabase.pulse.render.style}                                   ; TODO -- consolidate these into a real API namespace.
+    metabase.pulse                 #{metabase.pulse.core}
     metabase.query-processor       :any                                                             ; TODO omg scream, 29 namespaces used outside of the module. WHAT THE HECC
     metabase.query-analysis        #{metabase.query-analysis
                                      metabase.query-analysis.failure-map}
     metabase.related               #{metabase.related}
+    metabase.request               #{metabase.request.core}
     metabase.sample-data           #{metabase.sample-data}
-    metabase.search                #{metabase.search}
-    metabase.server                #{metabase.server
-                                     metabase.server.handler
-                                     metabase.server.middleware.auth
-                                     metabase.server.middleware.exceptions
+    metabase.search                #{metabase.search.core
+                                     ;; Need to expose this submodule, to break circular dependencies with models.
+                                     metabase.search.spec}
+    metabase.server                #{metabase.server.core
+                                     ;;
+                                     ;; TODO FIXME -- this is loaded for side effects since it contains the JSON
+                                     ;; encoder logic for stuff like `java.time` classes. As a
+                                     ;; result, [[metabase.models.setting]] (and thus the `metabase.models` module)
+                                     ;; has to depend on the `metabase.server` module...we should create either a new
+                                     ;; `metabase.json` or `metabase.encoders` module for stuff like this to live. Or
+                                     ;; maybe it just belongs in a generic `metabase.config` module.
                                      metabase.server.middleware.json
-                                     metabase.server.middleware.misc
-                                     metabase.server.middleware.offset-paging
-                                     metabase.server.middleware.session
-                                     metabase.server.protocols
-                                     metabase.server.request.util}                                  ; TODO -- consolidate these into a real API namespace.
+                                     ;;
+                                     ;; TODO -- we can't make this part of [[metabase.server.core]] YET because it
+                                     ;; causes circular dependencies. Maybe in the future once we tease apart more of
+                                     ;; the modules tangle we can.
+                                     metabase.server.protocols}
     metabase.setup                 #{metabase.setup}
-    metabase.shared                #{metabase.shared.dashboards.constants
-                                     metabase.shared.formatting.constants
-                                     metabase.shared.formatting.date
-                                     metabase.shared.formatting.numbers
-                                     metabase.shared.models.visualization-settings
-                                     metabase.shared.parameters.parameters
-                                     metabase.shared.util.currency
-                                     metabase.shared.util.i18n
-                                     metabase.shared.util.internal.time-common
-                                     metabase.shared.util.namespaces
-                                     metabase.shared.util.time}                                     ; TODO -- consolidate these into a real API namespace.
     metabase.sync                  #{metabase.sync
                                      metabase.sync.analyze
                                      metabase.sync.concurrent
@@ -242,7 +403,10 @@
                                      metabase.sync.util}                                            ; TODO -- consolidate these into a real API namespace.
     metabase.task                  #{metabase.task
                                      metabase.task.index-values
-                                     metabase.task.persist-refresh}                                 ; TODO -- consolidate these into a real API namespace.
+                                     metabase.task.persist-refresh
+                                     ;; We need to expose this to the metabase.search module.
+                                     ;; Ideally, it would just live inside that module.
+                                     metabase.task.search-index}                                    ; TODO -- consolidate these into a real API namespace.
     metabase.troubleshooting       #{metabase.troubleshooting}
     metabase.types                 #{metabase.types}
     metabase.upload                #{metabase.upload}
@@ -265,7 +429,7 @@
     metabase.api                   :any
     metabase.async                 :any
     metabase.audit                 :any
-    metabase.auth-provider         #{metabase.util}
+    metabase.auth-provider         #{metabase.util metabase.public-settings}
     metabase.bootstrap             #{}
     metabase.cmd                   :any
     metabase.compatibility         :any
@@ -286,6 +450,7 @@
     metabase.metabot               :any
     metabase.models                :any
     metabase.moderation            :any
+    metabase.notification          :any
     metabase.permissions           :any
     metabase.plugins               :any
     metabase.public-settings       :any
@@ -300,17 +465,20 @@
                                      metabase.util}
     metabase.query-processor       :any
     metabase.related               :any
+    metabase.request               #{metabase.config
+                                     metabase.models
+                                     metabase.public-settings
+                                     metabase.util}
     metabase.sample-data           :any
     metabase.search                :any
     metabase.server                :any
     metabase.setup                 :any
-    metabase.shared                :any
     metabase.sync                  :any
     metabase.task                  :any
     metabase.troubleshooting       :any
     metabase.types                 #{metabase.util}
     metabase.upload                :any
-    metabase.util                  :any
+    metabase.util                  :any ; TODO -- this should probably be #{}
     metabase.xrays                 :any}
 
    ;; namespaces matching these patterns (with `re-find`) are excluded from the module linter. Since regex literals
@@ -319,11 +487,11 @@
    ;; this is mostly intended for excluding test namespaces or those rare 'glue' namespaces that glue multiple modules
    ;; together, e.g. `metabase.lib.metadata.jvm`.
    :ignored-namespace-patterns
-   #{"-test$"                           ; anything ending in `-test`
-     "test[-.]util"                     ; anything that contains `test.util` or `test-util`
-     "test\\.impl"                      ; anything that contains `test.impl`
-     "^metabase\\.test"                 ; anything starting with `metabase.test`
-     "^metabase\\.http-client$"}}       ; `metabase.http-client` which is a test-only namespace despite its name.
+   #{"-test$"                     ; anything ending in `-test`
+     "test[-.]util"               ; anything that contains `test.util` or `test-util`
+     "test\\.impl"                ; anything that contains `test.impl`
+     "^metabase\\.test"           ; anything starting with `metabase.test`
+     "^metabase\\.http-client$"}} ; `metabase.http-client` which is a test-only namespace despite its name.
 
   :consistent-alias
   {:aliases
@@ -348,16 +516,11 @@
     clojure.tools.namespace.parse                                 ns.parse
     colorize.core                                                 colorize
     environ.core                                                  env
-    hf.depstar.api                                                depstar
     hiccup.core                                                   hiccup
     hiccup.util                                                   hiccup.util
     honey.sql                                                     sql
     honey.sql.helpers                                             sql.helpers
-    honeysql.core                                                 hsql
-    honeysql.format                                               hformat
-    honeysql.helpers                                              hh
-    honeysql.types                                                htypes
-    java-time                                                     t
+    java-time.api                                                 t
     macaw.core                                                    macaw
     malli.core                                                    mc
     malli.error                                                   me
@@ -372,6 +535,8 @@
     metabase-enterprise.test                                      met
     metabase.analytics.sdk                                        sdk
     metabase.analytics.stats                                      stats
+    metabase.analysis.native-query-analyzer                       nqa
+    metabase.analysis.native-query-analyzer.parameter-substitution nqa.sub
     metabase.analyze.query-results                                qr
     metabase.analyze.classifiers.category                         classifiers.category
     metabase.analyze.classifiers.core                             classifiers
@@ -426,6 +591,7 @@
     metabase.api.util                                             api.util
     metabase.async.streaming-response.thread-pool                 thread-pool
     metabase.channel.core                                         channel
+    metabase.channel.render.core                                  channel.render
     metabase.cmd.copy.h2                                          copy.h2
     metabase.config                                               config
     metabase.config.file                                          config.file
@@ -465,6 +631,7 @@
     metabase.driver.sql-jdbc.test-util                            sql-jdbc.tu
     metabase.driver.sql.parameters.substitute                     sql.params.substitute
     metabase.driver.sql.parameters.substitution                   sql.params.substitution
+    metabase.eid-translation                                      eid-translation
     metabase.email-test                                           et
     metabase.email.messages                                       messages
     metabase.formatter                                            formatter
@@ -480,6 +647,7 @@
     metabase.models.collection                                    collection
     metabase.models.collection.graph                              graph
     metabase.models.collection-permission-graph-revision          c-perm-revision
+    metabase.models.channel                                       models.channel
     metabase.models.dashboard-card                                dashboard-card
     metabase.models.database                                      database
     metabase.models.dependency                                    dependency
@@ -487,26 +655,26 @@
     metabase.models.interface                                     mi
     metabase.models.moderation-review                             moderation-review
     metabase.models.native-query-snippet                          native-query-snippet
+    metabase.models.notification                                  models.notification
     metabase.models.params                                        params
     metabase.models.permissions                                   perms
     metabase.models.permissions-group                             perms-group
     metabase.models.permissions-group-membership                  perms-group-membership
     metabase.models.permissions-revision                          perms-revision
     metabase.models.permissions.parse                             perms-parse
-    metabase.models.pulse                                         pulse
+    metabase.models.pulse                                         models.pulse
     metabase.models.pulse-channel                                 pulse-channel
     metabase.models.pulse-channel-recipient                       pulse-channel-recipient
     metabase.models.query.permissions                             query-perms
     metabase.models.setting.cache                                 setting.cache
     metabase.models.timeline                                      timeline
     metabase.models.timeline-event                                timeline-event
-    metabase.analysis.native-query-analyzer                       nqa
-    metabase.analysis.native-query-analyzer.parameter-substitution nqa.sub
+    metabase.notification.core                                    notification
+    metabase.notification.test-util                               notification.tu
     metabase.plugins.initialize                                   plugins.init
     metabase.public-settings                                      public-settings
     metabase.public-settings.premium-features                     premium-features
-    metabase.pulse                                                pulse ; NB some conflicts with metabase.models.pulse
-    metabase.pulse.markdown                                       markdown
+    metabase.pulse.core                                           pulse
     metabase.pulse.render                                         render
     metabase.pulse.render.body                                    body
     metabase.pulse.render.style                                   style
@@ -537,26 +705,16 @@
     metabase.query-processor.timezone                             qp.timezone
     metabase.query-processor.util                                 qp.util
     metabase.related                                              related
+    metabase.request.core                                         request
     metabase.search.config                                        search.config
     metabase.search.filter                                        search.filter
-    metabase.search.util                                          search.util
-    metabase.search.scoring                                       scoring
-    metabase.server.middleware.auth                               mw.auth
-    metabase.server.middleware.browser-cookie                     mw.browser-cookie
-    metabase.server.middleware.exceptions                         mw.exceptions
-    metabase.server.middleware.json                               mw.json
-    metabase.server.middleware.log                                mw.log
-    metabase.server.middleware.misc                               mw.misc
-    metabase.server.middleware.offset-paging                      mw.offset-paging
-    metabase.server.middleware.security                           mw.security
-    metabase.server.middleware.session                            mw.session
-    metabase.server.middleware.ssl                                mw.ssl
-    metabase.server.request.util                                  req.util
+    metabase.search.in-place.filter                               search.in-place.filter
+    metabase.search.in-place.util                                 search.util
+    metabase.search.in-place.scoring                              scoring
+    metabase.server.core                                          server
     metabase.server.protocols                                     server.protocols
-    metabase.shared.util                                          shared.u
-    metabase.shared.util.currency                                 currency
     metabase.sync.analyze.fingerprint                             sync.fingerprint
-    metabase.sync.field-values                                    field-values
+    metabase.sync.field-values                                    sync.field-values
     metabase.sync.interface                                       i
     metabase.sync.schedules                                       sync.schedules
     metabase.sync.sync-metadata.fields.our-metadata               fields.our-metadata
@@ -576,6 +734,7 @@
     metabase.test.util.timezone                                   test.tz
     metabase.timeseries-query-processor-test.util                 tqpt
     metabase.util.cron                                            u.cron
+    metabase.util.currency                                        currency
     metabase.util.date-2                                          u.date
     metabase.util.date-2.common                                   u.date.common
     metabase.util.date-2.parse                                    u.date.parse
@@ -592,6 +751,7 @@
     metabase.util.macros                                          u.macros
     metabase.util.malli                                           mu
     metabase.util.malli.schema                                    ms
+    metabase.util.markdown                                        markdown
     metabase.util.password                                        u.password
     metabase.util.schema                                          su
     metabase.util.ui-logic                                        ui-logic
@@ -610,114 +770,117 @@
     toucan.models                                                 models}}}
 
  :lint-as
- {cljs.cache/defcache                                                                  clojure.core/deftype
-  clojure.core.cache/defcache                                                          clojure.core/deftype
-  clojure.core.logic/defne                                                             clj-kondo.lint-as/def-catch-all
-  clojure.test.check.clojure-test/defspec                                              clojure.test/deftest
-  clojurewerkz.quartzite.jobs/defjob                                                   clojure.core/defn
-  honeysql.helpers/defhelper                                                           clj-kondo.lint-as/def-catch-all
-  honeysql.util/defalias                                                               clojure.core/def
-  metabase-enterprise.serialization.test-util/with-random-dump-dir                     clojure.core/let
-  metabase-enterprise.serialization.test-util/with-dbs                                 clojure.core/fn
-  metabase.actions.test-util/with-actions                                              clojure.core/let
-  metabase.api.common/let-404                                                          clojure.core/let
-  metabase.api.common/defroutes                                                        clojure.core/def
-  metabase.api.search-test/do-test-users                                               clojure.core/let
-  metabase.async.api-response-test/with-response                                       clojure.core/let
-  metabase.dashboard-subscription-test/with-dashboard-sub-for-card                     clojure.core/let
-  metabase.db.custom-migrations/define-migration                                       clj-kondo.lint-as/def-catch-all
-  metabase.db.custom-migrations/define-reversible-migration                            clj-kondo.lint-as/def-catch-all
-  metabase.db.data-migrations/defmigration                                             clojure.core/def
-  metabase.db.liquibase/with-liquibase                                                 clojure.core/let
-  metabase.db.schema-migrations-test.impl/with-temp-empty-app-db                       clojure.core/let
-  metabase.driver.mongo.query-processor/mongo-let                                      clojure.core/let
-  metabase.driver.mongo.connection/with-mongo-client                                   clojure.core/let
-  metabase.driver.mongo.connection/with-mongo-database                                 clojure.core/let
-  metabase.driver.sql-jdbc.actions/with-jdbc-transaction                               clojure.core/let
-  metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection      clojure.core/let
-  metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                clojure.core/fn
-  metabase.integrations.ldap/with-ldap-connection                                      clojure.core/fn
-  metabase.models.collection-test/with-collection-in-location                          clojure.core/let
-  metabase.models.json-migration/def-json-migration                                    clj-kondo.lint-as/def-catch-all
-  metabase.models.setting.multi-setting/define-multi-setting                           clojure.core/def
-  metabase.models.setting/defsetting                                                   clj-kondo.lint-as/def-catch-all
-  metabase.public-settings.premium-features/defenterprise-schema                       clj-kondo.lint-as/def-catch-all
-  metabase.public-settings.premium-features/define-premium-feature                     clojure.core/def
-  metabase.pulse-test/with-pulse-for-card                                              clojure.core/let
-  metabase.query-processor.error-type/deferror                                         clojure.core/def
-  metabase.query-processor.setup/with-qp-setup                                         clojure.core/let
-  metabase.query-processor.middleware.cache.impl/with-reducible-deserialized-results   clojure.core/let
-  metabase.query-processor.middleware.process-userland-query-test/with-query-execution clojure.core/let
-  metabase.query-processor-test.pipeline-queries-test/pmbql-query                      clojure.core/->
-  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                  clojure.core/->
-  metabase.shared.util.namespaces/import-fns                                           potemkin/import-vars
-  metabase.sync.util/sum-for                                                           clojure.core/for
-  metabase.sync.util/with-emoji-progress-bar                                           clojure.core/let
-  metabase.test.data.interface/defdataset                                              clojure.core/def
-  metabase.test.data.interface/defdataset-edn                                          clojure.core/def
-  metabase.test/defdataset                                                             clojure.core/def
-  metabase.test/let-url                                                                clojure.core/let
-  metabase.test/with-actions                                                           clojure.core/let
-  metabase.test/with-open-channels                                                     clojure.core/let
-  metabase.test/with-single-admin-user                                                 clojure.core/fn
-  metabase.test/with-temp-dir                                                          clojure.core/let
-  metabase.test/with-temp-empty-app-db                                                 clojure.core/let
-  metabase.test/with-temp-file                                                         clojure.core/let
-  metabase.test/with-user-in-groups                                                    clojure.core/let
-  metabase.test/with-grouper-batches!                                                  clojure.core/fn
-  metabase.upload-test/with-upload-table!                                              clojure.core/let
-  metabase.util.files/with-open-path-to-resource                                       clojure.core/let
-  metabase.util.malli.defn/defn                                                        schema.core/defn
-  metabase.util.malli.defn/defn-                                                       schema.core/defn
-  metabase.util.malli.fn/fn                                                            schema.core/fn
-  metabase.util.malli/defmethod                                                        schema.core/defmethod
-  metabase.util.malli/defn                                                             schema.core/defn
-  metabase.util.malli/defn-                                                            schema.core/defn
-  metabase.util.malli/fn                                                               schema.core/fn
-  metabase.util.ssh/with-ssh-tunnel                                                    clojure.core/let
-  metabase.xrays.domain-entities.malli/defn                                            schema.core/defn
-  monger.operators/defoperator                                                         clojure.core/def
-  potemkin.types/defprotocol+                                                          clojure.core/defprotocol
-  potemkin.types/defrecord+                                                            clojure.core/defrecord
-  potemkin.types/deftype+                                                              clojure.core/deftype
-  potemkin/defprotocol+                                                                clojure.core/defprotocol
-  potemkin/defrecord+                                                                  clojure.core/defrecord
-  potemkin/deftype+                                                                    clojure.core/deftype
-  toucan.db/with-call-counting                                                         clojure.core/fn
-  toucan2.core/with-call-count                                                         clojure.core/fn}
+ {cljs.cache/defcache                                                                   clojure.core/deftype
+  clojure.core.cache/defcache                                                           clojure.core/deftype
+  clojure.core.logic/defne                                                              clj-kondo.lint-as/def-catch-all
+  clojure.test.check.clojure-test/defspec                                               clojure.test/deftest
+  clojurewerkz.quartzite.jobs/defjob                                                    clojure.core/defn
+  metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
+  metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
+  metabase.actions.test-util/with-actions                                               clojure.core/let
+  metabase.api.common/defroutes                                                         clojure.core/def
+  metabase.api.common/let-404                                                           clojure.core/let
+  metabase.api.search-test/do-test-users                                                clojure.core/let
+  metabase.async.api-response-test/with-response                                        clojure.core/let
+  metabase.dashboard-subscription-test/with-dashboard-sub-for-card                      clojure.core/let
+  metabase.channel.impl.http-test/with-captured-http-requests                           clojure.core/fn
+  metabase.channel.impl.http-test/with-server                                           clojure.core/let
+  metabase.db.custom-migrations/define-migration                                        clj-kondo.lint-as/def-catch-all
+  metabase.db.custom-migrations/define-reversible-migration                             clj-kondo.lint-as/def-catch-all
+  metabase.db.data-migrations/defmigration                                              clojure.core/def
+  metabase.db.liquibase/with-liquibase                                                  clojure.core/let
+  metabase.db.schema-migrations-test.impl/with-temp-empty-app-db                        clojure.core/let
+  metabase.driver.mongo.connection/with-mongo-client                                    clojure.core/let
+  metabase.driver.mongo.connection/with-mongo-database                                  clojure.core/let
+  metabase.driver.mongo.query-processor/mongo-let                                       clojure.core/let
+  metabase.driver.sql-jdbc.actions/with-jdbc-transaction                                clojure.core/let
+  metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection       clojure.core/let
+  metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                 clojure.core/fn
+  metabase.integrations.ldap/with-ldap-connection                                       clojure.core/fn
+  metabase.models.collection-test/with-collection-in-location                           clojure.core/let
+  metabase.models.json-migration/def-json-migration                                     clj-kondo.lint-as/def-catch-all
+  metabase.models.setting.multi-setting/define-multi-setting                            clojure.core/def
+  metabase.models.setting/defsetting                                                    clj-kondo.lint-as/def-catch-all
+  metabase.public-settings.premium-features/defenterprise-schema                        clj-kondo.lint-as/def-catch-all
+  metabase.public-settings.premium-features/define-premium-feature                      clojure.core/def
+  metabase.pulse.send-test/with-pulse-for-card                                          clojure.core/let
+  metabase.query-processor-test.pipeline-queries-test/pmbql-query                       clojure.core/->
+  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                   clojure.core/->
+  metabase.query-processor.error-type/deferror                                          clojure.core/def
+  metabase.query-processor.middleware.cache.impl/with-reducible-deserialized-results    clojure.core/let
+  metabase.query-processor.middleware.process-userland-query-test/with-query-execution! clojure.core/let
+  metabase.query-processor.setup/with-qp-setup                                          clojure.core/let
+  metabase.sync.util/sum-for                                                            clojure.core/for
+  metabase.sync.util/with-emoji-progress-bar                                            clojure.core/let
+  metabase.test.data.interface/defdataset                                               clojure.core/def
+  metabase.test.data.interface/defdataset-edn                                           clojure.core/def
+  metabase.test/defdataset                                                              clojure.core/def
+  metabase.test/let-url                                                                 clojure.core/let
+  metabase.test/with-actions                                                            clojure.core/let
+  metabase.test/with-grouper-batches!                                                   clojure.core/fn
+  metabase.test/with-open-channels                                                      clojure.core/let
+  metabase.test/with-single-admin-user                                                  clojure.core/fn
+  metabase.test/with-temp-dir                                                           clojure.core/let
+  metabase.test/with-temp-empty-app-db                                                  clojure.core/let
+  metabase.test/with-temp-file                                                          clojure.core/let
+  metabase.test/with-user-in-groups                                                     clojure.core/let
+  metabase.upload-test/with-upload-table!                                               clojure.core/let
+  metabase.util.files/with-open-path-to-resource                                        clojure.core/let
+  metabase.util.malli.defn/defn                                                         schema.core/defn
+  metabase.util.malli.defn/defn-                                                        schema.core/defn
+  metabase.util.malli.fn/fn                                                             schema.core/fn
+  metabase.util.malli/defmethod                                                         schema.core/defmethod
+  metabase.util.malli/defn                                                              schema.core/defn
+  metabase.util.malli/defn-                                                             schema.core/defn
+  metabase.util.malli/fn                                                                schema.core/fn
+  metabase.util.namespaces/import-fns                                                   potemkin/import-vars
+  metabase.util.ssh/with-ssh-tunnel                                                     clojure.core/let
+  metabase.xrays.domain-entities.malli/defn                                             schema.core/defn
+  metabuild-common.core/with-open-jar-file-system                                       clojure.core/let
+  metabuild-common.files/with-open-jar-file-system                                      clojure.core/let
+  monger.operators/defoperator                                                          clojure.core/def
+  potemkin.types/defprotocol+                                                           clojure.core/defprotocol
+  potemkin.types/defrecord+                                                             clojure.core/defrecord
+  potemkin.types/deftype+                                                               clojure.core/deftype
+  potemkin/defprotocol+                                                                 clojure.core/defprotocol
+  potemkin/defrecord+                                                                   clojure.core/defrecord
+  potemkin/deftype+                                                                     clojure.core/deftype
+  toucan.db/with-call-counting                                                          clojure.core/fn
+  toucan2.core/with-call-count                                                          clojure.core/fn}
 
  :hooks
  {:analyze-call
-  {clojure.core/ns                                                                                                           hooks.clojure.core/lint-ns
-   cljs.test/deftest                                                                                                         hooks.clojure.test/deftest
+  {cljs.test/deftest                                                                                                         hooks.clojure.test/deftest
    cljs.test/is                                                                                                              hooks.clojure.test/is
    cljs.test/use-fixtures                                                                                                    hooks.clojure.test/use-fixtures
+   clojure.core/ns                                                                                                           hooks.clojure.core/lint-ns
    clojure.test/deftest                                                                                                      hooks.clojure.test/deftest
    clojure.test/is                                                                                                           hooks.clojure.test/is
    clojure.test/use-fixtures                                                                                                 hooks.clojure.test/use-fixtures
-   metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
    metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
+   metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
    metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
-   metabase.analytics.prometheus-test/with-prometheus-system                                                                 hooks.common/with-two-bindings
-   metabase.api.automagic-dashboards-test/with-indexed-model                                                                 hooks.metabase.api.automagic-dashboards-test/with-indexed-model
-   metabase.api.alert-test/with-alert-in-collection                                                                          hooks.common/with-four-bindings
-   metabase.api.card-test/with-persistence-setup                                                                             hooks.common/with-one-top-level-binding
+   metabase.analytics.prometheus-test/with-prometheus-system!                                                                hooks.common/with-two-bindings
+   metabase.api.alert-test/with-alert-in-collection!                                                                         hooks.common/with-four-bindings
+   metabase.api.automagic-dashboards-test/with-indexed-model!                                                                hooks.metabase.api.automagic-dashboards-test/with-indexed-model!
+   metabase.api.card-test/with-card-param-values-fixtures                                                                    hooks.common/let-one-with-optional-value
+   metabase.api.card-test/with-persistence-setup!                                                                            hooks.common/with-one-top-level-binding
    metabase.api.card-test/with-temp-native-card!                                                                             hooks.common/with-two-bindings
    metabase.api.card-test/with-temp-native-card-with-params!                                                                 hooks.common/with-two-bindings
-   metabase.api.collection-test/with-french-user-and-personal-collection                                                     hooks.common/with-two-top-level-bindings
+   metabase.api.collection-test/with-french-user-and-personal-collection!                                                    hooks.common/with-two-top-level-bindings
    metabase.api.common/defendpoint                                                                                           hooks.metabase.api.common/defendpoint
    metabase.api.common/defendpoint-async                                                                                     hooks.metabase.api.common/defendpoint
    metabase.api.common/defendpoint-async-schema                                                                              hooks.metabase.api.common/defendpoint
+   metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
    metabase.api.dashboard-test/with-chain-filter-fixtures                                                                    hooks.common/let-one-with-optional-value
    metabase.api.dashboard-test/with-simple-dashboard-with-tabs                                                               hooks.common/with-one-binding
-   metabase.api.card-test/with-card-param-values-fixtures                                                                    hooks.common/let-one-with-optional-value
    metabase.api.embed-test/do-response-formats                                                                               hooks.common/with-two-bindings
-   metabase.api.embed-test/with-chain-filter-fixtures                                                                        hooks.common/let-one-with-optional-value
+   metabase.api.embed-test/with-chain-filter-fixtures!                                                                       hooks.common/let-one-with-optional-value
    metabase.api.embed-test/with-temp-card                                                                                    hooks.common/let-one-with-optional-value
    metabase.api.embed-test/with-temp-dashcard                                                                                hooks.common/let-one-with-optional-value
-   metabase.api.persist-test/with-setup                                                                                      hooks.common/with-one-top-level-binding
-   metabase.api.public-test/with-required-param-card                                                                         hooks.common/with-one-binding
+   metabase.api.persist-test/with-setup!                                                                                     hooks.common/with-one-top-level-binding
+   metabase.api.public-test/with-required-param-card!                                                                        hooks.common/with-one-binding
    metabase.api.public-test/with-temp-public-card                                                                            hooks.common/let-one-with-optional-value
    metabase.api.public-test/with-temp-public-dashboard                                                                       hooks.common/let-one-with-optional-value
    metabase.api.public-test/with-temp-public-dashboard-and-card                                                              hooks.common/with-three-bindings
@@ -725,33 +888,42 @@
    metabase.api.search-test/with-search-items-in-root-collection                                                             hooks.common/do*
    metabase.api.user-test/with-temp-user-email                                                                               hooks.common/with-one-binding
    metabase.async.streaming-response-test/with-start-execution-chan                                                          hooks.common/with-one-binding
-   metabase.db.schema-migrations-test.impl/test-migrations                                                                   hooks.metabase.db.schema-migrations-test.impl/test-migrations
+   metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
+   metabase.channel.template.handlebars-helper/defhelper                                                                     hooks.metabase.channel.template.handlebars-helper/defhelper
    metabase.dashboard-subscription-test/with-link-card-fixture-for-dashboard                                                 hooks.common/let-second
+   metabase.db.schema-migrations-test.impl/test-migrations                                                                   hooks.metabase.db.schema-migrations-test.impl/test-migrations
    metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
+   metabase.driver.oracle-test/with-temp-user                                                                                hooks.common/let-one-with-optional-value
    metabase.driver/register!                                                                                                 hooks.metabase.driver/register!
    metabase.legacy-mbql.schema.macros/defclause                                                                              hooks.metabase.legacy-mbql.schemas.macros/defclause
-   metabase.lib.schema.mbql-clause/define-mbql-clause                                                                        hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.schema.mbql-clause/define-catn-mbql-clause                                                                   hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
+   metabase.lib.schema.mbql-clause/define-mbql-clause                                                                        hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.schema.mbql-clause/define-tuple-mbql-clause                                                                  hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.test-util.macros/$ids                                                                                        hooks.metabase.test.data/$ids
    metabase.lib.test-util.macros/mbql-query                                                                                  hooks.metabase.test.data/mbql-query
    metabase.lib.test-util.macros/with-testing-against-standard-queries                                                       hooks.metabase.lib.test-util.macros/with-testing-against-standard-queries
-   metabase.models.collection-test/with-collection-hierarchy                                                                 hooks.common/let-one-with-optional-value
+   metabase.models.collection-test/with-collection-hierarchy!                                                                hooks.common/let-one-with-optional-value
    metabase.models.collection-test/with-personal-and-impersonal-collections                                                  hooks.common/with-two-bindings
-   metabase.models.dashboard-test/with-dash-in-collection                                                                    hooks.common/with-three-bindings
    metabase.models.dashboard-tab-test/with-dashtab-in-personal-collection                                                    hooks.common/with-one-top-level-binding
-   metabase.models.interface/define-simple-hydration-method                                                                  hooks.metabase.models.interface/define-hydration-method
+   metabase.models.dashboard-test/with-dash-in-collection!                                                                   hooks.common/with-three-bindings
    metabase.models.interface/define-batched-hydration-method                                                                 hooks.metabase.models.interface/define-hydration-method
-   metabase.models.pulse-test/with-dashboard-subscription-in-collection                                                      hooks.common/with-four-bindings
-   metabase.models.pulse-test/with-pulse-in-collection                                                                       hooks.common/with-four-bindings
+   metabase.models.interface/define-simple-hydration-method                                                                  hooks.metabase.models.interface/define-hydration-method
+   metabase.models.pulse-test/with-dashboard-subscription-in-collection!                                                     hooks.common/with-four-bindings
+   metabase.models.pulse-test/with-pulse-in-collection!                                                                      hooks.common/with-four-bindings
    metabase.models.setting.multi-setting/define-multi-setting                                                                hooks.metabase.models.setting/define-multi-setting
    metabase.models.setting/defsetting                                                                                        hooks.metabase.models.setting/defsetting
    metabase.public-settings.premium-features/defenterprise                                                                   hooks.metabase.public-settings.premium-features/defenterprise
    metabase.pulse.test-util/checkins-query-card                                                                              hooks.metabase.test.data/$ids
    metabase.query-processor-test.expressions-test/calculate-bird-scarcity                                                    hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
    metabase.query-processor-test.filter-test/count-with-filter-clause                                                        hooks.metabase.test.data/$ids
-   metabase.query-processor.middleware.cache-test/with-mock-cache                                                            hooks.common/with-two-bindings
+   metabase.query-processor.middleware.cache-test/with-mock-cache!                                                           hooks.common/with-two-bindings
+   metabase.request.core/with-current-request                                                                                hooks.common/with-used-first-arg
+   metabase.request.core/with-current-user                                                                                   hooks.common/with-used-first-arg
+   metabase.request.core/with-limit-and-offset                                                                               hooks.common/with-used-first-two-args
    metabase.sample-data-test/with-temp-sample-database-db                                                                    hooks.common/with-one-binding
+   metabase.stale-test/with-stale-items                                                                                      hooks.toucan2.tools.with-temp/with-temp
+   metabase.test.data.datasets/test-driver                                                                                   hooks.metabase.test.data.datasets/test-driver
+   metabase.test.data.datasets/test-drivers                                                                                  hooks.metabase.test.data.datasets/test-drivers
    metabase.test.data.users/with-group                                                                                       hooks.common/let-one-with-optional-value
    metabase.test.data/$ids                                                                                                   hooks.metabase.test.data/$ids
    metabase.test.data/dataset                                                                                                hooks.metabase.test.data/dataset
@@ -759,7 +931,6 @@
    metabase.test.data/run-mbql-query                                                                                         hooks.metabase.test.data/mbql-query
    metabase.test.util.async/with-open-channels                                                                               hooks.common/let-with-optional-value-for-last-binding
    metabase.test.util.log/with-log-level                                                                                     hooks.common/with-ignored-first-arg
-   metabase.test.util.log/with-log-messages-for-level                                                                        hooks.common/with-ignored-first-arg
    metabase.test.util/discard-setting-changes                                                                                hooks.common/with-ignored-first-arg
    metabase.test.util/with-column-remappings                                                                                 hooks.common/with-ignored-first-arg
    metabase.test.util/with-non-admin-groups-no-root-collection-perms                                                         hooks.common/do*
@@ -770,70 +941,72 @@
    metabase.test/discard-setting-changes                                                                                     hooks.common/with-ignored-first-arg
    metabase.test/mbql-query                                                                                                  hooks.metabase.test.data/mbql-query
    metabase.test/query                                                                                                       hooks.metabase.test.data/mbql-query
-   metabase.test/test-drivers                                                                                                hooks.common/do*
    metabase.test/run-mbql-query                                                                                              hooks.metabase.test.data/mbql-query
+   metabase.test/test-driver                                                                                                 hooks.metabase.test.data.datasets/test-driver
+   metabase.test/test-drivers                                                                                                hooks.metabase.test.data.datasets/test-drivers
    metabase.test/with-column-remappings                                                                                      hooks.common/with-ignored-first-arg
    metabase.test/with-group                                                                                                  hooks.common/let-one-with-optional-value
    metabase.test/with-log-level                                                                                              hooks.common/with-ignored-first-arg
-   metabase.test/with-log-messages-for-level                                                                                 hooks.common/with-ignored-first-arg
+   metabase.test/with-log-messages-for-level                                                                                 hooks.metabase.util.log.capture/with-log-messages-for-level
    metabase.test/with-non-admin-groups-no-root-collection-perms                                                              hooks.common/do*
    metabase.test/with-temp                                                                                                   hooks.toucan2.tools.with-temp/with-temp
-   metabase.stale-test/with-stale-items                                                                                      hooks.toucan2.tools.with-temp/with-temp
    metabase.test/with-temp-file                                                                                              hooks.metabase.test.util/with-temp-file
    metabase.test/with-temporary-setting-values                                                                               hooks.metabase.test.util/with-temporary-setting-values
-   metabase.util/format-color                                                                                                hooks.metabase.util/format-color
-   metabase.util.log/trace                                                                                                   hooks.metabase.util.log/info
-   metabase.util.log/tracef                                                                                                  hooks.metabase.util.log/infof
+   metabase.util.log.capture/with-log-messages-for-level                                                                     hooks.metabase.util.log.capture/with-log-messages-for-level
    metabase.util.log/debug                                                                                                   hooks.metabase.util.log/info
    metabase.util.log/debugf                                                                                                  hooks.metabase.util.log/infof
-   metabase.util.log/info                                                                                                    hooks.metabase.util.log/info
-   metabase.util.log/infof                                                                                                   hooks.metabase.util.log/infof
-   metabase.util.log/warn                                                                                                    hooks.metabase.util.log/info
-   metabase.util.log/warnf                                                                                                   hooks.metabase.util.log/infof
    metabase.util.log/error                                                                                                   hooks.metabase.util.log/info
    metabase.util.log/errorf                                                                                                  hooks.metabase.util.log/infof
    metabase.util.log/fatal                                                                                                   hooks.metabase.util.log/info
    metabase.util.log/fatalf                                                                                                  hooks.metabase.util.log/infof
-   metabase.util.malli.registry/def                                                                                          hooks.metabase.util.malli.registry/def}
+   metabase.util.log/info                                                                                                    hooks.metabase.util.log/info
+   metabase.util.log/infof                                                                                                   hooks.metabase.util.log/infof
+   metabase.util.log/trace                                                                                                   hooks.metabase.util.log/info
+   metabase.util.log/tracef                                                                                                  hooks.metabase.util.log/infof
+   metabase.util.log/warn                                                                                                    hooks.metabase.util.log/info
+   metabase.util.log/warnf                                                                                                   hooks.metabase.util.log/infof
+   metabase.util.malli.registry/def                                                                                          hooks.metabase.util.malli.registry/def
+   metabase.util/case-enum                                                                                                   hooks.metabase.util/case-enum
+   metabase.util/format-color                                                                                                hooks.metabase.util/format-color}
 
