Regenerate SDK host app lockfiles with npm 11

fix literal coercion

.claude/skills/fe-modularization/SKILL.md

@@ -0,0 +1,248 @@
+---
+name: fe-modularization
+description: Deciding where frontend code lives — tier model, move mechanics, extension points, side effects, naming, and the traps. Use when moving code between modules, carving new modules, fixing boundary violations, adding a barrel or an endpoint, or reviewing module-shape decisions.
+---
+
+# Frontend modularization
+
+The module is the unit of blast radius: dependency direction, test selection,
+bundle cones, and review scope all follow module boundaries. Every decision
+here serves one goal: **make the file locations tell the truth about who owns
+what and who may depend on whom.**
+
+## Hard rules (check these before anything else)
+
+- NEVER add an `export … from` re-export at an old path, and NEVER `export *`
+  from a barrel. Move the code, codemod every call site, delete the old path,
+  all in the same PR.
+- NEVER import past a module's `index.ts` when that module has
+  `enforcePublicApi: true`, and never past `metabase/ui`'s index at all. If
+  the barrel is heavy, the fix is making the module side-effect free (below),
+  not a deep import.
+- NEVER rewrite a consumer to a lower-level idiom to make the linter pass. If
+  the fix makes the consumer worse, the plan is wrong.
+- NEVER give a new module `enforceSharedTiers: false`; new modules ship
+  enforced with `enforcePublicApi: true` and an explicit `index.ts`.
+- NEVER move code without the consumer-tier check (procedure step 2).
+- ALWAYS delete a module's `enforceSharedTiers: false` line in the PR that
+  takes it to zero violations.
+- ALWAYS measure `bun run module-boundaries` before and after, and report the
+  numbers.
+- ALWAYS import `dayjs` from `metabase/dayjs`, routing from `metabase/router`,
+  Mantine from `metabase/ui`, react-redux hooks from `metabase/redux`; the
+  raw specifiers are lint-forbidden.
+
+## Files that are ground truth
+
+| what | where |
+|---|---|
+| module elements, tiers, `enforceSharedTiers`, `enforcePublicApi` | `frontend/lint/module-boundaries.mjs` |
+| shared sub-tiers and levels, cluster rules | `frontend/lint/shared-tiers.mjs` |
+| standalone boundaries lint (all violations, incl. grandfathered) | `bun run module-boundaries` (config `eslint.config.module-boundaries.mjs`) |
+| PR lint (only enforced modules fail CI) | `bun run lint-eslint-pure` |
+| side-effect-free directories and their exceptions | `frontend/build/shared/rspack/side-effect-free-modules.js` (`SIDE_EFFECT_FREE_PATHS`, `SIDE_EFFECT_PATHS`) |
+| the lint rules that enforce that promise | `metabase/no-module-side-effects`, `metabase/no-base-api-access` in `frontend/lint/eslint-plugin-metabase/rules/` |
+| public-api enforcement | `metabase/enforce-module-public-api` rule, driven by `getPublicApiModules()` |
+
+## The model
+
+Tiers: `lib < basic < shared < feature < app`. Imports point downward, never
+sideways at feature tier (features may not import features; app and EE may
+import anything). The shared tier is subdivided in `shared-tiers.mjs` into
+shared-utils (U0…), shared-platform (P0…), and shared-domain, each ordered
+into levels. A module imports only *strictly lower* levels of its sub-tier
+plus the sub-tiers below; same-level peers are deliberately forbidden, which
+is what makes cycles structurally impossible. A domain may hold two seats
+when consumers demand it: a low core and a high surface (metabase-lib below
+questions below query_builder; viz-core below visualizations).
+
+Enforcement is per module: `enforceSharedTiers: false` on an element exempts
+it from the level rules (counted by `bun run module-boundaries`, invisible to
+PR lint). Modules with `enforcePublicApi: true` may only be imported from
+outside via `metabase/<module>`, and import relatively inside.
+
+## Deciding where code lives (apply in order; first decisive test wins)
+
+1. **Who owns the concept?** Code lives with the module that owns its
+   concept, not the module that renders or calls it. A mode encoding dashboard
+   click behaviour is dashboard code even if viz executes it. Metabot
+   conversation state is metabot state even though the store registers it.
+2. **Consumer-tier check.** The destination must sit at or below the file's
+   *lowest* consumer. A single consumer below the proposed home vetoes the
+   move; report it, don't force it.
+3. **Only four legitimate fixes** for a bad edge: move the code to its
+   terminal home; invert through a designed extension point (a prop, an
+   injected component, a contract type owned by the socket); fix the tier
+   placement when the declared level is wrong; delete a thin wrapper (a rename
+   with no derivation isn't an abstraction — deleting it *is* the migration).
+4. **A bridge lives above the lower endpoint.** Code that needs both sides of
+   a boundary belongs in or above the higher module.
+5. **"Genuinely shared" is proven by consumers.** A shared address needs two
+   or more consumers the tier rules can't serve another way. One consumer
+   pretending to be shared is a feature module at the wrong address.
+
+## Extension points
+
+The socket's owner defines the contract; every plug lives with its extender.
+Visualization owns the `mode` prop and click interfaces, each surface supplies
+its mode; the editor owns its extension contract, metabot supplies tiptap
+extensions; querying owns `TemplateTagsSidebarProps`, parameters implements
+it.
+
+- Prefer plain props/injection at composition sites. `PLUGIN_*` registries are
+  for edition gating; single-reader slots move out to their reading module;
+  slots with many readers live in the module that owns the concept (every
+  slot the whitelabel plugin fills lives in `whitelabel`), tier permitting.
+  Keep contracts type-light so implementations can load lazily.
+- Identical injection at every callsite is acceptable until a fourth consumer
+  or second slot appears; then the composition deserves its own module above
+  both parts. Don't pre-build the wrapper.
+
+## Store shape
+
+A module that has redux state owns it:
+
+- `store/` is private: reducer, plain creators/action types, and selectors,
+  typed against the module's own state (`QueryBuilderStoreState`), never the
+  global `State`. Thunks live in `actions/` and import `store/`, never the
+  reverse.
+- The barrel is the state API: selectors for reads, creators/thunks for
+  writes.
+- Store roots (`reducers-main`, `reducers-public`, the SDK store) import each
+  slice from its module barrel and derive their own state type; no slice
+  registry, no `declare module` merging.
+- Cross-module writes: a callback prop when a composition point exists;
+  otherwise dispatch the owner's exported creator; an event only when the
+  emitter must not know its listeners. Raw `dispatch({ type: "…" })` strings
+  are banned. A reducer or listener matching another module's *internal*
+  action is the coupling to remove.
+- Slices that mirror one endpoint get deleted (the RTK cache is the state); a
+  fold over many sources with one writer (the metadata store) is kept as a
+  module-private slice behind the barrel.
+
+## Endpoints
+
+Endpoints migrate to their owning module via `Api.injectEndpoints` from the
+module's `api/` file (settings, metabot, transforms precedents); `metabase/api`
+trends toward the client only. There is one `Api` object per backend because
+tag invalidation only works within one instance. Consumers reach endpoints
+only through the owner's exports (`useGetCardQuery`, `cardApi.endpoints.…`),
+never by name through the base object; `metabase/no-base-api-access` allows
+injection only in `metabase/api` and `**/api/**` / `**/api.ts`, and reaching by
+name only in `metabase/api` and test support (`invalidateTags` /
+`resetApiState` are fine anywhere). Each endpoint move carries its
+metadata-store hookup: the owner calls `entitiesFetched` from its own
+`onQueryStarted`.
+
+## Import-time side effects
+
+Directories in `SIDE_EFFECT_FREE_PATHS` are marked `sideEffects: false` for
+rspack, so importing one export from their barrel no longer drags the whole
+barrel into a bundle. The price: nothing in those directories may do work at
+import time, or production silently drops it. `metabase/no-module-side-effects`
+enforces this over every listed directory (module-scope calls, writes to
+imported objects or globals, bare imports, control flow at import; escape
+hatches are `/* #__PURE__ */` and the rule's pure-callee list). Files that
+must run at import are listed in `SIDE_EFFECT_PATHS` (files or directories).
+
+- **A library the app configures gets a facade module** owning the vendor
+  import, the registrations, and the types, with the raw specifier
+  lint-forbidden outside it: `metabase/router`, `metabase/ui`,
+  `metabase/redux`, `metabase/dayjs`. Facades are the effect, so they never
+  enter `SIDE_EFFECT_FREE_PATHS`. Never re-register a vendor plugin locally
+  (`dayjs.extend`, `echarts` `use`).
+- **A patch a component needs is an explicit registration module,
+  bare-imported by the provider that needs it** and listed in
+  `SIDE_EFFECT_PATHS` (Mantine's `Popover.Dropdown` replacement, imported by
+  `ThemeProvider`).
+- **Effects with no value to import** (global CSS, polyfills, the CSP nonce,
+  EE plugin bootstrap) live in the entry's side-effects file and nowhere else.
+- **Registries are filled from the composition root at boot**
+  (`initializePlugins`, `registerVisualizations`), never by a module
+  registering itself at import.
+- **RTK injection stays at import**; when a module with an `api/` folder is
+  declared side-effect free, list `<module>/api/` in `SIDE_EFFECT_PATHS`.
+
+## Naming
+
+The feature keeps the plain product-surface name; a shared carve is named for
+what the shared part actually is: the concept when the concept is the shared
+thing (`settings`, `current-user`, `whitelabel`, `dayjs`), or a qualified
+capability when the plain noun is taken (`search-ui`, `metrics-ui`,
+`viz-core`, `data-studio-ui`). Never two modules distinguished only by tier
+prefix; never generic `-shared` / `-feature` suffixes.
+
+## Procedure for a move
+
+1. **Enumerate consumers honestly** (hook-name greps miss the last three):
+   ```
+   grep -rn "metabase/<module>" frontend/src enterprise/frontend/src frontend/test e2e
+   grep -rn "jest.mock(\"metabase/<module>" frontend enterprise/frontend
+   grep -rn "addMatcher(.*<endpoint>" frontend/src enterprise/frontend/src
+   ```
+   plus sibling files importing the moved file relatively. Classify each by
+   module and tier from `module-boundaries.mjs` / `shared-tiers.mjs`.
+2. **Consumer-tier check**: destination at or below the lowest consumer. If
+   not, stop and report the blocking consumer.
+3. **Measure before**: `bun run module-boundaries 2>&1 | tail -1` on the base
+   (write the number down).
+4. **Move**: `git mv`; codemod every importer to `metabase/<module>` (outside)
+   or a relative path (inside); add named exports to the destination barrel
+   for every symbol an outside consumer needs (each must have a real
+   consumer). Delete the old path. If the module didn't exist: add its element
+   in `module-boundaries.mjs` (ordered before any element it's carved from,
+   first match wins), its level in `shared-tiers.mjs`, `enforcePublicApi:
+   true`, an `index.ts`. If the move empties a module's violations, delete
+   its `enforceSharedTiers: false` line. If the module has an `api/` folder
+   and is side-effect free, list `<module>/api/` in `SIDE_EFFECT_PATHS`.
+5. **Verify** (all of these, report the numbers):
+   ```
+   grep -rn "<old path>" frontend enterprise/frontend e2e        # must be empty
+   bunx eslint --no-warn-ignored <touched files>
+   bun run lint-eslint-pure                                       # enforce-module-public-api included
+   bun run type-check-pure
+   bun run test-unit-keep-cljs <touched folders' specs>
+   bun run module-boundaries 2>&1 | tail -1                       # after; no violation may name the new files
+   bun run build-release:static-viz                               # only if viz/static-viz/ui/dayjs touched; hard 3.5 MiB budget
+   ```
+6. **Report**: count before/after (state count-neutral explicitly), the edges
+   removed by file, flags/rules deleted, barrel exports added, anything you
+   skipped and why, and any consumer you found that vetoed part of the move.
+
+## Traps (each has bitten at least once)
+
+- **Late binding.** A bare function reference in a `createSelector` input
+  array, a component identity captured for comparison, a `PLUGIN_*` object
+  read at module scope: all capture at import time and dodge jest spies, EE
+  overrides, and lazy loading. Read at call time (`(_state) => fn()`), or
+  inject.
+- **Plans go stale.** Verify every recipe against current code before
+  executing; things get merged, renamed, or turn out never to have existed.
+  Skip-and-report beats force.
+- **The linter's blind spots**: `export … from` re-exports, bare-specifier
+  packages (custom-viz), pre-seeded caches that never register tags. A grep
+  for the old path is the stronger claim than a green lint run.
+- **Path-keyed baselines reset on rename**: a generated per-file ledger
+  silently loses a file's history when it moves.
+- **A heavy barrel is a bundle hazard until its module is side-effect free.**
+  One constant imported from the `metabase/ui` barrel pulled Mantine into the
+  static-viz bundle and broke its budget; the fix was `SIDE_EFFECT_FREE_PATHS`,
+  never a deep import.
+- **Type augmentation is program-wide.** `declare module "dayjs"` (and
+  similar) makes plugin types available to any file in the same tsconfig, so
+  a passing type-check never proves the setup ran; only importing the facade
+  does.
+- **Environment before diagnosis**: after a dependency-touching merge,
+  `bun install` before declaring a failure real; worktrees share staleness
+  through the node_modules symlink, and a stale `target/cljs_dev` makes
+  `type-check-pure` fail on `metabase-lib/metric/core.ts` (rebuild cljs in the
+  worktree).
+
+## PR shape
+
+One logical change per PR; the body names the specific edges removed (files,
+imports, before/after count) and gives each move's ownership reason in plain
+language a reviewer outside the effort can follow, without campaign labels.
+Stack only for semantic dependency or same-hot-file serialisation, and say
+so. Consider codeowner surface when chunking. Open as a draft until measured
+and green.

.claude/skills/typescript-write/SKILL.md

@@ -75,10 +75,6 @@ description: Write TypeScript and JavaScript code following Metabase coding stan
 - **No comments by default**. Well-named identifiers carry the `what`.
 - **Comments should be concise**. Add a short, concise comment only when the `why` is non-obvious: a workaround, a hidden invariant, a subtle ordering constraint, a clever reduction. Never document the actual implementation, focus on the intent and the why.
 
-## TypeScript Migration
-
-**When touching existing JavaScript files, propose to convert them to TypeScript first**. Create a separate PR for the conversion, then implement the changes.
-
 ## Verify before done
 
 - **Run the project type-check** when finished (see the shared TypeScript commands above).

.clj-kondo/config.edn

@@ -403,6 +403,7 @@
     metabase.channel.render.core              channel.render
     metabase.cloud-migration.core             cloud-migration
     metabase.eid-translation.core             eid-translation
+    metabase.llm.test-util                    llm.tu
     metabase.login-history.core               login-history
     metabase.model-persistence.core           model-persistence
     metabase.notification.core                notification
@@ -523,7 +524,6 @@
   metabase.test.data.interface/defdataset                                               clojure.core/def
   metabase.test.data.interface/defdataset-edn                                           clojure.core/def
   metabase.test.embedded-postgres.core/with-system                                      clojure.core/let
-  metabase.test.gentest/defgentest                                                      clojure.test/deftest
   metabase.test/defdataset                                                              clojure.core/def
   metabase.test/let-url                                                                 clojure.core/let
   metabase.test/with-actions                                                            clojure.core/let
@@ -682,7 +682,6 @@
    metabase.test.data/dataset                                                                                                hooks.metabase.test.data/dataset
    metabase.test.data/mbql-query                                                                                             hooks.metabase.test.data/mbql-query
    metabase.test.data/run-mbql-query                                                                                         hooks.metabase.test.data/mbql-query
-   metabase.test.gentest/iterate                                                                                             hooks.metabase.test.gentest/iterate*
    metabase.test.util.async/with-open-channels                                                                               hooks.common/let-with-optional-value-for-last-binding
    metabase.test.util.generators.jvm/with-random-cards                                                                       hooks.metabase.test.util.generators.jvm/with-random-cards
    metabase.test.util.log/with-log-level                                                                                     hooks.common/with-ignored-first-arg
@@ -801,7 +800,7 @@
    :name    test-namespaces}
   {:pattern "^(?!.*-test(?:\\..*)?$)(?!.*test-util)(?!^metabase\\.test.*).*$"
    :name    source-namespaces}
-  {:pattern "(?:(?:^metabase\\.cmd.*)|(?:^build.*)|(?:^metabuild-common.*)|(?:^release.*)|(?:^i18n.*)|(?:^lint-migrations-file$))|(?:^mage.*)"
+  {:pattern "(?:(?:^metabase\\.cmd.*)|(?:^build.*)|(?:^metabuild-common.*)|(?:^release.*)|(?:^i18n.*)|(?:^lint-migrations-file$))|(?:^mage.*)|(?:^load-namespaces.*)"
    :name    printable-namespaces}
   {:pattern "^metabase\\.(?:(?:lib)|(?:legacy-mbql))\\..*"
    :name    metabase-lib}

.clj-kondo/config/modules/config.edn

@@ -473,6 +473,7 @@
            app-db
            config
            events
+           lib
            models
            permissions
            premium-features
@@ -623,8 +624,7 @@
 
   collections-rest
   {:team "UX West"
-   :api  #{metabase.collections-rest.api
-           metabase.collections-rest.init}
+   :api  #{metabase.collections-rest.api}
    :uses #{api
            app-db
            collections
@@ -638,7 +638,6 @@
            queries
            request
            revisions
-           settings
            tracing
            transforms
            upload
@@ -735,6 +734,7 @@
            permissions
            public-sharing
            queries
+           query-permissions
            query-processor
            search
            settings
@@ -783,17 +783,19 @@
            revisions
            util
            xrays}
-   :model-imports #{:model/Card
+   :model-imports #{:model/Action
+                    :model/Card
                     :model/Collection
                     :model/Dashboard
                     :model/DashboardCard
+                    :model/DashboardCardSeries
                     :model/DashboardTab
                     :model/Field
+                    :model/ParameterCard
                     :model/Pulse
                     :model/PulseChannel
                     :model/PulseChannelRecipient
                     :model/Query
-                    :model/Table
                     :model/User}}
 
   data-studio
@@ -831,7 +833,9 @@
            batch-processing
            collections
            events
+           lib-be
            models
+           parameters
            public-sharing
            queries
            query-permissions
@@ -874,6 +878,7 @@
    :uses #{analytics-interface
            app-db
            appearance
+           audit-app
            auth-provider
            classloader
            config
@@ -974,6 +979,7 @@
            eid-translation
            embedding
            events
+           lib
            models
            notification
            parameters
@@ -985,6 +991,11 @@
            util}
    :model-imports #{:model/Card :model/Dashboard :model/DashboardCard :model/EmbeddingTheme}}
 
+  embeddings
+  {:team "Metabot"
+   :api  #{metabase.embeddings.provider metabase.embeddings.startup}
+   :uses #{plugins util}}
+
   entity-retrieval
   {:team "Metabot"
    :api  #{metabase.entity-retrieval.core
@@ -1209,7 +1220,8 @@
            metabase.lib.schema.util
            metabase.lib.schema.validate
            metabase.lib.types.isa
-           metabase.lib.util}
+           metabase.lib.util
+           metabase.lib.walk}
    :uses #{config
            graph
            legacy-mbql
@@ -1224,9 +1236,9 @@
 
   lib-be
   {:team "Querying Platform"
-   :api  #{metabase.lib-be.core
-           metabase.lib-be.init}
-   :uses #{lib
+   :api  #{metabase.lib-be.core metabase.lib-be.init metabase.lib-be.schema}
+   :uses #{legacy-mbql
+           lib
            models
            settings
            util}
@@ -1257,6 +1269,7 @@
   {:team "Metabot"
    :api  #{metabase.llm.api
            metabase.llm.init
+           metabase.llm.provider
            metabase.llm.settings
            metabase.llm.startup}
    :uses #{analytics
@@ -1267,6 +1280,8 @@
            lib-be
            metabot
            models
+           parameters
+           permissions
            premium-features
            request
            settings
@@ -1350,7 +1365,6 @@
   metabot
   {:team    "Metabot"
    :api     #{metabase.metabot.api
-              metabase.metabot.api.entity-analysis
               metabase.metabot.config
               metabase.metabot.core
               metabase.metabot.init
@@ -1550,6 +1564,7 @@
            driver
            embedding
            events
+           lib
            models
            parameters
            permissions
@@ -1675,6 +1690,7 @@
    :uses #{api
            audit-app
            events
+           lib
            permissions
            premium-features
            request
@@ -1759,6 +1775,7 @@
            api
            dashboards
            dashboards-rest
+           documents
            events
            lib
            models
@@ -1856,6 +1873,7 @@
            view-log
            warehouse-schema}
    :model-exports #{:model/Card
+                    :model/ParameterCard
                     :model/Query
                     :model/QueryExecution
                     :model/QueryTable
@@ -1879,8 +1897,7 @@
   queries-rest
   {:team "Querying Platform"
    :api  #{metabase.queries-rest.api}
-   :uses #{analyze
-           api
+   :uses #{api
            collections
            eid-translation
            embedding
@@ -1917,7 +1934,7 @@
            query-processor
            request
            util}
-   :model-imports #{:model/Card :model/Field}}
+   :model-imports #{:model/Card :model/Field :model/Table}}
 
   query-processor
   {:team    "Querying Platform"
@@ -2030,22 +2047,28 @@
            metabase.revisions.core
            metabase.revisions.init}
    :uses #{api
+           collections
            config
            dashboards
            events
            lib
+           lib-be
            models
+           parameters
            queries
            query-permissions
            util}
    :model-exports #{:model/Revision}
    :model-imports #{:model/Card
+                    :model/Collection
                     :model/Dashboard
                     :model/DashboardCard
+                    :model/DashboardCardSeries
                     :model/DashboardTab
                     :model/Document
                     :model/Exploration
                     :model/Measure
+                    :model/ParameterCard
                     :model/Segment
                     :model/Transform}}
 
@@ -2163,6 +2186,7 @@
            request
            session
            settings
+           setup
            sso
            system
            tracing
@@ -2254,6 +2278,7 @@
               channel
               formatter
               lib
+              llm
               metabot
               permissions
               query-processor
@@ -2496,7 +2521,6 @@
            models
            permissions
            premium-features
-           queries
            query-processor
            remote-sync
            revisions
@@ -2801,6 +2825,7 @@
    :uses #{analytics
            api
            app-db
+           collections
            database-routing
            driver
            events
@@ -2817,7 +2842,8 @@
            util
            warehouse-schema
            xrays}
-   :model-imports #{:model/Database
+   :model-imports #{:model/Collection
+                    :model/Database
                     :model/Dimension
                     :model/Field
                     :model/FieldValues
@@ -2939,8 +2965,7 @@
 
   enterprise/advanced-config
   {:team "UX West"
-   :api  #{metabase-enterprise.advanced-config.api
-           metabase-enterprise.advanced-config.api.logs
+   :api  #{metabase-enterprise.advanced-config.api.logs
            metabase-enterprise.advanced-config.file
            metabase-enterprise.advanced-config.init
            metabase-enterprise.advanced-config.settings}
@@ -3026,6 +3051,7 @@
            app-db
            audit-app
            classloader
+           config
            driver
            lib
            models
@@ -3095,7 +3121,7 @@
 
   enterprise/cloud-add-ons
   {:team "Cloud"
-   :api  #{metabase-enterprise.cloud-add-ons.api}
+   :api  #{metabase-enterprise.cloud-add-ons.api metabase-enterprise.cloud-add-ons.core}
    :uses #{api
            events
            premium-features
@@ -3107,6 +3133,7 @@
   {:team "Cloud"
    :api  #{metabase-enterprise.cloud-proxy.api}
    :uses #{api
+           lib
            premium-features
            util
            enterprise/harbormaster}}
@@ -3184,6 +3211,7 @@
            collections
            config
            driver
+           embeddings
            metabot
            models
            premium-features
@@ -3297,6 +3325,11 @@
            settings
            util}}
 