   :macroexpand
-  {clojurewerkz.quartzite.jobs/build                                            macros.quartz/build-job
-   clojurewerkz.quartzite.schedule.cron/schedule                                macros.quartz/schedule
-   clojurewerkz.quartzite.schedule.simple/schedule                              macros.quartz/simple-schedule
-   clojurewerkz.quartzite.triggers/build                                        macros.quartz/build-trigger
-   metabase-enterprise.sandbox.test-util/with-gtaps!                            macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                   macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.serialization.test-util/with-world                       macros.metabase-enterprise.serialization.test-util/with-world
-   metabase-enterprise.test/with-gtaps!                                         macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.test/with-gtaps-for-user!                                macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!  macros.metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!
-   metabase-enterprise.query-reference-validation.api-test/with-test-setup      macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup
-   metabase.api.card-test/with-ordered-items                                    macros.metabase.api.card-test/with-ordered-items
-   metabase.api.collection-test/with-collection-hierarchy                       macros.metabase.api.collection-test/with-collection-hierarchy
-   metabase.api.collection-test/with-some-children-of-collection                macros.metabase.api.collection-test/with-some-children-of-collection
-   metabase.api.common/define-routes                                            macros.metabase.api.common/define-routes
-   metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing     macros.metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing
-   metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing macros.metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing
-   metabase.api.public-test/with-sharing-enabled-and-temp-card-referencing      macros.metabase.api.public-test/with-sharing-enabled-and-temp-card-referencing
-   metabase.api.public-test/with-sharing-enabled-and-temp-dashcard-referencing  macros.metabase.api.public-test/with-sharing-enabled-and-temp-dashcard-referencing
-   metabase.lib.filter/deffilter                                                macros.metabase.lib.filter/deffilter
-   metabase.lib.common/defop                                                    macros.metabase.lib.common/defop
-   metabase.models.params.chain-filter-test/chain-filter                        macros.metabase.models.params.chain-filter-test/chain-filter
-   metabase.models.params.chain-filter-test/chain-filter-search                 macros.metabase.models.params.chain-filter-test/chain-filter
-   metabase.models.query-analysis-test/with-test-setup                          macros.metabase.models.query-analysis-test/with-test-setup
-   metabase.models.user-test/with-groups                                        macros.metabase.models.user-test/with-groups
-   metabase.query-processor.streaming/streaming-response                        macros.metabase.query-processor.streaming/streaming-response
-   metabase.related-test/with-world                                             macros.metabase.related-test/with-world
-   metabase.shared.util.namespaces/import-fn                                    macros.metabase.shared.util.namespaces/import-fn
-   metabase.task.setup.query-analysis-setup/with-test-setup!                    macros.metabase.task.setup.query-analysis-setup/with-test-setup!
-   metabase.test.data.users/with-group-for-user                                 macros.metabase.test.data.users/with-group-for-user
-   metabase.test.util/with-temp-env-var-value!                                  macros.metabase.test.util/with-temp-env-var-value!
-   metabase.test.util/with-temporary-raw-setting-values                         macros.metabase.test.util/with-temporary-raw-setting-values
-   metabase.test/with-group-for-user                                            macros.metabase.test.data.users/with-group-for-user
-   metabase.test/with-persistence-enabled                                       macros.metabase.test.persistence/with-persistence-enabled
-   metabase.test/with-temp-env-var-value!                                       macros.metabase.test.util/with-temp-env-var-value!
-   metabase.test/with-temporary-raw-setting-values                              macros.metabase.test.util/with-temporary-raw-setting-values
-   metabase.xrays.domain-entities.malli/define-getters-and-setters              macros.metabase.xrays.domain-entities.malli/define-getters-and-setters}}
+  {clojurewerkz.quartzite.jobs/build                                             macros.quartz/build-job
+   clojurewerkz.quartzite.schedule.cron/schedule                                 macros.quartz/schedule
+   clojurewerkz.quartzite.schedule.simple/schedule                               macros.quartz/simple-schedule
+   clojurewerkz.quartzite.triggers/build                                         macros.quartz/build-trigger
+   metabase-enterprise.sandbox.test-util/with-gtaps!                             macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                    macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.serialization.test-util/with-world                        macros.metabase-enterprise.serialization.test-util/with-world
+   metabase-enterprise.test/with-gtaps!                                          macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.test/with-gtaps-for-user!                                 macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!   macros.metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!
+   metabase-enterprise.query-reference-validation.api-test/with-test-setup!      macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
+   metabase.api.card-test/with-ordered-items                                     macros.metabase.api.card-test/with-ordered-items
+   metabase.api.collection-test/with-collection-hierarchy!                       macros.metabase.api.collection-test/with-collection-hierarchy!
+   metabase.api.collection-test/with-some-children-of-collection!                macros.metabase.api.collection-test/with-some-children-of-collection!
+   metabase.api.common/define-routes                                             macros.metabase.api.common/define-routes
+   metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing!     macros.metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing!
+   metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing! macros.metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
+   metabase.api.public-test/with-sharing-enabled-and-temp-card-referencing!      macros.metabase.api.public-test/with-sharing-enabled-and-temp-card-referencing!
+   metabase.api.public-test/with-sharing-enabled-and-temp-dashcard-referencing!  macros.metabase.api.public-test/with-sharing-enabled-and-temp-dashcard-referencing!
+   metabase.lib.filter/deffilter                                                 macros.metabase.lib.filter/deffilter
+   metabase.lib.common/defop                                                     macros.metabase.lib.common/defop
+   metabase.models.params.chain-filter-test/chain-filter                         macros.metabase.models.params.chain-filter-test/chain-filter
+   metabase.models.params.chain-filter-test/chain-filter-search                  macros.metabase.models.params.chain-filter-test/chain-filter
+   metabase.models.query-analysis-test/with-test-setup                           macros.metabase.models.query-analysis-test/with-test-setup
+   metabase.models.user-test/with-groups                                         macros.metabase.models.user-test/with-groups
+   metabase.query-processor.streaming/streaming-response                         macros.metabase.query-processor.streaming/streaming-response
+   metabase.related-test/with-world                                              macros.metabase.related-test/with-world
+   metabase.task.setup.query-analysis-setup/with-test-setup!                     macros.metabase.task.setup.query-analysis-setup/with-test-setup!
+   metabase.test.data.users/with-group-for-user                                  macros.metabase.test.data.users/with-group-for-user
+   metabase.test.util/with-temp-env-var-value!                                   macros.metabase.test.util/with-temp-env-var-value!
+   metabase.test.util/with-temporary-raw-setting-values                          macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.test/with-group-for-user                                             macros.metabase.test.data.users/with-group-for-user
+   metabase.test/with-persistence-enabled!                                       macros.metabase.test.persistence/with-persistence-enabled!
+   metabase.test/with-temp-env-var-value!                                        macros.metabase.test.util/with-temp-env-var-value!
+   metabase.test/with-temporary-raw-setting-values                               macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.util.namespaces/import-fn                                            macros.metabase.util.namespaces/import-fn
+   metabase.xrays.domain-entities.malli/define-getters-and-setters               macros.metabase.xrays.domain-entities.malli/define-getters-and-setters}}
 
  :config-in-comment
  {:linters {:unresolved-symbol {:level :off}}}

.clj-kondo/macros/metabase/api/collection_test.clj

@@ -1,7 +1,7 @@
 (ns macros.metabase.api.collection-test
   (:require [macros.common]))
 
-(defmacro with-collection-hierarchy [bindings & body]
+(defmacro with-collection-hierarchy! [bindings & body]
   `(let [~(macros.common/ignore-unused 'a) nil
          ~(macros.common/ignore-unused 'b) nil
          ~(macros.common/ignore-unused 'c) nil
@@ -12,6 +12,6 @@
      ~bindings
      ~@body))
 
-(defmacro with-some-children-of-collection [collection-or-id-or-nil & body]
+(defmacro with-some-children-of-collection! [collection-or-id-or-nil & body]
   `(let [~(macros.common/ignore-unused '&ids) ~collection-or-id-or-nil]
      ~@body))

.clj-kondo/macros/metabase/api/embed_test.clj

@@ -1,11 +1,11 @@
 (ns macros.metabase.api.embed-test)
 
-(defmacro with-embedding-enabled-and-temp-card-referencing
+(defmacro with-embedding-enabled-and-temp-card-referencing!
   [table-kw field-kw [card-binding] & body]
   `(let [~card-binding [~table-kw ~field-kw]]
      ~@body))
 
-(defmacro with-embedding-enabled-and-temp-dashcard-referencing
+(defmacro with-embedding-enabled-and-temp-dashcard-referencing!
   [table-kw field-kw [dash-binding card-binding dashcard-binding] & body]
   `(let [~dash-binding             [~table-kw ~field-kw]
          ~(or card-binding '_)     nil

.clj-kondo/macros/metabase/api/public_test.clj

@@ -1,11 +1,11 @@
 (ns macros.metabase.api.public-test)
 
-(defmacro with-sharing-enabled-and-temp-card-referencing
+(defmacro with-sharing-enabled-and-temp-card-referencing!
   [table-kw field-kw [card-binding] & body]
   `(let [~card-binding [~table-kw ~field-kw]]
      ~@body))
 
-(defmacro with-sharing-enabled-and-temp-dashcard-referencing
+(defmacro with-sharing-enabled-and-temp-dashcard-referencing!
   [table-kw field-kw [dash-binding card-binding dashcard-binding] & body]
   `(let [~dash-binding             [~table-kw ~field-kw]
          ~(or card-binding '_)     nil

.clj-kondo/macros/metabase/shared/util/namespaces.clj

@@ -1,8 +0,0 @@
-(ns macros.metabase.shared.util.namespaces)
-
-(defmacro import-fn
-  "Kondo macro replacement for [[metabase.shared.util.namespaces/import-fn]]."
-  ([sym]
-   `(def ~(-> sym name symbol) "docstring" ~sym))
-  ([sym name]
-   `(def ~name "docstring" ~sym)))

.clj-kondo/macros/metabase/task/setup/query_analysis_setup.clj

@@ -8,5 +8,6 @@
          ~(macros.common/ignore-unused 'c2) 2
          ~(macros.common/ignore-unused 'c3) 3
          ~(macros.common/ignore-unused 'c4) 4
-         ~(macros.common/ignore-unused 'arch) 5]
+         ~(macros.common/ignore-unused 'archived) 5
+         ~(macros.common/ignore-unused 'invalid) 6]
      ~@body))

.clj-kondo/macros/metabase/test/persistence.clj

@@ -1,5 +1,5 @@
 (ns macros.metabase.test.persistence)
 
-(defmacro with-persistence-enabled [[persist-fn-sym] & body]
+(defmacro with-persistence-enabled! [[persist-fn-sym] & body]
   `(clojure.core/let [~persist-fn-sym (fn [])]
      ~@body))

.clj-kondo/macros/metabase/util/namespaces.clj

@@ -0,0 +1,8 @@
+(ns macros.metabase.util.namespaces)
+
+(defmacro import-fn
+  "Kondo macro replacement for [[metabase.util.namespaces/import-fn]]."
+  ([sym]
+   `(def ~(-> sym name symbol) "docstring" ~sym))
+  ([sym name]
+   `(def ~name "docstring" ~sym)))

.clj-kondo/macros/metabase_enterprise/query_reference_validation/api_test.clj

@@ -1,7 +1,7 @@
 (ns macros.metabase-enterprise.query-reference-validation.api-test
   (:require [macros.common]))
 
-(defmacro with-test-setup [& body]
+(defmacro with-test-setup! [& body]
   `(let [~(macros.common/ignore-unused 'card-1) 1
          ~(macros.common/ignore-unused 'card-2) 2
          ~(macros.common/ignore-unused 'card-3) 3

.clj-kondo/src/hooks/clojure/core.clj

@@ -1,10 +1,11 @@
 (ns hooks.clojure.core
   (:require
    [clj-kondo.hooks-api :as hooks]
-   [clojure.set :as set]
    [clojure.string :as str]
    [hooks.common]))
 
+;;; TODO -- seems silly to maintain different blacklists and whitelists here than we use for the deftest `^:parallel`
+;;; checker... those lists live in the Clj Kondo config file
 (def ^:private symbols-allowed-in-fns-not-ending-in-an-exclamation-point
   '#{;; these toucan methods might actually set global values if it's used outside of a transaction,
      ;; but since mt/with-temp runs in a transaction, so we'll ignore them in this case.
@@ -84,15 +85,14 @@
      metabase.models.permissions/update-data-perms-graph!
      metabase.models.permissions/update-group-permissions!
      metabase.models.persisted-info/ready-database!
-     metabase.models.revision/revert!
      metabase.models.setting-test/test-user-local-allowed-setting!
      metabase.models.setting-test/test-user-local-only-setting!
      metabase.models.setting.cache/restore-cache!
      metabase.models.setting/set!
      metabase.models.setting/validate-settings-formatting!
      metabase.permissions.test-util/with-restored-perms!
-     metabase.pulse/send-notifications!
-     metabase.pulse/send-pulse!
+     metabase.pulse.send/send-notifications!
+     metabase.pulse.send/send-pulse!
      metabase.query-processor.streaming.interface/begin!
      metabase.query-processor.streaming.interface/finish!
      metabase.query-processor.streaming.interface/write-row!
@@ -139,23 +139,34 @@
   [s]
   (str/ends-with? s "!"))
 
+(defn- explicitly-safe? [qualified-symbol]
+  (contains? symbols-allowed-in-fns-not-ending-in-an-exclamation-point qualified-symbol))
+
+(defn- explicitly-unsafe? [config qualified-symbol]
+  (contains? (get-in config [:linters :metabase/validate-deftest :parallel/unsafe]) qualified-symbol))
+
+(defn- unsafe? [config qualified-symbol]
+  (and (or (end-with-exclamation? qualified-symbol)
+           (explicitly-unsafe? config qualified-symbol))
+       (not (explicitly-safe? qualified-symbol))))
+
 (defn- non-thread-safe-form-should-end-with-exclamation*
-  [{[defn-or-defmacro form-name] :children, :as node}]
+  [{[defn-or-defmacro form-name] :children, :as node} config]
   (when-not (and (:string-value form-name)
                  (end-with-exclamation? (:string-value form-name)))
     (letfn [(walk [f form]
               (f form)
               (doseq [child (:children form)]
-                (walk f child)))]
-      (walk (fn [form]
+                (walk f child)))
+            (check-node [form]
               (when-let [qualified-symbol (hooks.common/node->qualified-symbol form)]
-                (when (and (not (contains? symbols-allowed-in-fns-not-ending-in-an-exclamation-point qualified-symbol))
-                           (end-with-exclamation? qualified-symbol))
-                  (hooks/reg-finding! (assoc (meta form-name)
-                                             :message (format "The name of this %s should end with `!` because it contains calls to non thread safe form `%s`."
-                                                              (:string-value defn-or-defmacro) qualified-symbol)
-                                             :type :metabase/test-helpers-use-non-thread-safe-functions)))))
-            node))
+                (when (unsafe? config qualified-symbol)
+                  (hooks/reg-finding!
+                   (assoc (meta form-name)
+                          :message (format "The name of this %s should end with `!` because it contains calls to non thread safe form `%s`. [:metabase/test-helpers-use-non-thread-safe-functions]"
+                                           (:string-value defn-or-defmacro) qualified-symbol)
+                          :type :metabase/test-helpers-use-non-thread-safe-functions)))))]
+      (walk check-node node))
     node))
 
 (defn non-thread-safe-form-should-end-with-exclamation
@@ -163,36 +174,36 @@
   A function or a macro can be defined as 'not thread safe' when their funciton name ends with a `!`.
 
   Only used in tests to identify thread-safe/non-thread-safe test helpers. See #37126"
-  [{:keys [node cljc lang]}]
+  [{:keys [node cljc lang config]}]
   (when (or (not cljc)
             (= lang :clj))
-    (non-thread-safe-form-should-end-with-exclamation* node))
+    (non-thread-safe-form-should-end-with-exclamation* node config))
   {:node node})
 
 (comment
- (require '[clj-kondo.core :as clj-kondo])
- (def form (str '(defmacro a
-                   [x]
-                   `(fun-call x))))
+  (require '[clj-kondo.core :as clj-kondo])
+  (def form (str '(defmacro a
+                    [x]
+                    `(fun-call x))))
 
- (def form "(defmacro a
+  (def form "(defmacro a
            [x]
            `(some! ~x))")
 
- (def form "(defun f
+  (def form "(defun f
            [x]
            (let [g! (fn [] 1)]
            (g!)))")
 
- (str (hooks/parse-string form))
- (hooks/sexpr (hooks/parse-string form))
+  (str (hooks/parse-string form))
+  (hooks/sexpr (hooks/parse-string form))
 
- (binding [hooks/*reload* true]
-   (-> form
-       (with-in-str (clj-kondo/run! {:lint ["-"]}))
-       :findings))
+  (binding [hooks/*reload* true]
+    (-> form
+        (with-in-str (clj-kondo/run! {:lint ["-"]}))
+        :findings))
 
- (do (non-thread-safe-form-should-end-with-exclamation* (hooks/parse-string form)) nil))
+  (do (non-thread-safe-form-should-end-with-exclamation* (hooks/parse-string form)) nil))
 
 (defn- ns-form-node->require-node [ns-form-node]
   (some (fn [node]
@@ -227,11 +238,12 @@
                   (cond
                     (hooks/vector-node? node)
                     ;; propagate the metadata attached to this vector in case there's a `:clj-kondo/ignore` form.
-                    (vary-meta (first (:children node)) (partial merge (meta require-node) (meta node)))
+                    (let [symbol-node (first (:children node))]
+                      (hooks.common/merge-ignored-linters symbol-node require-node node))
 
                     ;; this should also be dead code since we require requires to be vectors
                     (hooks/token-node? node)
-                    (vary-meta node (partial merge (meta require-node)))
+                    (hooks.common/merge-ignored-linters node require-node)
 
                     :else
                     (printf "Don't know how to figure out what namespace is being required in %s\n" (pr-str node)))))
@@ -283,8 +295,7 @@
                                                 ns-form-node->require-node
                                                 require-node->namespace-symb-nodes)]
           (doseq [node  required-namespace-symb-nodes
-                  :let  [clj-kondo-ignore (some-> (meta node) :clj-kondo/ignore hooks/sexpr set)]
-                  :when (not (contains? clj-kondo-ignore :metabase/ns-module-checker))
+                  :when (not (contains? (hooks.common/ignored-linters node) :metabase/ns-module-checker))
                   :let  [required-namespace (hooks/sexpr node)
                          required-module    (module required-namespace)]
                   ;; ignore stuff not in a module i.e. non-Metabase stuff.

.clj-kondo/src/hooks/clojure/test.clj

@@ -4,114 +4,7 @@
    [clojure.string :as str]
    [hooks.common]))
 
-(def ^:private disallowed-parallel-forms
-  "Things you should not be allowed to use inside parallel tests. Besides these, anything ending in `!` not whitelisted
-  in [[allowed-parallel-forms]] is not allowed."
-  '#{clojure.core/alter-var-root
-     clojure.core/with-redefs
-     clojure.core/with-redefs-fn
-     metabase-enterprise.sandbox.test-util/with-gtaps!
-     metabase-enterprise.sandbox.test-util/with-gtaps-for-user!
-     metabase-enterprise.sandbox.test-util/with-user-attributes
-     metabase-enterprise.test/with-gtaps!
-     metabase-enterprise.test/with-gtaps-for-user!
-     metabase-enterprise.test/with-user-attributes
-     metabase.actions.test-util/with-actions
-     metabase.actions.test-util/with-actions-disabled
-     metabase.actions.test-util/with-actions-enabled
-     metabase.actions.test-util/with-actions-test-data
-     metabase.actions.test-util/with-actions-test-data-and-actions-enabled
-     metabase.actions.test-util/with-actions-test-data-tables
-     metabase.analytics.snowplow-test/with-fake-snowplow-collector
-     metabase.email-test/with-expected-messages
-     metabase.email-test/with-fake-inbox
-     metabase.test.data.users/with-group
-     metabase.test.data.users/with-group-for-user
-     metabase.test.persistence/with-persistence-enabled
-     metabase.test.util.log/with-log-level
-     metabase.test.util.log/with-log-messages-for-level
-     metabase.test.util.misc/with-single-admin-user
-     metabase.test.util/with-all-users-permission
-     metabase.test.util/with-discarded-collections-perms-changes
-     metabase.test.util/with-env-keys-renamed-by
-     metabase.test.util/with-locale
-     metabase.test.util/with-non-admin-groups-no-root-collection-for-namespace-perms
-     metabase.test.util/with-non-admin-groups-no-root-collection-perms
-     metabase.test.util/with-temp-env-var-value
-     metabase.test.util/with-temp-vals-in-db
-     metabase.test.util/with-temporary-raw-setting-values
-     metabase.test.util/with-temporary-setting-values
-     metabase.test.util/with-user-in-groups
-     metabase.test/with-actions
-     metabase.test/with-actions-disabled
-     metabase.test/with-actions-enabled
-     metabase.test/with-actions-test-data
-     metabase.test/with-actions-test-data-and-actions-enabled
-     metabase.test/with-actions-test-data-tables
-     metabase.test/with-all-users-permission
-     metabase.test/with-discarded-collections-perms-changes
-     metabase.test/with-env-keys-renamed-by
-     metabase.test/with-expected-messages
-     metabase.test/with-fake-inbox
-     metabase.test/with-group
-     metabase.test/with-group-for-user
-     metabase.test/with-locale
-     metabase.test/with-log-level
-     metabase.test/with-log-messages-for-level
-     metabase.test/with-non-admin-groups-no-root-collection-for-namespace-perms
-     metabase.test/with-non-admin-groups-no-root-collection-perms
-     metabase.test/with-persistence-enabled
-     metabase.test/with-single-admin-user
-     metabase.test/with-temp-env-var-value
-     metabase.test/with-temp-vals-in-db
-     metabase.test/with-temporary-raw-setting-values
-     metabase.test/with-temporary-setting-values
-     metabase.test/with-user-in-groups})
-
-;;; TODO -- we should disallow `metabase.test/user-http-request` with any method other than `:get`
-
-(def ^:private allowed-parallel-forms
-  "These fns are destructive, but are probably fine inside ^:parallel tests because it usually means you're doing
-  something to an atom or something like that."
-  '#{clojure.core/assoc!
-     clojure.core/compare-and-set!
-     clojure.core/conj!
-     clojure.core/disj!
-     clojure.core/dissoc!
-     clojure.core/persistent!
-     clojure.core/pop!
-     clojure.core/reset!
-     clojure.core/reset-vals!
-     clojure.core/run!
-     clojure.core/swap!
-     clojure.core/swap-vals!
-     clojure.core/volatile!
-     clojure.core/vreset!
-     clojure.core/vswap!
-     clojure.core.async/<!
-     clojure.core.async/<!!
-     clojure.core.async/>!
-     clojure.core.async/>!!
-     clojure.core.async/alt!
-     clojure.core.async/alt!!
-     clojure.core.async/alts!
-     clojure.core.async/alts!!
-     clojure.core.async/close!
-     clojure.core.async/ioc-alts!
-     clojure.core.async/offer!
-     clojure.core.async/onto-chan!
-     clojure.core.async/onto-chan!!
-     clojure.core.async/poll!
-     clojure.core.async/put!
-     clojure.core.async/take!
-     clojure.core.async/to-chan!
-     clojure.core.async/to-chan!!
-     metabase.driver.sql-jdbc.execute/execute-prepared-statement!
-     metabase.pulse/send-pulse!
-     metabase.query-processor.store/store-database!
-     next.jdbc/execute!})
-
-(defn- warn-about-disallowed-parallel-forms [form]
+(defn- warn-about-disallowed-parallel-forms [form config]
   (letfn [(error! [form message]
             (hooks/reg-finding! (assoc (meta form)
                                        :message message
@@ -119,12 +12,12 @@
           (f [form]
             (when-let [qualified-symbol (hooks.common/node->qualified-symbol form)]
               (cond
-                (disallowed-parallel-forms qualified-symbol)
-                (error! form (format "%s is not allowed inside a ^:parallel test or test fixture" qualified-symbol))
+                (contains? (:parallel/unsafe config) qualified-symbol)
+                (error! form (format "%s is not allowed inside a ^:parallel test or test fixture [:metabase/validate-deftest]" qualified-symbol))
 
-                (and (not (allowed-parallel-forms qualified-symbol))
+                (and (not (contains? (:parallel/safe config) qualified-symbol))
                      (str/ends-with? (name qualified-symbol) "!"))
-                (error! form (format "destructive functions like %s are not allowed inside a ^:parallel test or test fixture. If this should be allowed, add it to the whitelist in .clj-kondo/hooks/clojure/test.clj"
+                (error! form (format "destructive functions like %s are not allowed inside a ^:parallel test or test fixture. If this should be allowed, add it to the whitelist in the Kondo config file [:metabase/validate-deftest]"
                                      qualified-symbol)))))
           (walk [form]
             (f form)
@@ -135,7 +28,7 @@
 (defn- deftest-check-parallel
   "1. Check if test is marked ^:parallel / ^:synchronized correctly
    2. Make sure disallowed forms are not used in ^:parallel tests"
-  [{[_ test-name & body] :children, :as _node}]
+  [{[_ test-name & body] :children, :as _node} config]
   (let [test-metadata     (:meta test-name)
         metadata-sexprs   (map hooks/sexpr test-metadata)
         combined-metadata (transduce
@@ -152,9 +45,9 @@
       (hooks/reg-finding! (assoc (meta test-name)
                                  :message "Test should not be marked both ^:parallel and ^:synchronized"
                                  :type :metabase/validate-deftest)))
-    ;; only when the custom `:metabase/deftest-not-marked-parallel` is enabled: complain if tests are not explicitly
-    ;; marked `^:parallel` or `^:synchronized`. This is mostly to encourage people to mark everything `^:parallel` in
-    ;; places like `metabase.lib` tests unless there is a really good reason not to.
+    ;; only when the custom `:metabase/deftest-not-marked-parallel-or-synchronized` is enabled: complain if tests are
+    ;; not explicitly marked `^:parallel` or `^:synchronized`. This is mostly to encourage people to mark everything
+    ;; `^:parallel` in places like `metabase.lib` tests unless there is a really good reason not to.
     (when-not (or parallel? synchronized?)
       (hooks/reg-finding!
        (assoc (meta test-name)
@@ -162,59 +55,31 @@
               :type :metabase/deftest-not-marked-parallel-or-synchronized)))
     (when parallel?
       (doseq [form body]
-        (warn-about-disallowed-parallel-forms form)))))
-
-(def ^:private number-of-lines-for-a-test-to-be-considered-horrifically-long
-  200)
+        (warn-about-disallowed-parallel-forms form config)))))
 
 (defn- deftest-check-not-horrifically-long
-  [node]
+  [node {:keys [max-length], :as _config}]
   (let [{:keys [row end-row]} (meta node)]
     (when (and row end-row)
       (let [num-lines (- end-row row)]
-        (when (>= num-lines number-of-lines-for-a-test-to-be-considered-horrifically-long)
+        (when (and max-length
+                   (>= num-lines max-length))
           (hooks/reg-finding! (assoc (meta node)
                                      :message (str (format "This test is horrifically long, it's %d lines! 😱 " num-lines)
                                                    "Do you really want to try to debug it if it fails? 💀 "
                                                    "Split it up into smaller tests! 🥰")
                                      :type :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests)))))))
 
-;;; don't include `:h2` since that will probably lead to a mountain of tests where we are specifically testing
-;;; middleware or compilation behavior with just H2 since it's the default.
-(def driver-keywords
-  #{;; core drivers
-    #_:h2
-    :postgres
-    :mysql
-    ;; module drivers
-    :athena
-    :bigquery-cloud-sdk
-    :druid
-    :druid-jdbc
-    :googleanalytics
-    :mongo
-    :oracle
-    :presto-jdbc
-    :redshift
-    :snowflake
-    :sparksql
-    :sqlite
-    :sqlserver
-    :vertica})
-
 (defn- ignore? [node error-type]
-  (when-let [ignores (some-> node meta :clj-kondo/ignore hooks/sexpr)]
-    (when-let [ignores (cond
-                         (coll? ignores)    (set ignores)
-                         (keyword? ignores) #{ignores})]
-      (contains? ignores error-type))))
+  (contains? (hooks.common/ignored-linters node) error-type))
 
-(defn deftest-check-no-driver-keywords [node]
+(defn deftest-check-no-driver-keywords [node {:keys [drivers], :as _config}]
   ;; fail fast after we see the first error, where we see one hardcoded driver name there are likely several more and we
   ;; don't need multiple warnings for a single test.
   (letfn [(f [node]
             (when (and (hooks/keyword-node? node)
-                       (driver-keywords (hooks/sexpr node)))
+                       (set? drivers)
+                       (contains? drivers (hooks/sexpr node)))
               (hooks/reg-finding! (assoc (meta node)
                                          :message (format "Do not hardcode driver name %s in driver tests! [:metabase/disallow-hardcoded-driver-names-in-tests]"
                                                           (hooks/sexpr node))
@@ -237,14 +102,14 @@
                (:children node))))]
     (walk node)))
 
-(defn deftest [{:keys [node cljc lang]}]
+(defn deftest [{:keys [node cljc lang config]}]
   ;; run [[deftest-check-parallel]] only once... if this is a `.cljc` file only run it for the `:clj` analysis, no point
   ;; in running it twice.
   (when (or (not cljc)
             (= lang :clj))
-    (deftest-check-parallel node))
-  (deftest-check-not-horrifically-long node)
-  (deftest-check-no-driver-keywords node)
+    (deftest-check-parallel node (get-in config [:linters :metabase/validate-deftest])))
+  (deftest-check-not-horrifically-long node (get-in config [:linters :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests]))
+  (deftest-check-no-driver-keywords node (get-in config [:linters :metabase/disallow-hardcoded-driver-names-in-tests]))
   {:node node})
 
 ;;; this is a hacky way to determine whether these namespaces are required in the `ns` form or not... basically `:ns`
@@ -286,6 +151,6 @@
     (warn-about-missing-test-expr-requires-in-cljs node))
   {:node node})
 
-(defn use-fixtures [{:keys [node]}]
-  (warn-about-disallowed-parallel-forms node)
+(defn use-fixtures [{:keys [node config]}]
+  (warn-about-disallowed-parallel-forms node config)
   {:node node})

.clj-kondo/src/hooks/common.clj

@@ -1,7 +1,8 @@
 (ns hooks.common
   (:require
    [clj-kondo.hooks-api :as hooks]
-   [clojure.pprint]))
+   [clojure.pprint]
+   [clojure.set :as set]))
 
 (defn with-macro-meta
   "When introducing internal nodes (let, defn, etc) it is important to provide a meta of an existing token
@@ -9,10 +10,83 @@
   [new-node hook-node]
   (with-meta new-node (meta (first (:children hook-node)))))
 
+;;; Kondo stores information about ignored linters as rewrite-clj forms matching how they are specified in the code, so
+;;; either
+;;;
+;;;    <vector-node [<token-node :discouraged-namespace>]>
+;;;
+;;; or
+;;;
+;;;    <token-node :discouraged-namespace>
+;;;
+;;; these are stored in
+;;;
+;;;     (-> node meta :clj-kondo/ignore :linters).
+;;;
+;;; These are not a convenient shape(s) to work with, so the next few functions abstract that shape out and work with a
+;;; set of keywords like
+;;;
+;;;    #{:discouraged-namespace}
+;;;
+;;; instead.
+
+(defn- unwrap-ignored-linters [linters]
+  (cond
+    (or (hooks/vector-node? linters)
+        (hooks/list-node? linters))
+    (into #{}
+          (map hooks/sexpr)
+          (:children linters))
+
+    (hooks/keyword-node? linters)
+    #{(hooks/sexpr linters)}
+
+    (and (set? linters)
+         (every? keyword? linters))
+    linters
+
+    (and (sequential? linters)
+         (every? keyword? linters))
+    (into #{} linters)
+
+    (keyword? linters)
+    #{linters}))
+
+(defn- wrap-ignored-linters [linters]
+  (hooks/vector-node (mapv hooks/keyword-node linters)))
+
+(defn ignored-linters
+  "Return a set of keywords all ignored linters associated with a node by looking at its metadata."
+  [node]
+  (or (some-> node meta :clj-kondo/ignore :linters unwrap-ignored-linters)
+      ;; deal with the old pre-2024.09 shape mentioned in https://github.com/clj-kondo/clj-kondo/issues/2414
+      (some-> node :meta first hooks/sexpr :clj-kondo/ignore unwrap-ignored-linters)))
+
+(defn update-ignored-linters
+  "Update the `:clj-kondo/ignore` linters in `node`'s metadata. `linters` should be a set of keywords."
+  [node f & args]
+  (letfn [(apply-f [linters]
+            (apply f linters args))
+          (update-linters [linters]
+            (-> (or (unwrap-ignored-linters linters)
+                    #{})
+                apply-f
+                wrap-ignored-linters))]
+    (vary-meta node update-in [:clj-kondo/ignore :linters] update-linters)))
+
+(defn merge-ignored-linters
+  "Merge the ignored linters from `source-nodes` into `node`. You can use this to propagate
+  ignored linters from parent nodes to child nodes."
+  [node & source-nodes]
+  (if-let [linters (not-empty (transduce (map ignored-linters) set/union #{} source-nodes))]
+    (update-ignored-linters node set/union linters)
+    node))
+
 ;;; This stuff is to help debug hooks. Trace a function and it will pretty-print the before & after sexprs.
 ;;;
 ;;;    (hooks.common/trace #'calculate-bird-scarcity)
 
+#_{:clj-kondo/ignore [:discouraged-var]}
 (defn- trace* [f]
   {:pre [(fn? f)]}
   (fn traced-fn [node]
@@ -42,13 +116,14 @@
 ;;;; Common hook definitions
 
 (defn do*
-  "This is the same idea as [[clojure.core/do]] but doesn't cause Kondo to complain about redundant dos or unused values."
+  "This is the same idea as [[clojure.core/do]] but doesn't cause Kondo to complain about redundant dos or unused
+  values."
   [{{[_ & args] :children, :as node} :node}]
   (let [node* (-> (hooks/list-node
                    (list*
-                    (with-meta (hooks/token-node 'do) {:clj-kondo/ignore [:redundant-do]})
+                    (update-ignored-linters (hooks/token-node 'do) conj :redundant-do)
                     (for [arg args]
-                      (vary-meta arg update :clj-kondo/ignore #(conj (vec %) :unused-value)))))
+                      (update-ignored-linters arg conj :unused-value))))
                   (with-meta (meta node)))]
     {:node node*}))
 
@@ -288,8 +363,8 @@
     (-> (hooks/vector-node
          [(hooks/vector-node (map :model binding-infos))
           (-> (hooks/list-node (list* (hooks/token-node `let)
-                                    (hooks/vector-node (mapcat (juxt :binding :value) binding-infos))
-                                    body))
+                                      (hooks/vector-node (mapcat (juxt :binding :value) binding-infos))
+                                      body))
               (with-meta (meta body)))])
         (with-meta (meta body)))))
 
@@ -364,14 +439,58 @@
   where the first arg should be linted and appear to be used."
   [{{[_ arg & body] :children} :node}]
   (let [node* (hooks/list-node
-                (list*
-                  (hooks/token-node 'let)
-                  (hooks/vector-node [(hooks/token-node (gensym "_"))
-                                      arg])
-                  body))]
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node [(hooks/token-node (gensym "_"))
+                                    arg])
+                body))]
     {:node node*}))
 
-(defn node->qualified-symbol [node]
+(defn with-used-first-two-args
+  "For macros like
+
+    (with-limit-and-offset limit offset
+      ...)
+
+    =>
+
+    (let [_123 limit
+         [_456 offset]
+      ...)
+
+  where the first arg should be linted and appear to be used."
+  [{{[_ x y & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node [(hooks/token-node (gensym "_")) x
+                                    (hooks/token-node (gensym "_")) y])
+                body))]
+    {:node node*}))
+
+(defn with-vec-first-binding
+  "For macros like
+
+    (with-temp-file [binding \"temp.txt\" \"content\"]
+      (slurp binding))
+
+    =>
+    (let [binding nil]
+      (slurp binding))
+
+    where the first arg is a vector of bindings."
+  [{{[_ {[x & _args] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [(or x (hooks/token-node '_)) (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn node->qualified-symbol
+  "If the node is a symbol, return it as a qualified symbol if it's not already. Otherwise return nil."
+  [node]
   (try
     (when (hooks/token-node? node)
       (let [sexpr (hooks/sexpr node)]
@@ -381,8 +500,8 @@
               (and resolved (:ns resolved))
               (symbol (name (:ns resolved)) (name (:name resolved)))
 
-              ;; if it wasn't resolved but is still qualified it's probably using the full namespace name rather than an
-              ;; alias.
+             ;; if it wasn't resolved but is still qualified it's probably using the full namespace name rather than an
+             ;; alias.
               (qualified-symbol? sexpr)
               sexpr)))))
     ;; some symbols like `*count/Integer` aren't resolvable.
@@ -407,3 +526,12 @@
 
   ;; should be 1
   (format-string-specifier-count "%-02d"))
+
+(defn add-lsp-ignore-unused-public-var-metadata
+  "Add
+
+    ^{:clj-kondo/ignore [:clojure-lsp/unused-public-var]}
+
+  metadata to a node to suppress LSP warnings."
+  [node]
+  (update-ignored-linters node conj :clojure-lsp/unused-public-var))

.clj-kondo/src/hooks/metabase/api/automagic_dashboards_test.clj

@@ -4,8 +4,8 @@
 (comment
 
   (def input (hooks/parse-string
-              "(with-indexed-model [{:keys [model model-index model-index-value]}
-                                    {:query :some-query}]
+              "(with-indexed-model! [{:keys [model model-index model-index-value]}
+                                     {:query :some-query}]
                   :foo :bar :body)"))
 
   (println (hooks/sexpr input))
@@ -13,12 +13,12 @@
   (let [f (load-file ".clj-kondo/hooks/metabase/api/automagic_dashboards_test.clj")]
     (f {:node input})))
 
-(defn with-indexed-model
+(defn with-indexed-model!
   [{node :node}]
   (let [[_macro-call binding-and-query-info & body] (:children node)
         [binding query-info] (:children binding-and-query-info)
         node* (hooks/list-node
-               [(hooks/token-node 'do-with-testing-model)
+               [(hooks/token-node 'do-with-indexed-model!)
                 query-info
                 (hooks/list-node
                  (list* (hooks/token-node 'fn)

.clj-kondo/src/hooks/metabase/api/common.clj

@@ -1,7 +1,8 @@
 (ns hooks.metabase.api.common
   (:require
    [clj-kondo.hooks-api :as api]
-   [clojure.string :as str]))
+   [clojure.string :as str]
+   [hooks.common]))
 
 (defn route-fn-name
   "route fn hook"
@@ -15,31 +16,17 @@
   [arg]
   (letfn [(update-defendpoint [node]
             (let [[_defendpoint method route & body] (:children node)]
-              (api/list-node
-               (list
-                (api/token-node 'do)
-                (api/token-node (symbol "compojure.core" (str (api/sexpr method))))
-                (-> (api/list-node
+              (-> (api/list-node
+                   (list
+                    (api/token-node 'do)
+                    (-> (api/token-node (symbol "compojure.core" (str (api/sexpr method))))
+                        (with-meta (meta method)))
+                    (api/list-node
                      (list*
                       (api/token-node 'clojure.core/defn)
-                      (api/token-node (route-fn-name (api/sexpr method) (api/sexpr route)))
-                      body))
-                    (with-meta (meta node)))))))]
+                      (-> (api/token-node (route-fn-name (api/sexpr method) (api/sexpr route)))
+                          (with-meta (meta route)))
+                      body))))
+                  (with-meta (meta node))
+                  hooks.common/add-lsp-ignore-unused-public-var-metadata)))]
     (update arg :node update-defendpoint)))
-
-(comment
-  (-> {:node (-> '(api/defendpoint POST "/:id/copy"
-                    "Copy a `Card`, with the new name 'Copy of _name_'"
-                    [id]
-                    {id [:maybe ms/PositiveInt]}
-                    (let [orig-card (api/read-check Card id)
-                          new-name  (str (trs "Copy of ") (:name orig-card))
-                          new-card  (assoc orig-card :name new-name)]
-                      (-> (card/create-card! new-card @api/*current-user*)
-                          hydrate-card-details
-                          (assoc :last-edit-info (last-edit/edit-information-for-user @api/*current-user*)))))
-                 pr-str
-                 api/parse-string)}
-      defendpoint
-      :node
-      api/sexpr))

.clj-kondo/src/hooks/metabase/channel/template/handlebars_helper.clj

@@ -0,0 +1,25 @@
+(ns hooks.metabase.channel.template.handlebars-helper
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common]))
+
+(defn defhelper
+  "defhelper hook"
+  [{:keys [node]}]
+  (let [[_ helper-name description argvec & body] (:children node)
+        helper-fn-name (symbol (str (hooks/sexpr helper-name) "*"))]
+    {:node (-> (hooks/list-node
+                (list (hooks/token-node 'do)
+                      (hooks/list-node
+                       (list (hooks/token-node 'defn)
+                             (hooks/token-node helper-fn-name)
+                             description
+                             argvec
+                             (hooks/list-node body)))
+                      (hooks/list-node
+                       (list (hooks/token-node 'defn)
+                             helper-name
+                             description
+                             argvec
+                             (hooks/list-node body)))))
+               (with-meta (meta node)))}))

.clj-kondo/src/hooks/metabase/lib/test_util/macros.clj

@@ -4,9 +4,9 @@
 (defn with-testing-against-standard-queries [{{[_ & args] :children} :node}]
   (let [[query-sym & body] args
         node* (hooks/list-node
-                (list*
-                  (hooks/token-node 'let)
-                  (hooks/vector-node
-                    [query-sym (hooks/token-node 'nil)])
-                  body))]
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [query-sym (hooks/token-node 'nil)])
+                body))]
     {:node node*}))

.clj-kondo/src/hooks/metabase/models/interface.clj

@@ -1,5 +1,7 @@
 (ns hooks.metabase.models.interface
-  (:require [clj-kondo.hooks-api :as hooks]))
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common]))
 
 (defn define-hydration-method
   "This is used for both [[metabase.models.interface/define-simple-hydration-method]] and
@@ -14,5 +16,6 @@
                      (hooks/token-node 'defn)
                      fn-name
                      fn-tail))))
-                 (with-meta (update (meta node) :clj-kondo/ignore #(hooks/vector-node (cons :clojure-lsp/unused-public-var (:children %))))))]
+                 (with-meta (meta node))
+                 hooks.common/add-lsp-ignore-unused-public-var-metadata)]
     {:node node}))

.clj-kondo/src/hooks/metabase/models/setting.clj

@@ -21,6 +21,7 @@
      database-enable-actions
      deprecation-notice-version
      dismissed-custom-dashboard-toast
+     dismissed-onboarding-sidebar-link
      email-configured?
      email-from-address
      email-from-name
@@ -161,6 +162,7 @@
      token-features
      token-status
      toucan-name
+     trial-banner-dismissal-timestamp
      uncached-setting
      user-visibility
      version
@@ -181,12 +183,13 @@
         setter-node (-> (list
                          (hooks/token-node 'defn)
                          (with-meta
-                           (hooks/token-node (symbol (str (hooks/sexpr setting-name) \!)))
-                           (meta setting-name))
+                          (hooks/token-node (symbol (str (hooks/sexpr setting-name) \!)))
+                          (meta setting-name))
                          (hooks/string-node "Docstring.")
                          (hooks/vector-node [(hooks/token-node '_value-or-nil)]))
                         hooks/list-node
-                        (with-meta (update (meta node) :clj-kondo/ignore #(hooks/vector-node (cons :clojure-lsp/unused-public-var (:children %))))))]
+                        (with-meta (meta node))
+                        common/add-lsp-ignore-unused-public-var-metadata)]
 
     (when (nil? (second (drop-while (comp not #{[:k :export?]} first) options-list)))
       (when-not (contains? ignored-implicit-export? (:value setting-name))
@@ -242,14 +245,14 @@
 (comment
   (defn- defsetting* [form]
     (hooks/sexpr
-      (:node
-        (defsetting
-          {:node
-           (hooks/parse-string
-             (with-out-str
-               #_{:clj-kondo/ignore [:unresolved-namespace]}
-               (clojure.pprint/pprint
-                form)))}))))
+     (:node
+      (defsetting
+        {:node
+         (hooks/parse-string
+          (with-out-str
+            #_{:clj-kondo/ignore [:unresolved-namespace]}
+            (clojure.pprint/pprint
+             form)))}))))
 
   (defn x []
     (defsetting*

.clj-kondo/src/hooks/metabase/public_settings/premium_features.clj

@@ -1,6 +1,7 @@
 (ns hooks.metabase.public-settings.premium-features
   (:require
-   [clj-kondo.hooks-api :as hooks]))
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common]))
 
 (defn defenterprise [{node :node}]
   (let [[_defenterprise fn-name & args] (:children node)
@@ -26,7 +27,8 @@
                                  fn-name
                                  docstring))
                    fn-tail))
-                 (with-meta (update (meta node) :clj-kondo/ignore #(hooks/vector-node (cons :clojure-lsp/unused-public-var (:children %))))))))}))
+                 (with-meta (meta node))
+                 hooks.common/add-lsp-ignore-unused-public-var-metadata)))}))
 
 (comment
   (defn- defenterprise* [form]

.clj-kondo/src/hooks/metabase/test/data/datasets.clj

@@ -0,0 +1,58 @@
+(ns hooks.metabase.test.data.datasets
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.set :as set]
+   [hooks.common]))
+
+(defn- only-core-drivers?
+  "Whether we're for sure only testing against the 'core' drivers that are also app DB types: `:postgres`, `:mysql`, or
+  `:h2`. Tests like these are ok to mark `:mb/once` or `:mb/driver-tests` since we always run the full test suite
+  against app DB drivers anyway."
+  [node]
+  (let [drivers (hooks/sexpr (second (:children node)))
+        drivers (cond
+                  (keyword? drivers) #{drivers}
+                  (set? drivers)     drivers
+                  :else              nil)]
+    (when drivers
+      (empty? (set/difference drivers #{:h2 :mysql :postgres})))))
+
+(defn- validate-mb-once [x]
+  (when (:mb/once (meta (:ns x)))
+    (hooks/reg-finding!
+     (assoc (meta (:ns x))
+            :message (str "You should not use test-driver or test-drivers in a namespace marked ^:mb/once"
+                          " [:metabase/validate-mb-once]")
+            :type :metabase/validate-mb-once))))
+
+(defn- validate-mb-driver-tests [x]
+  (when-not (:mb/driver-tests (meta (:ns x)))
+    (hooks/reg-finding!
+     (assoc (meta (:ns x))
+            :message (str "Namespaces that run driver tests (test-driver or test-drivers) should be marked"
+                          " ^:mb/driver-tests [:metabase/validate-mb-driver-tests]")
+            :type :metabase/validate-mb-driver-tests))))
+
+(defn- validate-ns-tags [x]
+  (when-not (only-core-drivers? (:node x))
+    (validate-mb-once x)
+    (validate-mb-driver-tests x)))
+
+(defn test-drivers [x]
+  (validate-ns-tags x)
+  (letfn [(update-node [node]
+            (let [[test-drivers drivers-expr & body] (:children node)]
+              (-> (hooks/list-node
+                   (list*
+                    (hooks/token-node 'do)
+                    test-drivers
+                    (-> drivers-expr
+                        (hooks.common/update-ignored-linters conj :unused-value))
+                    body))
+                  (with-meta (meta node)))))]
+    (update x :node update-node)))
+
+(defn test-driver
+  "We can use the same hook for `test-driver` as we use for `test-drivers`."
+  [x]
+  (test-drivers x))

.clj-kondo/src/hooks/metabase/test/util.clj

@@ -27,11 +27,11 @@
                    (hooks/vector-node (into []
                                             (mapcat (fn [[setting-name v]]
                                                       (concat
-                                                        [(with-meta (hooks/token-node '_) (meta setting-name)) v]
+                                                       [(with-meta (hooks/token-node '_) (meta setting-name)) v]
                                                         ;; if the setting name is namespace-qualified add a `_`
                                                         ;; entry for it too.
-                                                        (when (namespaced-symbol-node? setting-name)
-                                                          [(with-meta (hooks/token-node '_) (meta setting-name)) setting-name]))))
+                                                       (when (namespaced-symbol-node? setting-name)
+                                                         [(with-meta (hooks/token-node '_) (meta setting-name)) setting-name]))))
                                             (partition 2 (:children bindings))))
                    bindings)]
     {:node (-> (list*

.clj-kondo/src/hooks/metabase/util.clj

@@ -15,3 +15,17 @@
                                                     actual-arg-count)
                                    :type :format))))))
   x)
+
+(defn case-enum
+  "Lint `(case-enum ...)` like `(condp = ...)`."
+  [x]
+  (letfn [(update-node [node]
+            (let [[_case-enum x & more] (:children node)]
+              (-> (api/list-node
+                   (list*
+                    (api/token-node 'clojure.core/condp)
+                    (api/token-node 'clojure.core/=)
+                    x
+                    more))
+                  (with-meta (meta node)))))]
+    (update x :node update-node)))

.clj-kondo/src/hooks/metabase/util/log.clj

@@ -109,8 +109,6 @@
                                                 actual-arg-count)
                                :type :metabase/validate-logging)))))
 
-
-
 (defn infof
   "Valid logf, debugf, etc."
   [{:keys [node], :as x}]

.clj-kondo/src/hooks/metabase/util/log/capture.clj

@@ -0,0 +1,26 @@
+(ns hooks.metabase.util.log.capture
+  (:require
+   [clj-kondo.hooks-api :as api]))
+
+(defn with-log-messages-for-level [x]
+  (letfn [(update-binding [[lhs-node _rhs-node]]
+            [lhs-node (api/list-node
+                       (list
+                        (api/token-node 'clojure.core/fn)
+                        (api/vector-node [])))])
+          (update-bindings [bindings-node]
+            (-> (api/vector-node
+                 (into []
+                       (comp (partition-all 2)
+                             (mapcat update-binding))
+                       (:children bindings-node)))
+                (with-meta (meta bindings-node))))
+          (update-node [node]
+            (let [[_with-log-messages-for-level bindings & body] (:children node)]
+              (-> (api/list-node
+                   (list*
+                    (api/token-node 'clojure.core/let)
+                    (update-bindings bindings)
+                    body))
+                  (with-meta (meta node)))))]
+    (update x :node update-node)))

.clj-kondo/test/hooks/clojure/core_test.clj

@@ -0,0 +1,54 @@
+(ns hooks.clojure.core-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.test :refer :all]
+   [hooks.clojure.core]))
+
+(deftest module-checker-allowed-modules-test
+  (let [findings (atom [])]
+    (with-redefs [hooks/reg-finding! (fn [node]
+                                       (swap! findings conj node))]
+      (hooks.clojure.core/lint-ns
+       {:node     (hooks/parse-string "
+(ns metabase.api.search
+  (:require
+   [metabase.request.core :as request]
+   [metabase.task :as task]))")
+        :config '{:linters {:metabase/ns-module-checker {:allowed-modules {metabase.api #{metabase.request}}
+                                                         :api-namespaces  {metabase.request #{metabase.request.core}}}}}})
+      (is (=? [{:message (str "Module metabase.task should not be used in the metabase.api module."
+                              " [:metabase/ns-module-checker :allowed-modules metabase.api]")
+                :type :metabase/ns-module-checker}]
+              @findings)))))
+
+(deftest module-checker-api-namespaces-test
+  (let [findings (atom [])]
+    (with-redefs [hooks/reg-finding! (fn [node]
+                                       (swap! findings conj node))]
+      (hooks.clojure.core/lint-ns
+       {:node     (hooks/parse-string "
+(ns metabase.api.search
+  (:require
+   [metabase.search.config :as search.config]
+   [metabase.search.core :as search]))")
+        :config '{:linters {:metabase/ns-module-checker {:allowed-modules {metabase.api #{metabase.search}}
+                                                         :api-namespaces  {metabase.search #{metabase.search.core}}}}}})
+      (is (=? [{:message (str "Namespace metabase.search.config is not an allowed external API namespace for the"
+                              " metabase.search module. [:metabase/ns-module-checker :api-namespaces metabase.search]")
+                :type :metabase/ns-module-checker}]
+              @findings)))))
+
+(deftest module-checker-api-namespaces-ignore-test
+  (let [findings (atom [])]
+    (with-redefs [hooks/reg-finding! (fn [node]
+                                       (swap! findings conj node))]
+      (hooks.clojure.core/lint-ns
+       {:node     (hooks/parse-string "
+(ns metabase.api.search
+  (:require
+   ^{:clj-kondo/ignore [:metabase/ns-module-checker]}
+   [metabase.search.config :as search.config]
+   [metabase.search.core :as search]))")
+        :config '{:linters {:metabase/ns-module-checker {:allowed-modules {metabase.api #{metabase.search}}
+                                                         :api-namespaces  {metabase.search #{metabase.search.core}}}}}})
+      (is (empty? @findings)))))

.clj-kondo/test/hooks/clojure/test_test.clj

@@ -2,7 +2,7 @@
   (:require
    [clj-kondo.hooks-api :as api]
    [clj-kondo.impl.utils]
-   [clojure.java.io :as io]
+   [clojure.edn :as edn]
    [clojure.test :refer :all]
    [hooks.clojure.test]))
 
@@ -14,10 +14,14 @@
                                         :ignores    (atom nil)
                                         :findings   (atom [])
                                         :namespaces (atom {})}]
-    (hooks.clojure.test/deftest {:node (api/parse-string form)})
+    (hooks.clojure.test/deftest {:node   (api/parse-string form)
+                                 :config {:linters
+                                          {:metabase/disallow-hardcoded-driver-names-in-tests
+                                           {:drivers
+                                            #{:athena}}}}})
     (mapv :message @(:findings clj-kondo.impl.utils/*ctx*))))
 
-(deftest disallow-hardcoded-driver-names-in-tests-test
+(deftest ^:parallel disallow-hardcoded-driver-names-in-tests-test
   (is (= []
          (deftest-warnings
            "(mt/test-drivers (mt/normal-drivers)
@@ -35,10 +39,17 @@
                 (when-not (= driver/*driver* :athena)
                   (do-something)))")))))
 
-(deftest check-driver-keywords-test
+(deftest ^:parallel check-driver-keywords-test
   (testing "Make sure we keep hooks.clojure.test/driver-keywords up to date"
-    (doseq [^java.io.File file (.listFiles (io/file "modules/drivers"))
-            :when (.isDirectory file)
-            :let [driver (keyword (.getName file))]]
-      (is (contains? hooks.clojure.test/driver-keywords driver)
-          (format "hooks.clojure.test/driver-keywords should contain %s, please add it" driver)))))
+    (let [driver-keywords (-> (slurp ".clj-kondo/config.edn")
+                              edn/read-string
+                              (get-in [:linters :metabase/disallow-hardcoded-driver-names-in-tests :drivers]))
+          driver-modules (->> (slurp "modules/drivers/deps.edn")
+                              edn/read-string
+                              :deps
+                              vals
+                              (keep (comp keyword :local/root))
+                              (into #{}))]
+      (doseq [driver driver-modules]
+        (is (contains? driver-keywords driver)
+            (format "hooks.clojure.test/driver-keywords should contain %s, please add it" driver))))))

.clj-kondo/test/hooks/common_test.clj

@@ -5,6 +5,35 @@
    [clojure.test :refer :all]
    [hooks.common]))
 
+(deftest ^:parallel ignored-linters-test
+  (doseq [ignored [":metabase/ns-module-checker"
+                   "[:metabase/ns-module-checker]"
+                   "(:metabase/ns-module-checker)"]
+          prefix ["#_"
+                  "^"]
+          :let [s (format "%s{:clj-kondo/ignore %s} [metabase.search.config :as search.config]"
+                          prefix
+                          ignored)]]
+    (testing (pr-str s)
+      (is (= #{:metabase/ns-module-checker}
+             (hooks.common/ignored-linters (api/parse-string s)))))))
+
+(deftest ^:parallel merge-ignored-linters-test
+  (let [node-1  (api/parse-string "#_{:clj-kondo/ignore [:a]} [:a]")
+        node-2  (api/parse-string "#_{:clj-kondo/ignore [:b]} [:b]")
+        node-3  (api/parse-string "#_{:clj-kondo/ignore [:c]} [:c]")
+        node-1' (hooks.common/merge-ignored-linters node-1 node-2 node-3)]
+    (is (= #{:a :b :c}
+           (hooks.common/ignored-linters node-1')))
+    (testing "Updated metadata should match the shape Kondo expects"
+      (is (=? {:clj-kondo/ignore {:linters api/vector-node?}}
+              (meta node-1')))
+      (let [children (-> node-1' meta :clj-kondo/ignore :linters :children)]
+        (is (= (count children) 3))
+        (is (every? api/keyword-node? children))
+        (is (= [:a :b :c]
+               (sort (map api/sexpr children))))))))
+
 (deftest ^:parallel node->qualified-symbol-test
   (binding [clj-kondo.impl.utils/*ctx* {:namespaces (atom nil)}]
     (is (= 'metabase.util.i18n/tru

.clj-kondo/test/hooks/metabase/api/common_test.clj

@@ -0,0 +1,35 @@
+(ns hooks.metabase.api.common-test
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clojure.test :refer :all]
+   [hooks.metabase.api.common]))
+
+(deftest ^:parallel defendpoint-test
+  (is (= '(do
+            compojure.core/POST
+            (clojure.core/defn
+              POST_:id_copy
+              "Copy a `Card`, with the new name 'Copy of _name_'"
+              [id]
+              {id [:maybe ms/PositiveInt]}
+              (let [orig-card (api/read-check Card id)
+                    new-name (str (trs "Copy of ") (:name orig-card))
+                    new-card (assoc orig-card :name new-name)]
+                (-> (card/create-card! new-card @api/*current-user*)
+                    hydrate-card-details
+                    (assoc :last-edit-info (last-edit/edit-information-for-user @api/*current-user*))))))
+         (-> {:node (-> '(api/defendpoint POST "/:id/copy"
+                           "Copy a `Card`, with the new name 'Copy of _name_'"
+                           [id]
+                           {id [:maybe ms/PositiveInt]}
+                           (let [orig-card (api/read-check Card id)
+                                 new-name  (str (trs "Copy of ") (:name orig-card))
+                                 new-card  (assoc orig-card :name new-name)]
+                             (-> (card/create-card! new-card @api/*current-user*)
+                                 hydrate-card-details
+                                 (assoc :last-edit-info (last-edit/edit-information-for-user @api/*current-user*)))))
+                        pr-str
+                        api/parse-string)}
+             hooks.metabase.api.common/defendpoint
+             :node
+             api/sexpr))))