+  enterprise/embedder
+  {:team "Metabot"
+   :api  #{}
+   :uses #{classloader embeddings util}}
+
   enterprise/embedding-hub
   {:team "Embedding"
    :api  #{metabase-enterprise.embedding-hub.api}
@@ -3390,7 +3423,7 @@
            warehouse-schema
            enterprise/sandbox}
    :model-exports #{:model/ConnectionImpersonation}
-   :model-imports #{:model/DataPermissions :model/PermissionsGroupMembership}}
+   :model-imports #{:model/DataPermissions :model/Database :model/PermissionsGroupMembership}}
 
   enterprise/internal-stats
   {:team "UX West"
@@ -3442,6 +3475,7 @@
               metabot}
    :uses    #{api
               lib-be
+              llm
               metabot
               models
               permissions
@@ -3449,6 +3483,7 @@
               settings
               task
               util
+              enterprise/cloud-add-ons
               enterprise/dependencies
               enterprise/transforms-python}
    :model-imports #{:model/AiUsageLog
@@ -3583,6 +3618,7 @@
            events
            legacy-mbql
            lib
+           lib-be
            models
            permissions
            premium-features
@@ -3669,6 +3705,7 @@
            collections
            config
            connection-pool
+           embeddings
            events
            health-inspector
            lib-be
@@ -3688,7 +3725,10 @@
 
   enterprise/serialization
   {:team "Graphy"
-   :api  #{metabase-enterprise.serialization.api metabase-enterprise.serialization.cmd metabase-enterprise.serialization.core}
+   :api  #{metabase-enterprise.serialization.api
+           metabase-enterprise.serialization.cmd
+           metabase-enterprise.serialization.core
+           metabase-enterprise.serialization.init}
    :friends #{enterprise/memoize-monitor}
    :uses #{analytics
            api
@@ -3703,6 +3743,7 @@
            premium-features
            search
            server
+           settings
            setup
            util}
    :model-imports :bypass}
@@ -3729,6 +3770,7 @@
            embedding
            premium-features
            request
+           server
            session
            settings
            sso

.clj-kondo/ratchets.edn

@@ -5,15 +5,15 @@
 ;; to defend in your PR.
 ;; :all is the vector-less ignore form, which suppresses every linter on the next form.
 {:ignore-counts {:aliased-namespace-symbol                                            3
-                 :all                                                                 50
+                 :all                                                                 48
                  :case-symbol-test                                                    1
                  :clojure-lsp/unused-public-var                                       9
                  :def-fn                                                              1
                  :deprecated-namespace                                                95
-                 :deprecated-var                                                      79
+                 :deprecated-var                                                      84
                  :discouraged-java-method                                             3
-                 :discouraged-namespace                                               79
-                 :discouraged-var                                                     107
+                 :discouraged-namespace                                               81
+                 :discouraged-var                                                     111
                  :equals-true                                                         1
                  :main-without-gen-class                                              1
                  :metabase/defsetting-namespace                                       2
@@ -24,8 +24,8 @@
                  :metabase/namespace-name                                             4
                  :metabase/prefer-with-dynamic-fn-redefs                              28
                  :metabase/test-helpers-use-non-thread-safe-functions                 17
-                 :metabase/validate-defendpoint-has-response-schema                   441
-                 :metabase/validate-defendpoint-query-params-use-kebab-case           47
+                 :metabase/validate-defendpoint-has-response-schema                   440
+                 :metabase/validate-defendpoint-query-params-use-kebab-case           50
                  :metabase/validate-defendpoint-route-uses-kebab-case                 44
                  :metabase/validate-deftest                                           9
                  :missing-docstring                                                   10
@@ -44,5 +44,5 @@
                  :unused-binding                                                      9
                  :unused-excluded-var                                                 2
                  :unused-namespace                                                    1
-                 :unused-private-var                                                  8
+                 :unused-private-var                                                  9
                  :unused-value                                                        1}}

.clj-kondo/src/hooks/clojure/core/ns.clj

@@ -71,6 +71,24 @@
   (some-> (ns-form-node->ns-symb-node ns-form-node)
           hooks/sexpr))
 
+(defn- lint-test-parallel-metadata [ns-form-node]
+  (when-let [ns-symb-node (ns-form-node->ns-symb-node ns-form-node)]
+    (let [ns-metadata (meta (hooks/sexpr ns-symb-node))]
+      (cond
+        (:synchronous ns-metadata)
+        (hooks/reg-finding!
+         (assoc (meta ns-symb-node)
+                :message (str "Use `^:synchronized` to mark this namespace explicitly non-parallel; "
+                              "`^:synchronous` is ignored by Hawk. [:metabase/validate-deftest]")
+                :type :metabase/validate-deftest))
+
+        (and (contains? ns-metadata :parallel)
+             (false? (:parallel ns-metadata)))
+        (hooks/reg-finding!
+         (assoc (meta ns-symb-node)
+                :message "Use `^:synchronized` instead of `^{:parallel false}`. [:metabase/validate-deftest]"
+                :type :metabase/validate-deftest))))))
+
 (defn- lint-modules [ns-form-node config]
   (let [ns-symb (ns-form-node->ns-symb ns-form-node)]
     (when-not (modules/ignored-namespace? config ns-symb)
@@ -140,6 +158,7 @@
     lint-requires-on-new-lines
     (lint-modules (modules/config x))
     lint-namespace-name
+    lint-test-parallel-metadata
     lint-jsqlparser-imports)
   x)
 

.clj-kondo/src/hooks/clojure/test.clj

@@ -28,11 +28,11 @@
     (walk form)))
 
 (defn- deftest-check-parallel
-  "1. Check if test is marked ^:parallel / ^:synchronized correctly.
+  "1. Check if test is marked `^:parallel` / `^:synchronized` correctly.
    2. Make sure disallowed forms are not used in ^:parallel tests.
-   3. Disallow ^:parallel tests in namespaces marked ^:synchronous -- the
-      ns marker is the author's blanket promise that nothing inside runs
-      in parallel, so an individual ^:parallel deftest contradicts it."
+   3. Disallow `^:parallel` tests in namespaces marked `^:synchronized` --
+      the ns marker is the author's blanket promise that nothing inside runs
+      in parallel, so an individual `^:parallel` deftest contradicts it."
   [{[_ test-name & body] :children, :as _node} ns-sym config]
   (let [test-metadata     (:meta test-name)
         metadata-sexprs   (map hooks/sexpr test-metadata)
@@ -44,28 +44,48 @@
                            (completing merge)
                            {}
                            metadata-sexprs)
-        parallel?     (:parallel combined-metadata)
-        synchronized? (:synchronized combined-metadata)
-        ns-synchronous? (boolean (:synchronous (meta ns-sym)))]
+        parallel?                  (true? (:parallel combined-metadata))
+        synchronized?              (true? (:synchronized combined-metadata))
+        explicitly-nonparallel?    (or synchronized?
+                                       (and (contains? combined-metadata :parallel)
+                                            (false? (:parallel combined-metadata))))
+        ns-metadata                (meta ns-sym)
+        ns-explicitly-nonparallel? (or (true? (:synchronized ns-metadata))
+                                       (and (contains? ns-metadata :parallel)
+                                            (false? (:parallel ns-metadata))))]
+    (when (and (contains? combined-metadata :parallel)
+               (false? (:parallel combined-metadata)))
+      (hooks/reg-finding! (assoc (meta test-name)
+                                 :message (str "Use `^:synchronized` instead of `^{:parallel false}`. "
+                                               "[:metabase/validate-deftest]")
+                                 :type :metabase/validate-deftest)))
+    (when (:sequential combined-metadata)
+      (hooks/reg-finding! (assoc (meta test-name)
+                                 :message (str "Use `^:synchronized` to mark this test explicitly non-parallel; "
+                                               "`^:sequential` is ignored by Hawk. "
+                                               "[:metabase/validate-deftest]")
+                                 :type :metabase/validate-deftest)))
     (when (and parallel? synchronized?)
       (hooks/reg-finding! (assoc (meta test-name)
-                                 :message "Test should not be marked both ^:parallel and ^:synchronized"
+                                 :message "Test should not be marked both `^:parallel` and `^:synchronized`"
                                  :type :metabase/validate-deftest)))
-    (when (and parallel? ns-synchronous?)
+    (when (and parallel? ns-explicitly-nonparallel?)
       (hooks/reg-finding!
        (assoc (meta test-name)
-              :message (str "Test should not be marked ^:parallel in a namespace marked ^:synchronous -- "
+              :message (str "Test should not be marked `^:parallel` in a namespace marked "
+                            "`^:synchronized` -- "
                             "the ns marker promises no parallel execution. "
-                            "Drop ^:parallel from the deftest, or drop ^:synchronous from the ns. "
+                            "Drop `^:parallel` from the deftest, or drop `^:synchronized` from the ns. "
                             "[:metabase/validate-deftest]")
               :type :metabase/validate-deftest)))
-    ;; only when the custom `:metabase/deftest-not-marked-parallel-or-synchronized` is enabled: complain if tests are
-    ;; not explicitly marked `^:parallel` or `^:synchronized`. This is mostly to encourage people to mark everything
-    ;; `^:parallel` in places like `metabase.lib` tests unless there is a really good reason not to.
-    (when-not (or parallel? synchronized?)
+    ;; Only when the custom `:metabase/deftest-not-marked-parallel-or-synchronized` is enabled:
+    ;; complain if tests are not explicitly marked `^:parallel` or `^:synchronized`. This is
+    ;; mostly to encourage people to mark everything `^:parallel` in places like `metabase.lib`
+    ;; tests unless there is a really good reason not to.
+    (when-not (or parallel? explicitly-nonparallel?)
       (hooks/reg-finding!
        (assoc (meta test-name)
-              :message "Test should be marked either ^:parallel or ^:synchronized"
+              :message "Test should be marked either `^:parallel` or `^:synchronized`"
               :type :metabase/deftest-not-marked-parallel-or-synchronized)))
     (when parallel?
       (doseq [form body]
@@ -153,6 +173,7 @@
          "build."
          "i18n." ; bin/i18n
          "lint-migrations-file-test"
+         "load-namespaces." ; bin/load-namespaces
          "mage."
          "main-test" ; bin/release-list
          "metabase.deps-edn-test"
@@ -232,18 +253,20 @@
 
 (defn use-fixtures
   "Flag `:parallel/unsafe` forms inside fixtures. Skipped when the surrounding
-  namespace is marked `^:synchronous` -- the ns marker is the author's
+  namespace is marked `^:synchronized` -- the ns marker is the author's
   explicit opt-in to a single-threaded test ns where destructive setup is
   safe. Without that opt-in, kondo can't know whether sibling deftests will
   be `^:parallel`, so the conservative default is to flag.
 
   Sister to [[deftest-check-parallel]]: the deftest hook rejects `^:parallel`
-  tests inside a `^:synchronous` ns, so the two checks together form a
-  coherent opt-in: either the whole ns is synchronous (fixtures can be
+  tests inside a `^:synchronized` ns, so the two checks together form a
+  coherent opt-in: either the whole ns is explicitly non-parallel (fixtures can be
   anything; no parallel tests allowed) or it isn't (fixtures must be
   parallel-safe)."
   [{:keys [node config], ns-sym :ns, :as input}]
-  (when-not (:synchronous (meta ns-sym))
+  (when-not (or (true? (:synchronized (meta ns-sym)))
+                (and (contains? (meta ns-sym) :parallel)
+                     (false? (:parallel (meta ns-sym)))))
     (let [linter-config (get-in config [:linters :metabase/validate-deftest])]
       (doseq [form (rest (:children node))]
         (warn-about-disallowed-parallel-forms form linter-config))))

.clj-kondo/src/hooks/common/modules.clj

@@ -71,7 +71,7 @@
   (let [module                (module ns-symb)
         module-api-namespaces (module-api-namespaces config module)
         module-friends        (module-friends config module)]
-    (or (empty? module-api-namespaces)
+    (or (nil? module-api-namespaces)
         (contains? module-api-namespaces ns-symb)
         (contains? module-friends current-module))))
 

.clj-kondo/src/hooks/metabase/test/gentest.clj

@@ -1,14 +0,0 @@
-(ns hooks.metabase.test.gentest
-  (:require
-   [clj-kondo.hooks-api :as hooks]))
-
-(defn iterate*
-  "(iterate {:as limit-spec} [s1 val1 & more] body-form body-form...)"
-  [{{:keys [children] :as node} :node :as orig}]
-  (let [[token limit-spec bindings & body-nodes] children
-        node* (-> (hooks/list-node
-                   (list token limit-spec
-                         (hooks/list-node (list* (hooks/token-node 'let) bindings
-                                                 body-nodes))))
-                  (with-meta (meta node)))]
-    (assoc orig :node node*)))

.clj-kondo/test/hooks/clojure/core/ns_test.clj

@@ -19,6 +19,19 @@
 (defn- lint-modules [form config]
   (lint-ns form (assoc-in config [:linters :metabase/modules :level] :warning)))
 
+(deftest ^:parallel explicit-nonparallel-namespace-metadata-test
+  (let [config {:linters {:metabase/validate-deftest {:level :warning}}}]
+    (testing "Hawk's supported namespace marker passes"
+      (is (empty? (lint-ns '(ns ^:synchronized example.test) config))))
+    (testing "the verbose Hawk spelling is not accepted as Metabase style"
+      (is (=? [{:type    :metabase/validate-deftest
+                :message #(re-find #"Use `\^:synchronized` instead" %)}]
+              (lint-ns '(ns ^{:parallel false} example.test) config))))
+    (testing "the legacy marker explains that Hawk ignores it"
+      (is (=? [{:type    :metabase/validate-deftest
+                :message #(re-find #"`\^:synchronous` is ignored by Hawk" %)}]
+              (lint-ns '(ns ^:synchronous example.test) config))))))
+
 (deftest ^:parallel module-checker-allowed-modules-test
   (are [task-namespace] (=? [{:message "Module task should not be used in the api module. [:metabase/modules api :uses]"
                               :type :metabase/modules}]
@@ -43,6 +56,16 @@
            '{:metabase/modules {api    {:uses #{search}}
                                 search {:api  #{metabase.search.core}}}}))))
 
+(deftest ^:parallel module-checker-empty-api-test
+  (is (=? [{:message "Namespace metabase.embeddings.core is not an allowed external API namespace for the embeddings module. [:metabase/modules embeddings :api]"
+            :type :metabase/modules}]
+          (lint-modules
+           '(ns metabase.metabot.core
+              (:require
+               [metabase.embeddings.core :as embeddings]))
+           '{:metabase/modules {metabot   {:uses #{embeddings}}
+                                embeddings {:api #{}}}}))))
+
 (deftest ^:parallel module-checker-friends-test
   (is (= []
          (lint-modules

.clj-kondo/test/hooks/clojure/test_test.clj

@@ -21,6 +21,54 @@
                                             #{:athena}}}}})
     (mapv :message @(:findings clj-kondo.impl.utils/*ctx*))))
 
+(defn- parallel-metadata-findings
+  ([form]
+   (parallel-metadata-findings form 'example.test))
+  ([form ns-sym]
+   (let [linters {:metabase/deftest-not-marked-parallel-or-synchronized {:level :warning}
+                  :metabase/validate-deftest                             {:level :warning}}]
+     (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters linters}
+                                           :ignores    (atom nil)
+                                           :findings   (atom [])
+                                           :namespaces (atom {})}]
+       (hooks.clojure.test/deftest {:node   (api/parse-string form)
+                                    :lang   :clj
+                                    :ns     ns-sym
+                                    :config {:linters {:metabase/validate-deftest {}}}})
+       @(:findings clj-kondo.impl.utils/*ctx*)))))
+
+(deftest ^:parallel explicit-nonparallel-metadata-test
+  (testing "Hawk's supported test markers satisfy the explicit metadata linter"
+    (are [metadata] (empty? (parallel-metadata-findings
+                             (format "(deftest %s example-test (is true))" metadata)))
+      "^:parallel"
+      "^:synchronized"))
+  (testing "an unmarked test still gets the opt-in linter's guidance"
+    (is (=? [{:type    :metabase/deftest-not-marked-parallel-or-synchronized
+              :message "Test should be marked either `^:parallel` or `^:synchronized`"}]
+            (parallel-metadata-findings "(deftest example-test (is true))"))))
+  (testing "the unsupported marker explains that Hawk ignores it"
+    (is (some #(and (= (:type %) :metabase/validate-deftest)
+                    (re-find #"ignored by Hawk" (:message %)))
+              (parallel-metadata-findings
+               "(deftest ^:sequential example-test (is true))"))))
+  (testing "the verbose Hawk spelling is not accepted as Metabase style"
+    (is (some #(and (= (:type %) :metabase/validate-deftest)
+                    (re-find #"Use `\^:synchronized` instead" (:message %)))
+              (parallel-metadata-findings
+               "(deftest ^{:parallel false} example-test (is true))"))))
+  (testing "a test cannot request both execution modes"
+    (is (some #(and (= (:type %) :metabase/validate-deftest)
+                    (re-find #"both `\^:parallel` and `\^:synchronized`" (:message %)))
+              (parallel-metadata-findings
+               "(deftest ^:parallel ^:synchronized example-test (is true))"))))
+  (testing "a namespace-level non-parallel promise rejects parallel tests"
+    (is (=? [{:type    :metabase/validate-deftest
+              :message #(re-find #"namespace marked.*`\^:synchronized`" %)}]
+            (parallel-metadata-findings
+             "(deftest ^:parallel example-test (is true))"
+             (with-meta 'example.test {:synchronized true}))))))
+
 (deftest ^:parallel disallow-hardcoded-driver-names-in-tests-test
   (is (= []
          (deftest-warnings

.cljfmt.edn

@@ -12,6 +12,7 @@
   "enterprise/backend"
   "bin/build"
   "bin/lint-migrations-file"
+  "bin/load-namespaces"
   "bin/release-list"
   #_"mage/src"
   #_"mage/test"

.github/CODEOWNERS

@@ -42,6 +42,8 @@ docs/api.json # auto-generated
 docs/configuring-metabase/environment-variables.md # auto-generated
 docs/configuring-metabase/config-template.md # auto-generated
 docs/installation-and-operation/commands.md # auto-generated
+docs/embedding/sdk/api # auto-generated
+docs/embedding/eajs/snippets # auto-generated
 
 # @metabase/devexp
 .github @metabase/devexp

.github/actionlint.yaml

@@ -3,3 +3,11 @@ self-hosted-runner:
   # selected through `vars.DEFAULT_RUNNER_KEY` and is not checked.
   labels:
     - arm-ubuntu-24-2core
+
+paths:
+  # GitHub added parallel steps (`parallel`, `background`, `wait`, `wait-all`,
+  # `cancel`) in June 2026, and actionlint 1.7.12 does not know the schema yet:
+  # https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/
+  .github/workflows/lint.yml:
+    ignore:
+      - 'step must run script with "run" section or run action with "uses" section'

.github/actions/bundle-size-check/action.yml

@@ -3,17 +3,15 @@ description: |
   Measures app + embedding SDK bundle sizes from the current and base-ref
   uberjars (reusing the builds that already ran) plus their bundle-stats
   artifacts, and flags gzipped size changes beyond the threshold for the main
-  app's initial bundle and the chunked SDK's reachable total. Skips when the
-  base-ref artifacts aren't available rather than rebuilding from source (which
-  would compare across pipelines).
+  app's initial bundle and the chunked SDK's reachable total. The base ref is
+  read back off the current uberjar so that both sides differ only by the PR.
+  Skips when the base-ref artifacts aren't available rather than rebuilding from
+  source (which would compare across pipelines).
 
 inputs:
   edition:
     description: 'Metabase edition (ee or oss)'
     required: true
-  base-ref-commit:
-    description: 'Commit SHA of the base ref.'
-    required: true
   threshold-percent:
     description: 'Percent threshold for bundle size change'
     required: true
@@ -41,12 +39,35 @@ runs:
         commit: ${{ github.event.pull_request.head.sha || github.sha }}
         edition: ${{ inputs.edition }}
         extract-path: temp/current-uberjar
+    - name: Resolve the base ref the current uberjar was built against
+      id: base-ref
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        set -uo pipefail
+
+        # The uberjar job checks out refs/pull/<n>/merge (the PR head already
+        # merged into the base branch tip) but names its artifact after head.sha,
+        # so the comparable base ref is that merge's first parent. Reading it back
+        # off the jar describes the artifact actually being measured. Using
+        # pull_request.base.sha instead compares against a stale snapshot of the
+        # base branch, reporting everything that landed in between as this PR's
+        # own bundle delta.
+        unzip -o -j temp/current-uberjar/metabase.jar version.properties -d temp/current-version >/dev/null
+        built=$(sed -n 's/^hash=//p' temp/current-version/version.properties)
+        base=$(gh api "/repos/${GITHUB_REPOSITORY}/commits/${built}" \
+          --jq 'if (.parents | length) == 2 then .parents[0].sha else empty end' 2>/dev/null) || base=""
+
+        echo "sha=${base}" >> "$GITHUB_OUTPUT"
+        echo "The current uberjar was built from ${built}; its base ref is ${base:-unknown}"
     - name: Download base-ref uberjar
       id: base-jar
+      if: steps.base-ref.outputs.sha != ''
       continue-on-error: true
       uses: ./.github/actions/fetch-artifact
       with:
-        commit: ${{ inputs.base-ref-commit }}
+        commit: ${{ steps.base-ref.outputs.sha }}
         edition: ${{ inputs.edition }}
         extract-path: temp/base-uberjar
     - name: Measure and compare bundle sizes
@@ -56,7 +77,7 @@ runs:
         GH_TOKEN: ${{ github.token }}
         EDITION: ${{ inputs.edition }}
         HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
-        BASE_SHA: ${{ inputs.base-ref-commit }}
+        BASE_SHA: ${{ steps.base-ref.outputs.sha }}
         THRESHOLD: ${{ inputs.threshold-percent }}
         MEASURE_BUNDLES: app,embedding-sdk-legacy,embedding-sdk-chunked
         # The gated bundles, as "<bundle>/<kind>". Each one's step outputs are
@@ -79,6 +100,7 @@ runs:
         # The base ref needs an already-built uberjar. Rebuilding it from source
         # would compare across two build pipelines (the bug this check used to
         # have), so skip instead when it — or its stats — isn't available.
+        [ -n "${BASE_SHA}" ] || skip "no comparable base ref for the current uberjar"
         [ -f temp/base-uberjar/metabase.jar ] || skip "base-ref uberjar not found for ${BASE_SHA}"
 
         extract_js() { # $1=jar  $2=dest-root

.github/actions/collect-profile/action.yml

@@ -0,0 +1,53 @@
+name: Collect profile
+description: >-
+  Attach a flamegraph and per-test wall times to a job whose tests ran under clj-async-profiler.
+  Does nothing when the run was not profiled.
+
+inputs:
+  profiled:
+    required: true
+    description: >-
+      "true" when the test step ran under the profiler. Passed in rather than read from the
+      environment so the decision stays recorded by the step that made it.
+  artifact-name:
+    required: true
+    description: Name for the uploaded artifact. Must be unique across the jobs of one run.
+
+runs:
+  using: "composite"
+  steps:
+    # Unlike a JUnit failure report, these run on a green build too — a suite that passes slowly is
+    # exactly what profiling is for.
+    - name: Summarize test wall times
+      if: ${{ inputs.profiled == 'true' }}
+      continue-on-error: true
+      shell: bash
+      run: |
+        {
+          echo "### Slowest test namespaces (seconds)"
+          echo '```'
+          grep -h '<testsuite' target/junit/*.xml 2>/dev/null \
+            | sed -E 's|.*<testsuite name="([^"]*)" time="([^"]*)".*|\2 \1|' \
+            | sort -rn | head -25
+          echo '```'
+          echo "### Slowest tests (seconds)"
+          echo '```'
+          grep -h '<testcase' target/junit/*.xml 2>/dev/null \
+            | sed -E 's|.*classname="([^"]*)" name="([^"]*)" time="([^"]*)".*|\3 \1/\2|' \
+            | sort -rn | head -25
+          echo '```'
+        } >> "$GITHUB_STEP_SUMMARY"
+
+    # Only the rendered flamegraph is kept: the raw collapsed stacks it was built from run to
+    # hundreds of MB on a long suite, and are reproducible locally from the same test selection.
+    - name: Upload profile
+      if: ${{ inputs.profiled == 'true' }}
+      continue-on-error: true
+      uses: actions/upload-artifact@v7
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: |
+          target/clj-async-profiler/results/*flamegraph.html
+          target/junit/*.xml
+        retention-days: 14
+        if-no-files-found: warn

.github/actions/get-cache-keys/action.yml

@@ -1,45 +0,0 @@
-name: Get cache keys
-description: |
-  Get deterministic cache keys for Maven and Node.js caches based on the centrally controlled cache prefix,
-  and the suffix based on the runner OS and the current week of the year.
-
-outputs:
-  m2-cache-key:
-    description: "The cache key for the Maven cache."
-    value: ${{ steps.keys-factory.outputs.m2-cache-key }}
-  m2-restore-key:
-    description: "The fallback restore key prefix for the Maven cache."
-    value: ${{ steps.keys-factory.outputs.m2-restore-key }}
-  node-cache-key:
-    description: "The cache key for the Node.js cache."
-    value: ${{ steps.keys-factory.outputs.node-cache-key }}
-  node-restore-key:
-    description: "The fallback restore key prefix for the Node.js cache."
-    value: ${{ steps.keys-factory.outputs.node-restore-key }}
-  eslint-cache-key:
-    description: "The cache key for Eslint cache"
-    value: ${{ steps.keys-factory.outputs.eslint-cache-key }}
-  cypress-cache-key:
-    description: "The cache key for Cypress cache"
-    value: ${{ steps.keys-factory.outputs.cypress-cache-key }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Generate and output cache keys
-      id: keys-factory
-      run: |
-        M2_CACHE_PREFIX='M2'
-        NODE_CACHE_PREFIX='node-modules'
-        ESLINT_CACHE_PREFIX='eslint'
-        CYPRESS_CACHE_PREFIX='cypress'
-        WEEK_OF_YEAR=$(/bin/date "+%G-%V")
-        CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
-
-        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> "$GITHUB_OUTPUT"
-        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> "$GITHUB_OUTPUT"
-        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-        echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-      shell: bash

.github/actions/prepare-backend/action.yml

@@ -32,10 +32,6 @@ runs:
           exit 1
         fi
 
-    - name: Get M2 cache key
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
-
     - name: Install uv (for Python package installation)
       uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       with:
@@ -43,12 +39,14 @@ runs:
         version: "0.10.2" # keep in sync with mise.toml
         github-token: ${{ github.token }}
 
+    - name: Cache spec
+      id: cache-spec
+      shell: bash
+      run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
+
     - name: Restore M2 cache
       uses: actions/cache/restore@v5
       with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
-        restore-keys: |
-          ${{ steps.get-cache-keys.outputs.m2-restore-key }}
+        path: ${{ steps.cache-spec.outputs.m2-path }}
+        key: ${{ steps.cache-spec.outputs.m2-key }}
+        restore-keys: ${{ steps.cache-spec.outputs.m2-restore-key }}

.github/actions/prepare-cypress/action.yml

@@ -25,15 +25,17 @@ runs:
         chrome-version: 144
       id: setup-chrome
 
-    - name: Get cache keys
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
+    - name: Cache spec
+      id: cache-spec
+      shell: bash
+      run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
 
-    - name: Get Cypress cache
+    - name: Restore Cypress binary
       uses: actions/cache/restore@v5
       with:
-        path: ~/.cache/Cypress
-        key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
+        path: ${{ steps.cache-spec.outputs.cypress-path }}
+        key: ${{ steps.cache-spec.outputs.cypress-key }}
+        restore-keys: ${{ steps.cache-spec.outputs.cypress-restore-key }}
 
     - name: Ensure that Cypress executable is ready
       run: |

.github/actions/prepare-frontend/action.yml

@@ -16,43 +16,37 @@ runs:
       with:
         node-version: ${{ inputs.node-version }}
 
-    - name: Get cache keys
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
-
-    - name: Restore M2 cache
-      uses: actions/cache/restore@v5
-      with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
-        restore-keys: |
-          ${{ steps.get-cache-keys.outputs.m2-restore-key }}
-
-    - name: Get bun cache directory
-      id: bun-cache
-      run: |
-        BUN_CACHE_DIR=$(bun pm cache)
-        echo "Bun cache directory: $BUN_CACHE_DIR"
-        echo "dir=$BUN_CACHE_DIR" >> "$GITHUB_OUTPUT"
+    - name: Cache spec
+      id: cache-spec
       shell: bash
+      run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
 
-    - name: Restore node_modules cache
+    # The spec names the store path rather than discovering it, so that a job can restore the cache
+    # before bun exists. Exported job-wide rather than per-step because every later bun invocation has
+    # to resolve against the same store. Confirm bun agreed: if the variable stopped taking effect, bun
+    # would fill its default directory and the cache would silently save an empty tree.
+    - name: Point bun at the cached store
+      shell: bash
+      env:
+        STORE: ${{ steps.cache-spec.outputs.bun-store-path }}
+      run: |
+        echo "BUN_INSTALL_CACHE_DIR=$STORE" >> "$GITHUB_ENV"
+        ACTUAL=$(BUN_INSTALL_CACHE_DIR="$STORE" bun pm cache)
+        if [ "$ACTUAL" != "$STORE" ]; then
+          echo "::error::bun reports its store at $ACTUAL, not $STORE; BUN_INSTALL_CACHE_DIR is not taking effect"
+          exit 1
+        fi
+
+    - name: Restore bun store
       uses: actions/cache/restore@v5
-      id: node-modules-cache
       with:
-        path: |
-          ${{ steps.bun-cache.outputs.dir }}
-          node_modules
-        key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
-        restore-keys: |
-          ${{ steps.get-cache-keys.outputs.node-restore-key }}
+        path: ${{ steps.cache-spec.outputs.bun-store-path }}
+        key: ${{ steps.cache-spec.outputs.bun-store-key }}
+        restore-keys: ${{ steps.cache-spec.outputs.bun-store-restore-key }}
 
     # postinstall lifecycle hook can be dangerous in CI so we only run it locally (see package.json)
     # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
-    # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
-    - name: Clean install
+    - name: Install front-end dependencies
       run: bun install --frozen-lockfile
       shell: bash
     - name: Patch frontend dependencies

.github/actions/report-failures-to-ci-conductor/action.yml

@@ -25,6 +25,7 @@ runs:
         TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
         CI_CONDUCTOR_TEST_SUITE: ${{ inputs.test-suite }}
         ADAPTER: ${{ inputs.adapter }}
+        IS_RERUN: ${{ github.run_attempt != '1' }}
       # Keep the path constrained to known entrypoints.
       run: |
         case "$ADAPTER" in

.github/actions/test-driver/action.yml

@@ -101,7 +101,21 @@ runs:
       # vector reaches clojure -X as a single argument.
       run: |
         BASE="clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test"
-        if [ "${{ inputs.granular-rerun }}" = "true" ] && [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
+        # `:profile-tests` overrides `:test`'s exec-fn, so it has to come last. See dev.profile-tests.
+        # The `profiled` output is what the collection steps below key off, so that the decision is
+        # recorded by the step that acts on it rather than re-derived from the environment.
+        if [ "$PROFILE_TESTS" = "true" ]; then
+          echo "Profiling this run; a flamegraph will be attached to the job."
+          echo "profiled=true" >> "$GITHUB_OUTPUT"
+          BASE="$BASE:profile-tests"
+        fi
+        # An explicit selection wins over the rerun narrowing below: it was asked for by hand, on this
+        # attempt. Names may be separated by commas or spaces; hawk wants them as one vector argument.
+        if [ -n "$ONLY_TESTS" ]; then
+          ONLY="[$(echo "$ONLY_TESTS" | tr ',' ' ')]"
+          echo "Running only: $ONLY"
+          $BASE :only "$ONLY"
+        elif [ "${{ inputs.granular-rerun }}" = "true" ] && [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
           echo "Granular rerun of previously-failed tests: $(cat target/failed-tests)"
           $BASE :only "$(cat target/failed-tests)"
         else
@@ -113,8 +127,15 @@ runs:
       # ultimately fails.
       continue-on-error: true
 
+    - name: Collect profile
+      if: ${{ !cancelled() }}
+      uses: ./.github/actions/collect-profile
+      with:
+        profiled: ${{ steps.run-test.outputs.profiled }}
+        artifact-name: ${{ format('profile-{0}{1}', inputs.junit-name, inputs.artifact-suffix && format('-{0}', inputs.artifact-suffix) || '') }}
+
     - name: Report failed tests to ci-conductor
-      if: ${{ !cancelled() && steps.run-test.outcome == 'failure' }}
+      if: ${{ !cancelled() && ( steps.run-test.outcome == 'failure' || github.run_attempt != '1' ) }}
       # This step should NEVER fail the job!
       continue-on-error: true
       uses: ./.github/actions/report-failures-to-ci-conductor

.github/actions/update-cache/action.yml

@@ -1,41 +0,0 @@
-name: Update cache
-description: |
-  Update a GitHub Actions cache based on a provided path and key.
-  If a cache entry already exists for the given key, it is first removed.
-  This ensures immutability of cache entries, and prevents runtime errors.
-
-inputs:
-  path:
-    description: "The path(s) to cache, separated by newlines."
-    required: true
-  key:
-    description: "The cache key to use."
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-    - name: Check if the cache entry exists
-      id: cache-lookup
-      uses: actions/cache/restore@v5
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}
-        lookup-only: true # Important bit: the action will not fetch anything, just check for the cache existence.
-    - name: Delete the cache entry if it exists
-      if: ${{ steps.cache-lookup.outputs.cache-hit == 'true' }}
-      run: |
-        echo "Cache entry found for key '${{ inputs.key }}'. Deleting it to ensure immutability."
-        gh api \
-          --method DELETE \
-          -H "Accept: application/vnd.github+json" \
-          -H "X-GitHub-Api-Version: 2022-11-28" \
-          /repos/${{ github.repository }}/actions/caches?key=${{ inputs.key }}
-      env:
-        GH_TOKEN: ${{ github.token }}
-      shell: bash
-    - name: Save the new cache entry
-      uses: actions/cache/save@v5
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}

.github/actions/upload-test-results/action.yml

@@ -1,40 +0,0 @@
-name: Upload Test Results to s3
-description: Uploads test results files to s3
-
-inputs:
-  input-path:
-    required: true
-  output-name:
-    required: true
-    default: test
-  role-to-assume:
-    required: true
-  aws-region:
-    required: true
-    default: us-east-1
-  bucket:
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885
-      with:
-        role-to-assume: ${{ inputs.role-to-assume }}
-        aws-region: ${{ inputs.aws-region }}
-    - name: zip test results
-      env:
-        INPUT_DIR: ${{ inputs.input-path }}
-        OUTPUT_FILE: ${{ inputs.output-name }}
-      shell: bash
-      run: | # sh
-        zip ${OUTPUT_FILE}.zip $INPUT_DIR/*.xml
-    - name: Upload test results to S3
-      env:
-        BUCKET: ${{ inputs.bucket }}
-        OUTPUT_FILE: ${{ inputs.output-name }}
-      shell: bash
-      run: | # sh
-        DATE=$(date '+%Y-%m-%d')
-        aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/

.github/actions/verify-membership/action.yml

@@ -1,22 +0,0 @@
-name: 'Verify Organization Membership'
-description: 'Check if a user is a member of a GitHub organization'
-inputs:
-  github_token:
-    description: 'Token with access to the organization'
-    required: true
-  organization_name:
-    description: 'Organization name'
-    required: true
-  username:
-    description: 'Username'
-    required: true
-outputs:
-  is_member:
-    value: ${{ steps.verify-membership.outputs.is_member }}
-    description: "Is the user a member of the organization"
-runs:
-  using: "composite"
-  steps:
-    - run: bash ${{ github.action_path }}/verify_membership.sh ${{ inputs.github_token }} ${{ inputs.organization_name }} ${{ inputs.username }}
-      id: verify-membership
-      shell: bash

.github/actions/verify-membership/verify_membership.sh

@@ -1,25 +0,0 @@
-#!/bin/bash
-
-TOKEN=$1
-ORG_NAME=$2
-USERNAME=$3
-
-response=$(curl -L -o /dev/null -w "%{http_code}" \
-  -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "X-GitHub-Api-Version: 2022-11-28" \
-  "https://api.github.com/orgs/$ORG_NAME/members/$USERNAME")
-
-# Github returns an empty response with 204 status if user is a member and 404 status otherwise
-# See: https://docs.github.com/en/rest/orgs/members?apiVersion=2022-11-28#check-organization-membership-for-a-user
-if [ "$response" == "204" ]; then
-    echo "The user $USERNAME is a member of $ORG_NAME"
-    echo "is_member=true" >> $GITHUB_OUTPUT
-elif [ "$response" == "404" ]; then
-    echo "The user $USERNAME is not a member of $ORG_NAME"
-    echo "is_member=false" >> $GITHUB_OUTPUT
-else
-    echo "Failed to determine the membership status for $USERNAME in $ORG_NAME"
-    echo "is_member=false" >> $GITHUB_OUTPUT
-    exit 1
-fi

.github/file-paths.yaml

@@ -106,13 +106,6 @@ backend_ci: &backend_ci
   - ".github/workflows/backend.yml"
   - ".github/workflows/drivers.yml"
 
-backend_presto_kerberos:
-  - "**/presto_jdbc/**"
-  - "**/presto-jdbc/**" # the driver module has a hyphen. underscores are classpaths
-  - "**/presto_jdbc.clj"
-  - "**/presto_jdbc_test.clj"
-  - ".github/workflows/presto-kerberos-integration-test.yml"
-
 backend_sources: &backend_sources
   - *shared_sources
   - "**deps.edn"
@@ -183,7 +176,7 @@ embedding_sdk_host_sample_apps:
   - "e2e/test-host-app/**/*.cy.*.{js,ts}"
 
 snowplow: &snowplow
-  - ".github/workflows/snowplow.yml"
+  - ".github/workflows/lint.yml"
   - "snowplow/**"
   - "bin/lint-snowplow-schemas.bb"
   - "bin/lint-snowplow-schemas-test.bb"
@@ -212,7 +205,7 @@ yaml:
   - "**/*.yaml"
 
 codeql:
-  - ".github/workflows/codeql.yml"
+  - ".github/workflows/lint.yml"
   - "frontend/src/**"
   - "enterprise/frontend/src/**"
 
@@ -220,26 +213,43 @@ i18n:
   - *default
   - ".github/actions/prepare-frontend/**"
   - ".github/actions/prepare-backend/**"
-  - ".github/workflows/i18n.yml"
+  - ".github/workflows/lint.yml"
   - *sources
 
-visualizations:
-  - "frontend/src/metabase/visualizations/**"
-  - "frontend/src/metabase/static-viz/**"
-  - "src/metabase/pulse/**"
-
 cljs:
   - *shared_sources
   - *shared_specs
   - ".github/workflows/cljs.yml"
   - "shadow-cljs.edn"
 
+embedder_plugin:
+  - ".github/actions/prepare-backend/**"
+  - ".github/file-paths.yaml"
+  - ".github/workflows/build-scripts.yml"
+  - "bin/build-embedder-plugin.sh"
+  - "bin/build/src/build/embedder_model.clj"
+  - "bin/build/src/build/plugin_uberjar.clj"
+  - "bin/build/src/build_embedder_plugin.clj"
+  - "deps.edn"
+  - "modules/embedder/**"
+  - "enterprise/backend/src/metabase_enterprise/data_complexity_score/complexity_embedders.clj"
+  - "enterprise/backend/src/metabase_enterprise/data_complexity_score/settings.clj"
+  - "enterprise/backend/src/metabase_enterprise/data_complexity_score/synonym_source.clj"
+  - "enterprise/backend/src/metabase_enterprise/semantic_search/embedding.clj"
+  - "enterprise/backend/src/metabase_enterprise/semantic_search/settings.clj"
+  - "enterprise/backend/test/metabase_enterprise/semantic_search/appdb_pgvector_mode_test.clj"
+  - "enterprise/backend/test/metabase_enterprise/semantic_search/embedding_test.clj"
+  - "src/metabase/embeddings/provider.clj"
+  - "src/metabase/embeddings/startup.clj"
+  - "src/metabase/plugins/**"
+  - "test/metabase/embeddings/embedder_plugin_artifact_test.clj"
+
 serialization_baseline:
   - ".github/workflows/serialization.yml"
   - "test_resources/serialization_baseline/**"
 
 openapi:
-  - ".github/workflows/openapi.yml"
+  - ".github/workflows/lint.yml"
   - "src/metabase/api/**"
   - "src/metabase/api_routes/**"
   - "src/metabase/*_rest/api.clj"

.github/instructions/e2e.instructions.md

@@ -0,0 +1,12 @@
+---
+applyTo: "e2e/**/*.cy.spec.{js,ts}"
+---
+
+# Cypress E2E Spec Review
+
+When reviewing Cypress E2E specs, apply the guidelines in these files:
+
+- `.claude/skills/_shared/cypress-conventions.md`
+- `.claude/skills/e2e-test-review/SKILL.md`
+
+These are in addition to the TypeScript/JavaScript instructions, which also match these files.

.github/scripts/bundle-size-stats-prepare.js

@@ -1,152 +0,0 @@
-/* eslint-disable import/no-commonjs */
-// Prepares the rows the bundle-size stats logger uploads to stats.metabase.com.
-//
-// For each measured (bundle, kind) it computes the delta — raw, gzipped and
-// brotli (as-served) bytes plus percent — against the previously *plotted* data
-// point (restored from a rolling cache), so the deltas can be charted directly.
-// It also decides whether this commit is worth recording at all: a point is kept
-// when the as-served size moved by at least MIN_DELTA_PERCENT, or when a new
-// bundle/kind appears. Only master builds run through here — releases form
-// non-linear lines whose deltas are meaningless, so they're not recorded (their
-// historical sizes are backfilled separately).
-//
-// buildStatsRows is pure (data in, data out) so it can be unit-tested; main()
-// is the thin I/O wrapper that reads env/files and writes the rows, cache and
-// step outputs.
-const fs = require("fs");
-const path = require("path");
-
-const deltaPercent = (current, base) =>
-  base ? Math.round(((current - base) * 10000) / base) / 100 : "";
-
-/**
- * Turn the current measurements + the last plotted point into upload rows, the
- * slim cache rows for the next diff, and the keep/skip decision.
- *
- * The significance threshold tracks the as-served size: brotli where the build
- * ships a precompressed .br, otherwise gzip. Current measurements always carry
- * brotliBytes (estimated when no .br shipped), but a cached base point recorded
- * before brotli logging may not, so the delta still falls back to gzip per row.
- */
-function buildStatsRows({ measurements, previous, threshold, date, commit, commitMessage, version }) {
-  const previousOf = (bundle, kind) => previous.find(row => row.bundle === bundle && row.kind === kind);
-
-  let maxServedDeltaPercent = 0;
-  let hasNewSeries = false;
-
-  const rows = measurements.map(measurement => {
-    const base = previousOf(measurement.bundle, measurement.kind);
-    const hasBrotli = measurement.brotliBytes != null && base?.brotliBytes != null;
-    const gzipDeltaPercent = deltaPercent(measurement.gzipBytes, base?.gzipBytes);
-    const brotliDeltaPercent = hasBrotli ? deltaPercent(measurement.brotliBytes, base.brotliBytes) : "";
-    if (!base) {
-      hasNewSeries = true;
-    } else {
-      const servedDeltaPercent = hasBrotli ? brotliDeltaPercent : gzipDeltaPercent;
-      maxServedDeltaPercent = Math.max(maxServedDeltaPercent, Math.abs(servedDeltaPercent));
-    }
-    return {
-      "Date": date,
-      "Version": version,
-      "Commit": commit,
-      "Bundle": measurement.bundle,
-      "Kind": measurement.kind, // "initial" or "total"
-      // The stats table carries a free-text Description column; append-csv
-      // requires every table column to be present. Populate it with the commit
-      // subject so the chart's points are self-describing.
-      "Description": commitMessage,
-      "Raw bytes": measurement.rawBytes,
-      "Gzip bytes": measurement.gzipBytes,
-      "Brotli bytes": measurement.brotliBytes, // as-served (shipped .br, else estimated)
-      "File count": measurement.fileCount,
-      "Raw bytes delta": base ? measurement.rawBytes - base.rawBytes : "",
-      "Gzip bytes delta": base ? measurement.gzipBytes - base.gzipBytes : "",
-      "Brotli bytes delta": hasBrotli ? measurement.brotliBytes - base.brotliBytes : "",
-      "Raw delta %": deltaPercent(measurement.rawBytes, base?.rawBytes),
-      "Gzip delta %": gzipDeltaPercent,
-      "Brotli delta %": brotliDeltaPercent,
-    };
-  });
-
-  const firstPoint = previous.length === 0;
-  const significant = firstPoint || hasNewSeries || maxServedDeltaPercent >= threshold;
-
-  // Slim rows the next run diffs against. The workflow only persists this to the
-  // cache when we actually push, so the cached reference always stays the last
-  // *plotted* point (cumulative drift is caught).
-  const cacheRows = measurements.map(({ bundle, kind, rawBytes, gzipBytes, brotliBytes }) => ({
-    bundle,
-    kind,
-    rawBytes,
-    gzipBytes,
-    brotliBytes,
-  }));
-
-  const reason = firstPoint
-    ? "first point"
-    : hasNewSeries
-      ? "new bundle/kind series"
-      : `max served Δ ${maxServedDeltaPercent.toFixed(2)}% (threshold ${threshold}%)`;
-
-  return { rows, cacheRows, significant, reason, maxServedDeltaPercent, firstPoint, hasNewSeries };
-}
-
-module.exports = { buildStatsRows };
-
-const readJson = filePath => (filePath && fs.existsSync(filePath) ? JSON.parse(fs.readFileSync(filePath, "utf8")) : null);
-const writeJson = (filePath, value) => {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, JSON.stringify(value));
-};
-const setOutput = (env, name, value) => {
-  if (env.GITHUB_OUTPUT) {
-    fs.appendFileSync(env.GITHUB_OUTPUT, `${name}=${value}\n`);
-  }
-};
-
-// version.properties (extracted from the uberjar) carries the build's tag.
-// Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
-function readVersion(versionPropsPath) {
-  const raw =
-    versionPropsPath && fs.existsSync(versionPropsPath)
-      ? (fs.readFileSync(versionPropsPath, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
-      : "";
-  return raw === "vUNKNOWN" ? "" : raw;
-}
-
-function main() {
-  const env = process.env;
-
-  const measurements = readJson(env.CURRENT);
-  if (!Array.isArray(measurements) || measurements.length === 0) {
-    console.error(`::error::No bundle measurements found at ${env.CURRENT}`);
-    process.exit(1);
-  }
-
-  const result = buildStatsRows({
-    measurements,
-    // The last plotted point, as slim rows: [{ bundle, kind, rawBytes, gzipBytes, brotliBytes }].
-    previous: readJson(env.LAST) || [],
-    threshold: Number(env.MIN_DELTA_PERCENT ?? 1),
-    date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
-    commit: (env.HEAD_SHA || "").slice(0, 12),
-    commitMessage: (env.COMMIT_MESSAGE || "").split("\n")[0], // subject line only
-    version: readVersion(env.VERSION_PROPS),
-  });
-
-  writeJson(env.ROWS_OUT, result.rows);
-  writeJson(env.CACHE_OUT, result.cacheRows);
-
-  console.log(`${result.significant ? "RECORD" : "SKIP"} — ${result.reason}`);
-
-  setOutput(env, "significant", result.significant ? "true" : "false");
-  setOutput(
-    env,
-    "max_delta_percent",
-    result.firstPoint || result.hasNewSeries ? "" : result.maxServedDeltaPercent.toFixed(2),
-  );
-}
-
-if (require.main === module) {
-  main();
-}