.clj-kondo/test/hooks/metabase/util/log/capture_test.clj

@@ -0,0 +1,19 @@
+(ns hooks.metabase.util.log.capture-test
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clojure.test :refer :all]
+   [hooks.metabase.util.log.capture]))
+
+(deftest ^:parallel with-log-messages-for-level-test
+  (is (= '(clojure.core/let [messages-1 (clojure.core/fn [])
+                             messages-2 (clojure.core/fn [])]
+            (concat (messages-1)
+                    (messages-2)))
+         (-> (hooks.metabase.util.log.capture/with-log-messages-for-level
+               {:node (-> '(with-log-messages-for-level [messages-1 [my.namespace :debug]
+                                                         messages-2 :info]
+                             (concat (messages-1) (messages-2)))
+                          pr-str
+                          api/parse-string)})
+             :node
+             api/sexpr))))

.cljfmt.edn

@@ -1,31 +1,348 @@
-;; https://github.com/weavejester/cljfmt/blob/master/cljfmt/resources/cljfmt/indents/clojure.clj
-{:extra-indents
- {auto-parse                                                       [[:inner 0]]
-  cond->                                                           [[:inner 0]]
-  check                                                            [[:inner 0]]
-  deferred-tru                                                     [[:inner 0]]
-  defprotocol+                                                     [[:block 1] [:inner 1]]
-  potemkin/defprotocol+                                            [[:block 1] [:inner 1]]
-  let-404                                                          [[:block 1]]
-  metabase.legacy-mbql.util/match-one                              [[:inner 0]]
-  merge-with                                                       [[:inner 0]]
-  metabase.test/dataset                                            [[:inner 0]]
-  metabase.test/formatted-rows                                     [[:inner 0]]
-  metabase.test/mbql-query                                         [[:inner 0]]
-  metabase.test/test-drivers                                       [[:inner 0]]
-  metabase.test/with-temporary-setting-values                      [[:block 1]]
-  ;; If we just treat these as functions we can ignore this, despite some files not being consistent
-  ;metabase.models.permissions/set-has-full-permissions-for-set?    [[:inner 0]]
-  ;metabase.models.permissions/set-has-full-permissions?            [[:inner 0]]
-  ;metabase.models.permissions/set-has-partial-permissions?         [[:inner 0]]
-  metabase.models.permissions/set-has-partial-permissions-for-set? [[:inner 0]]
-  publish-event!                                                   [[:block 1]]
-  metabase.query-processor.streaming/streaming-response            [[:inner 0]]
-  metabase.util/prog1                                              [[:inner 0]]
-  metabase.util/select-keys-when                                   [[:inner 0]]
-  ;; This supports a lot of existing formatting, but these are functions so the
-  ;; existing formatting is probably wrong.
-  ;toucan2.core/select                                              [[:inner 0]]
-  ;toucan2.core/update!                                             [[:inner 0]]
-  }
- :sort-ns-references? true}
+;; Cljfmt config. See https://github.com/weavejester/cljfmt#formatting-options
+{:sort-ns-references?
+ true
+
+ :function-arguments-indentation
+ :community
+
+ :parallel?
+ true
+
+ :paths
+ ["src"
+  "test"
+  "enterprise/backend"
+  "bin/build"
+  "bin/lint-migrations-file"
+  "bin/release-list"
+  "modules/drivers"
+  ".clj-kondo/src"
+  ".clj-kondo/test"
+  #_"dev"]
+
+ ;; See https://github.com/weavejester/cljfmt/blob/master/cljfmt/resources/cljfmt/indents/clojure.clj for the default
+ ;; definitions
+ ;;
+ ;;    [[:block 0]]
+ ;;             ^ number of special args
+ ;;
+ ;; `:block` indentation means format with all arguments indented 2 spaces except for the 'special' arguments which
+ ;; normally are supposed to go on the first line. e.g. `let` gets [[:block 1]] because it has one 'special' arg.
+ ;;
+ ;;    [[:inner 0]]
+ ;;             ^ depth
+ ;;    [[:inner 2 0]]
+ ;;               ^ argument index to restrict this rule to
+ ;;
+ ;; `:inner` indentation is like `:defn` indentation. `[[:inner 0]]` (default for `defn`) means all arguments at depth
+ ;; zero get indented 2 spaces if not on the first line regardless of number of elements on the first line.
+ :extra-indents
+ {;; clojure.core stuff
+  fn*                                                                                  [[:inner 0]]
+  let*                                                                                 [[:block 1]]
+  with-meta                                                                            [[:default]]
+  ;; library stuff. Libraries that specify their own `:style/indent` specs are included in the section after this
+  ;; since it is generated automatically.
+  clojure.core.logic/fresh                                                             [[:block 1]]
+  clojure.core.logic/matcha                                                            [[:block 1]]
+  clojure.core.logic/run                                                               [[:block 2]]
+  clojure.core.match/match                                                             [[:block 1]]
+  clojure.test.check.properties/for-all                                                [[:block 1]]
+  clojure.test.check.properties/for-all*                                               [[:block 1]]
+  clojure.test.check/quick-check                                                       [[:block 1]]
+  clojure.tools.macro/macrolet                                                         [[:block 1] [:inner 2 0]]
+  clojurewerkz.quartzite.jobs/build                                                    [[:default]]
+  clojurewerkz.quartzite.jobs/with-description                                         [[:default]]
+  clojurewerkz.quartzite.jobs/with-identity                                            [[:default]]
+  clojurewerkz.quartzite.schedule.cron/schedule                                        [[:default]]
+  clojurewerkz.quartzite.schedule.cron/with-misfire-handling-instruction-do-nothing    [[:default]]
+  clojurewerkz.quartzite.triggers/build                                                [[:default]]
+  clojurewerkz.quartzite.triggers/with-description                                     [[:default]]
+  clojurewerkz.quartzite.triggers/with-identity                                        [[:default]]
+  clojurewerkz.quartzite.triggers/with-priority                                        [[:default]]
+  clojurewerkz.quartzite.triggers/with-schedule                                        [[:default]]
+  def-map-type                                                                         [[:block 2] [:inner 1]]
+  defprotocol+                                                                         [[:block 1] [:inner 1]]
+  defrecord+                                                                           [[:block 2] [:inner 1]]
+  deftype+                                                                             [[:block 2] [:inner 1]]
+  net.cgrand.macrovich/case                                                            [[:block 0]]
+  potemkin.namespaces/import-vars                                                      [[:default]]
+  potemkin.types/def-map-type                                                          [[:block 2] [:inner 1]]
+  potemkin.types/defprotocol+                                                          [[:block 1] [:inner 1]]
+  potemkin.types/defrecord+                                                            [[:block 2] [:inner 1]]
+  potemkin.types/deftype+                                                              [[:block 2] [:inner 1]]
+  potemkin/def-map-type                                                                [[:block 2] [:inner 1]]
+  potemkin/defprotocol+                                                                [[:block 1] [:inner 1]]
+  potemkin/defrecord+                                                                  [[:block 2] [:inner 1]]
+  potemkin/deftype+                                                                    [[:block 2] [:inner 1]]
+  potemkin/import-vars                                                                 [[:default]]
+  taoensso.nippy/extend-freeze                                                         [[:inner 0]]
+  taoensso.nippy/extend-thaw                                                           [[:inner 0]]
+  throttle.core/with-throttling                                                        [[:block 1]]
+  ;; the rest of the stuff in this list is generated automatically based on `:style/indent` specs
+  ;; by running [[dev.generate-cljfmt-config/specs]]... use that code to update this list
+  metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!          [[:inner 0]]
+  metabase-enterprise.cache.config-test/with-temp-persist-models                       [[:block 1]]
+  metabase-enterprise.sandbox.test-util/with-gtaps!                                    [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                           [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-user-attributes                           [[:block 2]]
+  metabase-enterprise.serialization.test-util/with-dbs                                 [[:inner 0]]
+  metabase-enterprise.serialization.test-util/with-random-dump-dir                     [[:block 1]]
+  metabase-enterprise.serialization.test-util/with-world                               [[:block 0]]
+  metabase-enterprise.sso.integrations.jwt-test/with-users-with-email-deleted          [[:block 1]]
+  metabase-enterprise.test/with-gtaps!                                                 [[:inner 0]]
+  metabase-enterprise.test/with-gtaps-for-user!                                        [[:inner 0]]
+  metabase-enterprise.test/with-user-attributes                                        [[:block 2]]
+  metabase.actions-test/with-actions-test-data-and-actions-permissively-enabled        [[:block 0]]
+  metabase.actions.test-util/with-actions                                              [[:block 1]]
+  metabase.actions.test-util/with-actions-disabled                                     [[:block 0]]
+  metabase.actions.test-util/with-actions-enabled                                      [[:block 0]]
+  metabase.actions.test-util/with-actions-test-data                                    [[:inner 0]]
+  metabase.actions.test-util/with-actions-test-data-and-actions-enabled                [[:block 0]]
+  metabase.actions.test-util/with-actions-test-data-tables                             [[:block 1]]
+  metabase.actions.test-util/with-empty-db                                             [[:inner 0]]
+  metabase.actions.test-util/with-temp-test-data                                       [[:inner 0]]
+  metabase.api.alert-test/with-alert-in-collection                                     [[:block 1]]
+  metabase.api.card-test/with-cards-in-readable-collection                             [[:block 1]]
+  metabase.api.card-test/with-cards-in-writeable-collection                            [[:block 1]]
+  metabase.api.card-test/with-ordered-items                                            [[:inner 0]]
+  metabase.api.card-test/with-temp-native-card!                                        [[:block 1]]
+  metabase.api.card-test/with-temp-native-card-with-params!                            [[:block 1]]
+  metabase.api.collection-test/with-collection-hierarchy                               [[:block 1]]
+  metabase.api.collection-test/with-french-user-and-personal-collection                [[:block 2]]
+  metabase.api.collection-test/with-some-children-of-collection                        [[:block 1]]
+  metabase.api.common/check                                                            [[:default]]
+  metabase.api.common/define-routes                                                    [[:block 0]]
+  metabase.api.common/let-404                                                          [[:block 1]]
+  metabase.api.common.internal/auto-coerce                                             [[:block 1]]
+  metabase.api.common.internal/auto-parse                                              [[:block 1]]
+  metabase.api.common.internal-test/no-route-regexes                                   [[:block 0]]
+  metabase.api.embed-test/do-response-formats                                          [[:block 1]]
+  metabase.api.embed-test/with-embedding-enabled-and-new-secret-key                    [[:block 0]]
+  metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing             [[:block 3]]
+  metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing         [[:block 3]]
+  metabase.api.embed-test/with-new-secret-key                                          [[:block 0]]
+  metabase.api.embed-test/with-temp-card                                               [[:block 1]]
+  metabase.api.embed-test/with-temp-dashcard                                           [[:block 1]]
+  metabase.api.preview-embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
+  metabase.api.preview-embed-test/with-new-secret-key                                  [[:block 0]]
+  metabase.api.public-test/with-sharing-enabled-and-temp-card-referencing              [[:block 3]]
+  metabase.api.public-test/with-sharing-enabled-and-temp-dashcard-referencing          [[:block 3]]
+  metabase.api.public-test/with-temp-public-card                                       [[:block 1]]
+  metabase.api.public-test/with-temp-public-dashboard                                  [[:block 1]]
+  metabase.api.public-test/with-temp-public-dashboard-and-card                         [[:block 1]]
+  metabase.api.search-test/do-test-users                                               [[:block 1]]
+  metabase.api.session/http-401-on-error                                               [[:block 0]]
+  metabase.async.streaming-response/streaming-response                                 [[:block 2]]
+  metabase.async.streaming-response-test/with-streaming-response-thread-pool           [[:block 0]]
+  metabase.async.streaming-response-test/with-test-driver-db!                          [[:block 0]]
+  metabase.async.util/cancelable-thread                                                [[:block 0]]
+  metabase.cmd.copy/step                                                               [[:block 1]]
+  metabase.cmd.copy/with-connection-rollback-only                                      [[:block 1]]
+  metabase.cmd.copy/with-disabled-db-constraints                                       [[:block 2]]
+  metabase.config/build-type-case                                                      [[:block 0]]
+  metabase.dashboard-subscription-test/with-link-card-fixture-for-dashboard            [[:block 2]]
+  metabase.db.liquibase/with-liquibase                                                 [[:block 1]]
+  metabase.db.liquibase/with-scope-locked                                              [[:block 1]]
+  metabase.db.schema-migrations-test.impl/test-migrations                              [[:block 2]]
+  metabase.db/with-application-db                                                      [[:inner 0]]
+  metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                [[:default]]
+  metabase.driver.druid.client/DELETE                                                  [[:default]]
+  metabase.driver.druid.client/GET                                                     [[:default]]
+  metabase.driver.druid.client/POST                                                    [[:default]]
+  metabase.driver.druid.query-processor-test/druid-query                               [[:block 0]]
+  metabase.driver.druid.query-processor-test/druid-query-returning-rows                [[:block 0]]
+  metabase.driver.mongo.query-processor/mongo-let                                      [[:block 1]]
+  metabase.driver.sql-jdbc.actions/with-jdbc-transaction                               [[:block 1]]
+  metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection      [[:block 1]]
+  metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                [[:block 1]]
+  metabase.driver.sql.query-processor/apply-top-level-clause                           [[:default]]
+  metabase.driver/with-driver                                                          [[:block 1]]
+  metabase.lib.binning/with-binning                                                    [[:default]]
+  metabase.lib.core/with-binning                                                       [[:default]]
+  metabase.lib.core/with-join-alias                                                    [[:default]]
+  metabase.lib.core/with-join-conditions                                               [[:default]]
+  metabase.lib.join/with-join-alias                                                    [[:default]]
+  metabase.lib.join/with-join-conditions                                               [[:default]]
+  metabase.lib.test-util.macros/$ids                                                   [[:inner 0]]
+  metabase.lib.test-util.macros/mbql-query                                             [[:inner 0]]
+  metabase.lib.util.match/match                                                        [[:inner 0]]
+  metabase.lib.util.match/match-one                                                    [[:inner 0]]
+  metabase.lib.util.match/replace                                                      [[:inner 0]]
+  metabase.lib.util.match/replace-in                                                   [[:inner 0]]
+  metabase.models.collection-test/with-collection-hierarchy                            [[:block 1]]
+  metabase.models.collection-test/with-current-user-perms-for-collections              [[:block 1]]
+  metabase.models.collection-test/with-personal-and-impersonal-collections             [[:block 1]]
+  metabase.models.dashboard-test/with-dash-in-collection                               [[:inner 0]]
+  metabase.models.interface/define-batched-hydration-method                            [[:inner 0]]
+  metabase.models.interface/define-simple-hydration-method                             [[:inner 0]]
+  metabase.models.params.chain-filter-test/with-clean-field-values-for-field           [[:block 1]]
+  metabase.models.params.chain-filter-test/with-fk-field-to-field-remapping            [[:block 0]]
+  metabase.models.params.chain-filter-test/with-human-readable-values-remapping        [[:block 0]]
+  metabase.models.pulse-test/with-dashboard-subscription-in-collection                 [[:block 1]]
+  metabase.models.pulse-test/with-pulse-in-collection                                  [[:inner 0]]
+  metabase.models.setting/defsetting                                                   [[:block 1]]
+  metabase.models.setting.multi-setting/define-multi-setting                           [[:inner 0]]
+  metabase.models.task-history/with-task-history                                       [[:block 1]]
+  metabase.query-processor-test.pipeline-queries-test/pmbql-query                      [[:block 1]]
+  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                  [[:block 1]]
+  metabase.query-processor.debug/debug>                                                [[:block 0]]
+  metabase.query-processor.error-type/deferror                                         [[:block 1]]
+  metabase.query-processor.middleware.cache-backend.interface/with-cached-results      [[:block 4]]
+  metabase.query-processor.middleware.process-userland-query-test/with-query-execution [[:block 1]]
+  metabase.query-processor.store/cached                                                [[:block 1]]
+  metabase.query-processor.store/with-metadata-provider                                [[:inner 0]]
+  metabase.query-processor.streaming/streaming-response                                [[:block 1]]
+  metabase.query-processor.test-util/format-rows-by                                    [[:default]]
+  metabase.request.core/as-admin                                                       [[:block 0]]
+  metabase.request.core/with-current-request                                           [[:inner 0]]
+  metabase.request.core/with-current-user                                              [[:inner 0]]
+  metabase.request.core/with-limit-and-offset                                          [[:inner 0]]
+  metabase.request.session/as-admin                                                    [[:block 0]]
+  metabase.request.session/with-current-user                                           [[:inner 0]]
+  metabase.sample-data-test/with-temp-sample-database-db                               [[:block 1]]
+  metabase.server.middleware.session/as-admin                                          [[:block 0]]
+  metabase.server.middleware.session/with-current-user                                 [[:inner 0]]
+  metabase.sync.fetch-metadata/log-if-error                                            [[:block 1]]
+  metabase.sync.sync-metadata.fields-test/with-test-db                                 [[:block 0]]
+  metabase.sync.util/do-with-start-and-finish-debug-logging                            [[:default]]
+  metabase.sync.util/sum-for                                                           [[:block 1]]
+  metabase.sync.util/sync-operation                                                    [[:block 3]]
+  metabase.sync.util/with-db-logging-disabled                                          [[:default]]
+  metabase.sync.util/with-duplicate-ops-prevented                                      [[:default]]
+  metabase.sync.util/with-emoji-progress-bar                                           [[:block 1]]
+  metabase.sync.util/with-error-handling                                               [[:block 1]]
+  metabase.sync.util/with-start-and-finish-logging                                     [[:default]]
+  metabase.sync.util/with-start-and-finish-logging*                                    [[:default]]
+  metabase.sync.util/with-sync-events                                                  [[:default]]
+  metabase.test/$ids                                                                   [[:inner 0]]
+  metabase.test/as-admin                                                               [[:inner 0]]
+  metabase.test/dataset                                                                [[:inner 0]]
+  metabase.test/discard-setting-changes                                                [[:block 1]]
+  metabase.test/format-rows-by                                                         [[:default]]
+  metabase.test/let-url                                                                [[:block 1]]
+  metabase.test/mbql-query                                                             [[:inner 0]]
+  metabase.test/native-query                                                           [[:block 0]]
+  metabase.test/query                                                                  [[:block 1]]
+  metabase.test/run-mbql-query                                                         [[:inner 0]]
+  metabase.test/test-driver                                                            [[:inner 0]]
+  metabase.test/test-drivers                                                           [[:inner 0]]
+  metabase.test/test-helpers-set-global-values!                                        [[:block 0]]
+  metabase.test/throw-if-called!                                                       [[:block 1]]
+  metabase.test/with-actions                                                           [[:block 1]]
+  metabase.test/with-actions-disabled                                                  [[:block 0]]
+  metabase.test/with-actions-enabled                                                   [[:block 0]]
+  metabase.test/with-actions-test-data                                                 [[:inner 0]]
+  metabase.test/with-actions-test-data-and-actions-enabled                             [[:block 0]]
+  metabase.test/with-actions-test-data-tables                                          [[:block 1]]
+  metabase.test/with-additional-premium-features                                       [[:block 1]]
+  metabase.test/with-current-user                                                      [[:inner 0]]
+  metabase.test/with-driver                                                            [[:block 1]]
+  metabase.test/with-empty-db                                                          [[:inner 0]]
+  metabase.test/with-empty-h2-app-db                                                   [[:block 0]]
+  metabase.test/with-metadata-provider                                                 [[:inner 0]]
+  metabase.test/with-premium-features                                                  [[:block 1]]
+  metabase.test/with-temp                                                              [[:inner 0]]
+  metabase.test/with-temp-copy-of-db                                                   [[:block 0]]
+  metabase.test/with-temp-scheduler                                                    [[:block 0]]
+  metabase.test/with-temp-test-data                                                    [[:inner 0]]
+  metabase.test/with-temp-vals-in-db                                                   [[:block 3]]
+  metabase.test/with-test-user                                                         [[:inner 0]]
+  metabase.test/with-user-in-groups                                                    [[:inner 0]]
+  metabase.test.data/$ids                                                              [[:inner 0]]
+  metabase.test.data/dataset                                                           [[:inner 0]]
+  metabase.test.data/mbql-query                                                        [[:inner 0]]
+  metabase.test.data/native-query                                                      [[:block 0]]
+  metabase.test.data/query                                                             [[:block 1]]
+  metabase.test.data/run-mbql-query                                                    [[:inner 0]]
+  metabase.test.data/with-empty-h2-app-db                                              [[:block 0]]
+  metabase.test.data/with-temp-copy-of-db                                              [[:block 0]]
+  metabase.test.data.datasets/test-driver                                              [[:inner 0]]
+  metabase.test.data.datasets/test-drivers                                             [[:inner 0]]
+  metabase.test.data.one-off-dbs/with-blank-db                                         [[:block 0]]
+  metabase.test.data.one-off-dbs/with-blueberries-db                                   [[:block 0]]
+  metabase.test.data.users/with-test-user                                              [[:inner 0]]
+  metabase.test.util/discard-setting-changes                                           [[:block 1]]
+  metabase.test.util/let-url                                                           [[:block 1]]
+  metabase.test.util/throw-if-called!                                                  [[:block 1]]
+  metabase.test.util/with-temp-scheduler                                               [[:block 0]]
+  metabase.test.util/with-temp-vals-in-db                                              [[:block 3]]
+  metabase.test.util/with-user-in-groups                                               [[:inner 0]]
+  metabase.test.util.public-settings/with-additional-premium-features                  [[:block 1]]
+  metabase.test.util.public-settings/with-premium-features                             [[:block 1]]
+  metabase.test.util.thread-local/test-helpers-set-global-values!                      [[:block 0]]
+  metabase.timeseries-query-processor-test.util/test-timeseries-drivers                [[:block 0]]
+  metabase.timeseries-query-processor-test/run-mbql-query                              [[:inner 0]]
+  metabase.upload-test/with-upload-table!                                              [[:inner 0]]
+  metabase.upload.types/with-currency                                                  [[:default]]
+  metabase.upload.types/with-parens                                                    [[:default]]
+  metabase.util/auto-retry                                                             [[:block 1]]
+  metabase.util/case-enum                                                              [[:block 1]]
+  metabase.util/ignore-exceptions                                                      [[:block 0]]
+  metabase.util/or-with                                                                [[:block 1]]
+  metabase.util/profile                                                                [[:block 1]]
+  metabase.util/prog1                                                                  [[:inner 0]]
+  metabase.util/varargs                                                                [[:inner 0]]
+  metabase.util/with-us-locale                                                         [[:block 0]]
+  metabase.util.date-2/with-time-zone-same-instant                                     [[:default]]
+  metabase.util.encryption-test/with-secret-key                                        [[:block 1]]
+  metabase.util.honey-sql-2/with-database-type-info                                    [[:default]]
+  metabase.util.i18n/deferred-trs                                                      [[:default]]
+  metabase.util.i18n/deferred-tru                                                      [[:default]]
+  metabase.util.i18n/trs                                                               [[:default]]
+  metabase.util.i18n/trsn                                                              [[:default]]
+  metabase.util.i18n/tru                                                               [[:default]]
+  metabase.util.i18n/trun                                                              [[:default]]
+  metabase.util.jvm/auto-retry                                                         [[:block 1]]
+  metabase.util.jvm/varargs                                                            [[:block 1]]
+  metabase.util.jvm/with-us-locale                                                     [[:block 0]]
+  metabase.util.malli/disable-enforcement                                              [[:block 0]]
+  metabase.util.malli/with                                                             [[:default]]
+  metabase.util.malli/with-api-error-message                                           [[:default]]
+  metabase.util.namespaces/import-fns                                                  [[:default]]
+  metabuild-common.core/exit-when-finished-nonzero-on-exception                        [[:block 0]]
+  metabuild-common.core/step                                                           [[:block 1]]
+  metabuild-common.entrypoint/exit-when-finished-nonzero-on-exception                  [[:block 0]]
+  metabuild-common.steps/step                                                          [[:block 1]]
+  methodical.core/defmethod                                                            [[:inner 0]]
+  methodical.core/defmulti                                                             [[:inner 0]]
+  methodical.core/with-dispatcher                                                      [[:default]]
+  methodical.core/with-method-table                                                    [[:default]]
+  methodical.core/with-prefers                                                         [[:default]]
+  methodical.interface/with-dispatcher                                                 [[:default]]
+  methodical.interface/with-method-table                                               [[:default]]
+  methodical.interface/with-prefers                                                    [[:default]]
+  methodical.macros/defmethod                                                          [[:inner 0]]
+  methodical.macros/defmulti                                                           [[:inner 0]]
+  saml20-clj.sp.response/validate-confirmation-datas                                   [[:block 1]]
+  toucan2.connection/with-transaction                                                  [[:block 1]]
+  toucan2.core/build                                                                   [[:block 0]]
+  toucan2.core/compile                                                                 [[:block 0]]
+  toucan2.core/debug                                                                   [[:block 0]]
+  toucan2.core/define-after-insert                                                     [[:inner 0]]
+  toucan2.core/define-after-select                                                     [[:inner 0]]
+  toucan2.core/define-after-update                                                     [[:inner 0]]
+  toucan2.core/define-before-delete                                                    [[:inner 0]]
+  toucan2.core/define-before-insert                                                    [[:inner 0]]
+  toucan2.core/define-before-select                                                    [[:inner 0]]
+  toucan2.core/define-default-fields                                                   [[:inner 0]]
+  toucan2.core/define-named-query                                                      [[:block 1]]
+  toucan2.core/deftransforms                                                           [[:block 1]]
+  toucan2.core/with-transaction                                                        [[:block 1]]
+  toucan2.tools.after/define-after-impl                                                [[:default]]
+  toucan2.tools.after-insert/define-after-insert                                       [[:inner 0]]
+  toucan2.tools.after-select/define-after-select                                       [[:inner 0]]
+  toucan2.tools.after-update/define-after-update                                       [[:inner 0]]
+  toucan2.tools.before-delete/define-before-delete                                     [[:inner 0]]
+  toucan2.tools.before-insert/define-before-insert                                     [[:inner 0]]
+  toucan2.tools.before-select/define-before-select                                     [[:inner 0]]
+  toucan2.tools.compile/build                                                          [[:block 0]]
+  toucan2.tools.compile/compile                                                        [[:block 0]]
+  toucan2.tools.compile/resolved                                                       [[:block 0]]
+  toucan2.tools.debug/debug                                                            [[:block 0]]
+  toucan2.tools.default-fields/define-default-fields                                   [[:inner 0]]
+  toucan2.tools.named-query/define-named-query                                         [[:block 1]]
+  toucan2.tools.simple-out-transform/define-out-transform                              [[:inner 0]]
+  toucan2.tools.transformed/deftransforms                                              [[:block 1]]
+  toucan2.tools.with-temp/with-temp                                                    [[:inner 0]]
+  toucan2.util/try-with-error-context                                                  [[:inner 0]]}}

.dir-locals.el

@@ -20,68 +20,67 @@
  (clojure-mode
   ;; Specify which arg is the docstring for certain macros
   ;; (Add more as needed)
-  (eval . (put 'defendpoint-schema 'clojure-doc-string-elt 3))
-  (eval . (put 'defendpoint 'clojure-doc-string-elt 3))
-  (eval . (put 'defendpoint-async 'clojure-doc-string-elt 3))
-  (eval . (put 'define-premium-feature 'clojure-doc-string-elt 2))
-  (eval . (put 'api/defendpoint-schema 'clojure-doc-string-elt 3))
-  (eval . (put 'api/defendpoint 'clojure-doc-string-elt 3))
-  (eval . (put 'api/defendpoint-async 'clojure-doc-string-elt 3))
-  (eval . (put 'defsetting 'clojure-doc-string-elt 2))
-  (eval . (put 'setting/defsetting 'clojure-doc-string-elt 2))
-  (eval . (put 's/defn 'clojure-doc-string-elt 2))
-  (eval . (put 'p.types/defprotocol+ 'clojure-doc-string-elt 2))
-  (eval . (put 'methodical/defmethod 'clojure-doc-string-elt 3))
-  (eval . (put 'methodical/defmulti 'clojure-doc-string-elt 2))
-  (eval . (put 'mi/define-simple-hydration-method 'clojure-doc-string-elt 3))
+  (eval . (put 'defendpoint-schema                 'clojure-doc-string-elt 3))
+  (eval . (put 'defendpoint                        'clojure-doc-string-elt 3))
+  (eval . (put 'defendpoint-async                  'clojure-doc-string-elt 3))
+  (eval . (put 'define-premium-feature             'clojure-doc-string-elt 2))
+  (eval . (put 'api/defendpoint-schema             'clojure-doc-string-elt 3))
+  (eval . (put 'api/defendpoint                    'clojure-doc-string-elt 3))
+  (eval . (put 'api/defendpoint-async              'clojure-doc-string-elt 3))
+  (eval . (put 'defsetting                         'clojure-doc-string-elt 2))
+  (eval . (put 'setting/defsetting                 'clojure-doc-string-elt 2))
+  (eval . (put 's/defn                             'clojure-doc-string-elt 2))
+  (eval . (put 'p.types/defprotocol+               'clojure-doc-string-elt 2))
+  (eval . (put 'methodical/defmethod               'clojure-doc-string-elt 3))
+  (eval . (put 'methodical/defmulti                'clojure-doc-string-elt 2))
+  (eval . (put 'mi/define-simple-hydration-method  'clojure-doc-string-elt 3))
   (eval . (put 'mi/define-batched-hydration-method 'clojure-doc-string-elt 3))
-  (eval . (put 'mr/def 'clojure-doc-string-elt 2))
-  (eval . (put 'mu/defn 'clojure-doc-string-elt 2))
+  (eval . (put 'mr/def                             'clojure-doc-string-elt 2))
+  (eval . (put 'mu/defn                            'clojure-doc-string-elt 2))
   ;; Define custom indentation for functions inside metabase.
   ;; This list isn't complete; add more forms as we come across them.
   ;;
   ;; `put-clojure-indent' is a safe-local-eval-function, so use a bunch of calls to that
   ;; instead of one call to `define-clojure-indent'
-  (eval . (put-clojure-indent 'api/let-404 1))
-  (eval . (put-clojure-indent 'c/step 1))
-  (eval . (put-clojure-indent 'impl/test-migrations 2))
-  (eval . (put-clojure-indent 'let-404 0))
-  (eval . (put-clojure-indent 'lib.schema.match/match 1))
-  (eval . (put-clojure-indent 'lib.schema.match/match-one 1))
-  (eval . (put-clojure-indent 'lib.schema.match/replace 1))
-  (eval . (put-clojure-indent 'lib.schema.match/replace-in 2))
-  (eval . (put-clojure-indent 'lib.util.match/replace 1))
-  (eval . (put-clojure-indent 'macros/case 0))
-  (eval . (put-clojure-indent 'match 1))
-  (eval . (put-clojure-indent 'mi/define-methods '(:form)))
-  (eval . (put-clojure-indent 'mt/dataset 1))
-  (eval . (put-clojure-indent 'mt/format-rows-by 1))
-  (eval . (put-clojure-indent 'mt/query 1))
-  (eval . (put-clojure-indent 'mt/test-driver 1))
-  (eval . (put-clojure-indent 'mt/test-drivers 1))
-  (eval . (put-clojure-indent 'mt/with-anaphora 1))
-  (eval . (put-clojure-indent 'prop/for-all 1))
+  (eval . (put-clojure-indent 'api/let-404                     1))
+  (eval . (put-clojure-indent 'c/step                          1))
+  (eval . (put-clojure-indent 'impl/test-migrations            2))
+  (eval . (put-clojure-indent 'let-404                         0))
+  (eval . (put-clojure-indent 'lib.schema.match/match          '(:defn)))
+  (eval . (put-clojure-indent 'lib.schema.match/match-one      '(:defn)))
+  (eval . (put-clojure-indent 'lib.schema.match/replace        '(:defn)))
+  (eval . (put-clojure-indent 'lib.schema.match/replace-in     '(:defn)))
+  (eval . (put-clojure-indent 'lib.util.match/replace          '(:defn)))
+  (eval . (put-clojure-indent 'macros/case                     0))
+  (eval . (put-clojure-indent 'match                           1))
+  (eval . (put-clojure-indent 'mt/dataset                      1))
+  (eval . (put-clojure-indent 'mt/format-rows-by               '(:form)))
+  (eval . (put-clojure-indent 'mt/query                        1))
+  (eval . (put-clojure-indent 'mt/test-driver                  1))
+  (eval . (put-clojure-indent 'mt/test-drivers                 1))
+  (eval . (put-clojure-indent 'mt/with-anaphora                1))
+  (eval . (put-clojure-indent 'prop/for-all                    1))
   (eval . (put-clojure-indent 'qp.streaming/streaming-response 1))
-  (eval . (put-clojure-indent 'tc/quick-check 1))
-  (eval . (put-clojure-indent 'u/profile 1))
-  (eval . (put-clojure-indent 'u/prog1 1))
-  (eval . (put-clojure-indent 'u/select-keys-when 1))
-  (eval . (put-clojure-indent 'with-meta '(:form)))
+  (eval . (put-clojure-indent 'tc/quick-check                  1))
+  (eval . (put-clojure-indent 'u/profile                       1))
+  (eval . (put-clojure-indent 'u/prog1                         1))
+  (eval . (put-clojure-indent 'u/select-keys-when              '(:form)))
+  (eval . (put-clojure-indent 'with-meta                       '(:form)))
   ;; these ones have to be done with `define-clojure-indent' for now because of upstream bug
   ;; https://github.com/clojure-emacs/clojure-mode/issues/600 once that's resolved we should use `put-clojure-indent'
   ;; instead. Please don't add new entries unless they don't work with `put-clojure-indent'
   (eval . (define-clojure-indent
-           (l/matcha '(1 (:defn)))
-           (l/matche '(1 (:defn)))
+           (l/matcha                  '(1 (:defn)))
+           (l/matche                  '(1 (:defn)))
            (p.types/def-abstract-type '(1 (:defn)))
-           (p.types/defprotocol+ '(1 (:defn)))
-           (p.types/defrecord+ '(2 nil nil (:defn)))
-           (p.types/deftype+ '(2 nil nil (:defn)))
-           (p/def-map-type '(2 nil nil (:defn)))
-           (p/defprotocol+ '(1 (:defn)))
-           (p/defrecord+ '(2 nil nil (:defn)))
-           (p/deftype+ '(2 nil nil (:defn)))
-           (tools.macro/macrolet '(1 ((:defn)) :form))))
+           (p.types/defprotocol+      '(1 (:defn)))
+           (p.types/defrecord+        '(2 nil nil (:defn)))
+           (p.types/deftype+          '(2 nil nil (:defn)))
+           (p/def-map-type            '(2 nil nil (:defn)))
+           (p/defprotocol+            '(1 (:defn)))
+           (p/defrecord+              '(2 nil nil (:defn)))
+           (p/deftype+                '(2 nil nil (:defn)))
+           (tools.macro/macrolet      '(1 ((:defn)) :form))))
   (cider-clojure-cli-aliases . "dev:drivers:drivers-dev:ee:ee-dev:user")
   (clojure-indent-style . always-align)
   (cljr-favor-prefix-notation . nil)