.github/scripts/bundle-size-stats-prepare.ts

@@ -0,0 +1,225 @@
+// Prepares the rows the bundle-size stats logger imports into eng-stats-importer.
+//
+// For each measured (bundle, kind) it computes the delta — raw, gzipped and
+// brotli (as-served) bytes plus percent — against the previously *plotted* data
+// point (restored from a rolling cache), so the deltas can be charted directly.
+// It also decides whether this commit is worth recording at all: a point is kept
+// when the as-served size moved by at least MIN_DELTA_PERCENT, or when a new
+// bundle/kind appears. Only master builds run through here — releases form
+// non-linear lines whose deltas are meaningless, so they're not recorded (their
+// historical sizes are backfilled separately).
+//
+// buildStatsRows is pure (data in, data out) so it can be unit-tested; main()
+// is the thin I/O wrapper that reads env/files and writes the rows, cache and
+// step outputs.
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname } from "node:path";
+
+/** One measurement emitted by measure-bundle-sizes. */
+export interface Measurement {
+  bundle: string;
+  kind: "initial" | "total";
+  rawBytes: number;
+  gzipBytes: number;
+  brotliBytes: number;
+  fileCount: number;
+}
+
+/**
+ * The slim row cached between runs, holding the last *plotted* point.
+ * `brotliBytes` is optional because a point cached before brotli logging
+ * landed does not carry it — see buildStatsRows' per-row gzip fallback.
+ */
+export type CacheRow = Pick<Measurement, "bundle" | "kind" | "rawBytes" | "gzipBytes"> & {
+  brotliBytes?: number;
+};
+
+export interface BuildStatsRowsInput {
+  measurements: Measurement[];
+  previous: CacheRow[];
+  threshold: number;
+  date: string;
+  commit: string;
+  commitMessage: string;
+  version: string;
+}
+
+/** An upload row, keyed by the importer's column display names. */
+export type StatsRow = Record<string, string | number | null>;
+
+export interface BuildStatsRowsResult {
+  rows: StatsRow[];
+  cacheRows: CacheRow[];
+  significant: boolean;
+  reason: string;
+  maxServedDeltaPercent: number;
+  firstPoint: boolean;
+  hasNewSeries: boolean;
+}
+
+// null, not "", for an absent delta: the stats importer coerces values
+// strictly and rejects "" for a numeric column.
+const deltaPercent = (current: number, base: number | undefined | null): number | null =>
+  base ? Math.round(((current - base) * 10000) / base) / 100 : null;
+
+/**
+ * Turn the current measurements + the last plotted point into upload rows, the
+ * slim cache rows for the next diff, and the keep/skip decision.
+ *
+ * The significance threshold tracks the as-served size: brotli where the build
+ * ships a precompressed .br, otherwise gzip. Current measurements always carry
+ * brotliBytes (estimated when no .br shipped), but a cached base point recorded
+ * before brotli logging may not, so the delta still falls back to gzip per row.
+ */
+export function buildStatsRows({
+  measurements,
+  previous,
+  threshold,
+  date,
+  commit,
+  commitMessage,
+  version,
+}: BuildStatsRowsInput): BuildStatsRowsResult {
+  const previousOf = (bundle: string, kind: string) =>
+    previous.find((row) => row.bundle === bundle && row.kind === kind);
+
+  let maxServedDeltaPercent = 0;
+  let hasNewSeries = false;
+
+  const rows = measurements.map((measurement): StatsRow => {
+    const base = previousOf(measurement.bundle, measurement.kind);
+    // Non-null only when BOTH sides carry brotli: a point cached before brotli
+    // logging landed has none, and that row falls back to the gzip delta.
+    const baseBrotli =
+      measurement.brotliBytes != null && base?.brotliBytes != null ? base.brotliBytes : null;
+    const gzipDeltaPercent = deltaPercent(measurement.gzipBytes, base?.gzipBytes);
+    const brotliDeltaPercent =
+      baseBrotli != null ? deltaPercent(measurement.brotliBytes, baseBrotli) : null;
+    if (!base) {
+      hasNewSeries = true;
+    } else {
+      const servedDeltaPercent = baseBrotli != null ? brotliDeltaPercent : gzipDeltaPercent;
+      maxServedDeltaPercent = Math.max(maxServedDeltaPercent, Math.abs(servedDeltaPercent ?? 0));
+    }
+    return {
+      Date: date,
+      Version: version,
+      Commit: commit,
+      Bundle: measurement.bundle,
+      Kind: measurement.kind, // "initial" or "total"
+      // The stats table carries a free-text Description column. Populate it
+      // with the commit subject so the chart's points are self-describing.
+      Description: commitMessage,
+      "Raw bytes": measurement.rawBytes,
+      "Gzip bytes": measurement.gzipBytes,
+      "Brotli bytes": measurement.brotliBytes, // as-served (shipped .br, else estimated)
+      "File count": measurement.fileCount,
+      "Raw bytes delta": base ? measurement.rawBytes - base.rawBytes : null,
+      "Gzip bytes delta": base ? measurement.gzipBytes - base.gzipBytes : null,
+      "Brotli bytes delta": baseBrotli != null ? measurement.brotliBytes - baseBrotli : null,
+      "Raw delta %": deltaPercent(measurement.rawBytes, base?.rawBytes),
+      "Gzip delta %": gzipDeltaPercent,
+      "Brotli delta %": brotliDeltaPercent,
+    };
+  });
+
+  const firstPoint = previous.length === 0;
+  const significant = firstPoint || hasNewSeries || maxServedDeltaPercent >= threshold;
+
+  // Slim rows the next run diffs against. The workflow only persists this to the
+  // cache when we actually push, so the cached reference always stays the last
+  // *plotted* point (cumulative drift is caught).
+  const cacheRows = measurements.map(
+    ({ bundle, kind, rawBytes, gzipBytes, brotliBytes }): CacheRow => ({
+      bundle,
+      kind,
+      rawBytes,
+      gzipBytes,
+      brotliBytes,
+    }),
+  );
+
+  const reason = firstPoint
+    ? "first point"
+    : hasNewSeries
+      ? "new bundle/kind series"
+      : `max served Δ ${maxServedDeltaPercent.toFixed(2)}% (threshold ${threshold}%)`;
+
+  return {
+    rows,
+    cacheRows,
+    significant,
+    reason,
+    maxServedDeltaPercent,
+    firstPoint,
+    hasNewSeries,
+  };
+}
+
+const readJson = <T,>(filePath: string | undefined): T | null =>
+  filePath && existsSync(filePath) ? (JSON.parse(readFileSync(filePath, "utf8")) as T) : null;
+
+const writeJson = (filePath: string, value: unknown) => {
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, JSON.stringify(value));
+};
+
+const setOutput = (name: string, value: string) => {
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
+  }
+};
+
+// version.properties (extracted from the uberjar) carries the build's tag.
+// Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
+function readVersion(versionPropsPath: string | undefined): string {
+  const raw =
+    versionPropsPath && existsSync(versionPropsPath)
+      ? (readFileSync(versionPropsPath, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
+      : "";
+  return raw === "vUNKNOWN" ? "" : raw;
+}
+
+export function main() {
+  const env = process.env;
+
+  const measurements = readJson<Measurement[]>(env.CURRENT);
+  if (!Array.isArray(measurements) || measurements.length === 0) {
+    console.error(`::error::No bundle measurements found at ${env.CURRENT}`);
+    process.exit(1);
+  }
+
+  const result = buildStatsRows({
+    measurements,
+    // The last plotted point, as slim rows: [{ bundle, kind, rawBytes, gzipBytes, brotliBytes }].
+    previous: readJson<CacheRow[]>(env.LAST) || [],
+    threshold: Number(env.MIN_DELTA_PERCENT ?? 1),
+    date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+    commit: (env.HEAD_SHA || "").slice(0, 12),
+    commitMessage: (env.COMMIT_MESSAGE || "").split("\n")[0], // subject line only
+    version: readVersion(env.VERSION_PROPS),
+  });
+
+  writeJson(env.ROWS_OUT!, result.rows);
+  writeJson(env.CACHE_OUT!, result.cacheRows);
+
+  console.log(`${result.significant ? "RECORD" : "SKIP"} — ${result.reason}`);
+
+  setOutput("significant", result.significant ? "true" : "false");
+  setOutput(
+    "max_delta_percent",
+    result.firstPoint || result.hasNewSeries ? "" : result.maxServedDeltaPercent.toFixed(2),
+  );
+}
+
+// Only run the I/O wrapper when invoked directly, so importing buildStatsRows
+// (from the spec) has no side effects.
+if ((import.meta as ImportMeta & { main?: boolean }).main) {
+  main();
+}

.github/scripts/bundle-size-stats-prepare.unit.spec.ts

@@ -1,7 +1,16 @@
-const { buildStatsRows } = require("./bundle-size-stats-prepare");
+import {
+  buildStatsRows,
+  type CacheRow,
+  type Measurement,
+} from "./bundle-size-stats-prepare";
 
-const meta = { date: "2026-06-30", commit: "abc123", commitMessage: "Fix the thing (#123)", version: "" };
-const measurement = (over = {}) => ({
+const meta = {
+  date: "2026-06-30",
+  commit: "abc123",
+  commitMessage: "Fix the thing (#123)",
+  version: "",
+};
+const measurement = (over: Partial<Measurement> = {}): Measurement => ({
   bundle: "embedding-sdk-chunked",
   kind: "total",
   rawBytes: 1000,
@@ -23,8 +32,8 @@ describe("buildStatsRows", () => {
     expect(result.firstPoint).toBe(true);
     expect(result.significant).toBe(true);
     expect(result.reason).toBe("first point");
-    expect(result.rows[0]["Gzip bytes delta"]).toBe("");
-    expect(result.rows[0]["Brotli delta %"]).toBe("");
+    expect(result.rows[0]["Gzip bytes delta"]).toBeNull();
+    expect(result.rows[0]["Brotli delta %"]).toBeNull();
     expect(result.rows[0]["Description"]).toBe("Fix the thing (#123)");
     expect(result.cacheRows[0]).toEqual({
       bundle: "embedding-sdk-chunked",
@@ -49,7 +58,15 @@ describe("buildStatsRows", () => {
   });
 
   it("gates significance on the brotli (as-served) delta when both sides have it", () => {
-    const previous = [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400, brotliBytes: 300 }];
+    const previous: CacheRow[] = [
+      {
+        bundle: "embedding-sdk-chunked",
+        kind: "total",
+        rawBytes: 1000,
+        gzipBytes: 400,
+        brotliBytes: 300,
+      },
+    ];
 
     const big = buildStatsRows({
       ...meta,
@@ -75,13 +92,14 @@ describe("buildStatsRows", () => {
     const result = buildStatsRows({
       ...meta,
       measurements: [measurement({ gzipBytes: 440, brotliBytes: 300 })], // gzip +10%
+      // No brotliBytes: this point was cached before brotli logging landed.
       previous: [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400 }],
       threshold: 1,
     });
 
     expect(result.maxServedDeltaPercent).toBeCloseTo(10);
     expect(result.significant).toBe(true);
-    expect(result.rows[0]["Brotli bytes delta"]).toBe(""); // no base brotli to diff against
+    expect(result.rows[0]["Brotli bytes delta"]).toBeNull(); // no base brotli to diff against
     expect(result.rows[0]["Gzip delta %"]).toBeCloseTo(10);
   });
 });

.github/scripts/cache-keys.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# Single definition of every CI dependency cache: what it holds, what identifies it, what it falls back to.
+#
+# A GitHub cache entry is identified by its key, a hash of the declared path list, and the ref that saved
+# it. A step declaring a different path list than the one a cache was saved with computes a different
+# identity and can never match it, whatever its key says. So paths and keys are emitted together here and
+# every cache step takes both from this script.
+#
+# Emits `name=value` lines in $GITHUB_OUTPUT format:
+#
+#   .github/scripts/cache-keys.sh >> "$GITHUB_OUTPUT"
+#
+# Run it with no redirect to see the whole scheme, or pass one name to print a single value:
+#
+#   .github/scripts/cache-keys.sh
+#   .github/scripts/cache-keys.sh m2-key
+#
+# Hashes are computed here rather than with GitHub's hashFiles() so that a local run and a CI run of the
+# same commit produce the same keys, and so that an empty match can fail loudly - a hashFiles() call that
+# matches nothing silently yields "", collapsing the key onto its own restore prefix and pointing every
+# dependency set at one entry.
+
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+OS="${RUNNER_OS:-$(uname -s)}"
+[ "$OS" = "Darwin" ] && OS="macOS"
+
+sha256() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | cut -d' ' -f1
+  else
+    shasum -a 256 | cut -d' ' -f1
+  fi
+}
+
+# Digest of a set of files: hash each one, then hash the concatenation, so the result depends on every
+# file's contents and on which files exist.
+digest() {
+  local f
+  if [ "$#" -eq 0 ]; then
+    echo "::error::cache-keys.sh: no files matched; refusing to emit a key that would collide across dependency sets" >&2
+    exit 1
+  fi
+  for f in "$@"; do
+    [ -f "$f" ] || { echo "::error::cache-keys.sh: $f does not exist" >&2; exit 1; }
+    sha256 < "$f"
+  done | sha256
+}
+
+shopt -s nullglob
+DEPS_FILES=(deps.edn modules/drivers/deps.edn modules/drivers/*/deps.edn)
+shopt -u nullglob
+
+DEPS_HASH="$(digest "${DEPS_FILES[@]}")"
+LOCK_HASH="$(digest bun.lock)"
+
+# The Cypress binary depends on the Cypress version alone, so keying it on the whole lockfile would
+# throw away a 200MB download every time any frontend dependency moved.
+#
+# Reading a version out of a lockfile with a regex is only safe while exactly one line matches. Insist
+# on that rather than taking the first of several: a second match means the format moved under us, and
+# picking one at random would key the binary under a version it is not.
+CYPRESS_VERSIONS="$(sed -n 's/.*"cypress": \["cypress@\([^"]*\)".*/\1/p' bun.lock)"
+CYPRESS_MATCHES="$(printf '%s\n' "$CYPRESS_VERSIONS" | grep -c . || true)"
+if [ "$CYPRESS_MATCHES" != "1" ]; then
+  echo "::error::cache-keys.sh: expected exactly one resolved cypress version in bun.lock, found $CYPRESS_MATCHES" >&2
+  exit 1
+fi
+CYPRESS_VERSION="$CYPRESS_VERSIONS"
+
+# An incremental lint cache is only ever an accelerator, so it keys on the commit and always falls back
+# to the newest entry on the prefix. The exact key never pre-exists, which keeps the entry current.
+ESLINT_SHA="${GITHUB_SHA:-$(git rev-parse HEAD)}"
+
+emit_multiline() {
+  local name="$1"; shift
+  printf '%s<<CACHE_KEYS_EOF\n' "$name"
+  printf '%s\n' "$@"
+  printf 'CACHE_KEYS_EOF\n'
+}
+
+# Paths under the home directory are emitted absolute rather than as `~/...`. actions/cache would expand
+# a tilde, but a shell assigning one of these to a variable would not, and would go on to create a
+# directory named `~`. Paths inside the checkout stay relative; actions/cache resolves those against the
+# workspace.
+spec() {
+  emit_multiline m2-path "$HOME/.m2" "$HOME/.gitlibs" "$HOME/.deps.clj" 'bin/bb'
+  echo "m2-key=M2-$OS-$DEPS_HASH"
+  echo "m2-restore-key=M2-$OS-"
+
+  # Pinned rather than discovered via `bun pm cache` so that the path is known before bun is installed;
+  # prepare-frontend exports BUN_INSTALL_CACHE_DIR to match and fails if bun disagrees.
+  echo "bun-store-path=$HOME/.bun/install/cache"
+  echo "bun-store-key=bun-store-$OS-$LOCK_HASH"
+  echo "bun-store-restore-key=bun-store-$OS-"
+
+  echo "cypress-path=$HOME/.cache/Cypress"
+  echo "cypress-key=cypress-$OS-$CYPRESS_VERSION"
+  echo "cypress-restore-key=cypress-$OS-"
+
+  echo "eslint-path=.eslintcache"
+  echo "eslint-key=eslint-$OS-$ESLINT_SHA"
+  echo "eslint-restore-key=eslint-$OS-"
+}
+
+# Print one output's value, including the multiline form, and fail on a name that does not exist. A
+# caller that silently received "" would go on to build a key with a hole in it.
+query() {
+  local want="$1" line delim found=0 in_block=0
+  while IFS= read -r line; do
+    if [ "$in_block" = 1 ]; then
+      if [ "$line" = "$delim" ]; then
+        in_block=0
+      else
+        printf '%s\n' "$line"
+      fi
+      continue
+    fi
+    case "$line" in
+      "$want="*)
+        printf '%s\n' "${line#*=}"
+        found=1
+        ;;
+      "$want<<"*)
+        delim="${line#*<<}"
+        in_block=1
+        found=1
+        ;;
+    esac
+  done <<EOF
+$(spec)
+EOF
+  if [ "$found" = 0 ]; then
+    echo "::error::cache-keys.sh: no output named '$want'" >&2
+    exit 1
+  fi
+}
+
+if [ "$#" -eq 0 ]; then
+  spec
+else
+  query "$1"
+fi

.github/scripts/cache-keys.unit.spec.ts

@@ -0,0 +1,80 @@
+import { execFileSync } from "child_process";
+import { join } from "path";
+
+const SCRIPT = join(__dirname, "cache-keys.sh");
+
+const CACHES = ["m2", "bun-store", "cypress", "eslint"];
+
+// stderr is inherited by default, so the deliberate-failure case below would print a literal
+// `::error::` line - which GitHub Actions reads as an annotation directive, making a passing run
+// annotate itself with an error.
+const run = (args: string[] = [], env: NodeJS.ProcessEnv = {}, quiet = false) =>
+  execFileSync(SCRIPT, args, {
+    encoding: "utf8",
+    stdio: quiet ? ["ignore", "pipe", "ignore"] : "pipe",
+    env: { ...process.env, RUNNER_OS: "Linux", GITHUB_SHA: "abc123", ...env },
+  });
+
+const get = (name: string, env: NodeJS.ProcessEnv = {}) =>
+  run([name], env).trimEnd();
+
+describe("cache-keys.sh", () => {
+  it("is deterministic for a given tree", () => {
+    expect(run()).toEqual(run());
+  });
+
+  it("emits every cache's path, key and restore key", () => {
+    for (const cache of CACHES) {
+      expect(get(`${cache}-path`)).not.toEqual("");
+      expect(get(`${cache}-key`)).not.toEqual("");
+      expect(get(`${cache}-restore-key`)).not.toEqual("");
+    }
+  });
+
+  // Silently returning "" for a name that does not exist is how a caller ends up building a key with a
+  // hole in it.
+  it("fails on an unknown output name", () => {
+    expect(() => run(["no-such-output"], {}, true)).toThrow();
+  });
+
+  // A key equal to its own restore prefix points every dependency set at one entry, and nothing reports
+  // it. This is the failure the script exists to prevent.
+  it("never emits a key equal to its own restore prefix", () => {
+    for (const cache of CACHES) {
+      const key = get(`${cache}-key`);
+      const prefix = get(`${cache}-restore-key`);
+      expect(key.startsWith(prefix)).toBe(true);
+      expect(key.length).toBeGreaterThan(prefix.length);
+    }
+  });
+
+  it("scopes every key to the runner OS", () => {
+    for (const cache of CACHES) {
+      expect(get(`${cache}-key`, { RUNNER_OS: "Linux" })).not.toEqual(
+        get(`${cache}-key`, { RUNNER_OS: "macOS" }),
+      );
+    }
+  });
+
+  // Home paths must be absolute: actions/cache expands a tilde but a shell assigning one to a variable
+  // does not, and would create a directory literally named `~`.
+  it("emits absolute paths for home directory locations", () => {
+    expect(get("bun-store-path").startsWith("/")).toBe(true);
+    expect(get("cypress-path").startsWith("/")).toBe(true);
+    for (const line of get("m2-path").split("\n")) {
+      expect(line.startsWith("~")).toBe(false);
+    }
+  });
+
+  // The Cypress binary depends on the Cypress version alone, so an unrelated dependency bump must not
+  // invalidate a 200MB download.
+  it("keys the Cypress binary on the resolved version, not the lockfile", () => {
+    expect(get("cypress-key")).toMatch(/^cypress-Linux-\d+\.\d+\.\d+/);
+  });
+
+  it("keys the ESLint cache on the commit", () => {
+    expect(get("eslint-key", { GITHUB_SHA: "deadbeef" })).toEqual(
+      "eslint-Linux-deadbeef",
+    );
+  });
+});

.github/scripts/check-preresolve-aliases.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Fails when a `clojure` invocation under .github/ uses an alias combination that cache-warm does not
+# pre-resolve.
+#
+# tools.deps selects dependency versions globally per classpath, so two alias combinations can resolve
+# the same transitive library to different versions. A combination the warm job never resolved is
+# therefore not merely absent from the cache - the cache holds *a* version of those libraries, just not
+# the one this classpath wants, and the job fetches its delta straight from Maven Central on every run.
+# That is the intermittent-403 failure of DEV-2094, and it is invisible: the build still passes.
+#
+# Nothing about a missing combination shows up at runtime, so this check is the only thing standing
+# between a newly added alias combination and a permanently half-cold cache.
+#
+#   .github/scripts/check-preresolve-aliases.sh
+
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+WARM=.github/workflows/cache-warm.yml
+
+# Invocations deliberately left out of the warm job. Each needs a reason, because the default answer is
+# to add the combination to the list instead.
+WAIVED="$(
+  cat <<'EOF'
+:deps
+:outdated
+EOF
+)"
+# :deps      - tools.deps built-in used by write-poms.sh; contributes no dependencies of its own.
+# :outdated  - scheduled dependency-bump workflow only; a cold resolve there costs nothing anyone waits on.
+
+# Alias combinations the warm job pre-resolves.
+declared="$(sed -n '/combos=(/,/^ *)/p' "$WARM" | grep -oE '":[^"]*"' | tr -d '"' | sort -u)"
+if [ -z "$declared" ]; then
+  echo "::error::check-preresolve-aliases.sh: found no combos=( ... ) list in $WARM" >&2
+  exit 1
+fi
+
+# Expressions we know how to expand. An unrecognised one has to stop the check rather than be skipped:
+# silently ignoring it is how a whole matrix of combinations would go unchecked.
+unknown="$(grep -rhoE '\$\{\{[^}]*\}\}' --include='*' \
+             --exclude='*.png' --exclude='*.jpg' .github/ 2>/dev/null \
+           | sort -u | grep -v 'edition' || true)"
+
+scan() { # scan <edition>: alias strings used by clojure invocations, with expressions substituted
+  grep -rhE 'clojure[[:space:]]+(-P[[:space:]]+)?-[XMATP]?:' \
+       --include='*' --exclude='*.png' --exclude='*.jpg' .github/ 2>/dev/null \
+    | sed "s/\\\${{[^}]*edition[^}]*}}/$1/g" \
+    | grep -oE 'clojure[[:space:]]+(-P[[:space:]]+)?-[XMATP]?:[A-Za-z0-9:_.-]+' \
+    | grep -oE ':[A-Za-z0-9:_.-]+' \
+    | sed 's/:$//'
+}
+
+found="$( { scan ee; scan oss; } | sort -u )"
+
+covered="$(printf '%s\n%s\n' "$declared" "$WAIVED" | sort -u)"
+missing="$(comm -23 <(printf '%s\n' "$found") <(printf '%s\n' "$covered") || true)"
+
+if [ -n "$missing" ]; then
+  echo "::error::Alias combinations used under .github/ that cache-warm does not pre-resolve:" >&2
+  printf '%s\n' "$missing" | sed 's/^/  /' >&2
+  echo >&2
+  echo "Add each to the combos list in $WARM, or waive it in this script with a reason." >&2
+  echo "Leaving it uncovered means those jobs re-fetch their version deltas from Maven on every run." >&2
+  exit 1
+fi
+
+echo "All $(printf '%s\n' "$found" | grep -c .) clojure alias combinations under .github/ are pre-resolved."