.eslintrc.js

@@ -62,6 +62,13 @@ module.exports = {
         warnOnUnassignedImports: false,
       },
     ],
+    "sort-imports": [
+      "error",
+      {
+        // allows this rule to work with import/order
+        ignoreDeclarationSort: true,
+      },
+    ],
     "no-console": [2, { allow: ["warn", "error", "errorBuffer"] }],
     "react/no-is-mounted": 2,
     "react/prefer-es6-class": 2,
@@ -135,6 +142,7 @@ module.exports = {
     "plugin:import/warnings",
     "plugin:import/typescript",
     "plugin:depend/recommended",
+    "plugin:storybook/recommended",
   ],
   settings: {
     "import/internal-regex": "^metabase/|^metabase-lib/",
@@ -227,8 +235,9 @@ module.exports = {
         "plugin:jest/recommended",
         "plugin:jest-dom/recommended",
         "plugin:testing-library/react",
+        "plugin:jest-formatting/recommended",
       ],
-      plugins: ["jest", "jest-dom", "testing-library"],
+      plugins: ["jest", "jest-dom", "testing-library", "jest-formatting"],
       files: [
         "*.unit.spec.ts",
         "*.unit.spec.tsx",
@@ -239,5 +248,41 @@ module.exports = {
         "jest/valid-title": ["error", { ignoreTypeOfDescribeName: true }],
       },
     },
+    {
+      // Enable jest formatting for cypress tests too, the plugin logic just works
+      extends: ["plugin:jest-formatting/recommended"],
+      files: ["*.cy.spec.ts", "*.cy.spec.js"],
+    },
+    {
+      files: ["frontend/src/**/*"],
+      rules: {
+        "no-restricted-syntax": [
+          "error",
+          {
+            selector: "Literal[value=/mb-base-color-/]",
+            message:
+              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
+          },
+        ],
+      },
+    },
+    {
+      files: ["frontend/src/metabase/**/*"],
+      rules: {
+        "no-restricted-syntax": [
+          "error",
+          {
+            selector: "Literal[value=/mb-base-color-/]",
+            message:
+              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
+          },
+          {
+            selector:
+              "CallExpression[callee.property.name='legacyQuery'] > ObjectExpression > Property[key.name='useStructuredQuery'][value.value=true]",
+            message: "StructuredQuery usage is forbidden. Use MLv2",
+          },
+        ],
+      },
+    },
   ],
 };

.github/CODEOWNERS

@@ -1,14 +1,12 @@
 # Before changing this file, make sure you have read how we use it:
 # https://www.notion.so/metabase/Pull-Request-Code-Review-Guide-374f05df889748b69d67af753f9bc9b8?pvs=4#36550c04ceab40b5a8b8bee6264b090c
-# TL;DR: if @camsaul hasn't been involved you're probably doing it wrong
 
-src/metabase @camsaul
-modules @camsaul
-enterprise/backend @camsaul
 enterprise/backend/src/metabase_enterprise/advanced_permissions @noahmoss
 enterprise/backend/src/metabase_enterprise/audit_app @noahmoss
 enterprise/backend/src/metabase_enterprise/sso @noahmoss
 enterprise/backend/src/metabase_enterprise/task/truncate_audit_table.clj @noahmoss
 enterprise/backend/src/metabase_enterprise/internal_user.clj @noahmoss
+frontend/src/metabase/ui @metabase/core-frontend-admin-webapp
 src/metabase/**/*permissions* @noahmoss
 src/metabase/integrations @noahmoss
+snowplow/* @metabase/data

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -66,12 +66,13 @@ body:
         Copy and paste the JSON from `Admin -> Troubleshooting`.
         _This will be automatically formatted into code, so no need for backticks._
       placeholder: |
-        - Your browser and the version: (e.g., Chrome 52.1, Firefox 48.0, Safari 11.1, …)
-        - Your operating system: (e.g., OS X 10.10, Windows 10.1809, Ubuntu 16.04, …)
-        - Your databases: (e.g, MySQL, Postgres, MongoDB, …)
-        - Metabase version: (e.g., 0.19.3)
-        - Metabase hosting environment: (e.g., Elastic Beanstalk, Docker, Heroku, Jar-file on Ubuntu, …)
-        - Metabase internal database: (e.g., H2 (default), Postgres or MySQL)
+        {"browser-info": {
+           "language": "en-US",
+           "platform": "MacIntel",
+           "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+           "vendor": "Google Inc."},
+         "metabase-info": {
+           "databases": [ "postgres",...
       render: JSON
     validations:
       required: true

.github/ISSUE_TEMPLATE/epic.md

@@ -5,20 +5,19 @@ about: This issue is used to track a feature/project that may span several days
   and manage work.
 title: "[Epic] Title"
 labels: ".Epic"
-
 ---
 
-**Links**
-- product doc: _link to product doc_
-- eng doc: _link to technical design doc, if any_
-- feature branch: `branch-name` _this should be the feature branch where this work will be done in. PRs will be delivered against this branch_
-- issue links: _related issues if any_
+### Links
 
-**Implementation Plan**
+- [product doc](LINK_TO_PRODUCT_DOC)
+- [technical design doc](LINK_TO_TECHNICAL_DESIGN_DOC)
+- [testing plan](LINK_TO_TESTING_PLAN)
+- feature branch: `BRANCH_NAME`
+- issue links: _related issues, if any_
 
+### Implementation Plan
 
-***Milestone 1***
-_insert tasklist here_
-
-***Milestone 2***
-
+```[tasklist]
+#### Milestone 1
+- [ ] _Add tasks here_
+```

.github/actions/await-port/action.yml

@@ -0,0 +1,15 @@
+name: Wait for localhost port to be ready
+
+inputs:
+  port:
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Wait for port ${{ inputs.port }} to be ready
+      shell: bash
+      run: |
+        while ! nc -z localhost ${{ inputs.port }}; do
+          sleep 0.1;
+        done

.github/actions/build-e2e-matrix/action.yml

@@ -1,70 +0,0 @@
-name: Build E2E Matrix
-description: Build and output a custom matrix for E2E tests.
-
-outputs:
-  matrix:
-    description: Parameterized matrix in JSON format
-    value: ${{ steps.matrix.outputs.result }}
-
-runs:
-  using: "composite"
-  steps:
-    - uses: actions/github-script@v7
-      id: matrix
-      with:
-        script: | # js
-          const java = 11;
-
-          const defaultRunner = "ubuntu-22.04";
-
-          const defaultOptions = {
-            "java-version": java,
-            runner: defaultRunner,
-            edition: "ee",
-            context: "folder"
-          };
-
-          const testSets = [
-            ["actions", {} ],
-            ["admin", {} ],
-            ["admin-2", {} ],
-            ["binning", {} ],
-            ["collections", {} ],
-            ["custom-column", {} ],
-            ["dashboard", {} ],
-            ["dashboard-cards", {} ],
-            ["dashboard-filters", {} ],
-            ["embedding", {} ],
-            ["embedding-sdk", { context: "embedding-sdk" } ],
-            ["filters", {} ],
-            ["filters-reproductions", {}],
-            ["joins", {} ],
-            ["metrics", {} ],
-            ["models", {} ],
-            ["native", {} ],
-            ["native-filters", {} ],
-            ["onboarding", {} ],
-            ["organization", {} ],
-            ["permissions", {} ],
-            ["question", {} ],
-            ["question-reproductions", {} ],
-            ["search", {}],
-            ["sharing", {} ],
-            ["visualizations-charts", {} ],
-            ["visualizations-tabular", {} ],
-            ["oss-subset", { edition: 'oss', context: "special" } ],
-            ["slow", { context: "special" } ],
-            ["flaky", { context: "special" } ],
-            ["mongo", { context: "qa-database" } ],
-          ];
-
-          const config = testSets.map(([name, specialOptions]) => {
-            return {
-              ...defaultOptions,
-              ...specialOptions,
-              name,
-            }
-          });
-
-          const matrix = { include: config };
-          return matrix;

.github/actions/build-ee-extra/action.yml

@@ -0,0 +1,132 @@
+name: Build ee-extra
+description: Build Metabase Enterprise Edition with extra features
+
+inputs:
+  java-version:
+    required: true
+    # build with Java 11 since that's still officially what we target as a minimum and we don't want Java >11 bytecode
+    # sneaking in.
+    default: 11
+  iam-role:
+    description: "The IAM role to assume"
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare Java
+      uses: actions/setup-java@v3
+      with:
+        java-version: ${{ inputs.java-version }}
+        distribution: 'temurin'
+    - name: Reveal its original version.properties
+      run: jar xf ./bin/docker/metabase.jar version.properties && cat version.properties
+      shell: bash
+    - name: get major version
+      id: major_version
+      run: echo "major_version=$(cat version.properties | grep 'tag=' | cut -d'.' -f2)" >> $GITHUB_OUTPUT
+      shell: bash
+    - name: get drivers registry
+      run: |
+        curl -OL https://raw.githubusercontent.com/metabase/metabase-registry/main/registry.yaml
+      shell: bash
+    - uses: actions/setup-node@v4
+      with:
+        node-version: lts/Hydrogen # 18.x.x
+    - run: rm package.json && npm install yaml
+      shell: bash
+    - name: parse drivers registry
+      uses: actions/github-script@v7
+      id: drivers_registry
+      with:
+        script: | # js
+          const { parse } = require('yaml');
+          const fs = require('fs');
+          const registry = parse(fs.readFileSync('registry.yaml', 'utf8'));
+
+          const drivers = registry.drivers;
+          const majorVersion = '${{ steps.major_version.outputs.major_version }}';
+
+          const getDriverUrl = (driverName) => {
+            const driver = drivers.find(driver => driver.name === driverName);
+
+            if (!driver) {
+              throw new Error(`Driver ${driverName} not found in the registry`);
+            }
+
+            const driverUrl = driver.versions[majorVersion] ?? driver.versions.default;
+
+            if (!driverUrl) {
+              throw new Error(`Driver ${driverName} version ${majorVersion} not found in the registry`);
+            }
+
+            return driverUrl;
+          };
+
+          const extraDrivers = {
+            firebolt: getDriverUrl('firebolt'),
+            starburst: getDriverUrl('starburst'),
+            exasol: getDriverUrl('exasol'),
+            exasol_jdbc: drivers.find(d => d.name === 'exasol').deps[0],
+            clickhouse: getDriverUrl('clickhouse'),
+            ocient: getDriverUrl('ocient'),
+            materialize: getDriverUrl('materialize'),
+          };
+
+          console.log(extraDrivers);
+
+          return extraDrivers;
+    - name: Download Firebolt driver
+      run: |
+        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).firebolt }}
+      working-directory: modules
+      shell: bash
+    - name: Download Starburst driver
+      run: |
+        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).starburst }}
+      shell: bash
+      working-directory: modules
+    - name: Download Exasol driver
+      run: |
+        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).exasol }}
+        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).exasol_jdbc }}
+      shell: bash
+      working-directory: modules
+    - name: Download Clickhouse driver
+      run: |
+        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).clickhouse }}
+      shell: bash
+      working-directory: modules
+    - name: Download Ocient driver
+      run: |
+        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).ocient }}
+      shell: bash
+      working-directory: modules
+    - name: Download Materialize driver
+      run: |
+        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).materialize }}
+      shell: bash
+      working-directory: modules
+    - name: Bundle additional drivers into the Uberjar
+      run: jar uf bin/docker/metabase.jar modules/*.jar
+      shell: bash
+    - name: Launch uberjar
+      run: >-
+        java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./bin/docker/metabase.jar &
+      shell: bash
+    - name: Wait for Metabase to start
+      run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+      shell: bash
+    - name: Kill the java process
+      run: pkill -f metabase.jar
+      shell: bash
+    - name: configure aws credentials
+      if: ${{ github.ref_name == 'master' }}
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-to-assume: ${{ inputs.iam-role }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
+        aws-region: us-east-1
+    - name: Login to Amazon ECR
+      if: ${{ github.ref_name == 'master' }}
+      uses: aws-actions/amazon-ecr-login@v2

.github/actions/e2e-prepare-containers/action.yml

@@ -10,24 +10,27 @@ inputs:
   maildev:
     description: Maildev container
     required: true
-    default: 'false'
+    default: false
   openldap:
     description: OpenLDAP container
     required: true
-    default: 'false'
+    default: false
   postgres:
     description: Postgres container
     required: true
-    default: 'false'
+    default: false
   mysql:
     description: MySQL container
     required: true
-    default: 'false'
+    default: false
   mongo:
     description: Mongo container
     required: true
-    default: 'false'
-
+    default: false
+  webhook:
+    description: Webhook tester container
+    required: false
+    default: false
 
 runs:
   using: "composite"
@@ -84,4 +87,11 @@ runs:
           while ! nc -z localhost 27004; do sleep 1; done &&
           echo -e "${G}Mongo is up and running!"
         fi
+
+        if ${{ inputs.webhook }}; then
+          echo -e "${Y}Starting webhook test container..." &&
+          docker run -d -p 9080:8080/tcp tarampampam/webhook-tester:1.1.0 serve --create-session 00000000-0000-0000-0000-000000000000 &&
+          while ! nc -z localhost 9080; do sleep 1; done &&
+          echo -e "${G}Webhook tester is up and running!"
+        fi
       shell: bash

.github/actions/prepare-backend/action.yml

@@ -2,10 +2,10 @@ name: Prepare back-end environment
 inputs:
   java-version:
     required: true
-    default: '11'
+    default: '21'
   clojure-version:
     required: true
-    default: '1.11.1.1262'
+    default: '1.12.0.1488'
   m2-cache-key:
     description: 'Key to cache M2 packages from Maven Central'
     required: true

.github/auto_request_review.yml

@@ -5,9 +5,9 @@
 files:
   # migrations related files
   'resources/migrations/**':
-    - team:core-backend-components
+    - team:core-workflows
   'src/metabase/db/custom_migrations.clj':
-    - team:core-backend-components
+    - team:core-workflows
 
 options:
   ignore_draft: true

.github/file-paths.yaml

@@ -80,6 +80,7 @@ backend_specs: &backend_specs
   - "modules/drivers/*/test/**"
   - "test_config/**"
   - "dev/**"
+  - "test_resources/**"
 
 backend_all: &backend_all
   - *default

.github/scripts/handle-mochawesome-report.js

@@ -0,0 +1,110 @@
+const fs = require("fs");
+
+const logger = { debug: console.debug, error: console.error };
+
+const collectTestsByType = ({ type, suite, path, cache = [] }) => {
+  logger.debug(`Collecting tests of type ${type}`);
+  const localCache = cache;
+  const { [type]: typeList, suites, tests } = suite;
+
+  for (const uuid of typeList) {
+    const foundTestByUuid = tests.find(test => test.uuid === uuid);
+    if (!foundTestByUuid) {
+      logger.error(`Test with uuid ${uuid} not found`);
+      throw new Error(`Test with uuid ${uuid} not found`);
+    }
+    logger.debug(`Found test with uuid ${uuid}`);
+    foundTestByUuid.path = path;
+    localCache.push({ path, ...foundTestByUuid });
+  }
+
+  for (const subSuite of suites) {
+    collectTestsByType({
+      type,
+      suite: subSuite,
+      path: subSuite.file || path,
+      cache: localCache,
+    });
+  }
+
+  return localCache;
+};
+
+const extractTestResultsInfo = ({ results, stats }) => {
+  logger.debug("Extracting test results information");
+
+  const testType = "failures";
+
+  const failedTests = results.flatMap(result =>
+    collectTestsByType({
+      type: testType,
+      suite: result,
+      path: result.file,
+    }),
+  );
+
+  logger.debug("Finished extracting test results information");
+
+  return {
+    failedTests,
+  };
+};
+
+function parseReport() {
+  const content = fs.readFileSync(
+    "./cypress/reports/cypress-test-report.json",
+    "utf-8",
+  );
+
+  const data = JSON.parse(content);
+
+  return extractTestResultsInfo(data).failedTests.map(test => ({
+    title: test.fullTitle,
+    error: test.err?.message,
+    path: test.path,
+  }));
+}
+
+exports.parseReport = parseReport;
+
+const groupTestsByPath = report => {
+  return report.reduce((acc, item) => {
+    if (!acc[item.path]) {
+      acc[item.path] = [];
+    }
+    acc[item.path].push(item);
+
+    return acc;
+  }, {});
+};
+
+function formatSummary(report) {
+  const failedTestsByPath = groupTestsByPath(report);
+
+  let summary = "### Failed Tests Summary\n\n";
+
+  for (const [path, tests] of Object.entries(failedTestsByPath)) {
+    summary += `| ${path} |\n`;
+    summary += "| :--- |\n";
+
+    tests.forEach(test => {
+      summary += `| ${test.title}`;
+      summary += "<p></p>"; // adds extra space after title
+      summary += `<details>`;
+      summary += "<summary>❌ ";
+      summary += `<code>${truncateError(test.error)}</code>`;
+      summary += "</summary>";
+      summary += `<pre>${test.error}</pre>`.replaceAll("\n", "<br>");
+      summary += `</details> |\n`;
+    });
+  }
+
+  return summary;
+}
+
+function truncateError(error, maxLength = 100) {
+  if (error.length <= maxLength) return error;
+  return error.replaceAll("\n", "").substring(0, maxLength) + "...";
+}
+
+exports.formatSummary = formatSummary;

.github/scripts/run-presto-kerberos-integration-test.sh

@@ -10,9 +10,9 @@ export PATH="$PATH:$JAVA_HOME/bin"
 which java
 
 # install clojure version needed for Metabase
-curl -O https://download.clojure.org/install/linux-install-1.11.0.1100.sh
-chmod +x linux-install-1.11.0.1100.sh
-./linux-install-1.11.0.1100.sh
+curl -O https://download.clojure.org/install/linux-install-1.12.0.1488.sh
+chmod +x linux-install-1.12.0.1488.sh
+./linux-install-1.12.0.1488.sh
 
 RESOURCES_DIR=/app/source/resources
 

.github/team.json

@@ -1,40 +1,43 @@
 {
   "teams": [
     {
-      "name": "Querying Components",
-      "label": ".Team/QueryingComponents",
+      "name": "Querying",
+      "label": ".Team/Querying",
       "projectUrl": "https://github.com/orgs/metabase/projects/97/views/1",
       "members": [
         "ranquild",
         "kamilmielnik",
-        "nemanjaglumac",
-        "romeovs"
+        "romeovs",
+        "bshepherdson",
+        "metamben",
+        "lbrdnk",
+        "appleby",
+        "uladzimirdev",
+        "wzimrin"
       ]
     },
+    {
+      "name": "Drivers",
+      "label": ".Team/Drivers",
+      "members": ["snoe"]
+    },
     {
       "name": "Embedding",
       "label": ".Team/Embedding",
       "projectUrl": "https://github.com/orgs/metabase/projects/88/views/1",
-      "members": ["WiNloSt", "deniskaber", "oisincoveney", "npretto", "heypoom"]
+      "members": ["WiNloSt", "oisincoveney", "npretto", "heypoom"]
     },
     {
-      "name": "BEC",
-      "label": ".Team/BackendComponents",
+      "name": "Workflows",
+      "label": ".Team/Workflows",
       "projectUrl": "https://github.com/orgs/metabase/projects/50/views/1",
       "members": [
-        "tsmacdonald",
         "qnkhuat",
-        "calherries",
         "piranha",
-        "crisptrutski"
+        "crisptrutski",
+        "deniskaber"
       ]
     },
-    {
-      "name": "Query Processor",
-      "label": ".Team/QueryProcessor",
-      "projectUrl": "https://github.com/orgs/metabase/projects/83/views/8",
-      "members": ["camsaul", "snoe", "bshepherdson", "metamben", "lbrdnk", "appleby"]
-    },
     {
       "name": "Admin Webapp",
       "label": ".Team/AdminWebapp",
@@ -45,7 +48,8 @@
         "johnswanson",
         "rafpaf",
         "sloansparger",
-        "iethree"
+        "iethree",
+        "nvoxland"
       ]
     },
     {
@@ -53,17 +57,16 @@
       "label": ".Team/DashViz",
       "members": [
         "alxnddr",
-        "EmmadUsmani",
-        "JesseSDevaney",
         "kulyk",
-        "adam-james-v"
+        "adam-james-v",
+        "tsplude"
       ]
     },
     {
       "name": "DevEx",
       "label": ".Team/DevEx",
       "members": [
-        "uladzimirdev"
+        "camsaul"
       ]
     }
   ]

.github/workflows/backend-cloverage.yml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   be-linter-cloverage:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 90
     steps:

.github/workflows/backend.yml

@@ -12,9 +12,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
 
-env:
-  CLJ_KONDO_VERSION: "2023.09.07"
-
 jobs:
   files-changed:
     name: Check which files changed
@@ -70,23 +67,12 @@ jobs:
       (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
     timeout-minutes: 10
-    env:
-      DOWNLOAD_URL: https://github.com/clj-kondo/clj-kondo/releases/download
     steps:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: 'kondo'
-      - name: Install clj-kondo
-        run: |
-          curl -OL ${DOWNLOAD_URL}/v${CLJ_KONDO_VERSION}/clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip
-          curl -OL ${DOWNLOAD_URL}/v${CLJ_KONDO_VERSION}/clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip.sha256
-          cat clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip.sha256 >> SHA256sum.txt
-          echo " clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip" >> SHA256sum.txt
-          sha256sum -c SHA256sum.txt
-          unzip -d /usr/local/bin clj-kondo-${CLJ_KONDO_VERSION}-linux-static-amd64.zip
-      - run: clj-kondo --version
       - name: Run clj-kondo
         run: ./bin/kondo.sh
 
@@ -168,6 +154,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: be-tests
+          java-version: "${{ matrix.java-version }}"
       # Depending on which files changed, we might either have to build static-viz
       # from scratch or download the previously built artifact
       - name: Build static-viz frontend
@@ -182,12 +169,6 @@ jobs:
 
       - name: Run tests
         id: run-java-tests
-        if: matrix.java-version != 21
-        run: clojure -X:dev:ci:test:${{ matrix.edition }}:${{ matrix.edition }}-dev
-
-      - name: If using Java 21, only run tests on `master`
-        id: run-java-tests-21
-        if: matrix.java-version == 21 && github.ref_name == 'master'
         run: clojure -X:dev:ci:test:${{ matrix.edition }}:${{ matrix.edition }}-dev
 
       - name: Upload Test Results
@@ -214,9 +195,9 @@ jobs:
           fail-on-error: false
 
   be-tests-stub:
-    needs: [be-tests]
+    needs: [files-changed, static-viz-files-changed, be-tests]
     if: |
-      !cancelled() &&
+      always() &&
       github.event.pull_request.draft == false && needs.be-tests.result == 'skipped'
     runs-on: ubuntu-22.04
     name: be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
@@ -268,3 +249,18 @@ jobs:
     steps:
       - run: |
           echo "Didn't run due to conditional filtering"
+
+  be-cljfmt:
+    needs: [files-changed]
+    if: |
+      !cancelled() && needs.files-changed.outputs.backend_all == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: 'cljfmt'
+      - name: Run cljfmt
+        run: clojure -T:cljfmt check

.github/workflows/backport.yml

@@ -6,25 +6,50 @@ on:
     types: [created]
 
 jobs:
+  check_pull_request_state:
+    name: Checks whether the PR has been merged
+    if: github.event.issue.pull_request && contains(github.event.comment.body, '@metabase-bot backport')
+    runs-on: ubuntu-22.04
+    outputs:
+      canBackport: ${{ steps.check_pull_request_state.outputs.result }}
+    steps:
+      - uses: actions/github-script@v7
+        id: check_pull_request_state
+        with:
+          script: |
+            const { data: pullRequest } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.issue.number
+            });
+
+            const canBackport = pullRequest.state === "closed"
+            if (!canBackport) {
+              await github.rest.issues.createComment({
+                issue_number: context.payload.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: "The backport command can only be used after the pull request has been merged. Please wait until the PR is merged before attempting to backport."
+              });
+            }
+            return canBackport
+
   create_pull_request:
     name: Creates a pull request
-    if: contains(github.event.comment.body, '@metabase-bot backport')
+    needs: [check_pull_request_state]
+    if: needs.check_pull_request_state.outputs.canBackport == 'true'
     runs-on: ubuntu-22.04
     steps:
-      - uses: tibdex/github-app-token@v2.1.0
-        id: generate-token
-        with:
-          app_id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private_key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
       - uses: actions/checkout@v4
         name: Cherry-pick commits and create PR
         with:
           fetch-depth: 0
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
       - name: Verify Membership
         id: verify-membership
         uses: ./.github/actions/verify-membership
         with:
-          github_token: ${{ steps.generate-token.outputs.token }}
+          github_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           organization_name: metabase
           username: ${{ github.event.comment.user.login }}
       - run: |
@@ -110,23 +135,50 @@ jobs:
 
             if [ -n "${SQUASHED_COMMIT}" ]; then
               echo "found commit ${SQUASHED_COMMIT}"
-              git cherry-pick ${SQUASHED_COMMIT}
             else
               echo "probably a PR wasn't merged with Squash And Merge button, searching again"
               SQUASHED_COMMIT=$(env -i git log ${ORIGINAL_BASE_REF} --grep="#${ORIGINAL_PULL_REQUEST_NUMBER}" --format="%H")
 
               if [ -n "${SQUASHED_COMMIT}" ]; then
                 echo "found commit ${SQUASHED_COMMIT}"
-                git cherry-pick ${SQUASHED_COMMIT}
               else
                 echo "No squashed commit found for PR #${ORIGINAL_PULL_REQUEST_NUMBER}"
                 exit 1
               fi
             fi
-
           else
-            echo "PR has not been merged, copying all commits"
-            git cherry-pick ${ORIGINAL_BASE_SHA}..${ORIGINAL_HEAD_SHA}
+            echo "The PR has not been merged"
+            exit 1
+          fi
+
+          git cherry-pick ${SQUASHED_COMMIT} || true
+
+          CONFLICTS=$(git ls-files -u | wc -l)
+          if [ "$CONFLICTS" -gt 0 ]; then
+            git cherry-pick --abort
+
+            echo "Could not cherry pick because of a conflict"
+            echo "has-conflicts=true" >> $GITHUB_OUTPUT
+
+            # Add a shell script for resolving conflicts
+            echo "git reset HEAD~1" > ./backport.sh
+            echo "rm ./backport.sh" >> ./backport.sh
+            echo "git cherry-pick ${SQUASHED_COMMIT}" >> ./backport.sh
+            echo "echo 'Resolve conflicts and force push this branch'" >> ./backport.sh
+            chmod +x ./backport.sh
+            git add ./backport.sh
+            git commit -m "Add backport resolution script"
+
+            PR_BODY=$(cat <<-END
+            #${ORIGINAL_PULL_REQUEST_NUMBER}
+            > [!IMPORTANT]
+            > Manual conflict resolution is required.
+            Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking.
+          END
+            )
+          else
+            echo "has-conflicts=false" >> $GITHUB_OUTPUT
+            PR_BODY="#${ORIGINAL_PULL_REQUEST_NUMBER}"
           fi
 
           git push origin "${BACKPORT_BRANCH}" --force-with-lease
@@ -134,12 +186,14 @@ jobs:
           if [[ $(gh pr list --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" -s "open") ]]; then
               echo "PR already exists"
           else
-              BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "#${ORIGINAL_PULL_REQUEST_NUMBER}")
+              BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
               BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
 
               echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT
               echo "New PR has been created"
           fi
+
+          git checkout master
         env:
           ORIGINAL_TITLE: ${{ fromJson(steps.branch_info.outputs.result).originalPullRequest.title }}
           ORIGINAL_BASE_REF: ${{ fromJson(steps.branch_info.outputs.result).originalPullRequest.base.ref }}
@@ -151,18 +205,25 @@ jobs:
           BACKPORT_BRANCH: ${{ fromJson(steps.branch_info.outputs.result).backportBranch }}
           START_SHA: ${{ fromJson(steps.branch_info.outputs.result).startSha }}
           END_SHA: ${{ fromJson(steps.branch_info.outputs.result).endSha }}
-          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
       - name: Auto approve backport PR
+        if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
         uses: juliangruber/approve-pull-request-action@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
       - name: Enable Pull Request Automerge
+        if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
         uses: peter-evans/enable-pull-request-automerge@v2
         with:
-          token: ${{ steps.generate-token.outputs.token }}
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           pull-request-number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
           merge-method: squash
+      - uses: ./.github/actions/notify-pull-request
+        if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'true' }}
+        with:
+          include-log: false
+          message: Manual conflict resolution is required
 
   notify_when_failed:
     runs-on: ubuntu-22.04

.github/workflows/bugs-triage-slack-notification.yml

@@ -3,14 +3,13 @@ name: Bugs Slack Notification
 on:
   issues:
     types:
-      - opened
+      - labeled
 jobs:
-  on-issue-opened:
+  on-issue-labeled:
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     if: |
-        contains(github.event.issue.labels.*.name, '.Needs Triage') &&
-        contains(github.event.issue.labels.*.name, 'Type:Bug')
+      github.event.label.name == '.Needs Triage' && contains(github.event.issue.labels.*.name, 'Type:Bug')
     steps:
       - name: Setting title
         uses: actions/github-script@v7
@@ -34,7 +33,7 @@ jobs:
       - name: Send the issue ${{ github.event.issue.number }} to Slack
         id: slack
         if: steps.check_labels.outputs.has_team_label == 'false'
-        uses: slackapi/slack-github-action@v1.23.0
+        uses: slackapi/slack-github-action@v1.26.0
         with:
           payload: |
             {