.github/scripts/csv-to-mb.js

@@ -1,91 +0,0 @@
-/**
- * jsonData must be in the format:
- * [
- *   { column1: value1, column2: value2, ... },
- *   { column1: value3, column2: value4, ... },
- *   ...
- * ]
- */
-function jsonToCsvFormData(jsonData) {
-  const formData = new FormData();
-  const csvHeader = Object.keys(jsonData[0]).join(',') + '\n';
-  const csvContent = jsonData.map(row =>
-    Object.values(row).map(value => `"${String(value).replace(/"/g, '""')}"`).join(',')
-  ).join('\n');
-
-  const blob = new Blob([csvHeader + csvContent], { type: 'text/csv' });
-  formData.append('file', blob, 'data.csv');
-
-  return formData;
-}
-
-// Transient failures worth retrying: throttling and server-side errors. A 4xx
-// (bad request, auth) won't succeed on retry, so those fail fast.
-const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
-
-class UploadError extends Error {
-  constructor(message, { retryable }) {
-    super(message);
-    this.retryable = retryable;
-  }
-}
-
-async function attemptUpload(url, jsonData, timeoutMs) {
-  let response;
-  try {
-    response = await fetch(url, {
-      method: 'POST',
-      headers: {
-        "x-api-key": process.env.API_KEY
-      },
-      // Rebuilt per attempt: a consumed request body can't be reused.
-      body: jsonToCsvFormData(jsonData),
-      // Without this the request can hang indefinitely on a stalled server,
-      // eating the whole job timeout. An abort surfaces below as a retryable
-      // network error, so it retries with backoff instead.
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-  } catch (networkError) {
-    throw new UploadError(networkError.message, { retryable: true });
-  }
-
-  if (response.ok) {
-    return;
-  }
-
-  const body = await response.text().catch(() => '');
-  throw new UploadError(
-    `Upload failed: ${response.status} ${response.statusText} ${body}`.trim(),
-    { retryable: RETRYABLE_STATUS.has(response.status) }
-  );
-}
-
-const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
-
-/**
- * Uploads jsonData as CSV, retrying transient API errors with exponential
- * backoff. `retries` is the number of extra attempts after the first (so the
- * default 2 means up to 3 tries). `timeoutMs` is a per-attempt total deadline
- * (default 60s) that aborts a stalled request. Throws the last error once
- * attempts are exhausted or the error is non-retryable.
- */
-async function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append', retries = 2, retryDelayMs = 1000, timeoutMs = 60_000 }) {
-  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
-  const url = `${baseUrl}/api/table/${tableId}/${operation}`;
-
-  for (let attempt = 0; ; attempt++) {
-    try {
-      await attemptUpload(url, jsonData, timeoutMs);
-      return { success: true };
-    } catch (error) {
-      if (!error.retryable || attempt >= retries) {
-        throw error;
-      }
-      const delay = retryDelayMs * 2 ** attempt;
-      console.warn(`Upload attempt ${attempt + 1} failed (${error.message}); retrying in ${delay}ms`);
-      await sleep(delay);
-    }
-  }
-}
-
-module.exports = { uploadCsvToMb };

.github/scripts/csv-to-mb.unit.spec.js

@@ -1,50 +0,0 @@
-const { uploadCsvToMb } = require("./csv-to-mb");
-
-const ok = () => ({ ok: true });
-const fail = status => ({ ok: false, status, statusText: "err", text: async () => "" });
-
-const upload = (over = {}) =>
-  uploadCsvToMb({
-    baseUrl: "https://stats.example.com",
-    tableId: 1,
-    jsonData: [{ a: 1 }],
-    retryDelayMs: 1,
-    ...over,
-  });
-
-describe("uploadCsvToMb retries", () => {
-  afterEach(() => {
-    delete global.fetch;
-  });
-
-  it("retries transient server errors then succeeds", async () => {
-    global.fetch = jest.fn().mockResolvedValueOnce(fail(503)).mockResolvedValueOnce(fail(500)).mockResolvedValueOnce(ok());
-
-    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
-    expect(global.fetch).toHaveBeenCalledTimes(3);
-  });
-
-  it("retries network errors", async () => {
-    global.fetch = jest
-      .fn()
-      .mockRejectedValueOnce(new Error("ECONNRESET"))
-      .mockResolvedValueOnce(ok());
-
-    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
-    expect(global.fetch).toHaveBeenCalledTimes(2);
-  });
-
-  it("gives up after exhausting retries and throws the last error", async () => {
-    global.fetch = jest.fn().mockResolvedValue(fail(500));
-
-    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 500");
-    expect(global.fetch).toHaveBeenCalledTimes(3); // 1 initial + 2 retries
-  });
-
-  it("does not retry a non-transient 4xx", async () => {
-    global.fetch = jest.fn().mockResolvedValue(fail(400));
-
-    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 400");
-    expect(global.fetch).toHaveBeenCalledTimes(1);
-  });
-});

.github/scripts/find-linear-issue.js

@@ -1,40 +0,0 @@
-async function findLinearIssue({ githubIssueUrl, linearApiKey }) {
-  const response = await fetch("https://api.linear.app/graphql", {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: linearApiKey,
-    },
-    body: JSON.stringify({
-      query: `
-        query {
-          attachmentsForURL(url: "${githubIssueUrl}") {
-            nodes {
-              issue { identifier }
-            }
-          }
-        }
-      `,
-    }),
-  });
-
-  const data = await response.json();
-
-  if (!response.ok) {
-    return { success: false, message: `Linear API error: ${response.status}` };
-  }
-
-  if (!data.data?.attachmentsForURL?.nodes?.length) {
-    return {
-      success: false,
-      message: `No Linear issue linked to ${githubIssueUrl}`,
-    };
-  }
-
-  return {
-    success: true,
-    issue: data.data.attachmentsForURL.nodes[0].issue.identifier,
-  };
-}
-
-module.exports = { findLinearIssue };

.github/scripts/fix-yarn-lock-aliases.ts

@@ -0,0 +1,66 @@
+/**
+ * Renames aliased dependency keys in a bun-generated yarn.lock.
+ *
+ * Yarn names an alias entry after the alias, for example
+ * `"typescript7@npm:typescript@7.0.2"`. Bun names it after the aliased package
+ * instead, for example `"typescript@npm:typescript@7.0.2"`. Snyk follows the
+ * yarn convention and fails to resolve the dependency.
+ */
+
+import { readFile, writeFile } from "node:fs/promises";
+
+async function main() {
+  const packageJsonPath = `${process.cwd()}/package.json`;
+  const lockPath = `${process.cwd()}/yarn.lock`;
+
+  const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
+
+  const dependencies = Object.entries<string>(
+    Object.assign(
+      {},
+      packageJson.dependencies,
+      packageJson.devDependencies,
+      packageJson.optionalDependencies,
+    ),
+  );
+
+  let lock = await readFile(lockPath, "utf8");
+  const renamedKeys: string[] = [];
+
+  for (const [alias, specifier] of dependencies) {
+    if (!specifier.startsWith("npm:")) {
+      continue;
+    }
+
+    const aliasedPackage = specifier
+      .slice("npm:".length)
+      .replace(/@[^@]*$/, "");
+
+    if (aliasedPackage === alias) {
+      continue;
+    }
+
+    const bunKey = `"${aliasedPackage}@${specifier}"`;
+    const yarnKey = `"${alias}@${specifier}"`;
+
+    if (lock.includes(bunKey)) {
+      lock = lock.replaceAll(bunKey, yarnKey);
+      renamedKeys.push(`${bunKey} -> ${yarnKey}`);
+    }
+  }
+
+  if (renamedKeys.length > 0) {
+    await writeFile(lockPath, lock);
+  }
+
+  process.stdout.write(
+    renamedKeys.length > 0
+      ? `Renamed alias keys in yarn.lock:\n${renamedKeys.join("\n")}\n`
+      : "No alias keys to rename in yarn.lock\n",
+  );
+}
+
+main().catch((error) => {
+  process.stderr.write(`Failed to rename alias keys in yarn.lock: ${error}\n`);
+  process.exit(1);
+});

.github/scripts/get-issue-data.js

@@ -1,84 +0,0 @@
-const githubSlackMap = require("../../release/github-slack-map.json");
-
-async function getIssueData({ context, github, manualIssueNumber }) {
-  let issueNumber;
-  let issueData;
-  let prReviews = [];
-  const triggerType = context.eventName;
-
-  if (context.eventName === "issues") {
-    issueNumber = context.payload.issue.number;
-    issueData = context.payload.issue;
-  } else if (context.eventName === "workflow_dispatch") {
-    issueNumber = parseInt(manualIssueNumber);
-    const { data } = await github.rest.issues.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      issue_number: issueNumber,
-    });
-    issueData = data;
-  } else if (context.eventName === "pull_request_review") {
-    const prNumber = context.payload.pull_request.number;
-    const { data: prData } = await github.rest.pulls.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      pull_number: prNumber,
-    });
-
-    // Extract issue number from branch name (e.g., "claude-fix/issue-12345-some-title")
-    const branchMatch = prData.head.ref.match(/claude-fix\/issue-(\d+)/);
-    if (!branchMatch) {
-      throw new Error(
-        `Could not extract issue number from branch name: ${prData.head.ref}`,
-      );
-    }
-
-    issueNumber = parseInt(branchMatch[1]);
-
-    const { data } = await github.rest.issues.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      issue_number: issueNumber,
-    });
-    issueData = data;
-
-    const { data: reviews } = await github.rest.pulls.listReviews({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      pull_number: prNumber,
-    });
-
-    prReviews = reviews.filter(
-      (review) =>
-        review.state === "CHANGES_REQUESTED" &&
-        isMetabaseMember(review.user.login),
-    );
-  }
-
-  const { data: comments } = await github.rest.issues.listComments({
-    owner: context.repo.owner,
-    repo: context.repo.repo,
-    issue_number: issueNumber,
-  });
-
-  const employeeComments = comments.filter((comment) =>
-    isMetabaseMember(comment.user.login),
-  );
-
-  return {
-    issueNumber,
-    issueData,
-    employeeComments,
-    prReviews,
-    triggerType,
-    isIssueAuthorEmployee: isMetabaseMember(issueData.user.login),
-  };
-}
-
-function isMetabaseMember(username) {
-  return username in githubSlackMap;
-}
-
-module.exports = {
-  getIssueData,
-};

.github/scripts/linear-issues.js

@@ -0,0 +1,109 @@
+async function findLinearIssue({ githubIssueUrl, linearApiKey }) {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: linearApiKey,
+    },
+    body: JSON.stringify({
+      query: `
+        query {
+          attachmentsForURL(url: "${githubIssueUrl}") {
+            nodes {
+              issue { identifier }
+            }
+          }
+        }
+      `,
+    }),
+  });
+
+  const data = await response.json();
+
+  if (!response.ok) {
+    return { success: false, message: `Linear API error: ${response.status}` };
+  }
+
+  if (!data.data?.attachmentsForURL?.nodes?.length) {
+    return {
+      success: false,
+      message: `No Linear issue linked to ${githubIssueUrl}`,
+    };
+  }
+
+  return {
+    success: true,
+    issue: data.data.attachmentsForURL.nodes[0].issue.identifier,
+  };
+}
+
+async function createLinearIssue({
+  teamId,
+  title,
+  description,
+  projectId,
+  labelIds,
+  linearApiKey,
+}) {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: linearApiKey,
+    },
+    body: JSON.stringify({
+      query: `
+        mutation CreateIssue($input: IssueCreateInput!) {
+          issueCreate(input: $input) {
+            success
+            issue {
+              id
+              identifier
+              title
+              url
+            }
+          }
+        }
+      `,
+      variables: {
+        input: {
+          teamId,
+          title,
+          ...(description ? { description } : {}),
+          ...(projectId ? { projectId } : {}),
+          ...(labelIds?.length ? { labelIds } : {}),
+        },
+      },
+    }),
+  });
+
+  if (!response.ok) {
+    return { success: false, message: `Linear API error: ${response.status}` };
+  }
+
+  const data = await response.json();
+
+  if (data.errors?.length) {
+    return {
+      success: false,
+      message: `Linear API error: ${data.errors.map((e) => e.message).join(", ")}`,
+    };
+  }
+
+  if (!data.data?.issueCreate?.success) {
+    return {
+      success: false,
+      message: `Failed to create Linear issue "${title}"`,
+    };
+  }
+
+  return {
+    success: true,
+    issue: data.data.issueCreate.issue,
+  };
+}
+
+module.exports = {
+  findLinearIssue,
+  createLinearIssue,
+};

.github/scripts/run-presto-kerberos-integration-test.sh

@@ -1,65 +0,0 @@
-#! /usr/bin/env bash
-# runs one or more Metabase test(s) against a Kerberized Presto instance
-set -eo pipefail
-
-# Need Java commands on $PATH, which apparently is not yet the case
-export JAVA_HOME="/usr/lib/jvm/msopenjdk-current"
-export PATH="$PATH:$JAVA_HOME/bin"
-
-# ensure java commmand is available
-which java
-
-# install clojure version needed for Metabase
-curl -O https://download.clojure.org/install/linux-install-1.12.0.1488.sh
-chmod +x linux-install-1.12.0.1488.sh
-./linux-install-1.12.0.1488.sh
-
-RESOURCES_DIR=/app/source/resources
-
-# ensure the expected files are in place, in the resources dir
-if [ ! -f "$RESOURCES_DIR/ssl_keystore.jks" ]; then
-  echo "$RESOURCES_DIR/ssl_keystore.jks does not exist; cannot run test" >&2
-  exit 11
-fi
-
-if [ ! -f "$RESOURCES_DIR/krb5.conf" ]; then
-  echo "$RESOURCES_DIR/krb5.conf does not exist; cannot run test" >&2
-  exit 12
-fi
-
-if [ ! -f "$RESOURCES_DIR/client.keytab" ]; then
-  echo "$RESOURCES_DIR/client.keytab does not exist; cannot run test" >&2
-  exit 13
-fi
-
-# Copy the JDK cacerts file to our resources
-cp $JAVA_HOME/lib/security/cacerts $RESOURCES_DIR/cacerts-with-presto-ca.jks
-
-# Capture the Presto server self signed CA in PEM format
-openssl s_client -showcerts -connect presto-kerberos:7778 </dev/null \
-  | openssl x509 -outform PEM >$RESOURCES_DIR/presto-ssl-root-ca.pem
-
-# Convert the Presto server self signed CA to DER format
-openssl x509 -outform der -in $RESOURCES_DIR/presto-ssl-root-ca.pem  -out $RESOURCES_DIR/presto-ssl-root-ca.der
-
-# Add Presto's self signed CA to the truststore
-keytool -noprompt -import -alias presto-kerberos -keystore $RESOURCES_DIR/cacerts-with-presto-ca.jks \
-        -storepass changeit -file $RESOURCES_DIR/presto-ssl-root-ca.der -trustcacerts
-
-# Set up the environment variables pointing to all of this, and run some tests
-DRIVERS=presto-jdbc \
-MB_ENABLE_PRESTO_JDBC_DRIVER=true \
-MB_PRESTO_JDBC_TEST_HOST=presto-kerberos \
-MB_PRESTO_JDBC_TEST_PORT=7778 \
-MB_PRESTO_JDBC_TEST_SSL=true \
-MB_PRESTO_JDBC_TEST_SSL_KEYSTORE_PATH=$RESOURCES_DIR/ssl_keystore.jks \
-MB_PRESTO_JDBC_TEST_SSL_KEYSTORE_PASSWORD=presto \
-MB_PRESTO_JDBC_TEST_SSL_TRUSTSTORE_PATH=$RESOURCES_DIR/cacerts-with-presto-ca.jks \
-MB_PRESTO_JDBC_TEST_SSL_TRUSTSTORE_PASSWORD=changeit \
-MB_PRESTO_JDBC_TEST_KERBEROS=true \
-MB_PRESTO_JDBC_TEST_USER=bob@EXAMPLE.COM \
-MB_PRESTO_JDBC_TEST_KERBEROS_PRINCIPAL=bob@EXAMPLE.COM \
-MB_PRESTO_JDBC_TEST_KERBEROS_REMOTE_SERVICE_NAME=HTTP \
-MB_PRESTO_JDBC_TEST_KERBEROS_KEYTAB_PATH=$RESOURCES_DIR/client.keytab \
-MB_PRESTO_JDBC_TEST_KERBEROS_CONFIG_PATH=$RESOURCES_DIR/krb5.conf \
-clojure -X:dev:test:drivers:drivers-dev :only metabase.driver.presto-jdbc-test

.github/scripts/stats-import.ts

@@ -0,0 +1,140 @@
+// Pushes stats rows to eng-stats-importer, which writes them to Postgres.
+//
+// The importer's origin comes from ENG_STATS_URL and its key from API_KEY, both
+// repository secrets — this repo is public, so neither is hardcoded here. Visit
+// the importer to see the tables and mint keys.
+
+// Transient failures worth retrying: throttling and server-side errors. A 4xx
+// (bad request, auth, unknown table) won't succeed on retry, so those fail fast.
+const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
+
+/**
+ * One row, keyed by column. Values are `unknown` rather than a scalar union
+ * because a `json` column takes arbitrary nested data.
+ */
+export type StatsRow = Record<string, unknown>;
+
+export interface ImportStatsOptions {
+  /** Table name as it appears in `/api/import/{table}`, e.g. `emotion_files`. */
+  table: string;
+  rows: StatsRow[];
+  /** Importer origin. Defaults to ENG_STATS_URL. */
+  baseUrl?: string;
+  /** Extra attempts after the first, so the default 2 means up to 3 tries. */
+  retries?: number;
+  retryDelayMs?: number;
+  /** Per-attempt total deadline; aborts a stalled request. */
+  timeoutMs?: number;
+}
+
+export interface ImportStatsResult {
+  success: true;
+  inserted?: number;
+  /** Payload keys with no matching column, when `ignoreUnknown` is in play. */
+  ignoredKeys?: string[];
+}
+
+class ImportError extends Error {
+  retryable: boolean;
+
+  constructor(message: string, { retryable }: { retryable: boolean }) {
+    super(message);
+    this.retryable = retryable;
+  }
+}
+
+async function attemptImport(
+  url: string,
+  rows: StatsRow[],
+  timeoutMs: number,
+): Promise<ImportStatsResult> {
+  let response: Response;
+  try {
+    response = await fetch(url, {
+      method: "PUT",
+      headers: {
+        "x-api-key": process.env.API_KEY ?? "",
+        "content-type": "application/json",
+      },
+      body: JSON.stringify(rows),
+      // Without this the request can hang indefinitely on a stalled server,
+      // eating the whole job timeout. An abort surfaces below as a retryable
+      // network error, so it retries with backoff instead.
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (networkError) {
+    const message =
+      networkError instanceof Error ? networkError.message : String(networkError);
+    throw new ImportError(message, { retryable: true });
+  }
+
+  if (!response.ok) {
+    // Failures carry an `{ error }` body naming the offending row and column,
+    // which is the only way to tell a type mismatch from a typo'd key.
+    const body = await response.text().catch(() => "");
+    throw new ImportError(
+      `Import failed: ${response.status} ${response.statusText} ${body}`.trim(),
+      { retryable: RETRYABLE_STATUS.has(response.status) },
+    );
+  }
+
+  // Best-effort: the row count is for logging, so a body that doesn't parse
+  // shouldn't turn a successful import into a failure.
+  const result = (await response.json().catch(() => ({}))) as {
+    inserted?: number;
+    ignoredKeys?: string[];
+  };
+  return { success: true, inserted: result.inserted, ignoredKeys: result.ignoredKeys };
+}
+
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+/**
+ * Imports `rows` into the `table` table, retrying transient API errors with
+ * exponential backoff.
+ *
+ * Keys are matched leniently against the table's columns -- `Emotion Files`,
+ * `emotionFiles` and `emotion_files` all land in `emotion_files` -- but values
+ * are matched strictly, and a key matching no column is an error rather than a
+ * silent drop. Rows are appended; the importer has no replace mode.
+ *
+ * Throws the last error once attempts are exhausted or the error is
+ * non-retryable.
+ */
+export async function importStats({
+  table,
+  rows,
+  baseUrl = process.env.ENG_STATS_URL,
+  retries = 2,
+  retryDelayMs = 1000,
+  timeoutMs = 60_000,
+}: ImportStatsOptions): Promise<ImportStatsResult> {
+  // The importer accepts an empty payload, but there's no point spending a
+  // request (and a rate-limit slot) to insert nothing.
+  if (rows.length === 0) {
+    return { success: true, inserted: 0 };
+  }
+
+  if (!baseUrl) {
+    throw new Error("ENG_STATS_URL is not set, so there is no importer to push to");
+  }
+
+  // Tolerate a trailing slash: the origin comes from a hand-entered secret.
+  const url = `${baseUrl.replace(/\/+$/, "")}/api/import/${table}`;
+
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await attemptImport(url, rows, timeoutMs);
+    } catch (error) {
+      const importError = error as ImportError;
+      if (!importError.retryable || attempt >= retries) {
+        throw error;
+      }
+      const delay = retryDelayMs * 2 ** attempt;
+      console.warn(
+        `Import attempt ${attempt + 1} failed (${importError.message}); retrying in ${delay}ms`,
+      );
+      await sleep(delay);
+    }
+  }
+}