.github/workflows/build-for-release.yml

@@ -100,21 +100,14 @@ jobs:
             oss: getCanonicalVersion(version, 'oss'),
           };
 
-          const ossReleased = await hasBeenReleased({
+          const released = await hasBeenReleased({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version: versions.oss,
           });
 
-          const eeReleased = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.ee,
-          });
-
-          if (ossReleased || eeReleased) {
+          if (released) {
             throw new Error("This version has already been released!", version);
           }
 
@@ -243,24 +236,11 @@ jobs:
           ./COMMIT-ID
           ./SHA256.sum
 
-  trigger-tests:
-    needs: [build-uberjar-for-release]
-    permissions:
-      actions: write
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    steps:
-      - name: trigger pre-release testing
-        uses: actions/github-script@v7
-        with:
-          script: | # js
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'pre-release.yml',
-              ref: '${{ github.ref }}',
-              inputs: {
-                commit: '${{ inputs.commit }}',
-                version: '${{ inputs.version }}',
-              }
-            });
+  run-pre-release-tests:
+    name: Run pre-release tests for ${{ inputs.version }}
+    needs: build-uberjar-for-release
+    uses: ./.github/workflows/pre-release.yml
+    secrets: inherit
+    with:
+      commit: ${{ inputs.commit }}
+      version: ${{ inputs.version }}

.github/workflows/check-milestone.yml

@@ -1,16 +1,24 @@
 name: Automatically set milestone
-run-name: Set milestone for ${{ github.event.head_commit.message }}
+run-name: Set milestone for ${{ github.event.head_commit.message || inputs.version }}
 
 on:
   push:
     branches:
       - release-x.**
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Major version number  (e.g. 52, 78, 109)'
+        type: number
+        required: true
 
 jobs:
   set-milestone:
     name: Automatically set milestone
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
+    timeout-minutes: 30
+    env:
+      isNewReleaseBranch: ${{ github.event_name == 'workflow_dispatch' }}
     permissions:
       pull-requests: write
       issues: write
@@ -19,10 +27,13 @@ jobs:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: release
+          fetch-depth: ${{ env.isNewReleaseBranch == 'false' && 3 || 0 }} # we need the full history to get all the commit messages
           ref: master # we want the logic from master, even though we're triggering on a release branch
       - name: Prepare build scripts
         run: cd ${{ github.workspace }}/release && yarn && yarn build
       - uses: actions/github-script@v7
+        if: ${{ env.isNewReleaseBranch == 'false' }}
+        name: Set milestone for single commit
         with:
           script: | # js
             const { setMilestoneForCommits } = require('${{ github.workspace }}/release/dist/index.cjs');
@@ -39,3 +50,36 @@ jobs:
               branchName,
               commitMessages: [commitMessage],
             });
+      - name: Get commit messages for release branch
+        if: ${{ env.isNewReleaseBranch == 'true' }}
+        run: |
+          npm i -g tsx
+          tsx release/src/release-branch-commits.ts ${{ inputs.version }} > commit-messages.json
+      - uses: actions/github-script@v7
+        if: ${{ env.isNewReleaseBranch == 'true' }}
+        name: Set milestones for new release branch
+        env:
+          # this token has a higher rate limit than the default token, and
+          # we will need it for this workflow to work
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        with:
+          script: | # js
+            const { setMilestoneForCommits } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const commitMessages = require('${{ github.workspace }}/commit-messages.json');
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            const versionNumber = context.payload.inputs.version;
+            const branchName = `release-x.${versionNumber}.x`;
+
+            console.log(`Found ${commitMessages.length} new commits for ${branchName}`);
+
+            await setMilestoneForCommits({
+              github,
+              owner,
+              repo,
+              branchName,
+              commitMessages: commitMessages,
+              ignoreExistingMilestones: true,
+            });

.github/workflows/doc-md-links.yml

@@ -1,18 +0,0 @@
-name: Lint doc Markdown links
-
-on:
-  push:
-    paths:
-      - docs/**
-  pull_request:
-    paths:
-      - docs/**
-jobs:
-  markdown-link-check:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Lint doc links
-        run: yarn run docs-lint-links

.github/workflows/drivers.yml

@@ -49,7 +49,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-athena-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -82,7 +83,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -116,7 +118,42 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-druid-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  be-tests-databricks-ee:
+    needs: files-changed
+    if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: databricks
+      MB_DATABRICKS_TEST_HOST: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HOST }}
+      MB_DATABRICKS_TEST_HTTP_PATH: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HTTP_PATH }}
+      MB_DATABRICKS_TEST_TOKEN: ${{ secrets.MB_DATABRICKS_JDBC_TEST_TOKEN }}
+      MB_DATABRICKS_TEST_CATALOG: 'metabase_ci'
+      MB_DATABRICKS_TEST_CLIENT_ID: ${{ secrets.MB_DATABRICKS_JDBC_TEST_CLIENT_ID }}
+      MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Databricks driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-databricks-ee'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -150,7 +187,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-druid-jdbc-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -168,6 +206,10 @@ jobs:
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        partition-index: [0, 1, 2, 3]
     env:
       CI: 'true'
       DRIVERS: mysql
@@ -188,6 +230,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mariadb-10-2-ee'
+        test-args: >-
+          :partition/total 4
+          :partition/index ${{ matrix.partition-index }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -205,6 +250,10 @@ jobs:
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        partition-index: [0, 1, 2, 3]
     env:
       CI: 'true'
       DRIVERS: mysql
@@ -225,6 +274,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mariadb-latest-ee'
+        test-args: >-
+          :partition/total 4
+          :partition/index ${{ matrix.partition-index }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -258,7 +310,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-4-4-ee'
-        test-args: ":exclude-tags '[:mb/once :mongo-sharded-cluster-tests]'"
+        test-args: >-
+          :exclude-tags [:mongo-sharded-cluster-tests]
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -285,9 +339,19 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Spin up Mongo docker container
-        run: docker run -d -p 27017:27017 --name metamongo metabase/qa-databases:mongo-sample-4.4 mongod --dbpath /data/db2/ --tlsMode requireTLS --tlsCertificateKeyFile /etc/mongo/metamongo.pem --tlsCAFile /etc/mongo/metaca.crt
-      - name: Wait until the port 27017 is ready
-        run: while ! nc -z localhost 27017; do sleep 1; done
+        run: >-
+          docker run -d
+          -p 27017:27017
+          --name metamongo
+          metabase/qa-databases:mongo-sample-4.4
+          mongod
+          --dbpath /data/db2/
+          --tlsMode requireTLS
+          --tlsCertificateKeyFile /etc/mongo/metamongo.pem
+          --tlsCAFile /etc/mongo/metaca.crt
+      - uses: ./.github/actions/await-port
+        with:
+          port: 27017
         timeout-minutes: 5
       - name: Make SSL certificates for Mongo available
         run: |
@@ -299,12 +363,13 @@ jobs:
 
           curl https://raw.githubusercontent.com/metabase/metabase-qa/master/dbs/mongo/certificates/metaca.crt \
           -o ./test_resources/ssl/mongo/metaca.crt
-
       - name: Test MongoDB SSL driver (4.4)
         uses: ./.github/actions/test-driver
         with:
           junit-name: 'be-tests-mongo-4-4-ee'
-          test-args: ":exclude-tags '[:mb/once :mongo-sharded-cluster-tests]'"
+          test-args: >-
+            :exclude-tags [:mongo-sharded-cluster-tests]
+            :only-tags [:mb/driver-tests]
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -338,7 +403,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-5-0-ee'
-        test-args: ":exclude-tags '[:mb/once :mongo-sharded-cluster-tests]'"
+        test-args: >-
+          :exclude-tags [:mongo-sharded-cluster-tests]
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -365,9 +432,19 @@ jobs:
     steps:
     - uses: actions/checkout@v4
     - name: Spin up Mongo docker container
-      run: docker run -d -p 27017:27017 --name metamongo metabase/qa-databases:mongo-sample-5.0 mongod --dbpath /data/db2/ --tlsMode requireTLS --tlsCertificateKeyFile /etc/mongo/metamongo.pem --tlsCAFile /etc/mongo/metaca.crt
-    - name: Wait until the port 27017 is ready
-      run: while ! nc -z localhost 27017; do sleep 1; done
+      run: >-
+        docker run -d
+        -p 27017:27017
+        --name metamongo
+        metabase/qa-databases:mongo-sample-5.0
+        mongod
+        --dbpath /data/db2/
+        --tlsMode requireTLS
+        --tlsCertificateKeyFile /etc/mongo/metamongo.pem
+        --tlsCAFile /etc/mongo/metaca.crt
+    - uses: ./.github/actions/await-port
+      with:
+        port: 27017
       timeout-minutes: 5
     - name: Make SSL certificates for Mongo available
       run: |
@@ -379,12 +456,13 @@ jobs:
 
         curl https://raw.githubusercontent.com/metabase/metabase-qa/master/dbs/mongo/certificates/metaca.crt \
         -o ./test_resources/ssl/mongo/metaca.crt
-
     - name: Test MongoDB SSL driver (5.0)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-5-0-ee'
-        test-args: ":exclude-tags '[:mb/once :mongo-sharded-cluster-tests]'"
+        test-args: >-
+          :exclude-tags [:mongo-sharded-cluster-tests]
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -421,7 +499,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-latest-ee'
-        test-args: ":exclude-tags '[:mb/once :mongo-sharded-cluster-tests]'"
+        test-args: >-
+          :exclude-tags [:mongo-sharded-cluster-tests]
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -471,6 +551,10 @@ jobs:
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        partition-index: [0, 1, 2, 3]
     env:
       CI: 'true'
       DRIVERS: mysql
@@ -491,12 +575,30 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mysql-8-0-ee'
+        test-args: >-
+          :partition/total 4
+          :partition/index ${{ matrix.partition-index }}
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-mysql-latest-ee:
     needs: files-changed
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        partition-index: [0, 1, 2, 3]
     env:
       CI: 'true'
       DRIVERS: mysql
@@ -532,6 +634,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mysql-latest-ee'
+        test-args: >-
+          :partition/total 4
+          :partition/index ${{ matrix.partition-index }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -569,7 +674,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-oracle-18-4-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -616,7 +722,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-oracle-21-3-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -634,6 +741,28 @@ jobs:
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - name: Postgres 12.x
+            junit-name: postgres-ee
+            docker-image: postgres:12-alpine
+            env:
+              enable-ssl-tests: 'false'
+          - name: Postgres Latest
+            junit-name: postgres-latest-ee
+            docker-image: postgres:latest
+            env:
+              enable-ssl-tests: 'true'
+        job:
+          - name: Driver Tests
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+          - name: App DB Tests
+            test-args: >-
+              :exclude-tags [:mb/driver-tests]
+    name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
     env:
       CI: 'true'
       DRIVERS: postgres
@@ -643,9 +772,13 @@ jobs:
       MB_DB_DBNAME: mb_test
       MB_DB_USER: mb_test
       MB_POSTGRESQL_TEST_USER: mb_test
+      # SSL tests are only enabled for the postgres-latest job.
+      MB_POSTGRES_SSL_TEST_SSL: ${{ matrix.version.env.enable-ssl-tests }}
+      MB_POSTGRES_SSL_TEST_SSL_MODE: verify-full
+      MB_POSTGRES_SSL_TEST_SSL_ROOT_CERT_PATH: 'test-resources/certificates/us-east-2-bundle.pem'
     services:
       postgres:
-        image: postgres:12-alpine
+        image: ${{ matrix.version.docker-image }}
         ports:
           - "5432:5432"
         env:
@@ -653,55 +786,24 @@ jobs:
           POSTGRES_DB: mb_test
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
-    - uses: actions/checkout@v4
-    - name: Test Postgres driver (12)
-      uses: ./.github/actions/test-driver
-      with:
-        junit-name: 'be-tests-postgres-ee'
-
-  be-tests-postgres-latest-ee:
-    needs: files-changed
-    if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 90
-    env:
-      CI: 'true'
-      DRIVERS: postgres
-      MB_DB_TYPE: postgres
-      MB_DB_PORT: 5432
-      MB_DB_HOST: localhost
-      MB_DB_DBNAME: circle_test
-      MB_DB_USER: circle_test
-      MB_POSTGRESQL_TEST_USER: circle_test
-      MB_POSTGRES_SSL_TEST_SSL: true
-      MB_POSTGRES_SSL_TEST_SSL_MODE: verify-full
-      MB_POSTGRES_SSL_TEST_SSL_ROOT_CERT_PATH: 'test-resources/certificates/us-east-2-bundle.pem'
-    services:
-      postgres:
-        image: circleci/postgres:latest
-        ports:
-          - "5432:5432"
-        env:
-          POSTGRES_USER: circle_test
-          POSTGRES_DB: circle_test
-          POSTGRES_HOST_AUTH_METHOD: trust
-    steps:
-    - uses: actions/checkout@v4
-    - name: Test Postgres driver (latest)
-      uses: ./.github/actions/test-driver
-      with:
-        junit-name: 'be-tests-postgres-latest-ee'
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+      - uses: actions/checkout@v4
+      - name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
+        uses: ./.github/actions/test-driver
+        with:
+          junit-name: 'be-tests-${{ matrix.version.junit-name }}'
+          test-args: >-
+            ${{ matrix.job.test-args }}
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit/
+          output-name: ${{ github.job }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-presto-jdbc-ee:
     needs: files-changed
@@ -728,30 +830,37 @@ jobs:
           JAVA_TOOL_OPTIONS: "-Xmx2g"
     steps:
     - uses: actions/checkout@v4
-    - name: Wait for port ${{ env.MB_PRESTO_JDBC_TEST_PORT }} to be ready
-      run: while ! nc -z localhost ${{ env.MB_PRESTO_JDBC_TEST_PORT }}; do sleep 0.1; done
-      timeout-minutes: 15
+    - uses: ./.github/actions/await-port
+      with:
+         port: ${{ env.MB_PRESTO_JDBC_TEST_PORT }}
+      timeout-minutes: 5
     - name: Create temp cacerts file based on bundled JDK one
       run: cp $JAVA_HOME/lib/security/cacerts /tmp/cacerts-with-presto-ssl.jks
     - name: Capture Presto server self signed CA
       run: |
-          while [[ ! -s /tmp/presto-ssl-ca.pem ]];
-            do echo "Waiting to capture SSL CA" \
+          while [[ ! -s /tmp/presto-ssl-ca.pem ]]; do
+            echo "Waiting to capture SSL CA" \
               && openssl s_client -connect localhost:8443 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/presto-ssl-ca.pem \
-              && sleep 1; done
+              && sleep 1;
+          done
     - name: Convert Presto CA from PEM to DER
       run: openssl x509 -outform der -in /tmp/presto-ssl-ca.pem -out /tmp/presto-ssl-ca.der
     - name: Add write permission on cacerts file
       run: chmod u+w /tmp/cacerts-with-presto-ssl.jks
     - name: Import Presto CA into temp cacerts file
-      run: |
-          keytool -noprompt -import -alias presto -keystore /tmp/cacerts-with-presto-ssl.jks \
-                  -storepass changeit -file /tmp/presto-ssl-ca.der -trustcacerts
+      run: >-
+        keytool -noprompt -import
+        -alias presto
+        -keystore /tmp/cacerts-with-presto-ssl.jks
+        -storepass changeit
+        -file /tmp/presto-ssl-ca.der
+        -trustcacerts
     - name: Test Presto JDBC driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-presto-jdbc-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -782,7 +891,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-redshift-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -820,7 +930,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-snowflake-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -852,7 +963,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sparksql-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -879,7 +991,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlite-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -895,7 +1008,7 @@ jobs:
   be-tests-sqlserver-2017-ee:
     needs: files-changed
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-20.04
     timeout-minutes: 90
     env:
       CI: 'true'
@@ -918,7 +1031,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlserver-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -957,7 +1071,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlserver-2022-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -991,7 +1106,8 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-vertica-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: >-
+          :only-tags [:mb/driver-tests]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1003,3 +1119,41 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  # Dummy job generator to spit out fake runs for matrix jobs we skipped. See
+  # https://github.com/orgs/community/discussions/9141 and
+  # https://metaboat.slack.com/archives/C0669P4AF9N/p1732315370301059
+  be-driver-tests-skipped-stub:
+    needs: files-changed
+    if: |
+      !cancelled() &&
+      (github.event.pull_request.draft == true ||
+      needs.files-changed.outputs.backend_all == 'false')
+    strategy:
+      matrix:
+        job:
+          -  "Test Postgres 12.x (App DB Tests)"
+          -  "Test Postgres 12.x (Driver Tests)"
+          -  "Test Postgres Latest (App DB Tests)"
+          -  "Test Postgres Latest (Driver Tests)"
+          -  "be-tests-mariadb-10-2-ee (0)"
+          -  "be-tests-mariadb-10-2-ee (1)"
+          -  "be-tests-mariadb-10-2-ee (2)"
+          -  "be-tests-mariadb-10-2-ee (3)"
+          -  "be-tests-mariadb-latest-ee (0)"
+          -  "be-tests-mariadb-latest-ee (1)"
+          -  "be-tests-mariadb-latest-ee (2)"
+          -  "be-tests-mariadb-latest-ee (3)"
+          -  "be-tests-mysql-8-0-ee (0)"
+          -  "be-tests-mysql-8-0-ee (1)"
+          -  "be-tests-mysql-8-0-ee (2)"
+          -  "be-tests-mysql-8-0-ee (3)"
+          -  "be-tests-mysql-latest-ee (0)"
+          -  "be-tests-mysql-latest-ee (1)"
+          -  "be-tests-mysql-latest-ee (2)"
+          -  "be-tests-mysql-latest-ee (3)"
+    name: ${{ matrix.job }}
+    runs-on: ubuntu-22.04
+    steps:
+      - run: >-
+          echo 'Skipping job due to conditional filtering'

.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml

@@ -0,0 +1,250 @@
+name: E2E Cross-version Component Tests for Embedding SDK
+
+on:
+  push:
+    branches:
+      - "release-**"
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - "release-**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      e2e_all: ${{ steps.changes.outputs.e2e_all }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  # if this is a test on a release branch, we need to check the build requirements
+  get-build-requirements:
+    if: |
+      !cancelled()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get build dependencies
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const {
+              getBuildRequirements,
+              getVersionFromReleaseBranch,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const targetBranchName = '${{ github.base_ref || github.ref }}';
+
+            const version = getVersionFromReleaseBranch(targetBranchName);
+            const requirements = getBuildRequirements(version);
+
+            return {
+              java_version: requirements.java,
+              node_version: requirements.node,
+            };
+
+  build:
+    needs: [files-changed, get-build-requirements]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == false
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    env:
+      MB_EDITION: ee
+      INTERACTIVE: false
+      # make sure that builds on release branches get licenses, because we use them for releases
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: uberjar
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 11 }}"
+
+      - name: Build uberjar with ./bin/build.sh
+        run: ./bin/build.sh
+
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+  resolve-sdk-version:
+    if: |
+      !cancelled()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      sdk_version: ${{ fromJson(steps.dependencies.outputs.result).sdk_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get latest SDK release for this branch
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const { getSdkVersionFromReleaseBranchName } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const branchName = '${{ github.base_ref || github.ref }}';
+
+            const sdk_version = await getSdkVersionFromReleaseBranchName({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              branchName,
+            });
+
+            return {
+              sdk_version,
+            };
+
+  e2e-tests:
+    needs: [get-build-requirements, build, resolve-sdk-version]
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-tests-embedding-sdk
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # Needed to omit newly added tests for functionality that is not yet released
+      - name: Sparse checkout tests from SDK release commit
+        uses: actions/checkout@v4
+        with:
+          ref: embedding-sdk-${{ needs.resolve-sdk-version.outputs.sdk_version }}
+          path: sdk-release-e2e
+          sparse-checkout: e2e
+
+      - name: Move tests from the release commit into the repo
+        run: |
+          rm -rf ./e2e/support/helpers/*
+          mv ./sdk-release-e2e/e2e/support/helpers/* ./e2e/support/helpers
+          rm -rf ./e2e/test-component/*
+          mv ./sdk-release-e2e/e2e/test-component/* ./e2e/test-component
+        shell: bash
+
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Get the version info
+        run: |
+          jar xf target/uberjar/metabase.jar version.properties
+          mv version.properties resources/
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Install Embedding SDK package v${{ needs.resolve-sdk-version.outputs.sdk_version }}
+        run: yarn add @metabase/embedding-sdk-react@${{ needs.resolve-sdk-version.outputs.sdk_version }}
+
+      - name: Run E2E tests for Embedding SDK
+        run: yarn run test-cypress-run-component-sdk --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-cross-version
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = parseReport();
+             const summary = formatSummary(report);
+
+             await core.summary.addRaw(summary).write();
+
+  e2e-tests-skipped-stub:
+    needs: [e2e-tests]
+    if: |
+      !cancelled() &&
+      needs.e2e-tests.result == 'skipped'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    name: e2e-component-tests-embedding-sdk-cross-version
+    steps:
+      - run: |
+          echo "Didn't run due to conditional filtering"

.github/workflows/e2e-component-tests-embedding-sdk.yml

@@ -0,0 +1,212 @@
+name: E2E Component Tests for Embedding SDK
+
+on:
+  push:
+    branches:
+      - "master"
+      - "release-**"
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      e2e_all: ${{ steps.changes.outputs.e2e_all }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  # if this is a test on a release branch, we need to check the build requirements
+  get-build-requirements:
+    if: |
+      !cancelled() &&
+      contains(github.base_ref || github.ref, 'release-x')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get build dependencies
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const {
+              getBuildRequirements,
+              getVersionFromReleaseBranch,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const targetBranchName = '${{ github.base_ref || github.ref }}';
+
+            const version = getVersionFromReleaseBranch(targetBranchName);
+            const requirements = getBuildRequirements(version);
+
+            return {
+              java_version: requirements.java,
+              node_version: requirements.node,
+            };
+
+  build:
+    needs: [files-changed, get-build-requirements]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == false &&
+      needs.files-changed.outputs.e2e_all == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    env:
+      MB_EDITION: ee
+      INTERACTIVE: false
+      # make sure that builds on release branches get licenses, because we use them for releases
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: uberjar
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 11 }}"
+
+      - name: Build uberjar with ./bin/build.sh
+        run: ./bin/build.sh
+
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+  e2e-tests:
+    needs: [get-build-requirements, build]
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-tests-embedding-sdk
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Get the version info
+        run: |
+          jar xf target/uberjar/metabase.jar version.properties
+          mv version.properties resources/
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+        shell: bash
+
+      - name: Build Embedding SDK package
+        run: yarn build-embedding-sdk
+
+      - name: Run E2E tests for Embedding SDK
+        run: yarn run test-cypress-run-component-sdk --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-latest
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = parseReport();
+             const summary = formatSummary(report);
+
+             await core.summary.addRaw(summary).write();
+
+  e2e-tests-skipped-stub:
+    needs: [e2e-tests]
+    if: |
+      !cancelled() &&
+      needs.e2e-tests.result == 'skipped'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    name: e2e-component-tests-embedding-sdk
+    steps:
+      - run: |
+          echo "Didn't run due to conditional filtering"

.github/workflows/e2e-cross-version.yml

@@ -9,6 +9,8 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 3
     outputs:

.github/workflows/e2e-matrix-builder.yml

@@ -0,0 +1,91 @@
+name: E2E Matrix Builder
+
+on:
+  workflow_call:
+    inputs:
+      chunks:
+        required: true
+        type: number
+        default: 30
+    outputs:
+      matrix:
+        value: ${{ jobs.build-matrix.outputs.matrix }}
+
+jobs:
+  build-matrix:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.matrix.outputs.config }}
+    steps:
+      - uses: actions/setup-node@v3
+        with:
+          node-version: '20.x'
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: e2e
+      - name: get test file names
+        id: test-files
+        shell: bash
+        run: |
+          echo "::set-output name=filenames::$(find e2e/test/scenarios -name '*.cy.spec.*' | tr '\n' ',')"
+      - run: yarn add underscore
+      - uses: actions/github-script@v7
+        id: matrix
+        with:
+          script: | # js
+            const _ = require('underscore');
+
+            const java = 21;
+            const defaultRunner = "ubuntu-22.04";
+
+            // these are special and shouldn't be chunked out arbitrarily
+            const blacklist = [
+              "/embedding-sdk/",
+              "/cross-version/"
+            ];
+
+            const defaultOptions = {
+              "java-version": java,
+              runner: defaultRunner,
+              specs: "./e2e/test/scenarios/**/*.cy.spec.*",
+              edition: "ee",
+            };
+
+            const specialTests = [
+              { name: "embedding-sdk", specs: "./e2e/test/scenarios/embedding-sdk/**.cy.spec.*" },
+              { name: "oss-subset", edition: 'oss', tags: "@OSS" },
+              { name: "slow", tags: "@slow" },
+              { name: "mongo", tags: "@mongo" },
+            ];
+
+            const fileNames = "${{ steps.test-files.outputs.filenames }}"
+              .split(",")
+              .filter(Boolean)
+              .filter(testPath => !blacklist.some(blacklisted => testPath.includes(blacklisted)));
+
+            const fileCount = fileNames.length;
+
+            // subtract the special tests since they all get their own runners
+            const chunkSize = fileCount / (Number('${{ inputs.chunks }}') - specialTests.length);
+
+
+
+            const chunkedFiles = _.chunk(fileNames, chunkSize);
+
+            const regularTests = chunkedFiles.map((files, index) => ({
+              name: `e2e-group-${index + 1}`,
+              specs: files.join(","),
+              tags: '',
+            }));
+
+            const testSets = [...regularTests, ...specialTests];
+
+            const config = testSets.map((options) => ({
+              ...defaultOptions,
+              ...options,
+            }));
+
+            console.log("matrix config", config);
+
+            core.setOutput("config", JSON.stringify({ include: config }));

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -87,10 +87,10 @@ jobs:
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-      - name: Prepare JDK 11
+      - name: Prepare JDK 21
         uses: actions/setup-java@v4
         with:
-          java-version: 11
+          java-version: 21
           distribution: "temurin"
       - name: Prepare Cypress environment
         id: cypress-prep

.github/workflows/e2e-test.yml

@@ -0,0 +1,151 @@
+name: E2E Test
+run-name: E2E Test - ${{ inputs.name }}
+
+on:
+  workflow_call:
+    inputs:
+      name:
+        required: true
+        type: string
+      edition: # oss | ee
+        required: false
+        type: string
+        default: ee
+      specs:
+        required: false
+        default: ./e2e/test/scenarios/**/*.cy.spec.*
+        type: string
+      tags:
+        required: false
+        type: string
+      runner:
+        required: false
+        type: string
+        default: ubuntu-22.04
+
+jobs:
+  e2e-tests:
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 45
+    name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
+    env:
+      MB_EDITION: ${{ inputs.edition }}
+      DISPLAY: ""
+      QA_DB_ENABLED: true
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      MB_SNOWPLOW_AVAILABLE: true
+      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+      CYPRESS_QA_DB_MONGO: ${{ inputs.name == 'mongo' }}
+      CYPRESS_IS_EMBEDDING_SDK: ${{ inputs.name == 'embedding-sdk' }}
+      mongo: ${{ inputs.name == 'mongo' }}
+      postgres: ${{ inputs.name != 'mongo' }}
+      mysql: ${{ inputs.name != 'mongo' }}
+      openldap: ${{ contains(inputs.specs, 'ldap') }}
+      maildev: true
+      webhook: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
+          openldap: ${{ env.openldap }}
+          postgres: ${{ env.postgres }}
+          mysql: ${{ env.mysql }}
+          mongo: ${{ env.mongo }}
+          webhook: ${{ env.webhook }}
+
+      - name: Run Embedding SDK Storybook
+        if: inputs.name == 'embedding-sdk'
+        uses: ./.github/actions/run-embedding-sdk-storybook
+
+      - name: Retrieve uberjar artifact for ${{ inputs.edition }}
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Get the version info
+        run: |
+          jar xf target/uberjar/metabase.jar version.properties
+          mv version.properties resources/
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: 21
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Run Snowplow micro
+        uses: ./.github/actions/run-snowplow-micro
+
+      - name: Run EE Cypress tests on ${{ inputs.name }}
+        if: ${{ !inputs.tags }}
+        shell: bash
+        run: |
+          yarn run test-cypress-run \
+          --env grepTags="-@slow+-@mongo+-@flaky+-@OSS --@quarantine",grepOmitFiltered=true \
+          --spec '${{ inputs.specs }}' \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
+        if: ${{ inputs.tags }}
+        shell: bash
+        run: |
+          yarn run test-cypress-run \
+          --env grepTags="${{inputs.tags}} --@quarantine",grepOmitFiltered=true \
+          --spec '${{ inputs.specs }}' \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-${{ inputs.name }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-${{ inputs.name }}-${{ inputs.edition }}
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = parseReport();
+             const summary = formatSummary(report);
+
+             await core.summary.addRaw(summary).write();

.github/workflows/e2e-tests.yml

@@ -29,15 +29,9 @@ jobs:
           filters: .github/file-paths.yaml
 
   e2e-matrix-builder:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    outputs:
-      matrix: ${{ steps.e2e-matrix.outputs.matrix }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Generate matrix for E2E tests
-        id: e2e-matrix
-        uses: ./.github/actions/build-e2e-matrix
+    uses: ./.github/workflows/e2e-matrix-builder.yml
+    with:
+      chunks: 50
 
   # if this is a test on a release branch, we need to check the build requirements
   get-build-requirements:
@@ -70,12 +64,12 @@ jobs:
               node_version: requirements.node,
             };
 
+
   build:
-    needs: [files-changed, e2e-matrix-builder, get-build-requirements]
+    needs: [files-changed, get-build-requirements]
     if: |
       !cancelled() &&
       github.event.pull_request.draft == false &&
-      needs.e2e-matrix-builder.result == 'success' &&
       needs.files-changed.outputs.e2e_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 25
@@ -108,162 +102,58 @@ jobs:
           name: metabase-${{ matrix.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
 
   e2e-tests:
+    name: ${{ matrix.name }}-${{ matrix.edition }}
+    uses: ./.github/workflows/e2e-test.yml
     needs: [build, e2e-matrix-builder]
     if: |
       !cancelled() && needs.build.result == 'success'
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 45
-    name: e2e-tests-${{ matrix.name }}-${{ matrix.edition }}
-    env:
-      MB_EDITION: ${{ matrix.edition }}
-      DISPLAY: ""
-      QA_DB_ENABLED: true
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
-      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.even.head.sha }}
-      MB_SNOWPLOW_AVAILABLE: true
-      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
-      TZ: US/Pacific # to make node match the instance tz
     strategy:
       fail-fast: false
-      matrix: ${{ fromJSON(needs.e2e-matrix-builder.outputs.matrix) }}
+      matrix: ${{ fromJson(needs.e2e-matrix-builder.outputs.matrix) }}
+    secrets: inherit
+    with:
+      name: ${{ matrix.name }}
+      edition: ${{ matrix.edition }}
+      specs: ${{ matrix.specs }}
+      tags: ${{ matrix.tags }}
+      runner: ${{ matrix.runner }}
 