.github/scripts/stats-import.unit.spec.ts

@@ -0,0 +1,160 @@
+import { importStats } from "./stats-import";
+
+const ok = (body: unknown = { inserted: 1 }) => ({ ok: true, json: async () => body });
+const fail = (status: number) => ({
+  ok: false,
+  status,
+  statusText: "err",
+  text: async () => "",
+});
+
+const load = (over: Record<string, unknown> = {}) =>
+  importStats({
+    baseUrl: "https://stats.example.com",
+    table: "emotion_files",
+    rows: [{ a: 1 }],
+    retryDelayMs: 1,
+    ...over,
+  });
+
+describe("importStats requests", () => {
+  afterEach(() => {
+    // @ts-expect-error -- removing the stub the tests installed
+    delete global.fetch;
+    delete process.env.API_KEY;
+    delete process.env.ENG_STATS_URL;
+  });
+
+  it("defaults the origin to ENG_STATS_URL", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(ok());
+    global.fetch = fetchMock;
+    process.env.ENG_STATS_URL = "https://importer.example.com";
+
+    await load({ baseUrl: undefined });
+
+    expect(fetchMock.mock.calls[0][0]).toBe(
+      "https://importer.example.com/api/import/emotion_files",
+    );
+  });
+
+  it("tolerates a trailing slash on the origin", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(ok());
+    global.fetch = fetchMock;
+
+    await load({ baseUrl: "https://importer.example.com/" });
+
+    expect(fetchMock.mock.calls[0][0]).toBe(
+      "https://importer.example.com/api/import/emotion_files",
+    );
+  });
+
+  it("fails loudly when no origin is configured", async () => {
+    const fetchMock = jest.fn();
+    global.fetch = fetchMock;
+
+    await expect(load({ baseUrl: undefined })).rejects.toThrow("ENG_STATS_URL is not set");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("PUTs the rows as JSON to the table's import endpoint", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(ok());
+    global.fetch = fetchMock;
+    process.env.API_KEY = "secret";
+
+    await expect(load({ rows: [{ a: 1 }, { a: 2 }] })).resolves.toEqual({
+      success: true,
+      inserted: 1,
+      ignoredKeys: undefined,
+    });
+
+    const [url, options] = fetchMock.mock.calls[0];
+    expect(url).toBe("https://stats.example.com/api/import/emotion_files");
+    expect(options.method).toBe("PUT");
+    expect(options.headers).toMatchObject({
+      "x-api-key": "secret",
+      "content-type": "application/json",
+    });
+    expect(JSON.parse(options.body)).toEqual([{ a: 1 }, { a: 2 }]);
+  });
+
+  it("skips the request entirely when there are no rows", async () => {
+    const fetchMock = jest.fn();
+    global.fetch = fetchMock;
+
+    await expect(load({ rows: [] })).resolves.toEqual({ success: true, inserted: 0 });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("succeeds even if the response body does not parse", async () => {
+    global.fetch = jest.fn().mockResolvedValue({
+      ok: true,
+      json: async () => {
+        throw new Error("not json");
+      },
+    });
+
+    await expect(load()).resolves.toMatchObject({ success: true });
+  });
+});
+
+describe("importStats retries", () => {
+  afterEach(() => {
+    // @ts-expect-error -- removing the stub the tests installed
+    delete global.fetch;
+  });
+
+  it("retries transient server errors then succeeds", async () => {
+    const fetchMock = jest
+      .fn()
+      .mockResolvedValueOnce(fail(503))
+      .mockResolvedValueOnce(fail(500))
+      .mockResolvedValueOnce(ok());
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).resolves.toMatchObject({ success: true });
+    expect(fetchMock).toHaveBeenCalledTimes(3);
+  });
+
+  it("retries throttling", async () => {
+    const fetchMock = jest.fn().mockResolvedValueOnce(fail(429)).mockResolvedValueOnce(ok());
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).resolves.toMatchObject({ success: true });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it("retries network errors", async () => {
+    const fetchMock = jest
+      .fn()
+      .mockRejectedValueOnce(new Error("ECONNRESET"))
+      .mockResolvedValueOnce(ok());
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).resolves.toMatchObject({ success: true });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it("gives up after exhausting retries and throws the last error", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(fail(500));
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).rejects.toThrow("Import failed: 500");
+    expect(fetchMock).toHaveBeenCalledTimes(3); // 1 initial + 2 retries
+  });
+
+  it("does not retry a non-transient 4xx", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(fail(400));
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).rejects.toThrow("Import failed: 400");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not retry an unknown table", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(fail(404));
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).rejects.toThrow("Import failed: 404");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+});

.github/scripts/upload-affected-tests-stats.ts

@@ -1,11 +1,11 @@
 // Appends the test-plan stats row produced by create-test-plan.ts to the
-// "FE Affected Tests" table on stats.metabase.com.
-// Reads STATS_JSON, TRIGGERED_BY, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
+// "FE Affected Tests" table in eng-stats-importer.
+// Reads STATS_JSON, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
 
-const { uploadCsvToMb } = require("./csv-to-mb.js");
+import type { TestPlanStats } from "./affected-tests";
+import { importStats } from "./stats-import";
 
-// "FE Affected Tests" uploaded table on stats.metabase.com.
-const TABLE_ID = 81818;
+const TABLE = "fe_affected_tests";
 
 async function main() {
   // create-test-plan doesn't always produce stats (e.g. on release branches
@@ -16,13 +16,13 @@ async function main() {
     return;
   }
 
-  const s = JSON.parse(raw);
+  const s = JSON.parse(raw) as TestPlanStats;
   console.log("stats", s);
 
   const row = {
     Date: new Date().toISOString(),
-    // "pr_update" or "merge_to_master". ("Trigger" is a reserved SQL word.)
-    "Triggered By": process.env.TRIGGERED_BY,
+    // ("Trigger" is a reserved SQL word.)
+    "Triggered By": "pr_update",
     PR: Number(process.env.PR_NUMBER),
     "Head SHA": process.env.HEAD_SHA,
     "Base SHA": process.env.BASE_SHA,
@@ -43,17 +43,15 @@ async function main() {
     "Loki Stories All": s.loki_stories_all,
     "Loki Stories To Run (Rules)": s.loki_stories_to_run_rules,
     "Loki Stories To Run (Usage)": s.loki_stories_to_run_usage,
-    "E2E Specs All": s.e2e_specs_all,
-    "E2E Specs To Run (Rules)": s.e2e_specs_to_run_rules,
-    "E2E Specs To Run (Usage)": s.e2e_specs_to_run_usage,
+    // Spelled as the column name rather than a display name: the importer
+    // splits a digit-then-capital run, so "E2E Specs All" would normalize to
+    // `e2_e_specs_all` instead of `e2e_specs_all`.
+    e2e_specs_all: s.e2e_specs_all,
+    e2e_specs_to_run_rules: s.e2e_specs_to_run_rules,
+    e2e_specs_to_run_usage: s.e2e_specs_to_run_usage,
   };
 
-  await uploadCsvToMb({
-    baseUrl: "https://stats.metabase.com",
-    tableId: TABLE_ID,
-    jsonData: [row],
-    mode: "append",
-  });
+  await importStats({ table: TABLE, rows: [row] });
   console.log("Data uploaded successfully");
 }
 

.github/scripts/upload-bundle-size-stats.ts

@@ -0,0 +1,38 @@
+// Appends the measured bundle sizes (with deltas) to the "Bundle Sizes" table
+// in eng-stats-importer. Reads ROWS (a JSON file of rows) and API_KEY from env,
+// and reports whether the import landed via the `uploaded` step output.
+
+import { appendFileSync, readFileSync } from "node:fs";
+
+import { importStats, type StatsRow } from "./stats-import";
+
+/** `core.setOutput` without the github-script runtime. */
+function setOutput(name: string, value: string) {
+  const file = process.env.GITHUB_OUTPUT;
+  if (file) {
+    appendFileSync(file, `${name}=${value}\n`);
+  }
+}
+
+async function main() {
+  const rowsPath = process.env.ROWS || "artifacts/upload-rows.json";
+  const rows = JSON.parse(readFileSync(rowsPath, "utf8")) as StatsRow[];
+
+  console.table(rows);
+
+  try {
+    await importStats({ table: "bundle_sizes", rows });
+    console.log("Bundle sizes uploaded successfully");
+    setOutput("uploaded", "true");
+  } catch (error) {
+    // Stats logging is best-effort: if the importer is still unreachable after
+    // the client's retries, keep the run green. The last-plotted cache is only
+    // saved on a successful upload, so this point is re-attempted on the next
+    // master build and nothing is silently dropped.
+    const message = error instanceof Error ? error.message : String(error);
+    console.log(`::warning::Bundle-size upload failed after retries; leaving run green: ${message}`);
+    setOutput("uploaded", "false");
+  }
+}
+
+main();

.github/scripts/upload-emotion-stats.ts

@@ -0,0 +1,25 @@
+// Appends the weekly @emotion/* importer count to the "Emotion Files" table in
+// eng-stats-importer. Reads EMOTION_FILES and API_KEY from env.
+
+import { importStats } from "./stats-import";
+
+async function main() {
+  console.log("EMOTION_FILES", Number(process.env.EMOTION_FILES));
+
+  // Keys must match the target table's columns (the importer normalizes both
+  // sides, so casing/spacing is forgiving).
+  const rows = [
+    {
+      Date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+      "Emotion Files": Number(process.env.EMOTION_FILES),
+    },
+  ];
+
+  await importStats({ table: "emotion_stats", rows });
+  console.log("Data uploaded successfully");
+}
+
+main().catch((error) => {
+  console.error("Error uploading data:", error);
+  process.exit(1);
+});

.github/scripts/upload-module-boundaries-stats.ts

@@ -0,0 +1,30 @@
+// Appends the weekly module-boundary counts to the "Module Boundaries" table in
+// eng-stats-importer. Reads NAMED_MODULES, ENFORCED_MODULES, UNMODULED,
+// VIOLATIONS and API_KEY from env.
+
+import { importStats } from "./stats-import";
+
+async function main() {
+  console.log("NAMED_MODULES", Number(process.env.NAMED_MODULES));
+  console.log("ENFORCED_MODULES", Number(process.env.ENFORCED_MODULES));
+  console.log("UNMODULED", Number(process.env.UNMODULED));
+  console.log("VIOLATIONS", Number(process.env.VIOLATIONS));
+
+  const rows = [
+    {
+      Date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+      Modules: Number(process.env.NAMED_MODULES),
+      "Enforced modules": Number(process.env.ENFORCED_MODULES),
+      "Unmoduled folders": Number(process.env.UNMODULED),
+      Violations: Number(process.env.VIOLATIONS),
+    },
+  ];
+
+  await importStats({ table: "module_boundaries", rows });
+  console.log("Data uploaded successfully");
+}
+
+main().catch((error) => {
+  console.error("Error uploading data:", error);
+  process.exit(1);
+});

.github/team.json

@@ -56,16 +56,14 @@
       "label": ".Team/Metabot",
       "members": [
         "appleby",
-        "noahmoss",
         "retro",
         "sloansparger",
-        "somtom",
         "tsplude",
         "lbrdnk",
-        "piranha",
         "crisptrutski",
         "undrfined",
-        "andreis"
+        "andreis",
+        "prascuna"
       ]
     },
     {

.github/workflows/actionlint.yml

@@ -1,44 +0,0 @@
-name: Actionlint
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-    paths:
-      - '.github/workflows/**'
-  pull_request:
-    paths:
-      - '.github/workflows/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  actionlint:
-    name: Lint Github Actions Workflows
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Get changed Github actions
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-          list-files: shell
-      - name: Setup actionlint
-        if: steps.changes.outputs.actionlint == 'true'
-        id: download
-        shell: bash
-        run: |
-          if command -v actionlint; then
-            echo "executable=actionlint" >> "$GITHUB_OUTPUT"
-          else
-            # script sets executable output, for details see: https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
-            bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash)
-          fi
-      - name: Run actionlint
-        if: steps.changes.outputs.actionlint == 'true'
-        run: ${{ steps.download.outputs.executable }} --color --verbose ${{ steps.changes.outputs.actionlint_files }}

.github/workflows/ai-benchmark.yml

@@ -1,5 +1,5 @@
 name: AI Benchmark
-run-name: "dispatch evals · ${{ github.event_name == 'pull_request' && format('smoke PR#{0}', github.event.pull_request.number) || (inputs.pr != '' && format('PR#{0}', inputs.pr) || (inputs.ref != '' && inputs.ref || 'master')) }}"
+run-name: "dispatch evals · ${{ github.event_name == 'pull_request' && format('smoke PR#{0}', github.event.pull_request.number) || (inputs.ref != '' && inputs.ref || (inputs.pr != '' && format('PR#{0}', inputs.pr) || 'master')) }}"
 
 on:
   pull_request:
@@ -11,7 +11,7 @@ on:
         required: false
         default: ""
       ref:
-        description: "Metabase ref"
+        description: "Metabase branch, tag or sha (resolved to a full sha; overrides the PR head, and must sit on the PR's branch when both are given)"
         required: false
         default: ""
       scope:
@@ -38,7 +38,7 @@ jobs:
       github.event_name == 'pull_request'
       && github.event.label.name == 'evals/smoke'
       && github.event.pull_request.head.repo.full_name != github.repository
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - run: |
@@ -50,7 +50,7 @@ jobs:
       github.event_name == 'pull_request'
       && github.event.label.name == 'evals/smoke'
       && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       comment_id: ${{ steps.post.outputs.comment_id }}
@@ -74,22 +74,88 @@ jobs:
             const { data } = await github.rest.issues.createComment({ owner, repo, issue_number, body });
             core.setOutput('comment_id', String(data.id));
 
-  uberjar:
-    needs: [announce]
+  resolve:
+    # Collapse the dispatch inputs into the one full sha everything downstream needs: it keys the
+    # uberjar artifact, tags the ECR image, and tells eval-run which commit was measured. `pr` was
+    # not consulted at all before, so `pr: 12345` built the tip of whatever branch the run was
+    # launched from and then reported the result against the PR.
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      sha: ${{ steps.sha.outputs.sha }}
+    steps:
+      - name: Resolve pr/ref to a full commit sha
+        id: sha
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ inputs.pr }}
+          REF: ${{ inputs.ref }}
+          DEFAULT_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          # `ref` wins over `pr`, matching evals' eval-run.yml, which this dispatches into — same two
+          # inputs with opposite precedence in chained workflows would be a trap. eval-run also
+          # rejects a ref that doesn't sit on the PR's branch; that check stays there rather than
+          # being duplicated here.
+          if [[ -n "$REF" ]]; then
+            # `ref` accepts a branch or tag; fetch-artifact and the image tag need a full sha.
+            SHA=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${REF}" --jq .sha)
+            echo "ref ${REF} -> ${SHA}"
+          elif [[ -n "$PR" ]]; then
+            SHA=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR}" --jq .head.sha)
+            echo "PR #${PR} head -> ${SHA}"
+          else
+            SHA="$DEFAULT_SHA"
+            echo "neither pr nor ref given; using this run's commit -> ${SHA}"
+          fi
+          if [[ ! "$SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::could not resolve a full commit sha (got '${SHA}')"
+            exit 1
+          fi
+          echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
+
+  image:
+    needs: [resolve]
+    # `resolve` is workflow_dispatch-only, so tolerate it being skipped. The label guard is not
+    # optional: the trigger is `pull_request: [labeled]` with no filter of its own, so without it
+    # any label on any same-repo PR builds ee+oss and pushes to ECR — and since announce/smoke/
+    # finalize all skip in that case, a failure shows up as a bare red check with nothing
+    # explaining it.
     if: >-
-      github.event_name == 'pull_request'
-      && github.event.label.name == 'evals/smoke'
-      && github.event.pull_request.head.repo.full_name == github.repository
-    uses: ./.github/workflows/uberjar.yml
-    secrets: inherit
+      !cancelled()
+      && (needs.resolve.result == 'success' || needs.resolve.result == 'skipped')
+      && (github.event_name == 'workflow_dispatch'
+          || (github.event_name == 'pull_request'
+              && github.event.label.name == 'evals/smoke'
+              && github.event.pull_request.head.repo.full_name == github.repository))
+    uses: ./.github/workflows/build-private-ee-docker-image.yml
+    secrets:
+      PR_ENV_IAM_ROLE: ${{ secrets.PR_ENV_IAM_ROLE }}
+      PR_ENV_AWS_ACCOUNT_ID: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}
+    with:
+      # Empty on the label path on purpose — the image workflow then falls back to the PR head,
+      # which is the artifact run-tests has already built and cached under that sha.
+      commit: ${{ needs.resolve.outputs.sha }}
 
   smoke:
-    needs: [announce, uberjar]
+    needs: [announce, image]
+    # `!cancelled()` is load-bearing, not decoration: on the label path `resolve` is skipped by
+    # design, and `image` only runs at all because it opts back in with its own `!cancelled()`.
+    # GitHub propagates that skip *transitively*, so a plain boolean `if` here — carrying the
+    # implicit `success()` — skips smoke even though image succeeded and the image is in ECR.
+    # Opting out of the implicit check means the needs' results have to be asserted by hand.
     if: >-
-      github.event_name == 'pull_request'
+      !cancelled()
+      && needs.announce.result == 'success'
+      && needs.image.result == 'success'
+      && github.event_name == 'pull_request'
       && github.event.label.name == 'evals/smoke'
       && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       COMMENT_ID: ${{ needs.announce.outputs.comment_id }}
@@ -114,14 +180,14 @@ jobs:
   finalize:
     # If the build or dispatch fell over, eval-run never took over the comment — leave a
     # failure verdict instead of a comment stuck at "building the image…".
-    needs: [announce, uberjar, smoke]
+    needs: [announce, image, smoke]
     if: always() && needs.announce.result == 'success' && needs.smoke.result != 'success'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       COMMENT_ID: ${{ needs.announce.outputs.comment_id }}
       SMOKE_RESULT: ${{ needs.smoke.result }}
-      UBERJAR_RESULT: ${{ needs.uberjar.result }}
+      IMAGE_RESULT: ${{ needs.image.result }}
     steps:
       - name: Comment (build/dispatch failed)
         uses: actions/github-script@v9
@@ -130,7 +196,7 @@ jobs:
           script: |
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             // A concurrency-cancelled retrigger lands here too; don't stamp it as an infra failure.
-            const cancelled = [process.env.SMOKE_RESULT, process.env.UBERJAR_RESULT].includes('cancelled');
+            const cancelled = [process.env.SMOKE_RESULT, process.env.IMAGE_RESULT].includes('cancelled');
             const body = cancelled
               ? `🤖 **Evals smoke** — ⚪ cancelled before evals started ([logs](${runUrl}))`
               : `🤖 **Evals smoke** — ❌ build or dispatch failed before evals started ([logs](${runUrl}))`;
@@ -150,8 +216,12 @@ jobs:
             }).catch(() => {});
 
   dispatch:
+    needs: [resolve, image]
+    # Deliberately no `always()`: benchmarking without the image this run was supposed to produce
+    # would measure a stale build or nothing at all. A failed `image` fails the run, which is the
+    # signal here — unlike the PR path there is no comment for `finalize` to stamp.
     if: github.event_name == 'workflow_dispatch'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Dispatch eval-run
@@ -159,7 +229,8 @@ jobs:
           GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           EVALS_BRANCH: ${{ github.event.inputs.evals_branch }}
           PR: ${{ inputs.pr }}
-          REF: ${{ inputs.ref }}
+          # The sha the image was actually built and tagged with, not the raw `ref` input.
+          REF: ${{ needs.resolve.outputs.sha }}
           SCOPE: ${{ inputs.scope }}
           SAMPLE: ${{ inputs.sample }}
         run: |

.github/workflows/app-db.yml

@@ -6,6 +6,34 @@ on:
       skip:
         type: boolean
         default: false
+      force-run:
+        description: Run the full suite regardless of the diff (master / release branches).
+        type: boolean
+        default: false
+
+  # Run one app-DB job on demand, against the ref you dispatch on, optionally under a profiler.
+  # Everything else about the job -- services, matrix legs, test args, quarantine gating -- is
+  # whatever the normal CI run uses, because it is the same job.
+  workflow_dispatch:
+    inputs:
+      app-db:
+        description: 'Which app-DB job to run. Only this one runs; the others are skipped.'
+        type: choice
+        required: true
+        options:
+          - mariadb
+          - mysql
+          - postgres
+      tests:
+        description: 'Optional: run only these tests, comma- or space-separated, e.g. metabase.db.custom-migrations-test/some-test. Bare namespaces work too. Blank runs the job''s usual set.'
+        type: string
+        required: false
+        default: ''
+      profile:
+        description: 'Profile the test run and attach a flamegraph to the job. Adds sampling overhead.'
+        type: boolean
+        required: false
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-app-db
@@ -15,28 +43,105 @@ concurrency:
 # ci-conductor (secrets: inherit is already set on the app-db call in
 # run-tests.yml). See DEV-2224.
 env:
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  # Both read by the test-driver action, which is what actually runs the tests. Set here rather than
+  # passed as inputs to each job so that turning either on is one line, not one line per job.
+  # Empty (and so off) on workflow_call, where neither input exists.
+  #
+  # ONLY_TESTS replaces the job's own test selection, so every matrix leg of the chosen job runs the
+  # whole list -- each app DB has three.
+  PROFILE_TESTS: ${{ inputs.profile }}
+  ONLY_TESTS: ${{ inputs.tests }}
 
 jobs:
-  be-tests-mariadb:
+  app-db-matrix:
     if: ${{ !inputs.skip }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    name: Determine app DB versions
+    outputs:
+      mariadb: ${{ steps.versions.outputs.mariadb }}
+      mysql: ${{ steps.versions.outputs.mysql }}
+      postgres: ${{ steps.versions.outputs.postgres }}
+    steps:
+      - name: Select versions to test
+        id: versions
+        uses: actions/github-script@v9
+        env:
+          RUN_ALL: ${{ inputs.force-run }}
+        with:
+          script: | # js
+            const runAll = process.env.RUN_ALL === 'true';
+
+            const versions = {
+              mariadb: [
+                {
+                  name: 'MariaDB 10.6',
+                  image: 'metabase/mariadb:10.6',
+                  'junit-name': 'be-tests-mariadb-10-6-ee',
+                  env: { 'enable-ssl-tests': 'false' },
+                  latest: false
+                },
+                {
+                  name: 'MariaDB Latest',
+                  image: 'mariadb:latest',
+                  'junit-name': 'be-tests-mariadb-latest-ee',
+                  env: { 'enable-ssl-tests': 'false' },
+                  latest: true
+                },
+              ],
+              mysql: [
+                {
+                  name: 'MySQL 8.0',
+                  image: 'mysql:8.0',
+                  'junit-name': 'be-tests-mysql-8-0-ee',
+                  env: { 'enable-ssl-tests': 'false', 'enable-aws-iam-tests': 'false' },
+                  latest: false
+                },
+                {
+                  name: 'MySQL 9',
+                  image: 'mysql:9',
+                  'junit-name': 'be-tests-mysql-9-ee',
+                  env: { 'enable-ssl-tests': 'true', 'enable-aws-iam-tests': 'true' },
+                  // treating 9.0 as latest until we introduce mysql 26+ support
+                  latest: true
+                },
+              ],
+              postgres: [
+                {
+                  name: 'Postgres 14.x',
+                  'junit-name': 'be-tests-postgres-ee',
+                  image: 'postgres:14-alpine',
+                  env: { 'enable-ssl-tests': 'false', 'enable-aws-iam-tests': 'false' },
+                  latest: false,
+                },
+                {
+                  name: 'Postgres Latest',
+                  'junit-name': 'be-tests-postgres-latest-ee',
+                  image: 'postgres:latest',
+                  env: { 'enable-ssl-tests': 'true', 'enable-aws-iam-tests': 'true' },
+                  latest: true,
+                },
+              ],
+            };
+
+
+            for (const [db, dbVersions] of Object.entries(versions)) {
+              const selected = runAll ? dbVersions : dbVersions.filter((version) => version.latest);
+              core.info(`${db}: ${selected.map((version) => version.name).join(', ')}`);
+              core.setOutput(db, JSON.stringify(selected));
+            }
+
+  be-tests-mariadb:
+    needs: app-db-matrix
+    if: ${{ !inputs.skip && (inputs.app-db == '' || inputs.app-db == 'mariadb') }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
-        version:
-          - name: MariaDB 10.6
-            junit-name: be-tests-mariadb-10-6-ee
-            image: metabase/mariadb:10.6 # https://github.com/metabase/metabase-mariadb-docker-image
-            env:
-              enable-ssl-tests: 'false'
-          - name: MariaDB Latest
-            junit-name: be-tests-mariadb-latest-ee
-            image: mariadb:latest
-            env:
-              enable-ssl-tests: 'false'
+        version: ${{ fromJSON(needs.app-db-matrix.outputs.mariadb) }}
         job:
           - name: Enterprise Tests
             build-static-viz: false
@@ -70,21 +175,9 @@ jobs:
           MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
           MARIADB_DATABASE: mb_test
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: mysql
@@ -125,45 +218,16 @@ jobs:
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-mysql:
-    if: ${{ !inputs.skip }}
+    needs: app-db-matrix
+    if: ${{ !inputs.skip && (inputs.app-db == '' || inputs.app-db == 'mysql') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
-        version:
-          - name: MySQL 8.0
-            junit-name: be-tests-mysql-8-0-ee
-            image: mysql:8.0
-            env:
-              enable-ssl-tests: 'false'
-              enable-aws-iam-tests: 'false'
-          - name: MySQL 9
-            junit-name: be-tests-mysql-9-ee
-            image: mysql:9
-            env:
-              enable-ssl-tests: 'true'
-              enable-aws-iam-tests: 'true'
-          # `mysql:latest` now resolves to MySQL 26.x, which fails in a way that floods the log
-          # until the runner cancels the job. A cancelled job can't be soft-failed with
-          # continue-on-error, so the leg is disabled until 26.x is supported.
-          # - name: MySQL Latest
-          #   junit-name: be-tests-mysql-latest-ee
-          #   image: mysql:latest
-          #   env:
-          #     enable-ssl-tests: 'false'
-          #     enable-aws-iam-tests: 'false'
+        version: ${{ fromJSON(needs.app-db-matrix.outputs.mysql) }}
         job:
           - name: Enterprise Tests
             build-static-viz: false
@@ -197,21 +261,9 @@ jobs:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: mysql
@@ -260,36 +312,16 @@ jobs:
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-postgres:
-    if: ${{ !inputs.skip }}
+    needs: app-db-matrix
+    if: ${{ !inputs.skip && (inputs.app-db == '' || inputs.app-db == 'postgres') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
-        version:
-          - name: Postgres 14.x
-            junit-name: postgres-ee
-            docker-image: postgres:14-alpine
-            env:
-              enable-ssl-tests: 'false'
-              enable-aws-iam-tests: 'false'
-          - name: Postgres Latest
-            junit-name: postgres-latest-ee
-            docker-image: postgres:latest
-            env:
-              enable-ssl-tests: 'true'
-              enable-aws-iam-tests: 'true'
+        version: ${{ fromJSON(needs.app-db-matrix.outputs.postgres) }}
         job:
           - name: Enterprise Tests
             build-static-viz: false
@@ -313,21 +345,9 @@ jobs:
             exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: postgres
@@ -350,7 +370,7 @@ jobs:
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
     services:
       postgres:
-        image: ${{ matrix.version.docker-image }}
+        image: ${{ matrix.version.image }}
         ports:
           - "5432:5432"
         env:
@@ -364,28 +384,20 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
-          junit-name: 'be-tests-${{ matrix.version.junit-name }}'
+          junit-name: ${{ matrix.version.junit-name }}
           artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
 
   app-db-tests-result:
     needs:
+      - app-db-matrix
       - be-tests-mariadb
       - be-tests-mysql
       - be-tests-postgres
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     name: app-db-tests-result
     if: always() && !cancelled()

.github/workflows/auto-assign.yml

@@ -7,7 +7,8 @@ on:
 
 jobs:
   update_pr:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
 
     steps:
       - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0

.github/workflows/auto-backport.yml

@@ -99,6 +99,36 @@ jobs:
       )
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
+      - name: "!! double-backport and triple-backport label deprecation warning !!"
+        if:
+          |
+          github.event.pull_request.merged == true && (
+            github.event.action == 'closed' && (
+              contains(github.event.pull_request.labels.*.name, 'double-backport') ||
+              contains(github.event.pull_request.labels.*.name, 'triple-backport')
+            ) ||
+            github.event.action == 'labeled' && (
+              github.event.label.name == 'double-backport' ||
+              github.event.label.name == 'triple-backport'
+            )
+          )
+        env:
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: |
+          msg="🚨🚨 Backport failed because \`double-backport\` and \`triple-backport\` labels are **deprecated**! Use the \`backport\` label to port changes to all supported releases instead. 🚨🚨"
+
+          gh api \
+            --silent \
+            --method POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2026-03-10" \
+            /repos/"$REPO"/issues/"$PR"/comments \
+            -f "body=$msg"
+
+          echo "::error::$msg"
+          exit 1
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
@@ -110,29 +140,6 @@ jobs:
           pull-request-number: ${{ github.event.pull_request.number }}
           base-ref: ${{ github.event.pull_request.base.ref }}
 
-      - name: how many backports?
-        id: how-many-backports
-        uses: actions/github-script@v9
-        with:
-          script: | # js
-            const labels = [
-              ...${{ toJson(github.event.pull_request.labels) }},
-              { name:"${{ github.event.label.name }}" }
-            ];
-
-            const backportLabelNames = labels.filter(label => label.name.includes('backport')).map(label => label.name);
-
-            let result = 1;
-
-            if (backportLabelNames.includes("triple-backport")) {
-              result = 3;
-            } else if (backportLabelNames.includes("double-backport")) {
-              result = 2;
-            }
-
-            console.log("backports", result);
-            return result;
-
       - name: get release versions
         id: get-latest-release-version
         uses: actions/github-script@v9
@@ -157,21 +164,3 @@ jobs:
           backport-commit: ${{ steps.find_commit.outputs.commit }}
           github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           github-token-2: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Double Backport
-        if: ${{ always() && fromJson(steps.how-many-backports.outputs.result) >= 2 }}
-        uses: ./.github/actions/create-backport
-        with:
-          target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).secondLatest }}
-          backport-commit: ${{ steps.find_commit.outputs.commit }}
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          github-token-2: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Triple Backport
-        if: ${{ always() && fromJson(steps.how-many-backports.outputs.result) >= 3 }}
-        uses: ./.github/actions/create-backport
-        with:
-          target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).thirdLatest }}
-          backport-commit: ${{ steps.find_commit.outputs.commit }}
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          github-token-2: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/backend-cloverage.yml

@@ -17,7 +17,8 @@ on:
 
 jobs:
   setup-oss:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       modules: ${{ steps.get-modules.outputs.modules }}
     steps:
@@ -64,7 +65,8 @@ jobs:
           flags: back-end
 
   setup-ee:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       modules: ${{ steps.get-modules.outputs.modules }}
     steps:

.github/workflows/backend.yml

@@ -6,6 +6,26 @@ on:
       skip:
         type: boolean
         default: false
+      force-run:
+        description: Run the full suite regardless of the diff (master / release branches).
+        type: boolean
+        default: false
+
+  # Run the backend test suite on demand, against the ref you dispatch on, optionally under a
+  # profiler. Everything else about the jobs -- matrix legs, tag filters, quarantine gating -- is
+  # whatever the normal CI run uses, because they are the same jobs.
+  workflow_dispatch:
+    inputs:
+      tests:
+        description: 'Optional: run only these tests, comma- or space-separated, e.g. metabase.query-processor-test/some-test. Bare namespaces work too. Blank runs each leg''s usual set.'
+        type: string
+        required: false
+        default: ''
+      profile:
+        description: 'Profile the test run and attach a flamegraph to the job. Adds sampling overhead.'
+        type: boolean
+        required: false
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-backend
@@ -15,8 +35,15 @@ concurrency:
 # (secrets: inherit is already set on the backend call in run-tests.yml).
 # See DEV-2224.
 env:
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  # Both read by the be-tests run step below. Set here rather than passed per job so that turning
+  # either on is one line. Empty (and so off) on workflow_call, where neither input exists.
+  #
+  # ONLY_TESTS replaces the leg's own test selection, so every matrix leg runs the whole list: the
+  # partition args no longer apply, and legs that hold none of the named tests run nothing.
+  PROFILE_TESTS: ${{ inputs.profile }}
+  ONLY_TESTS: ${{ inputs.tests }}
 
 jobs:
   be-linter-clj-kondo:
@@ -45,7 +72,7 @@ jobs:
 
   be-linter-eastwood-test:
     # Master / release safety net: lint every backend test namespace.
-    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
+    if: ${{ !inputs.skip && inputs.force-run }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: Eastwood (tests only)
@@ -57,8 +84,8 @@ jobs:
         name: Run Eastwood linter on our backend tests
 
   be-linter-eastwood-test-changed:
-    # PR / merge queue: lint only the test namespaces touched by the diff.
-    if: ${{ !inputs.skip && (github.event_name == 'pull_request' || github.event_name == 'merge_group') }}
+    # Lint only the test namespaces touched by the diff.
+    if: ${{ !inputs.skip && !inputs.force-run && github.event_name == 'pull_request' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     name: Eastwood (changed tests only)
@@ -72,8 +99,8 @@ jobs:
       - name: Compute changed test namespaces
         id: changed
         env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || github.sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           set -euo pipefail
 
@@ -158,21 +185,9 @@ jobs:
               :partition/index 1
     name: "Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
     steps:
       - uses: actions/checkout@v6
       - name: Prepare front-end environment
@@ -230,7 +245,21 @@ jobs:
         # whole `[ns/var ...]` vector reaches clojure -X as a single argument.
         run: |
           BASE="clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev"
-          if [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
+          # `:profile-tests` overrides `:test`'s exec-fn, so it has to come last. See dev.profile-tests.
+          # The `profiled` output is what the collection steps below key off, so that the decision is
+          # recorded by the step that acts on it rather than re-derived from the environment.
+          if [ "$PROFILE_TESTS" = "true" ]; then
+            echo "Profiling this run; a flamegraph will be attached to the job."
+            echo "profiled=true" >> "$GITHUB_OUTPUT"
+            BASE="$BASE:profile-tests"
+          fi
+          # An explicit selection wins over the rerun narrowing below: it was asked for by hand, on this
+          # attempt. Names may be separated by commas or spaces; hawk wants them as one vector argument.
+          if [ -n "$ONLY_TESTS" ]; then
+            ONLY="[$(echo "$ONLY_TESTS" | tr ',' ' ')]"
+            echo "Running only: $ONLY"
+            $BASE :only "$ONLY"
+          elif [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
             echo "Granular rerun of previously-failed tests: $(cat target/failed-tests)"
             $BASE :only "$(cat target/failed-tests)"
           else
@@ -239,8 +268,15 @@ jobs:
         # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
+      - name: Collect profile
+        if: ${{ !cancelled() }}
+        uses: ./.github/actions/collect-profile
+        with:
+          profiled: ${{ steps.run-java-tests.outputs.profiled }}
+          artifact-name: profile-be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
+
       - name: Report failed tests to ci-conductor
-        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        if: ${{ !cancelled() && ( steps.run-java-tests.outcome == 'failure' || github.run_attempt != '1' ) }}
         # This step should NEVER fail the job!
         continue-on-error: true
         uses: ./.github/actions/report-failures-to-ci-conductor
@@ -281,16 +317,6 @@ jobs:
           test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
           enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
         if: failure()
@@ -326,7 +352,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
       # TODO -- we should probably also check WITHOUT ee -- do a check with only OSS namespaces on the classpath
       - name: Check namespaces
-        run: clojure -M:ee:drivers:check
+        run: clojure -M:ee:drivers:load-namespaces
 
   be-cljfmt:
     if: ${{ !inputs.skip }}
@@ -350,7 +376,7 @@ jobs:
       - be-check
       - be-tests
     if: always() && !cancelled()
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       needs: ${{ toJson(needs) }}

.github/workflows/backport-reminder.yml

@@ -12,7 +12,8 @@ concurrency:
 
 jobs:
   flags:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       has_backport_label: ${{ steps.c.outputs.value }}
     steps:
@@ -27,7 +28,7 @@ jobs:
 
   files-changed:
     name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       docs: ${{ steps.changes.outputs.docs }}
@@ -44,7 +45,7 @@ jobs:
     needs: [ files-changed, flags ]
     if: ${{ !cancelled() }}
     name: Decide whether to backport or not
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     permissions: {}
     steps:
@@ -59,7 +60,7 @@ jobs:
 
   priority-backport-reminder:
     name: Remind about backporting P0 + P1 fixes
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     needs: [flags]
     permissions:

.github/workflows/block-master-source-branch-prs.yml

@@ -5,10 +5,11 @@ on:
 
 jobs:
   check-source-branch:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    if: github.head_ref == 'master'
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     steps:
       - name: Block master branch PRs
-        if: github.head_ref == 'master'
         run: |
           echo "PRs from \`master\` branches are not allowed, please use a new branch name for your PR."
           exit 1

.github/workflows/build-for-release.yml

@@ -1,273 +0,0 @@
-# Builds a fresh release JAR from scratch at a given commit.
-#
-# You should almost never have to use this. The normal release flow relies on a
-# commit that has already been built and tested on its branch — see
-# `tag-for-release.yml`, which tags that existing JAR. Building from scratch
-# here is only for exceptional cases.
-name: Release 0 - Build Release Artifact
-run-name: Build ${{ inputs.version }}
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Metabase version (e.g. v0.46.3)'
-        type: string
-        required: true
-      commit:
-        description: 'A full-length commit SHA-1 hash'
-        required: true
-
-jobs:
-  start-message:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          sparse-checkout: |
-            release
-            .github
-      - name: Prepare release scripts
-        uses: ./.github/actions/prepare-release-scripts
-      - name: Send build start message
-        uses: actions/github-script@v9
-        env:
-          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        with:
-          script: | # js
-            const { sendPreReleaseMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-            await sendPreReleaseMessage({
-              github,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              version: '${{ inputs.version }}',
-              runId: '${{ github.run_id }}',
-              releaseSha: '${{ inputs.commit }}',
-              userName: '${{ github.actor }}',
-              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
-            }).catch(console.error);
-
-  trigger-milestone-check:
-    # Posts a Slack FYI about issues that still need review for this release.
-    # Informational only — nothing depends on it, so it never blocks the release.
-    needs: [check-version, check-commit]
-    permissions:
-      contents: read
-      issues: read
-    uses: ./.github/workflows/release-milestone-check.yml
-    secrets: inherit
-    with:
-      version: ${{ inputs.version }}
-      commit: ${{ inputs.commit }}
-
-  check-version:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    outputs:
-      ee: ${{ fromJson(steps.canonical_version.outputs.result).ee }}
-      oss: ${{ fromJson(steps.canonical_version.outputs.result).oss }}
-    steps:
-    - name: Fail early on the incorrect version format
-      if: ${{ !(startsWith(inputs.version,'v0.') || startsWith(inputs.version,'v1.')) }}
-      run: |
-        echo "The version format is invalid!"
-        echo "It must start with either 'v0.' or 'v1.'."
-        echo "Please, try again."
-        exit 1
-    - uses: actions/checkout@v6
-      with:
-        sparse-checkout: |
-          release
-          .github
-    - name: Prepare release scripts
-      uses: ./.github/actions/prepare-release-scripts
-    - name: Get Release Version
-      uses: actions/github-script@v9
-      id: canonical_version
-      with:
-        script: | # js
-          const { isValidVersionString, getCanonicalVersion, hasBeenReleased } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          const version = '${{ inputs.version }}';
-
-          if (!isValidVersionString(version)) {
-            throw new Error("The version format is invalid! It must start with either 'v0.' or 'v1.'.");
-          }
-
-          const versions = {
-            ee: getCanonicalVersion(version, 'ee'),
-            oss: getCanonicalVersion(version, 'oss'),
-          };
-
-          const released = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.oss,
-          });
-
-          if (released) {
-            throw new Error("This version has already been released!", version);
-          }
-
-          return versions;
-
-  check-commit:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    steps:
-    - name: Check out the code to verify the release branch
-      uses: actions/checkout@v6
-      with:
-        fetch-depth: 0  # IMPORTANT! to get all the branches
-        sparse-checkout: |
-          release
-          .github
-    - name: Prepare release scripts
-      uses: ./.github/actions/prepare-release-scripts
-    - name: Get Release Branch
-      uses: actions/github-script@v9
-      id: release_branch
-      with:
-        result-encoding: string
-        script: | # js
-          const { getReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
-          const version = '${{ inputs.version }}';
-          const releaseBranch = getReleaseBranch(version);
-          return releaseBranch;
-    - name: Ensure that the specified commit exists in the ${{ steps.release_branch.outputs.result }} release branch
-      run: | # bash
-        RELEASE_BRANCH=${{ steps.release_branch.outputs.result }}
-        git checkout "$RELEASE_BRANCH"
-        if git branch --contains ${{ inputs.commit }} | grep -q "$RELEASE_BRANCH"; then
-          echo "Commit found in correct release branch"
-        else
-          echo "Commit not found in correct release branch"
-          exit 1
-        fi
-        git checkout -
-
-  get-build-requirements:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-      build_process: ${{ fromJson(steps.dependencies.outputs.result).build_process }}
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        sparse-checkout: |
-          release
-          .github
-    - name: Prepare release scripts
-      uses: ./.github/actions/prepare-release-scripts
-    - name: Get build dependencies
-      uses: actions/github-script@v9
-      id: dependencies
-      with:
-        script: | # js
-          const { getBuildRequirements, getMajorVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          const version = '${{ inputs.version }}';
-
-          const requirements = getBuildRequirements(version);
-          const build_process = getMajorVersion(version) < 46 ? 'legacy' : 'new';
-          console.log('Build process:', build_process);
-
-          return {
-            java_version: requirements.java,
-            node_version: requirements.node,
-            build_process,
-          };
-
-  manage-milestones:
-    # Close the milestone we're about to ship and open the next one BEFORE building,
-    # so any PRs that merge while the build is in flight are tagged with the next
-    # milestone (not the one about to be released).
-    #
-    # Sequenced after trigger-milestone-check so that the check sees the milestone
-    # in its open state. milestone-check is informational and must never block, so
-    # we run regardless of its outcome; only preflight failures suppress this.
-    needs: [check-version, check-commit, trigger-milestone-check]
-    if: ${{ !cancelled() && needs.check-version.result == 'success' && needs.check-commit.result == 'success' }}
-    permissions:
-      contents: read
-      issues: write
-    uses: ./.github/workflows/release-milestone-manage.yml
-    with:
-      version: ${{ inputs.version }}
-
-  build-uberjar-for-release:
-    needs: [check-version, check-commit, get-build-requirements]
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 50
-    strategy:
-      matrix:
-        edition: [oss, ee]
-    env:
-      INTERACTIVE: false
-    steps:
-    - name: Get correct version number
-      run: | # bash
-        if [ '${{matrix.edition}}' == 'ee' ]; then
-          version='${{ needs.check-version.outputs.ee }}'
-        else
-          version='${{ needs.check-version.outputs.oss }}'
-        fi
-
-        echo "VERSION=$version" >> "$GITHUB_ENV"
-    - name: Setup Java ${{ needs.get-build-requirements.outputs.java_version }}
-      uses: actions/setup-java@v5.2.0
-      with:
-        distribution: 'temurin'
-        java-version: ${{ needs.get-build-requirements.outputs.java_version }}
-    - name: Setup Node.js ${{ needs.get-build-requirements.outputs.node_version }}
-      uses: actions/setup-node@v6.4.0
-      with:
-        node-version: ${{ needs.get-build-requirements.outputs.node_version }}.x
-    - name: Check out the code
-      uses: actions/checkout@v6
-      with:
-        ref: ${{ github.event.inputs.commit }}
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-
-    - name: Build Metabase
-      if: ${{ needs.get-build-requirements.outputs.build_process != 'legacy' }}
-      run: ./bin/build.sh :edition :${{ matrix.edition }} :version "$VERSION"
-
-    - name: Build Metabase (legacy)
-      if: ${{ needs.get-build-requirements.outputs.build_process == 'legacy' }}
-      run: cd ./bin/build-mb && clojure -X build/build! :edition :${{ matrix.edition }} :version "$VERSION"
-
-    - name: Store commit's SHA-1 hash
-      run:  echo ${{ inputs.commit }} > COMMIT-ID
-      shell: bash
-    - run: mv ./target/uberjar/metabase.jar ./metabase.jar
-    - name: Calculate SHA256 checksum
-      run: sha256sum ./metabase.jar > SHA256.sum
-      shell: bash
-    - name: Upload JARs as artifact
-      uses: actions/upload-artifact@v7
-      with:
-        name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
-        path: |
-          ./metabase.jar
-          ./COMMIT-ID
-          ./SHA256.sum
-
-  run-pre-release-tests:
-    name: Run pre-release tests for ${{ inputs.version }}
-    needs: build-uberjar-for-release
-    uses: ./.github/workflows/pre-release.yml
-    secrets: inherit
-    with:
-      commit: ${{ inputs.commit }}
-      version: ${{ inputs.version }}

.github/workflows/build-private-ee-docker-image.yml

@@ -0,0 +1,140 @@
+name: Build & push private Metabase Docker image
+
+# Builds the ee uberjar for a commit and pushes it to the private ECR repo, tagged with that
+# commit's full SHA. Callers get the tag back as an output.
+#
+# The tag is per-commit rather than per-PR, so a PR leaves one image behind per pushed commit.
+# Nothing in this repo prunes them — retention is whatever lifecycle policy the ECR repo carries.
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: Full sha of commit to build, optional
+  workflow_call:
+    inputs:
+      commit:
+        description: Full sha of commit to build, optional
+        type: string
+
+    secrets:
+      PR_ENV_IAM_ROLE:
+        description: Role assumed via OIDC to reach ECR
+        required: true
+      PR_ENV_AWS_ACCOUNT_ID:
+        description: Account hosting the private ECR registry
+        required: true
+
+    outputs:
+      tag:
+        description: "Image tag (the commit SHA)"
+        value: ${{ jobs.dockerize.outputs.tag }}
+
+# Keyed on the calling workflow as well as the commit: pr-env and ai-benchmark both land here, and
+# a shared group lets a re-label on one evict the other's queued run (`cancel-in-progress: false`
+# still drops a *pending* run when a third queues). Before the extraction the two paths were
+# independent; this keeps them that way.
+concurrency:
+  group: build-private-ee-docker-image-${{ github.workflow }}-${{ inputs.commit || github.event.pull_request.head.sha || github.sha }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  actions: read # fetch-artifact reads the artifact API
+
+jobs:
+
+  build:
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
+    uses: ./.github/workflows/uberjar.yml
+    with:
+      # Pass through only an *explicit* commit and let uberjar apply its own event fallback.
+      # Resolving head.sha here instead would pin the PR path's checkout to the head commit, while
+      # run-tests' uberjar keeps building the merge ref — both upload under the same
+      # `metabase-ee-<head.sha>-uberjar` name, so whichever raced first would decide what the tag
+      # actually contains.
+      commit: ${{ inputs.commit }}
+
+  dockerize:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    needs: [build]
+    if: needs.build.result == 'success'
+    timeout-minutes: 60
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+    outputs:
+      tag: ${{ steps.meta.outputs.tag }}
+    steps:
+      # Deliberately the workflow's own revision, not `inputs.commit`: this checkout is where
+      # `./.github/actions/fetch-artifact` below comes from, and pinning it to the target commit
+      # would run that commit's copy of the action instead of this one. Nothing else in this job
+      # reads the tree.
+      - name: Checkout source code
+        uses: actions/checkout@v6
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+        with:
+          role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: us-east-1
+      - name: Login to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896 # v2
+        with:
+          registries: "${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}"
+      - name: Compute image tag
+        id: meta
+        env:
+          SHA: ${{ inputs.commit || github.event.pull_request.head.sha || github.sha }}
+        run: echo "tag=${SHA}" >> "$GITHUB_OUTPUT"
+      - name: Check whether image already exists
+        id: exists
+        env:
+          TAG: ${{ steps.meta.outputs.tag }}
+          # Same registry the push below targets — the assumed role's default registry is not
+          # necessarily this account, and querying the wrong one always reports "not found".
+          REGISTRY_ID: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}
+        run: |
+          set +e
+          OUT=$(aws ecr describe-images \
+                  --registry-id "${REGISTRY_ID}" \
+                  --repository-name metabase-enterprise \
+                  --image-ids imageTag="${TAG}" 2>&1)
+          STATUS=$?
+          set -e
+
+          if [[ "${STATUS}" -eq 0 ]]; then
+            echo "Image already present for ${TAG}; reusing it."
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          elif grep -q 'ImageNotFoundException' <<< "${OUT}"; then
+            echo "No image for ${TAG}; building."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          else
+            # Anything else (missing ecr:DescribeImages, wrong registry, throttling) is
+            # indistinguishable from "not found" if we swallow it, and we'd rebuild forever
+            # without ever saying why. Rebuilding is still the safe answer, so warn and go on.
+            echo "${OUT}" >&2
+            echo "::warning::Could not determine whether ${TAG} exists in ECR (exit ${STATUS}); building unconditionally."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Retrieve uberjar artifact for ee
+        if: steps.exists.outputs.found == 'false'
+        uses: ./.github/actions/fetch-artifact
+        with:
+          commit: ${{ steps.meta.outputs.tag }}
+          edition: ee
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"
+      - name: Move uberjar to bin/docker
+        if: steps.exists.outputs.found == 'false'
+        run: mv target/uberjar/metabase.jar bin/docker/metabase.jar
+      - name: Build container
+        if: steps.exists.outputs.found == 'false'
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: bin/docker/
+          platforms: linux/amd64
+          network: host
+          tags: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com/metabase-enterprise:${{ steps.meta.outputs.tag }}
+          push: true