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Prepare Docker containers
-        uses: ./.github/actions/e2e-prepare-containers
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          maildev: true
-          openldap: ${{ startsWith(matrix.name, 'admin') }}
-          postgres: ${{ matrix.name != 'mongo'}}
-          mysql: ${{ matrix.name != 'mongo'}}
-          mongo: ${{ matrix.name == 'mongo'}}
-
-      - name: Retrieve uberjar artifact for ${{ matrix.edition }}
-        uses: actions/download-artifact@v4
-        with:
-          name: metabase-${{ matrix.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-
-      - name: Get the version info
-        run: |
-          jar xf target/uberjar/metabase.jar version.properties
-          mv version.properties resources/
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare JDK ${{ matrix.java-version }}
-        uses: actions/setup-java@v4
-        with:
-          java-version: ${{ matrix.java-version }}
-          distribution: "temurin"
-
-      - name: Prepare Cypress environment
-        id: cypress-prep
-        uses: ./.github/actions/prepare-cypress
-
-      - name: Run Snowplow micro
-        uses: ./.github/actions/run-snowplow-micro
-
-      - name: Run OSS-specific Cypress tests
-        if: matrix.edition == 'oss' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags=@OSS,grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run slow and resource-intensive Cypress tests
-        if: matrix.name == 'slow' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="@slow",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run Flaky Cypress tests
-        if: matrix.name == 'flaky' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="@flaky --@quarantine",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run EE Cypress tests on ${{ matrix.name }}
-        if: matrix.context == 'folder' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="-@slow+-@mongo+-@flaky --@quarantine",grepOmitFiltered=true \
-          --folder ${{ matrix.name }} \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run E2E tests that depend on Mongo
-        if: matrix.name == 'mongo'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="@mongo --@quarantine",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-        env:
-          CYPRESS_QA_DB_MONGO: true
-
-      - name: Run Embedding SDK Storybook
-        if: matrix.context == 'embedding-sdk' && github.event_name != 'schedule'
-        uses: ./.github/actions/run-embedding-sdk-storybook
-
-      - name: Run E2E tests for Embedding SDK
-        if: matrix.context == 'embedding-sdk' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="-@slow+-@flaky --@quarantine",grepOmitFiltered=true \
-          --folder 'embedding-sdk' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-        env:
-          CYPRESS_IS_EMBEDDING_SDK: true
-        shell: bash
-
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-${{ matrix.name }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
-      - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: cypress-recording-${{ matrix.name }}-${{ matrix.edition }}
-          path: |
-            ./cypress
-            ./logs/test.log
-          if-no-files-found: ignore
-
-  e2e-tests-skipped-stub:
-    needs: [e2e-tests, e2e-matrix-builder]
+  # run this separately to make it non-blocking
+  flaky-e2e-tests:
+    name: Flaky e2e Tests
+    uses: ./.github/workflows/e2e-test.yml
+    needs: build
     if: |
-      !cancelled() &&
-      needs.e2e-tests.result == 'skipped'
-    runs-on: ${{ matrix.runner }}
+      !cancelled() && needs.build.result == 'success'
+    secrets: inherit
+    with:
+      name: Flaky
+      tags: "@flaky"
+
+  e2e-tests-result:
+    needs: [e2e-tests, flaky-e2e-tests]
+    runs-on: ubuntu-latest
     timeout-minutes: 5
-    name: e2e-tests-${{ matrix.name }}-${{ matrix.edition }}
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJSON(needs.e2e-matrix-builder.outputs.matrix) }}
+    name: e2e-tests-result
+    if: always() && !cancelled()
+    env:
+      E2E_TESTS_RESULT: ${{ needs.e2e-tests.result }}
+      FLAKY_E2E_TESTS_RESULT: ${{ needs.flaky-e2e-tests.result }}
     steps:
-      - run: |
+      - name: Stub
+        if: ${{ needs.e2e-tests.result == 'skipped' }}
+        run: |
           echo "Didn't run due to conditional filtering"
+      - name: Test results
+        if: ${{ needs.e2e-tests.result != 'skipped' }}
+        run: | # sh
+          echo "E2E Tests: ${{ needs.e2e-tests.result }}"
+          echo "Flaky E2E Tests: ${{ needs.flaky-e2e-tests.result }}"
+
+          if [ "${{ needs.e2e-tests.result }}" != "success" ]; then
+            echo "E2E Tests failed"
+            exit 1
+          fi
 
   pr-env:
     needs: [build]

.github/workflows/flake-issue-creator.yml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   flake-issue-creator:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:

.github/workflows/flake-status.yml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   flake-status-report:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:

.github/workflows/links.yml

@@ -0,0 +1,32 @@
+name: Links
+
+on:
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * 0"
+
+jobs:
+  linkChecker:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write # required for peter-evans/create-issue-from-file
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Link Checker
+        id: lychee
+        uses: lycheeverse/lychee-action@v2
+        with:
+          fail: false
+          args: docs --config ./lychee/config.toml --verbose --no-progress
+          format: markdown
+
+      - name: Create Issue From File
+        if: steps.lychee.outputs.exit_code != 0
+        uses: peter-evans/create-issue-from-file@v5
+        with:
+          title: Link Checker Report
+          content-filepath: ./lychee/out.md
+          labels: "Type:Documentation"
+          assignees: jeff-bruemmer

.github/workflows/loki-update.yml

@@ -61,9 +61,9 @@ jobs:
         with:
           github-token: ${{secrets.METABASE_AUTOMATION_USER_TOKEN}}
           script: |
-            github.issues.removeLabel({
+            github.rest.issues.removeLabel({
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
               name: 'loki-update'
-            })
+            });

.github/workflows/loki.yml

@@ -83,5 +83,6 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: loki-report
+          include-hidden-files: true
           path: .loki/
           if-no-files-found: ignore

.github/workflows/main.yml

@@ -0,0 +1,38 @@
+name: Slack Notification for New Feature Requests
+
+on:
+  issues:
+    types:
+      - labeled
+jobs:
+  on-issue-labeled:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: |
+      contains(github.event.issue.labels.*.name, 'Type:New Feature')
+    steps:
+      - name: Setting title
+        uses: actions/github-script@v7
+        id: vars
+        with:
+          script: |
+            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
+      - name: Send the issue ${{ github.event.issue.number }} to Slack
+        id: slack
+        uses: slackapi/slack-github-action@v1.26.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "New incoming feature request: ${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_FEATURE_REQUEST_TRIAGE_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/on-epic-close.yml

@@ -0,0 +1,48 @@
+name: A New Feature Slack Notification
+
+on:
+  issues:
+    types:
+      - closed
+
+jobs:
+  on-epic-closed:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: ${{ contains(github.event.issue.labels.*.name, '.Epic') || contains(github.event.issue.labels.*.name, 'Type:New Feature') }}
+    steps:
+      - name: Setting title
+        uses: actions/github-script@v6
+        id: vars
+        with:
+          script: |
+            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
+      - name: Extracting team name
+        id: team_name
+        run: |
+          team_label=$(echo "${{ join(github.event.issue.labels.*.name, ',') }}" | grep -o '\.Team/[^,]*' | head -n 1)
+          echo $team_label
+          echo "team_label=${team_label}" >> "$GITHUB_OUTPUT"
+          team_name=${team_label#*.Team/}
+          echo $team_name
+          echo "team_name=${team_name^^}_SLACK_EPIC_WEBHOOK_URL" >> "$GITHUB_OUTPUT"
+      - name: Send the issue ${{ github.event.issue.number }} to Slack
+        id: slack
+        if: ${{ steps.team_name.outputs.team_label }}
+        uses: slackapi/slack-github-action@v1.26.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets[steps.team_name.outputs.team_name] }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/pre-release.yml

@@ -10,11 +10,18 @@ on:
         required: true
       commit:
         description: "A full-length commit SHA-1 hash"
+        type: string
+        required: true
+  workflow_call:
+    inputs:
+      version:
+        description: "Metabase version (e.g. v0.46.3)"
+        type: string
+        required: true
+      commit:
+        description: "A full-length commit SHA-1 hash"
+        type: string
         required: true
-      auto:
-        description: 'auto-patch release DO NOT SET MANUALLY'
-        type: boolean
-        default: false
 
 jobs:
   release-artifact:
@@ -79,7 +86,7 @@ jobs:
       - name: Upload Metabase ${{ matrix.edition }} JAR as artifact
         uses: actions/upload-artifact@v4
         with:
-          name: metabase-${{ matrix.edition }}-uberjar
+          name: metabase-test-${{ matrix.edition }}-uberjar
           path: |
             ./metabase.jar
             ./COMMIT-ID
@@ -93,7 +100,7 @@ jobs:
     strategy:
       matrix:
         edition: [oss, ee]
-        java-version: [11, 17]
+        java-version: [11, 17, 21]
     steps:
       - name: Prepare JRE (Java Run-time Environment)
         uses: actions/setup-java@v4
@@ -105,9 +112,10 @@ jobs:
       - uses: actions/download-artifact@v4
         name: Retrieve uberjar artifact
         with:
-          name: metabase-${{ matrix.edition }}-uberjar
+          name: metabase-test-${{ matrix.edition }}-uberjar
       - name: Launch uberjar (and keep it running)
-        run: java -jar ./metabase.jar &
+        run: >-
+          java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./metabase.jar &
       - name: Wait for Metabase to start
         run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
 
@@ -142,10 +150,10 @@ jobs:
           maildev: true
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-      - name: Prepare JDK 11
+      - name: Prepare JDK 21
         uses: actions/setup-java@v4
         with:
-          java-version: 11
+          java-version: 21
           distribution: "temurin"
       - name: Prepare Cypress environment
         id: cypress-prep
@@ -155,7 +163,7 @@ jobs:
       - uses: actions/download-artifact@v4
         name: Retrieve uberjar artifact for ${{ matrix.edition }}
         with:
-          name: metabase-${{ matrix.edition }}-uberjar
+          name: metabase-test-${{ matrix.edition }}-uberjar
       - name: Get the version info
         run: |
           jar xf metabase.jar version.properties
@@ -207,16 +215,16 @@ jobs:
       - uses: actions/download-artifact@v4
         name: Retrieve uberjar artifact
         with:
-          name: metabase-${{ matrix.edition }}-uberjar
+          name: metabase-test-${{ matrix.edition }}-uberjar
       - name: Move the Uberjar to the context dir
         run: mv metabase.jar bin/docker/.
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
         with:
           driver-opts: network=host
       - name: Build ${{ matrix.edition }} container
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           context: bin/docker/.
           platforms: linux/amd64
@@ -233,7 +241,7 @@ jobs:
         timeout-minutes: 3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
           password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
@@ -270,7 +278,7 @@ jobs:
       IMAGE_TAG: ${{ needs.containerize.outputs.image_tag }}
     steps:
       - name: Login to Docker Hub # authenticated, to avoid being rate-throttled
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
           password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
@@ -289,30 +297,6 @@ jobs:
         run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
         timeout-minutes: 3
 
-  trigger-auto-publish:
-    if: ${{ inputs.auto }}
-    needs: [run-sanity-check, check-uberjar-health, verify-docker-pull]
-    permissions:
-      actions: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: trigger auto publish
-        uses: actions/github-script@v7
-        with:
-          script: | # js
-            await github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'release.yml',
-              ref: '${{ github.ref }}',
-              inputs: {
-                commit: '${{ inputs.commit }}',
-                version: '${{ inputs.version }}',
-                auto: true,
-              }
-            });
-
   tests-complete-message:
     if: always()
     runs-on: ubuntu-22.04

.github/workflows/release-embedding-sdk.yml

@@ -1,35 +1,97 @@
 name: Release Metabase Embedding SDK for React
+run-name: Release SDK from ${{ inputs.branch }}
 
 on:
   workflow_dispatch:
     inputs:
-      # TODO: Add a version validation, so the workflow won't fail when publishing to npm
-      sdk_version:
-        description: 'SDK version (e.g. 0.1.3)'
-        type: string
-        required: true
-      git_ref:
-        description: 'A git commit hash that will be used to build the SDK'
-        type: string
+      branch:
+        description: "Branch we want to release the SDK from"
+        type: choice
         required: true
+        default: "master"
+        options:
+          - master
+          - release-x.51.x
+          - release-x.52.x
 
 concurrency:
-  # We want to ensure only one job is running at a time because
+  # We want to ensure only one job is running at a time per branch because
   # there could be a conflict when updating the readme file.
-  group: ${{ github.workflow }}
+  group: ${{ github.workflow }}-${{ inputs.branch }}
   cancel-in-progress: true
 
 jobs:
+  workflow-summary:
+    name: Log inputs
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - name: Generate workflow summary
+        run: |
+          tee -a $GITHUB_STEP_SUMMARY << EOF
+          **Inputs:**
+
+          - \`branch\`: ${{ inputs.branch }}
+
+          triggered by: @${{ github.event.sender.login }}
+          EOF
+
+  determine-version:
+    name: Determine SDK version
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    outputs:
+      sdk_version: ${{ steps.new-sdk-version.outputs.result }}
+    steps:
+      - name: Check out the code using the provided branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.branch }}
+
+      - name: Get current SDK version
+        id: current-sdk-version
+        run: |
+          VERSION=$(jq -r .version ./enterprise/frontend/src/embedding-sdk/package.template.json)
+          echo "sdk_current_version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Get next SDK patch version
+        id: new-sdk-version
+        uses: actions/github-script@v7
+        with:
+          result-encoding: string
+          script: |
+            const currentVersion = "${{ steps.current-sdk-version.outputs.sdk_current_version }}";
+            const [currentVersionWithoutSuffix, suffix] = currentVersion.split("-");
+            const versionParts = currentVersionWithoutSuffix.split(".");
+            versionParts[versionParts.length - 1] = parseInt(versionParts.at(-1)) + 1;
+            const newVersion = versionParts.join(".");
+
+            if (!suffix) {
+              return newVersion;
+            }
+
+            return `${newVersion}-${suffix}`
+
+      - name: Append workflow summary
+        run: |
+          tee -a $GITHUB_STEP_SUMMARY << EOF
+          **Derived inputs:**
+
+          - \`current_version\`: "${{ steps.current-sdk-version.outputs.sdk_current_version }}"
+          - \`next_version\`: "${{ steps.new-sdk-version.outputs.result }}"
+          EOF
+
   check-git-tag:
+    needs: determine-version
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     env:
-      tag: embedding-sdk-${{ inputs.sdk_version }}
+      tag: embedding-sdk-${{ needs.determine-version.outputs.sdk_version }}
     steps:
-      - name: Check out the code using the provided ref
+      - name: Check out the code using the provided branch
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.git_ref }}
+          ref: ${{ inputs.branch }}
           fetch-depth: 0
           fetch-tags: true
 
@@ -48,10 +110,10 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
-      - name: Check out the code using the provided ref
+      - name: Check out the code using the provided branch
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.git_ref }}
+          ref: ${{ inputs.branch }}
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
@@ -65,14 +127,14 @@ jobs:
         run: yarn embedding-sdk:test-unit
 
   build-sdk:
-    needs: test
+    needs: [test, determine-version]
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
-      - name: Check out the code using the provided ref
+      - name: Check out the code using the provided branch
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.git_ref }}
+          ref: ${{ inputs.branch }}
           fetch-depth: 0
           fetch-tags: true
 
@@ -84,14 +146,10 @@ jobs:
         with:
           m2-cache-key: "release-sdk"
 
-      - name: Update readme
-        run: |
-          ./bin/embedding-sdk/release_utils.bash update_readme ${{ inputs.sdk_version }}
-
       - name: Bump published npm package version
         # NOTE: this should happen before "Build SDK bundle" as we inject SDK version into the code during build step
         run: |
-          ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ inputs.sdk_version }}
+          ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ needs.determine-version.outputs.sdk_version }}
 
       - name: Update changelog
         run: |
@@ -115,50 +173,18 @@ jobs:
           name: sdk-changelog-diff
           path: ./changelog-diff
 
-  build-jar:
-    needs: test
-    uses: ./.github/workflows/uberjar-sdk.yml
-    with:
-      git_ref: ${{ inputs.git_ref }}
-      image_name: embedding-sdk-${{ inputs.sdk_version }}
-    secrets: inherit
-
-  upload-jar:
-    needs: build-jar
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    steps:
-      - uses: actions/download-artifact@v4
-        name: Retrieve uberjar artifact
-        with:
-          name: metabase-ee-uberjar
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_S3_RELEASE_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_S3_RELEASE_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_REGION }}
-
-      - name: Upload uberjar to S3
-        env:
-          BUCKET: ${{ vars.AWS_S3_DOWNLOADS_BUCKET }}
-          BUCKET_PATH: sdk/v${{ inputs.sdk_version }}/metabase.jar
-          FILE: ./target/uberjar/metabase.jar
-        shell: bash
-        run: |
-          aws s3 cp $FILE s3://$BUCKET/$BUCKET_PATH
-
   publish-npm:
-    needs: [build-sdk, upload-jar]
+    needs: [build-sdk, determine-version]
     runs-on: ubuntu-22.04
     timeout-minutes: 20
+    env:
+      sdk_version: ${{ needs.determine-version.outputs.sdk_version }}
     steps:
-      - name: Check out master to prepare for a SDK version bump PR
+      - name: Check out branch to prepare for a SDK version bump PR
         uses: actions/checkout@v4
         with:
           # when we created version update PR, it would only have diff from 2 files SDK readme and SDK package.json template
-          ref: master
+          ref: ${{ inputs.branch}}
 
       - name: Setup git user
         run: |
@@ -167,11 +193,11 @@ jobs:
 
       - name: Update readme
         run: |
-          bash ./bin/embedding-sdk/release_utils.bash update_readme ${{ inputs.sdk_version }}
+          bash ./bin/embedding-sdk/release_utils.bash update_readme ${{ env.sdk_version }}
 
       - name: Bump published npm package version
         run: |
-          bash ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ inputs.sdk_version }}
+          bash ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ env.sdk_version }}
 
       - name: Retrieve SDK changelog diff
         uses: actions/download-artifact@v4
@@ -185,13 +211,13 @@ jobs:
 
       - name: Create a PR updating readme + published version, and changelog (using GitHub Metabase Automation account)
         run: |
-          git checkout -b update-sdk-version-${{ inputs.sdk_version }}
-          git commit -a -m 'Update Readme version references and published npm version to ${{ inputs.sdk_version }}'
+          git checkout -b update-sdk-version-${{ env.sdk_version }}
+          git commit -a -m 'Update Readme version references and published npm version to ${{ env.sdk_version }}'
           git push origin HEAD
-          gh pr create --base master\
+          gh pr create --base ${{ inputs.branch }}\
                        --assignee "${GITHUB_ACTOR}"\
-                       --title "Update SDK version to ${{ inputs.sdk_version }}"\
-                       --body "Update Readme version references and published npm package version to ${{ inputs.sdk_version }}"
+                       --title "Update SDK version to ${{ env.sdk_version }}"\
+                       --body "Update Readme version references and published npm package version to ${{ env.sdk_version }}"
         env:
           GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
 
@@ -203,7 +229,7 @@ jobs:
 
       - name: Edit PR adding useful information (using Metabase bot app)
         run: |
-          gh pr edit --add-reviewer @metabase/embedding --add-label no-backport
+          gh pr edit --add-reviewer @metabase/embedding,albertoperdomo --add-label no-backport
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
@@ -226,22 +252,29 @@ jobs:
           path: sdk
 
       - name: Publish to NPM
+        working-directory: sdk
         run: |
-          cd sdk
           echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
-          npm publish
+          # Please keep the value in sync with `inputs.branch`'s release branch
+          npm publish --tag ${{fromJson('{"master": "nightly", "release-x.51.x": "51-stable", "release-x.52.x": "52-stable"}')[inputs.branch]}}
+
+      - name: Add `latest` tag to the latest release branch (`release-x.52.x`) deployment
+        if: ${{ inputs.branch == 'release-x.52.x' }}
+        working-directory: sdk
+        run: |
+          npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest
 
   git-tag:
-    needs: publish-npm
+    needs: [publish-npm, determine-version]
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     env:
-      tag: embedding-sdk-${{ inputs.sdk_version }}
+      tag: embedding-sdk-${{ needs.determine-version.outputs.sdk_version }}
     steps:
-      - name: Check out the code using the provided ref
+      - name: Check out the code using the provided branch
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.git_ref }}
+          ref: ${{ inputs.branch }}
 
       # Lightweight tags don't need committer name and email
       - name: Create a new git tag
@@ -249,6 +282,6 @@ jobs:
           git tag ${{ env.tag }}
 
       - name: Push the new tag
-        id : push-tag
+        id: push-tag
         run: |
           git push origin ${{ env.tag }}

.github/workflows/release-log.yml

@@ -1,22 +1,34 @@
 name: Update Release Log
-run-name: Update Release Log ${{ inputs.version }}
+run-name: Update Release Log ${{ inputs.version || github.ref_name }}
 
 on:
+  push:
+    branches:
+      - release-x.*
+    tags:
+      - v*
+      - nightly-*
+      - latest-*
+      - beta-*
   workflow_dispatch:
     inputs:
       version:
         description: 'Major Metabase version (e.g. 45, 52, 68)'
         type: number
         required: true
-  schedule:
-    - cron: '45 * * * *' # hourly
+  workflow_call:
+    inputs:
+      version:
+        description: 'Major Metabase version (e.g. 45, 52, 68)'
+        type: number # needs to be a number to pass variables
+        required: true
 
 jobs:
   update-release-log:
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    env:
-      VERSION: ${{ github.event_name == 'workflow_dispatch' && inputs.version || 50 }} # Update this for the next major release
+    # don't run this workflow for forks
+    if: ${{ github.event_name != 'push' || github.repository == 'metabase/metabase' }}
     steps:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -26,18 +38,54 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
       - uses: actions/checkout@v4
         with:
+          ref: master # this only works on master
           fetch-depth: 0 # we want all branches and tags
       - name: Install Dependencies
         run: yarn --cwd release --frozen-lockfile && npm i -g tsx
+      - name: Build release scripts
+        run: yarn --cwd release build
+      - name: Get version number
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            const {
+              getVersionFromReleaseBranch,
+              getMajorVersion,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            console.log({ context });
+
+            // if the version is explicitly set, use that
+            if (context.payload?.inputs?.version) {
+              core.exportVariable('VERSION', context.payload.inputs.version);
+              return;
+            }
+
+            // otherwise, get the version from the release branch name
+            const branch = context.payload.ref;
+            const version = getVersionFromReleaseBranch(branch);
+            const majorVersion = getMajorVersion(version);
+
+            console.log({ branch, version, majorVersion });
+            core.exportVariable('VERSION', majorVersion);
+
       - name: generate release Log
-        run: cd release && tsx ./src/release-log.ts $VERSION > v$VERSION.html
+        run: cd release && tsx ./src/release-log-run.ts $VERSION > v$VERSION.html
+      - name: generate release channel log
+        run: cd release && tsx ./src/release-channel-log.ts > channels.html
       - name: upload release log to the web
         run: |
           aws s3 cp \
           release/v$VERSION.html \
           s3://${{ vars.AWS_S3_STATIC_BUCKET }}/release-log/v$VERSION.html
+      - name: upload release channel log to the web
+        run: |
+          aws s3 cp \
+          release/channels.html \
+          s3://${{ vars.AWS_S3_STATIC_BUCKET }}/release-log/channels.html
+
       - name: Create cloudfront invalidation
         run: |
           aws cloudfront create-invalidation \
           --distribution-id ${{ vars.AWS_CLOUDFRONT_STATIC_ID }} \
-          --paths /release-log/v$VERSION.html
+          --paths "/release-log/v$VERSION.html" "/release-log/channels.html"

.github/workflows/release-milestone-check.yml

@@ -14,6 +14,7 @@ on:
 
 jobs:
   check-milestone:
+    permissions: write-all
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:
@@ -24,9 +25,9 @@ jobs:
         run: yarn --cwd release --frozen-lockfile && yarn --cwd release build
       - uses: actions/github-script@v7
         env:
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
         with:
           script: | # js
             const {

.github/workflows/release-patch.yml

@@ -13,6 +13,8 @@ on:
 
 jobs:
   auto-patch-trigger:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     steps:
@@ -31,8 +33,9 @@ jobs:
               hasCommitBeenReleased,
             } = require('${{ github.workspace }}/release/dist/index.cjs');
 
-            // Don't forget to update this for the next major release 🤞
-            const AUTO_RELEASE_VERSIONS = [49, 50];
+            const currentRelease = Number('${{ vars.CURRENT_VERSION }}');
+            const lastRelease = currentRelease - 1;
+            const AUTO_RELEASE_VERSIONS = [lastRelease, currentRelease];
 
             async function releasePatchFor(majorVersion) {
               const nextPatch = await getNextPatchVersion({

.github/workflows/release-status.yml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   check-release-status:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:

.github/workflows/release-tag.yml

@@ -0,0 +1,343 @@
+name: Release 4 - Set Release Channel
+run-name: Set ${{ inputs.version }} as ${{ inputs.tag_name }} ( ${{ inputs.tag_ee && 'EE' || '' }} ${{ inputs.tag_oss && 'OSS' || '' }} )
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Metabase version (e.g. v0.46.3)
+        type: string
+        required: true
+      tag_name:
+        description: Tag name to apply to this release
+        type: choice
+        options:
+          - nightly
+          - beta
+          - latest
+        required: true
+      tag_rollout:
+        description: Rollout % (0-100)
+        type: number
+        default: 100
+      tag_ee:
+        description: Apply to EE
+        type: boolean
+        default: true
+      tag_oss:
+        description: Apply to OSS
+        type: boolean
+        default: true
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        required: true
+      tag_name:
+        type: string
+        # options:
+        #   - nightly
+        #   - beta
+        #   - latest
+        #   - none (skips everything)
+        required: true
+      tag_rollout:
+        description: Rollout % (0-100)
+        type: number
+        default: 100
+      tag_ee:
+        description: Apply to EE
+        type: boolean
+        default: true
+      tag_oss:
+        description: Apply to OSS
+        type: boolean
+        default: true
+
+jobs:
+  green-check-stub:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 2
+    steps:
+    - name: Stub
+      run: echo "Stub to make this job successful even if all the rest of the steps are skipped"
+  check-version:
+    # skips everything if the tag_name is 'none' because all later jobs depend on this job
+    if: ${{ inputs.tag_name != 'none' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      ee: ${{ fromJson(steps.canonical_version.outputs.result).ee }}
+      oss: ${{ fromJson(steps.canonical_version.outputs.result).oss }}
+      edition_matrix: ${{ steps.edition_matrix.outputs.result }}
+    steps:
+    - name: Fail early on the incorrect version format
+      if: ${{ !(startsWith(inputs.version,'v0.') || startsWith(inputs.version,'v1.')) }}
+      run: |
+        echo "The version format is invalid!"
+        echo "It must start with either 'v0.' or 'v1.'."
+        echo "Please, try again."
+        exit 1
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get Release Version
+      uses: actions/github-script@v7
+      id: canonical_version
+      with:
+        script: | # js
+          const { isValidVersionString, getCanonicalVersion, hasBeenReleased } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          const version = '${{ inputs.version }}';
+
+          if (!isValidVersionString(version)) {
+            throw new Error("The version format is invalid!");
+          }
+
+          const versions = {
+            ee: getCanonicalVersion(version, 'ee'),
+            oss: getCanonicalVersion(version, 'oss'),
+          };
+
+          const released = await hasBeenReleased({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            version: versions.oss,
+          });
+
+          if (!released) {
+            throw new Error("This version has not been released yet!", version);
+          }
+
+          return versions;
+
+    - name: Get Edition matrix
+      uses: actions/github-script@v7
+      id: edition_matrix
+      with:
+        script: | # js
+          const tag_oss = ${{ inputs.tag_oss }};
+          const tag_ee = ${{ inputs.tag_ee }};
+
+          if (tag_oss && tag_ee) {
+            return ["oss", "ee"];
+          }
+
+          if (tag_oss) {
+            return ["oss"];
+          }
+
+          if (tag_ee) {
+            return ["ee"];
+          }
+
+          throw new Error("No edition selected to tag");
+
+  copy-to-s3:
+    runs-on: ubuntu-22.04
+    needs: check-version
+    timeout-minutes: 5
+    strategy:
+      matrix:
+        edition: ${{ fromJson(needs.check-version.outputs.edition_matrix) }}
+    steps:
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_S3_RELEASE_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_S3_RELEASE_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+    - name: Determine the source path
+      uses: actions/github-script@v7
+      id: source_path
+      with:
+        result-encoding: string
+        script: | # js
+          const version = '${{ inputs.version }}';
+          const edition = '${{ matrix.edition }}';
+
+          const source_path = edition === 'ee'
+            ? 'enterprise/' + version.replace(/^v0\./, "v1.") // always e.g. v1.47.2
+            : version.replace(/^v1\./, "v0."); // always e.g. v0.45.6;
+
+          console.log("The source path for this", edition, "edition is", source_path);
+
+          return source_path;
+
+    - name: Determine upload path
+      uses: actions/github-script@v7
+      id: upload_path
+      with:
+        result-encoding: string
+        script: | # js
+          const edition = '${{ matrix.edition }}';
+          const tagName = '${{ inputs.tag_name }}';
+
+          const OSSversion = '${{ needs.check-version.outputs.oss }}';
+          const EEversion = '${{ needs.check-version.outputs.ee }}';
+
+          const upload_path = edition === 'ee'
+            ? `enterprise/${tagName}`
+            : tagName;
+
+          console.log("The upload path for this", edition, "edition is", upload_path);
+
+          return upload_path;
+
+    - name: Upload to s3 ${{ inputs.tag_name }} path
+      run: | # sh
+        aws s3 cp \
+          s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.source_path.outputs.result }}/metabase.jar \
+          s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.upload_path.outputs.result }}/metabase.jar
+
+    - name: Create cloudfront invalidation
+      run: |
+        aws cloudfront create-invalidation \
+        --distribution-id ${{ vars.AWS_CLOUDFRONT_DOWNLOADS_ID }} \
+        --paths /${{ steps.upload_path.outputs.result }}/metabase.jar
+
+    - name: Download the jars
+      run: | # sh
+        curl -L http://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}.s3.${{ vars.AWS_REGION }}.amazonaws.com/${{ steps.source_path.outputs.result }}/metabase.jar -o metabase-source.jar
+        curl -L http://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}.s3.${{ vars.AWS_REGION }}.amazonaws.com/${{ steps.upload_path.outputs.result }}/metabase.jar -o metabase-tagged.jar
+
+    - name: Verify Checksums match
+      run: | # sh
+        SOURCE_CHECKSUM=$(sha256sum ./metabase-source.jar | awk '{print $1}')
+        TAGGED_CHECKSUM=$(sha256sum ./metabase-tagged.jar | awk '{print $1}')
+
+        echo "Source Checksum: $SOURCE_CHECKSUM"
+        echo "Tagged Checksum: $TAGGED_CHECKSUM"
+
+        if [[ "$SOURCE_CHECKSUM" != "$TAGGED_CHECKSUM" ]]; then
+          echo "jar Checksums do not match!"
+          exit 1
+        fi
+
+  tag-docker-image:
+    runs-on: ubuntu-22.04
+    needs: check-version
+    timeout-minutes: 5
+    strategy:
+      matrix:
+        edition: ${{ fromJson(needs.check-version.outputs.edition_matrix) }}
+    env:
+      TAG_NAME: ${{ inputs.tag_name }}
+    steps:
+    - name: Determine the Docker Hub repository
+      run: | # sh
+        if [[ "${{ matrix.edition }}" == "ee" ]]; then
+          echo "Metabase EE: image is going to be pushed to ${{ github.repository_owner }}/metabase-enterprise"
+          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/metabase-enterprise" >> $GITHUB_ENV
+          echo "DOCKERHUB_VERSION=${{ needs.check-version.outputs.ee }}" >> $GITHUB_ENV
+        else
+          echo "Metabase OSS: image is going to be pushed to ${{ github.repository_owner }}/metabase"
+          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/metabase" >> $GITHUB_ENV
+          echo "DOCKERHUB_VERSION=${{ needs.check-version.outputs.oss }}" >> $GITHUB_ENV
+        fi
+
+    - name: Login to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
+
+    - name: Tag the docker image
+      run: | # sh
+        docker pull $DOCKERHUB_REPO\:$DOCKERHUB_VERSION
+        docker tag $DOCKERHUB_REPO\:$DOCKERHUB_VERSION $DOCKERHUB_REPO\:$TAG_NAME
+        docker image ls $DOCKERHUB_REPO
+
+        SOURCE_ID=$(docker image ls $DOCKERHUB_REPO\:$DOCKERHUB_VERSION -q)
+        TAGGED_ID=$(docker image ls $DOCKERHUB_REPO\:$TAG_NAME -q)
+
+        if [[ $SOURCE_ID != $TAGGED_ID ]]; then
+          echo "Error tagging docker image"
+          exit 1
+        fi
+
+        docker push $DOCKERHUB_REPO\:$TAG_NAME
+
+  push-git-tags:
+    permissions: write-all
+    needs: check-version
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    strategy:
+      matrix:
+        edition: ${{ fromJson(needs.check-version.outputs.edition_matrix) }}
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0 # we want all branches and tags
+        fetch-tags: true
+    - name: Add and push git tag
+      run: | # sh
+
+        if [[ "${{ matrix.edition }}" == "ee" ]]; then
+          git tag -f ${{ inputs.tag_name }}-ee ${{ needs.check-version.outputs.oss }}
+          git push origin -f ${{ inputs.tag_name }}-ee
+        elif [[ "${{ matrix.edition }}" == "oss" ]]; then
+          git tag -f ${{ inputs.tag_name }}-oss ${{ needs.check-version.outputs.oss }}
+          git push origin -f ${{ inputs.tag_name }}-oss
+        fi
+
+  update-version-info:
+    runs-on: ubuntu-22.04
+    needs: check-version
+    timeout-minutes: 5
+    strategy:
+      matrix:
+        edition: ${{ fromJson(needs.check-version.outputs.edition_matrix) }}
+    env:
+      AWS_S3_STATIC_BUCKET: ${{ vars.AWS_S3_STATIC_BUCKET }}
+      AWS_REGION: ${{ vars.AWS_REGION }}
+    steps:
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_S3_RELEASE_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_S3_RELEASE_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Generate new version info
+      uses: actions/github-script@v7
+      id: new_version_info
+      with:
+        result-encoding: string
+        script: | # js
+          const { updateVersionInfoChannel } = require('${{ github.workspace }}/release/dist/index.cjs');
+          const fs = require('fs');
+
+          const edition = '${{ matrix.edition }}';
+
+          const canonical_version = edition === 'ee'
+            ? '${{ needs.check-version.outputs.ee }}'
+            : '${{ needs.check-version.outputs.oss }}';
+
+          const newVersionInfo = await updateVersionInfoChannel({
+            channel: '${{ inputs.tag_name }}',
+            newVersion: canonical_version,
+            rollout: ${{ inputs.tag_rollout }},
+          });
+
+          fs.writeFileSync('version-info.json', JSON.stringify(newVersionInfo));
+    - name: Upload new version-info.json to S3
+      run: |
+        if [[ "${{ matrix.edition }}" == "ee" ]]; then
+          aws s3 cp version-info.json s3://${{ vars.AWS_S3_STATIC_BUCKET }}/version-info-ee.json
+        else
+          aws s3 cp version-info.json s3://${{ vars.AWS_S3_STATIC_BUCKET }}/version-info.json
+        fi
+    - name: Create cloudfront invalidation for version-info.json and version-info-ee.json
+      run: |
+        aws cloudfront create-invalidation \
+        --distribution-id ${{ vars.AWS_CLOUDFRONT_STATIC_ID }} \
+        --paths "/version-info.json" "/version-info-ee.json"

.github/workflows/release.yml

@@ -11,26 +11,40 @@ on:
       commit:
         description: 'A full-length commit SHA-1 hash'
         required: true
-      skip-docker:
-        description: 'Skip Docker image publishing'
-        type: boolean
-        default: false
-      skip-s3:
-        description: 'Skip S3 artifact publishing'
-        type: boolean
-        default: false
-      skip-version-info:
-        description: 'Skip publishing version-info.json'
-        type: boolean
-        default: false
-      skip-tag:
-        description: 'Skip tagging the release'
-        type: boolean
-        default: false
-      skip-release-notes:
-        description: 'Skip publishing release notes'
+      release-channel:
+        description: 'The release channel to publish to (optional)'
+        type: choice
+        options:
+          - none
+          - latest
+          - beta
+          - nightly
+        required: true
+        default: 'none'
+      auto:
+        description: 'auto-patch release DO NOT SET MANUALLY'
         type: boolean
         default: false
+  workflow_call:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.46.3)'
+        type: string
+        required: true
+      commit:
+        description: 'A full-length commit SHA-1 hash'
+        type: string
+        required: true
+      release-channel:
+        description: 'The release channel to publish to (optional)'
+        type: string
+        # options:
+        #   - none
+        #   - latest
+        #   - beta
+        #   - nightly
+        required: true
+        default: 'none'
       auto:
         description: 'auto-patch release DO NOT SET MANUALLY'
         type: boolean
@@ -74,21 +88,14 @@ jobs:
             oss: getCanonicalVersion(version, 'oss'),
           };
 
-          const ossReleased = await hasBeenReleased({
+          const released = await hasBeenReleased({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version: versions.oss,
           });
 
-          const eeReleased = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.ee,
-          });
-
-          if (ossReleased || eeReleased) {
+          if (released) {
             throw new Error("This version has already been released!", version);
           }
 
@@ -185,6 +192,7 @@ jobs:
       uses: actions/upload-artifact@v4
       with:
         name: metabase-${{ matrix.edition }}-uberjar
+        overwrite: true
         path: |
           ./metabase.jar
           ./COMMIT-ID
@@ -192,7 +200,6 @@ jobs:
           ./version.properties
 
   upload-to-s3:
-    if: ${{ inputs.skip-s3 != true }}
     runs-on: ubuntu-22.04
     needs: download-uberjar
     timeout-minutes: 15
@@ -230,38 +237,10 @@ jobs:
 
           console.log("The download path for this", edition, "edition is", version_path);
           return version_path;
-    - name: Determine if this is a latest version
-      uses: actions/github-script@v7
-      id: latest_path
-      with:
-        result-encoding: string
-        script: | # js
-          const { isLatestRelease, getCanonicalVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          const version = '${{ inputs.version }}';
-          const edition = '${{ matrix.edition }}';
-
-          const canonical_version = getCanonicalVersion(version, edition);
-
-          const isLatest = await isLatestRelease({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: canonical_version,
-          });
-
-          console.log("Latest version?", isLatest);
-
-          if (isLatest) {
-            return edition === 'ee' ? 'enterprise/latest' : 'latest';
-          }
-          return "false";
 
     - name: Upload to S3
       run: aws s3 cp ./metabase.jar s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.version_path.outputs.result }}/metabase.jar
-    - name: Upload to s3 latest path
-      if: ${{ !inputs.auto && steps.latest_path.outputs.result != 'false' }}
-      run: aws s3 cp ./metabase.jar s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.latest_path.outputs.result }}/metabase.jar
+
     - name: Create cloudfront invalidation
       run: |
         aws cloudfront create-invalidation \
@@ -270,7 +249,6 @@ jobs:
 
 
   verify-s3-download:
-    if: ${{ inputs.skip-s3 != true }}
     runs-on: ubuntu-22.04
     needs: upload-to-s3
     timeout-minutes: 15
@@ -287,7 +265,7 @@ jobs:
       id: version_path
       with:
         result-encoding: string
-        script: |
+        script: | # js
           const version = '${{ inputs.version }}';
           const edition = '${{ matrix.edition }}';
 
@@ -304,7 +282,6 @@ jobs:
       run: grep -q $(sha256sum ./metabase-downloaded.jar) SHA256.sum && echo "checksums match" || exit 1
 
   containerize:
-    if: ${{ inputs.skip-docker != true }}
     runs-on: ubuntu-22.04
     needs: [check-version, download-uberjar]
     timeout-minutes: 15
@@ -319,6 +296,8 @@ jobs:
     steps:
     - uses: actions/checkout@v4
       with:
+        # checkout the commit that was tagged so we get the right dockerfile
+        ref: ${{ inputs.commit }}
         fetch-depth: 0  # IMPORTANT! to get all the tags
     - name: prepare release scripts
       run: cd release && yarn && yarn build
@@ -338,23 +317,6 @@ jobs:
           console.log("The canonical version of this Metabase", edition, "edition is", canonical_version);
 
           return canonical_version;
-    - name: Check if the container image should be tagged as latest
-      uses: actions/github-script@v7
-      id: latest_version_check
-      with:
-        result-encoding: string
-        script: |
-          const { execSync } = require("child_process");
-          const { isLatestVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          const currentTag = '${{ inputs.version }}';
-          const allTags = execSync("git tag -l").toString("utf-8").split("\n");
-
-          const isLatest = isLatestVersion(currentTag, allTags);
-
-          console.log("Latest version?", isLatest);
-
-          return isLatest ? "latest" : "not-latest";
     - uses: actions/download-artifact@v4
       name: Retrieve previously downloaded Uberjar
       with:
@@ -405,16 +367,7 @@ jobs:
         docker push ${{ env.DOCKERHUB_REPO }}:${{ steps.canonical_version.outputs.result }}
         echo "Finished!"
 
-    - name: Tag the container image as latest
-      if: ${{ !inputs.auto && steps.latest_version_check.outputs.result == 'latest' }}
-      run: |
-        echo "Pushing ${{ env.DOCKERHUB_REPO }}:latest ..."
-        docker tag localhost:5000/local-metabase:${{ steps.canonical_version.outputs.result }} ${{ env.DOCKERHUB_REPO }}:latest
-        docker push ${{ env.DOCKERHUB_REPO }}:latest
-        echo "Finished!"
-
   verify-docker-pull:
-    if: ${{ inputs.skip-docker != true }}
     runs-on: ubuntu-22.04
     needs: containerize
     timeout-minutes: 15
@@ -463,7 +416,6 @@ jobs:
       timeout-minutes: 3
 
   push-tags:
-    if: ${{ inputs.skip-tag != true }}
     permissions: write-all
     needs: [verify-s3-download, verify-docker-pull, check-version]
     runs-on: ubuntu-22.04
@@ -482,21 +434,7 @@ jobs:
           const { tagRelease } = require('${{ github.workspace }}/release/dist/index.cjs');
 
           const OSSversion = '${{ needs.check-version.outputs.oss }}';
-          const EEversion = '${{ needs.check-version.outputs.ee }}';
 
-          // push EE tag
-          await tagRelease({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: EEversion,
-            commitHash: '${{ inputs.commit }}',
-          }).catch((err) => {
-            console.error('Failed to tag release', EEversion, err);
-            process.exit(1);
-          });
-
-          // push OSS tag
           await tagRelease({
             github,
             owner: context.repo.owner,
@@ -507,85 +445,9 @@ jobs:
             console.error('Failed to tag release', OSSversion, err);
             process.exit(1);
           });
-    - name: Reorder release tags to put OSS first
-      run: |
-        git config user.name github-actions
-        git config user.email github-actions@github.com
-        $GITHUB_WORKSPACE/release/reorder-tags.sh ${{ needs.check-version.outputs.ee }} ${{ inputs.commit }}
-
-  trigger-docs-update:
-    if: ${{ !inputs.auto && inputs.skip-release-notes != true }}
-    needs:
-      - push-tags
-      - check-version
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    permissions:
-      contents: write
-      pull-requests: write
-    env:
-      NEW_OSS_VERSION: ${{ needs.check-version.outputs.oss }}
-      NEW_EE_VERSION: ${{ needs.check-version.outputs.ee }}
-      GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-    steps:
-      - uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          script: | # js
-            await github.rest.repos.createDispatchEvent({
-              owner: '${{ github.repository_owner }}',
-              repo: '${{ secrets.DOCS_REPO }}',
-              event_type: 'trigger-docs-update',
-              client_payload: {
-                version: '${{ inputs.version }}'
-              }
-            });
-      - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-      - name: update releases.md
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          script: | # js
-            const fs = require('fs');
-
-            const releaseText = fs.readFileSync('./docs/releases.md', 'utf8');
-
-            const newReleaseText = releaseText
-              .replace(
-                /## Metabase Enterprise Edition releases\n\n/,
-                `## Metabase Enterprise Edition releases\n\n- [${process.env.NEW_EE_VERSION}](https://github.com/metabase/metabase/releases/tag/${process.env.NEW_EE_VERSION})\n`
-              )
-              .replace(
-                /## Metabase Open Source Edition releases\n\n/,
-                `## Metabase Open Source Edition releases\n\n- [${process.env.NEW_OSS_VERSION}](https://github.com/metabase/metabase/releases/tag/${process.env.NEW_OSS_VERSION})\n`
-              );
-
-            fs.writeFileSync('./docs/releases.md', newReleaseText);
-
-      - name: commit and push updates
-        run: | # bash
-          git config --global user.email "metabase-bot@metabase.com"
-          git config --global user.name "Metabase bot"
-
-          git checkout -b docs-add-$NEW_OSS_VERSION
-          cd docs/
-
-          git add releases.md
-          git commit -m "Add $NEW_OSS_VERSION to the list of releases"
-          git push origin docs-add-$NEW_OSS_VERSION --force
-
-      - name: open pr with updates
-        run: | # bash
-          gh pr create --fill \
-            --body "Like it says on the tin 😁" \
-            --label "Type:Documentation" \
-            --label "backport" \
-            --reviewer "jeff-bruemmer" \
-            --assignee "jeff-bruemmer"
 
   trigger-cloud-issues:
+    if: ${{ !inputs.auto }}
     needs: push-tags
     runs-on: ubuntu-22.04
     timeout-minutes: 10
@@ -624,12 +486,12 @@ jobs:
               event_type: 'update-ee-extra-build',
               client_payload: {
                 version: enterpriseVersion,
-                auto: '${{ inputs.auto }}',
+                auto: 'true', // always auto-merge
               }
             });
 
   draft-release-notes:
-    if: ${{ !inputs.auto && inputs.skip-release-notes != true }}
+    if: ${{ !inputs.auto }}
     needs: push-tags
     runs-on: ubuntu-22.04
     timeout-minutes: 15
@@ -638,41 +500,26 @@ jobs:
       AWS_S3_DOWNLOADS_BUCKET: ${{ vars.AWS_S3_DOWNLOADS_BUCKET }}
       DOCKERHUB_OWNER: ${{ vars.DOCKERHUB_OWNER }}
       DOCKERHUB_REPO: ${{ vars.DOCKERHUB_REPO }}
-    strategy:
-      matrix:
-        edition: [oss, ee]
     steps:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: release
       - name: prepare release scripts
         run: cd release && yarn && yarn build
-      - uses: actions/download-artifact@v4
-        name: Retrieve uberjar artifact
-        with:
-          name: metabase-${{ matrix.edition }}-uberjar
-      - name: Read Checksum
-        run: |
-          CHECKSUM=$(cat SHA256.sum)
-          echo "CHECKSUM=$CHECKSUM" >> $GITHUB_ENV
       - name: Publish draft release notes
         uses: actions/github-script@v7
         with:
           result-encoding: string
-          script: |
+          script: | # js
             const { publishRelease, getCanonicalVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
 
             const version = '${{ inputs.version }}';
-            const edition = '${{ matrix.edition }}';
-
-            const canonical_version = getCanonicalVersion(version, edition);
 
             await publishRelease({
               github,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              version: canonical_version,
-              checksum: '${{ env.CHECKSUM }}',
+              version,
             }).then(() => {
               console.log('Successfully published release notes', '${{ inputs.version }}');
             }).catch((err) => {
@@ -681,7 +528,6 @@ jobs:
             });
 
   publish-version-info:
-    if: ${{ !inputs.auto && inputs.skip-version-info != true }}
     runs-on: ubuntu-22.04
     needs: [push-tags, check-version]
     timeout-minutes: 15
@@ -692,6 +538,11 @@ jobs:
       AWS_S3_STATIC_BUCKET: ${{ vars.AWS_S3_STATIC_BUCKET }}
       AWS_REGION: ${{ vars.AWS_REGION }}
     steps:
+    - name: Finish early
+      if: ${{ inputs.auto }}
+      run: |
+        echo "skipping version info update for nightly patch"
+        exit 0
     - name: Configure AWS credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -703,12 +554,12 @@ jobs:
         sparse-checkout: release
     - name: Prepare build scripts
       run: cd ${{ github.workspace }}/release && yarn && yarn build
-    - name: Publish release notes
+    - name: Publish version info
       uses: actions/github-script@v7
       id: new_version_info
       with:
         result-encoding: string
-        script: |
+        script: | # js
           const { getVersionInfo } = require('${{ github.workspace }}/release/dist/index.cjs');
           const fs = require('fs');
 
@@ -739,10 +590,20 @@ jobs:
         --distribution-id ${{ vars.AWS_CLOUDFRONT_STATIC_ID }} \
         --paths "/version-info.json" "/version-info-ee.json"
 
+  set-release-channel:
+    needs: publish-version-info
+    uses: ./.github/workflows/release-tag.yml
+    secrets: inherit
+    with:
+      version: ${{ inputs.version }}
+      tag_name: ${{ inputs.release-channel }}
+      tag_rollout: 100
+      tag_ee: true
+      tag_oss: true
+
   publish-complete-message:
-    if: ${{ !inputs.auto }}
     runs-on: ubuntu-22.04
-    needs: [draft-release-notes, verify-docker-pull, verify-s3-download, publish-version-info]
+    needs: set-release-channel
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -759,34 +620,7 @@ jobs:
           script: | # js
             const { sendPublishCompleteMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
 
-            await sendPublishCompleteMessage({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              version: '${{ inputs.version }}',
-              runId: '${{ github.run_id }}',
-              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
-              generalChannelName: 'general',
-            }).catch(console.error);
-
-  auto-publish-complete-message:
-    if: ${{ inputs.auto }}
-    runs-on: ubuntu-22.04
-    needs: [push-tags, verify-docker-pull, verify-s3-download]
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      - name: Send auto publish complete message
-        uses: actions/github-script@v7
-        env:
-          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        with:
-          script: | # js
-            const { sendPublishCompleteMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const isAutoRelease = '${{ inputs.auto }}' === 'true';
 
             await sendPublishCompleteMessage({
               owner: context.repo.owner,
@@ -794,7 +628,7 @@ jobs:
               version: '${{ inputs.version }}',
               runId: '${{ github.run_id }}',
               channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
-              generalChannelName: '',
+              generalChannelName: !isAutoRelease ? '${{ vars.SLACK_GENERAL_CHANNEL }}' : '',
             }).catch(console.error);
 
   manage-milestones:
@@ -813,12 +647,12 @@ jobs:
       uses: actions/github-script@v7
       with:
         script: | # js
-          const { closeMilestone, openNextMilestones, isRCVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
+          const { closeMilestone, openNextMilestones, isPreReleaseVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
 
           const version = '${{ inputs.version }}';
 
-          if (isRCVersion(version)) {
-            console.log("This is a release candidate, skipping milestone management");
+          if (isPreReleaseVersion(version)) {
+            console.log("This is a prerelease version, skipping milestone management");
             return;
           }
 

.github/workflows/snyk.yml

@@ -16,6 +16,8 @@ on:
 
 jobs:
   monitor:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     name: Generate Snyk report
     runs-on: ubuntu-22.04
     steps:

.github/workflows/stale.yml

@@ -8,6 +8,8 @@ permissions:
 
 jobs:
   close-stale-prs:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/stale@v6

.github/workflows/tag-for-release.yml

@@ -83,21 +83,14 @@ jobs:
             oss: getCanonicalVersion(version, 'oss'),
           };
 
-          const ossReleased = await hasBeenReleased({
+          const released = await hasBeenReleased({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version: versions.oss,
           });
 
-          const eeReleased = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.ee,
-          });
-
-          if (ossReleased || eeReleased) {
+          if (released) {
             throw new Error("This version has already been released!", version);
           }
 
@@ -155,7 +148,7 @@ jobs:
       uses: actions/setup-java@v4
       with:
         distribution: 'temurin'
-        java-version: 17 # 11 throws an error on jar uf
+        java-version: 21
 
     - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
       id: find_release_artifact
@@ -233,25 +226,25 @@ jobs:
           ./COMMIT-ID
           ./SHA256.sum
 
-  trigger-tests:
-    needs: [tag-uberjar-for-release]
-    permissions:
-      actions: write
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    steps:
-      - name: trigger pre-release testing
-        uses: actions/github-script@v7
-        with:
-          script: | # js
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'pre-release.yml',
-              ref: '${{ github.ref }}',
-              inputs: {
-                commit: '${{ inputs.commit }}',
-                version: '${{ inputs.version }}',
-                auto: '${{ inputs.auto }}',
-              }
-            });
+  run-pre-release-tests:
+    name: Run pre-release tests for ${{ inputs.version }}
+    needs: tag-uberjar-for-release
+    uses: ./.github/workflows/pre-release.yml
+    secrets: inherit
+    with:
+      commit: ${{ inputs.commit }}
+      version: ${{ inputs.version }}
+
+  auto-publish-release:
+    name: Auto-publish release ${{ inputs.version }}
+    if: ${{ inputs.auto }}
+    needs: run-pre-release-tests
+    uses: ./.github/workflows/release.yml
+    secrets: inherit
+    with:
+      version: ${{ inputs.version }}
+      commit: ${{ inputs.commit }}
+      auto: ${{ inputs.auto }}
+      # for now don't auto-set release channel because we don't want to have
+      # multiple nightlies due to race conditions
+      release-channel: none

.github/workflows/uberjar-sdk.yml

@@ -1,157 +0,0 @@
-name: Build + Docker Uberjar for SDK
-
-on:
-  # This workflow will be called from "release-embedding-sdk.yml"
-  workflow_call:
-    inputs:
-      git_ref:
-        description: 'Valid git reference e.g. branches, tags, hashes'
-        type: string
-        required: true
-      image_name:
-        description: Docker image used to upload to Dockerhub
-        type: string
-        required: true
-
-jobs:
-  build:
-    name: Build MB ${{ matrix.edition }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 40
-    strategy:
-      matrix:
-        edition: [ee]
-    env:
-      MB_EDITION: ${{ matrix.edition }}
-      INTERACTIVE: false
-    steps:
-    - name: Check out the code
-      uses: actions/checkout@v4
-      with:
-        ref: ${{ inputs.git_ref }}
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: uberjar
-    - name: Build
-      run: ./bin/build.sh
-    - name: Prepare uberjar artifact
-      uses: ./.github/actions/prepare-uberjar-artifact
-      with:
-        name: metabase-ee-uberjar
-
-  check_jar_health:
-    runs-on: ubuntu-22.04
-    name: Is ${{ matrix.edition }} (java ${{ matrix.java-version }}) healthy?
-    needs: build
-    timeout-minutes: 10
-    strategy:
-      matrix:
-        edition: [ee]
-        java-version: [11, 17]
-    steps:
-    - name: Prepare JRE (Java Run-time Environment)
-      uses: actions/setup-java@v4
-      with:
-        java-package: jre
-        java-version: ${{ matrix.java-version }}
-        distribution: 'temurin'
-    - run: java -version
-    - uses: actions/download-artifact@v4
-      name: Retrieve uberjar artifact
-      with:
-        name: metabase-ee-uberjar
-    - name: Launch uberjar
-      run: java -jar ./target/uberjar/metabase.jar &
-    - name: Wait for Metabase to start
-      run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-
-  containerize_test_and_push_container:
-    runs-on: ubuntu-22.04
-    name: Containerize ${{ matrix.edition }}
-    needs: check_jar_health
-    strategy:
-      matrix:
-        edition: [ee]
-    services:
-      registry:
-        image: registry:2
-        ports:
-          - 5000:5000
-    steps:
-      - name: Extract and clean branch name
-        shell: bash
-        run: echo "branch=$(echo $GITHUB_REF_NAME | sed 's/[^-._a-zA-Z0-9]/-/g')" >> $GITHUB_OUTPUT
-        id: extract_branch
-
-      - name: Set image name to env
-        run: echo "image_name=${{ inputs.image_name || steps.extract_branch.outputs.branch }}" >> "$GITHUB_ENV"
-
-      - name: Verify the intended tag of the container image
-        run: echo "Container image will be tagged as ${{ env.image_name }}-${{ matrix.edition }}"
-
-      - name: Check out the code (Dockerfile needed)
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.git_ref }}
-
-      - name: Download uploaded artifacts to insert into container
-        uses: actions/download-artifact@v4
-        with:
-          name: metabase-ee-uberjar
-          path: bin/docker/
-
-      - name: Move the ${{ matrix.edition }} uberjar to the context dir
-        run: mv bin/docker/target/uberjar/metabase.jar bin/docker/.
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v2.5.0
-        with:
-          driver-opts: network=host
-
-      - name: Build ${{ matrix.edition }} container
-        uses: docker/build-push-action@v3
-        with:
-          context: bin/docker/.
-          platforms: linux/amd64
-          network: host
-          tags: localhost:5000/metabase-dev:${{ env.image_name }}-${{ matrix.edition }}
-          no-cache: true
-          push: true
-
-      - name: Launch ${{ matrix.edition }} container
-        run: docker run --rm -dp 3000:3000 localhost:5000/metabase-dev:${{ env.image_name }}-${{ matrix.edition }}
-        timeout-minutes: 5
-
-      - name: Is Docker running?
-        run: docker ps
-
-      - name: Wait for Metabase to start and reach 100% health
-        run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-        timeout-minutes: 3
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Retag and push images
-        run: docker tag localhost:5000/metabase-dev:${{ env.image_name }}-ee ${{ github.repository_owner }}/metabase-dev:${{ env.image_name }} && docker push ${{ github.repository_owner }}/metabase-dev:${{ env.image_name }}
-
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        env:
-          TRIVY_OFFLINE_SCAN: true
-        with:
-          image-ref: docker.io/${{ github.repository_owner }}/metabase-dev:${{ env.image_name }}
-          format: sarif
-          output: trivy-results.sarif
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: 'trivy-results.sarif'

.github/workflows/uberjar.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - "master"
+      - metabot-v3-second-try
+      - feature-visualizer
     paths-ignore:
       # config files
       - ".**"
@@ -41,6 +43,9 @@ jobs:
       uses: ./.github/actions/prepare-backend
       with:
         m2-cache-key: uberjar
+        # Build with Java 11 so they compiled code doesn't try to use Java >11 classes... see
+        # https://metaboat.slack.com/archives/C5XHN8GLW/p1731517744549619?thread_ts=1731504670.951389&cid=C5XHN8GLW
+        java-version: 11
     - name: Build
       run: ./bin/build.sh
     - name: Prepare uberjar artifact
@@ -56,7 +61,7 @@ jobs:
     strategy:
       matrix:
         edition: [ee, oss]
-        java-version: [11, 17]
+        java-version: [11, 17, 21]
     steps:
     - name: Prepare JRE (Java Run-time Environment)
       uses: actions/setup-java@v4
@@ -70,7 +75,8 @@ jobs:
       with:
         name: metabase-${{ matrix.edition }}-${{ github.sha }}-uberjar
     - name: Launch uberjar
-      run: java -jar ./target/uberjar/metabase.jar &
+      run: >-
+        java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./target/uberjar/metabase.jar &
     - name: Wait for Metabase to start
       run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
 
@@ -80,12 +86,16 @@ jobs:
     needs: check_jar_health
     strategy:
       matrix:
-        edition: [ee, oss]
+        edition: [ee, oss, ee-extra]
     services:
       registry:
         image: registry:2
         ports:
           - 5000:5000
+    permissions:
+      id-token: write
+      contents: read
+      security-events: write
     steps:
     - name: Extract and clean branch name
       shell: bash
@@ -98,12 +108,24 @@ jobs:
       with:
         ref: ${{ github.event.inputs.commit }}
     - name: Download uploaded artifacts to insert into container
+      if: ${{ matrix.edition != 'ee-extra' }}
       uses: actions/download-artifact@v4
       with:
         name: metabase-${{ matrix.edition }}-${{ github.sha }}-uberjar
         path: bin/docker/
+    - name: Download uploaded artifacts to insert into container
+      if: ${{ matrix.edition == 'ee-extra' }}
+      uses: actions/download-artifact@v4
+      with:
+        name: metabase-ee-${{ github.sha }}-uberjar
+        path: bin/docker/
     - name: Move the ${{ matrix.edition }} uberjar to the context dir
       run: mv bin/docker/target/uberjar/metabase.jar bin/docker/.
+    - name: Add partner drivers to the container
+      if: ${{ matrix.edition == 'ee-extra' }}
+      uses: ./.github/actions/build-ee-extra
+      with:
+        iam-role: ${{ secrets.METABASE_EE_EXTRA_IAM_ROLE }}
     - name: Set up Docker Buildx
       id: buildx
       uses: docker/setup-buildx-action@v2.5.0
@@ -133,44 +155,57 @@ jobs:
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
+
     - name: Retag and push images if master (ee)
       if: ${{ (github.ref_name == 'master') && matrix.edition == 'ee' }}
       run: docker tag localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-ee ${{ github.repository_owner }}/metabase-enterprise-head:latest && docker push ${{ github.repository_owner }}/metabase-enterprise-head:latest
 
+    # TODO: remove when we're done testing metabot
+    - name: Retag and push images if metabot-v3-second-try (ee)
+      if: ${{ (github.ref_name == 'metabot-v3-second-try') && matrix.edition == 'ee' }}
+      run: docker tag localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-ee ${{ github.repository_owner }}/metabase-enterprise-head:metabot && docker push ${{ github.repository_owner }}/metabase-enterprise-head:metabot
+
     - name: Retag and push images if master (oss)
       if: ${{ (github.ref_name == 'master') && matrix.edition == 'oss' }}
       run: docker tag localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-oss ${{ github.repository_owner }}/metabase-head:latest && docker push ${{ github.repository_owner }}/metabase-head:latest
 
+    - name: Retag and push images if master (ee-extra)
+      if: ${{ (github.ref_name == 'master') && matrix.edition == 'ee-extra' }}
+      run: docker tag localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-ee-extra ${{ secrets.METABASE_EE_EXTRA_CONTAINER_REGISTRY }}/metabase-enterprise-head:latest && docker push ${{ secrets.METABASE_EE_EXTRA_CONTAINER_REGISTRY }}/metabase-enterprise-head:latest
+
     - name: Retag and push images if dev branch
       if: ${{ !(startsWith(github.ref_name,'master') || startsWith(github.ref_name,'backport')) && matrix.edition == 'ee' }}
       run: docker tag localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-ee ${{ github.repository_owner }}/metabase-dev:${{ steps.extract_branch.outputs.branch }} && docker push ${{ github.repository_owner }}/metabase-dev:${{ steps.extract_branch.outputs.branch }}
 
     - name: Run Trivy vulnerability scanner if master (ee)
       if: ${{ (github.ref_name == 'master') && matrix.edition == 'ee' }}
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@0.28.0
       env:
         TRIVY_OFFLINE_SCAN: true
       with:
         image-ref: docker.io/${{ github.repository_owner }}/metabase-enterprise-head:latest
         format: sarif
         output: trivy-results.sarif
+        version: "v0.57.1"
 
     - name: Run Trivy vulnerability scanner if master (oss)
       if: ${{ (github.ref_name == 'master') && matrix.edition == 'oss' }}
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@0.28.0
       env:
         TRIVY_OFFLINE_SCAN: true
       with:
         image-ref: docker.io/${{ github.repository_owner }}/metabase-head:latest
         format: sarif
         output: trivy-results.sarif
+        version: "v0.57.1"
 
     - name: Run Trivy vulnerability scanner if dev branch
       if: ${{ !(startsWith(github.ref_name,'master') || startsWith(github.ref_name,'backport')) && matrix.edition == 'ee' }}
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@0.28.0
       env:
         TRIVY_OFFLINE_SCAN: true
       with:
+        version: "v0.57.1"
         image-ref: docker.io/${{ github.repository_owner }}/metabase-dev:${{ steps.extract_branch.outputs.branch }}
         format: sarif
         output: trivy-results.sarif

.gitignore

@@ -77,6 +77,7 @@ target/checksum.txt
 xcshareddata
 xcuserdata
 dev/src/dev/nocommit/
+dev/serialization_deltas/
 *~
 **/cypress_sample_database.json
 **/cypress_sample_instance_data.json