.github/workflows/build-scripts.yml

@@ -9,6 +9,74 @@ on:
 
 jobs:
 
+  files-changed:
+    name: Check which files changed
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 3
+    permissions:
+      contents: read
+    outputs:
+      embedder_plugin: ${{ steps.changes.outputs.embedder_plugin }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Test which files changed
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  test-embedder-plugin:
+    needs: files-changed
+    if: needs.files-changed.outputs.embedder_plugin == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    services:
+      postgres:
+        image: pgvector/pgvector:pg17
+        env:
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+        ports:
+          - 5432:5432
+    steps:
+    - uses: actions/checkout@v6
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+    - name: Build embedder plugin
+      run: ./bin/build-embedder-plugin.sh
+    - name: Verify packaged plugin resources
+      run: |
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase/embedder/metabase-plugin.yaml
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase/embedder-model-catalog.edn
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/snowflake-arctic-embed-xs-d8c86521100d3556476a063fc2342036d45c106f-arm64.zip
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/snowflake-arctic-embed-xs-d8c86521100d3556476a063fc2342036d45c106f-avx2.zip
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/all-minilm-l6-v2-1110a243fdf4706b3f48f1d95db1a4f5529b4d41-arm64.zip
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/all-minilm-l6-v2-1110a243fdf4706b3f48f1d95db1a4f5529b4d41-avx2.zip
+    - name: Run artifact-only plugin smoke test
+      env:
+        MB_EMBEDDER_ARTIFACT_TEST: "true"
+        MB_PLUGINS_DIR: modules/embedder/target
+      run: >-
+        ./bin/test-agent --oss :only
+        '[metabase.embeddings.embedder-plugin-artifact-test]'
+    - name: Run in-process semantic-search round trip
+      env:
+        MB_DB_TYPE: postgres
+        MB_DB_PORT: 5432
+        MB_DB_HOST: localhost
+        MB_DB_DBNAME: mb_test
+        MB_DB_USER: mb_test
+        MB_APPDB_PGVECTOR_MODE_TEST: "true"
+        MB_IN_PROCESS_EMBEDDER_SEMANTIC_SEARCH_TEST: "true"
+        MB_PLUGINS_DIR: modules/embedder/target
+      run: >-
+        ./bin/test-agent --drivers=postgres :only
+        '[metabase-enterprise.semantic-search.appdb-pgvector-mode-test/appdb-pgvector-in-process-embedder-round-trip-test]'
+
   test-build-scripts:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
@@ -24,3 +92,7 @@ jobs:
       run: clojure -M:test
       working-directory: bin/lint-migrations-file
       timeout-minutes: 15
+    - name: Run load-namespaces tests
+      run: clojure -M:test
+      working-directory: bin/load-namespaces
+      timeout-minutes: 15

.github/workflows/bundle-size-stats.yml

@@ -2,7 +2,7 @@ name: Bundle Size Stats
 
 # Reuses the uberjar built on every master merge: downloads the jar (for the
 # emitted JS) plus the bundle-stats and embedding-sdk artifacts, measures
-# initial/total bundle sizes, and appends them to stats.metabase.com.
+# initial/total bundle sizes, and appends them to eng-stats-importer.
 
 on:
   workflow_run:
@@ -32,6 +32,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
+      - uses: ./.github/actions/prepare-node-bun
       - name: Download EE uberjar
         uses: ./.github/actions/fetch-artifact
         with:
@@ -104,42 +105,15 @@ jobs:
           # Passed via env (not interpolated into the shell) so the commit
           # message can't inject commands; the script keeps only the subject.
           COMMIT_MESSAGE: ${{ github.event.workflow_run.head_commit.message }}
-        run: node ./.github/scripts/bundle-size-stats-prepare.js
-      - name: Upload sizes (with deltas) to Stats
+        run: bun ./.github/scripts/bundle-size-stats-prepare.ts
+      - name: Import sizes (with deltas) into Stats
         id: upload
         if: steps.prepare.outputs.significant == 'true'
-        uses: actions/github-script@v9
         env:
-          API_KEY: ${{ secrets.STATS_API_KEY }}
-        with:
-          script: | # js
-            const fs = require("fs");
-            const { uploadCsvToMb } = require("${{ github.workspace }}/.github/scripts/csv-to-mb.js");
-
-            const data = JSON.parse(
-              fs.readFileSync("${{ github.workspace }}/artifacts/upload-rows.json", "utf8"),
-            );
-
-            console.table(data);
-
-            try {
-              await uploadCsvToMb({
-                baseUrl: "https://stats.metabase.com",
-                tableId: 79702,
-                jsonData: data,
-                mode: "append",
-              });
-              console.log("Bundle sizes uploaded successfully");
-              core.setOutput("uploaded", "true");
-            } catch (error) {
-              // Stats logging is best-effort: if stats.metabase.com is still
-              // unreachable after the client's retries, keep the run green. The
-              // last-plotted cache is only saved on a successful upload (below),
-              // so this point is re-attempted on the next master build and
-              // nothing is silently dropped.
-              core.warning(`Bundle-size upload failed after retries; leaving run green: ${error.message}`);
-              core.setOutput("uploaded", "false");
-            }
+          ROWS: artifacts/upload-rows.json
+          ENG_STATS_URL: ${{ secrets.ENG_STATS_URL }}
+          API_KEY: ${{ secrets.ENG_STATS_API_KEY }}
+        run: bun .github/scripts/upload-bundle-size-stats.ts
       - name: Remember this as the last plotted point
         if: steps.upload.outputs.uploaded == 'true'
         uses: actions/cache/save@v4

.github/workflows/bundle-size.yml

@@ -7,11 +7,6 @@ name: Bundle Size
 
 on:
   workflow_call:
-    inputs:
-      skip:
-        description: Whether to skip the check (e.g. no front-end sources changed, or the uberjar failed to build).
-        required: true
-        type: boolean
 
 concurrency:
   group: bundle-size-${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
@@ -20,7 +15,6 @@ concurrency:
 jobs:
   bundle-size-check:
     name: "Bundle size check"
-    if: ${{ !inputs.skip }}
     continue-on-error: true
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
@@ -32,7 +26,6 @@ jobs:
         id: compare
         with:
           edition: ee
-          base-ref-commit: ${{ github.event.pull_request.base.sha }}
           threshold-percent: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
 
       - name: Comment on PR if app bundle size has increased

.github/workflows/cache-cleanup-codeql.yml

@@ -1,83 +0,0 @@
-# CodeQL's overlay analysis saves a ~400MB "base database" cache on every master run, keyed by commit SHA.
-#
-# Only the newest entry is ever restored: CodeQL looks its cache up by key *prefix* and takes the most recent match,
-# so everything behind it is dead weight. This job keeps the newest few and deletes the rest.
-name: CodeQL Cache Cleanup
-
-on:
-  schedule:
-    - cron: "0 4 * * *" # daily at 04:00 UTC
-  workflow_dispatch:
-    inputs:
-      keep:
-        description: "How many of the newest CodeQL caches to keep"
-        required: false
-        default: "2"
-      dry-run:
-        description: "List what would be deleted without deleting it"
-        type: boolean
-        required: false
-        default: false
-
-concurrency:
-  group: cache-cleanup-codeql
-  cancel-in-progress: false
-
-permissions:
-  actions: write # required to delete cache entries
-  contents: read
-
-jobs:
-  cleanup:
-    # don't run the schedule on forks
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    env:
-      GH_TOKEN: ${{ github.token }}
-      KEEP: ${{ github.event.inputs.keep || '2' }}
-      DRY_RUN: ${{ github.event.inputs.dry-run || 'false' }}
-      PREFIX: codeql-overlay-base-database-
-    steps:
-      - name: Delete superseded CodeQL caches
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          # created_at is ISO-8601, so a reverse lexicographic sort is newest-first.
-          gh api --paginate "/repos/${GITHUB_REPOSITORY}/actions/caches?per_page=100" \
-            --jq ".actions_caches[] | select(.key | startswith(\"${PREFIX}\")) | \"\(.created_at)\t\(.id)\t\(.size_in_bytes)\t\(.key)\"" \
-            | sort -r > all.tsv || true
-
-          found=$(wc -l < all.tsv | tr -d ' ')
-          echo "Found $found cache(s) matching '${PREFIX}'; keeping the newest $KEEP."
-          if [ "$found" -eq 0 ]; then
-            echo "Nothing to do." >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          tail -n +$((KEEP + 1)) all.tsv > doomed.tsv || true
-          doomed=$(wc -l < doomed.tsv | tr -d ' ')
-
-          freed=0
-          while IFS=$'\t' read -r created id size key; do
-            [ -z "${id:-}" ] && continue
-            echo "  deleting $key ($((size / 1000000))MB, created $created)"
-            if [ "$DRY_RUN" = "true" ]; then
-              echo "    (dry run — not deleted)"
-            else
-              # A cache can vanish between listing and deleting (concurrent eviction); don't fail the job over it.
-              gh api --method DELETE "/repos/${GITHUB_REPOSITORY}/actions/caches/${id}" >/dev/null \
-                || echo "    (already gone, skipping)"
-            fi
-            freed=$((freed + size))
-          done < doomed.tsv
-
-          {
-            echo "### CodeQL cache cleanup"
-            echo ""
-            echo "- matched: **$found**"
-            echo "- kept (newest): **$KEEP**"
-            echo "- deleted: **$doomed**"
-            echo "- reclaimed: **$((freed / 1000000)) MB**${DRY_RUN:+ (dry run: $DRY_RUN)}"
-          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/cache-generator.yml

@@ -1,173 +0,0 @@
-# This workflow is the single source of truth for generating and updating various caches used by our CI pipeline.
-# It sets the fresh cache each Monday but provides a manual trigger to update it on-demand.
-#
-# All other jobs only restore from this cache; *they never update it*!
-# They should always use `actions/cache/restore@vX` because `actions/cache@vX` would attempt to save the cache.
-#
-# Our agreed-upon strategy is to use a deterministic cache key based on the week of the year.
-# Jobs can utilize the prior week's cache if the current week's cache is not found.
-#
-#
-# PRINCIPLES:
-#   - The cache is never wrong!
-#   - Caches are immutable once created.
-#   - Caches are for speeding up builds, not for correctness.
-#   - It is faster to download a large cache than to re-resolve missing dependencies.
-#
-#
-# DESIGN:
-#
-# 1. Prepare
-#     - A job first prepares the local environment (e.g., installs JDK, Clojure, Node.js, etc.)
-#     - This fetches the dependencies from the cache (if it exists) and warms up the local cache for this workflow.
-# 2. Resolve
-#     - The next step pre-resolves all dependencies, ensuring that the local cache is fully populated and up-to-date.
-# 3. Update
-#     - The final step saves the local cache back to GitHub Actions cache with a deterministic key.
-#     - If a cache entry already exists for that key, it is deleted first to ensure immutability.
-#
-name: Cache Generator
-
-on:
-  schedule:
-    - cron: "0 3 * * 1" # Mondays at 03:00 UTC
-  workflow_dispatch: # manually update the cache
-
-concurrency:
-  group: cache-generator
-  cancel-in-progress: true
-
-jobs:
-  get-cache-keys:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Get cache keys
-        uses: ./.github/actions/get-cache-keys
-        id: get-cache-keys
-    outputs:
-      m2-cache-key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
-      node-cache-key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
-      eslint-cache-key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
-      cypress-cache-key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
-
-  generate-caches:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 30
-    needs: get-cache-keys
-    env:
-      M2_CACHE_KEY: ${{ needs.get-cache-keys.outputs.m2-cache-key }}
-      NODE_CACHE_KEY: ${{ needs.get-cache-keys.outputs.node-cache-key }}
-      CYPRESS_CACHE_KEY: ${{ needs.get-cache-keys.outputs.cypress-cache-key }}
-      ESLINT_CACHE_KEY: ${{ needs.get-cache-keys.outputs.eslint-cache-key }}
-    steps:
-      - uses: actions/checkout@v6
-
-      # Backend preparation and cache
-      - name: Prepare backend
-        uses: ./.github/actions/prepare-backend
-
-      # Pre-resolve every Clojure dependency classpath CI actually uses, so the
-      # saved cache is a SUPERSET of what each job resolves at runtime.
-      #
-      # Why a single `-P` is not enough: tools.deps selects dependency *versions*
-      # globally per classpath, so different alias combinations can resolve the
-      # same transitive lib to different versions (e.g. `org.clojure/data.json`
-      # 2.4.0 vs 2.5.x, `org.ow2.asm/asm` 9.2 vs newer). Resolving only one combo
-      # leaves the others to fetch their version-deltas straight from Maven
-      # Central / Clojars on every run -> intermittent 403s. See DEV-2094.
-      #
-      # Keep this list in sync with the `clojure` invocations across .github/.
-      # Each entry notes its consumer. We resolve the FULL alias strings (not a
-      # hand-reduced set) on purpose: if a currently dep-less alias later gains a
-      # dependency, this still covers it instead of silently drifting back into a
-      # cache gap.
-      - name: Pre-resolve Clojure dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          combos=(
-            ":build:dev:ee:ee-dev:drivers:drivers-dev:cljs"     # build + uberjar (combined classpath)
-            ":cljs"                                             # shadow-cljs (build:cljs); resolves :cljs alone -> covers asm:9.2
-            ":dev:ee:ee-dev:drivers:drivers-dev:test:eastwood"  # backend.yml (eastwood + eastwood/test)
-            ":dev:ci:ee:ee-dev:drivers:drivers-dev:test"        # test-driver.yml (ee) -> covers data.json:2.4.0
-            ":dev:ci:oss:oss-dev:drivers:drivers-dev:test"      # test-driver.yml (oss)
-            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee) + generative-query-test.yml
-            ":dev:ci:test:oss:oss-dev"                          # backend.yml matrix (oss)
-            ":dev:ci:ee:ee-dev:test:cloverage"                  # backend-cloverage.yml
-            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml + presto script
-            ":dev:drivers:build:build-dev:build-test:ci"        # build-scripts.yml
-            ":ee:drivers:check"                                 # backend.yml (check; git dep athos/clj-check)
-            ":ee:doc"                                           # docs-generate-base.yml
-            ":kondo"                                            # resolve-backport-conflicts.yml (replace-deps)
-            ":run:ee"                                           # cross-branch-migration-test
-            ":dev:ee:migrate"                                   # cross-branch-migration-test
-          )
-          for combo in "${combos[@]}"; do
-            echo "::group::clojure -P -A${combo}"
-            clojure -P -A"${combo}"
-            echo "::endgroup::"
-          done
-
-      - name: Update M2 cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: |
-            ~/.m2
-            ~/.gitlibs
-          key: ${{ env.M2_CACHE_KEY }}
-
-      # Frontend preparation and caches
-      # `prepare-frontend` action (1) prepares Node.js and (2) fetches the node_modules cache if it exists.
-      # It then (3) runs `bun install --frozen-lockfile` which ensures the local cache is fully populated.
-      # IMPORTANT: Caching node_modules after patches are already applied will break any PR that attempts to either:
-      #   - upgrade a patched library
-      #   - change a patch
-      # Hence why we explicitly exclude patches from the cache (controlled by the `apply-patches` action input).
-      - name: Install front-end dependencies
-        uses: ./.github/actions/prepare-frontend
-        with:
-          apply-patches: "false"
-
-      - name: Get bun cache directory
-        id: bun-cache
-        run: |
-          BUN_CACHE_DIR=$(bun pm cache)
-          echo "Bun cache directory: $BUN_CACHE_DIR"
-          echo "dir=$BUN_CACHE_DIR" >> "$GITHUB_OUTPUT"
-
-      - name: Ensure that Cypress executable is ready
-        run: |
-          bun run cypress install
-          bun run cypress cache path
-          bun run cypress cache list
-          bun run cypress verify
-        shell: bash
-
-      - name: Update node_modules cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: |
-            ${{ steps.bun-cache.outputs.dir }}
-            node_modules
-          key: ${{ env.NODE_CACHE_KEY }}
-
-      - name: Update Cypress cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: ~/.cache/Cypress
-          key: ${{ env.CYPRESS_CACHE_KEY }}
-
-      # ESLint cache (requires both backend and frontend)
-      - name: Compile CLJS
-        run: bun run build-pure:cljs
-
-      - name: Run ESLint to populate cache
-        run: bun run lint-eslint-pure
-
-      - name: Update eslint cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: ${{ github.workspace}}/.eslintcache
-          key: ${{ env.ESLINT_CACHE_KEY }}

.github/workflows/cache-warm.yml

@@ -0,0 +1,172 @@
+# Writes the three large dependency caches. Every other job restores them and none of them writes.
+#
+# A single writer rather than the usual let-every-job-save arrangement, because a pull request here fans
+# out to roughly 200 jobs, ~75 of which install Cypress. Letting each of those save would have them all
+# build a 200MB archive and race for one reservation on every lockfile change, and all pull the Cypress
+# binary at once on a version bump.
+#
+# The ESLint cache is the exception and saves from the lint job itself: it is under a megabyte and only a
+# couple of jobs write it, so there is no herd to avoid.
+#
+# A cache is readable from the ref that saved it, from that ref's pull requests, and - for every ref -
+# from the default branch. Warming on push to each merge target therefore serves the pull requests aimed
+# at it, and master's copy backs up every ref that has none of its own.
+#
+# Keys are content-derived (see .github/scripts/cache-keys.sh), so a push whose dependencies already have
+# an entry does nothing but three lookups. There is no cron: nothing here is keyed by date.
+#
+#
+# PRINCIPLES:
+#   - The cache is never wrong!
+#   - Caches are immutable once created.
+#   - Caches are for speeding up builds, not for correctness.
+#   - It is faster to download a large cache than to re-resolve missing dependencies.
+
+name: Cache Warm
+
+on:
+  push:
+    branches:
+      - master
+      - "release-x.*.x"
+  workflow_dispatch:
+
+concurrency:
+  group: cache-warm-${{ github.ref }}
+  # Pushes to master land a median of 27 minutes apart and a full resolve takes longer, so cancelling in
+  # progress would abort most warms before they save and a ref could stay cold indefinitely. Queueing
+  # costs one wait instead: the queued run finds every key present and exits in about a minute.
+  cancel-in-progress: false
+
+jobs:
+  warm:
+    # Forks read the upstream default branch's caches and cannot usefully write their own, so warming
+    # there would burn a runner for nothing.
+    if: ${{ github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Cache spec
+        id: cache-spec
+        run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
+
+      # `lookup-only` with no restore-keys asks whether this exact dependency set is already cached.
+      # Paths come from the spec, the same ones the save below declares - a lookup that named different
+      # paths would compute a different cache identity and report a miss every time.
+      - name: Look up M2 cache
+        id: m2-lookup
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.m2-path }}
+          key: ${{ steps.cache-spec.outputs.m2-key }}
+          lookup-only: true
+      - name: Look up bun store
+        id: bun-lookup
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.bun-store-path }}
+          key: ${{ steps.cache-spec.outputs.bun-store-key }}
+          lookup-only: true
+      - name: Look up Cypress binary
+        id: cypress-lookup
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.cypress-path }}
+          key: ${{ steps.cache-spec.outputs.cypress-key }}
+          lookup-only: true
+
+      - name: Prepare backend
+        if: steps.m2-lookup.outputs.cache-hit != 'true'
+        uses: ./.github/actions/prepare-backend
+
+      # Pre-resolve every Clojure dependency classpath CI actually uses, so the saved cache is a SUPERSET
+      # of what each job resolves at runtime.
+      #
+      # Why a single `-P` is not enough: tools.deps selects dependency *versions* globally per classpath,
+      # so different alias combinations can resolve the same transitive lib to different versions (e.g.
+      # `org.clojure/data.json` 2.4.0 vs 2.5.x, `org.ow2.asm/asm` 9.2 vs newer). Resolving only one combo
+      # leaves the others to fetch their version-deltas straight from Maven Central / Clojars on every
+      # run -> intermittent 403s. See DEV-2094.
+      #
+      # Keep this list in sync with the `clojure` invocations across .github/. Each entry notes its
+      # consumer. We resolve the FULL alias strings (not a hand-reduced set) on purpose: if a currently
+      # dep-less alias later gains a dependency, this still covers it instead of silently drifting back
+      # into a cache gap.
+      - name: Pre-resolve Clojure dependencies
+        if: steps.m2-lookup.outputs.cache-hit != 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          combos=(
+            ":build:dev:ee:ee-dev:drivers:drivers-dev:cljs"     # build + uberjar (combined classpath)
+            ":cljs"                                             # shadow-cljs (build:cljs); resolves :cljs alone -> covers asm:9.2
+            ":dev:ee:ee-dev:drivers:drivers-dev:test:eastwood"  # backend.yml (eastwood + eastwood/test)
+            ":dev:ci:ee:ee-dev:drivers:drivers-dev:test"        # test-driver.yml (ee) -> covers data.json:2.4.0
+            ":dev:ci:oss:oss-dev:drivers:drivers-dev:test"      # test-driver.yml (oss)
+            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee)
+            ":dev:ci:test:oss:oss-dev"                          # backend.yml matrix (oss)
+            ":dev:ci:ee:ee-dev:test:cloverage"                  # backend-cloverage.yml
+            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml
+            ":dev:drivers:build:build-dev:build-test:ci"        # build-scripts.yml
+            ":test"                                             # build-scripts.yml (bin/build unit tests)
+            ":ee:drivers:load-namespaces"                       # backend.yml (load-namespaces)
+            ":ee:doc"                                           # docs-generate-base.yml
+            ":kondo"                                            # resolve-backport-conflicts.yml (replace-deps)
+            ":run:ee"                                           # cross-branch-migration-test
+            ":dev:ee:migrate"                                   # cross-branch-migration-test
+            ":whitespace-linter"                                # whitespace linter
+          )
+          for combo in "${combos[@]}"; do
+            echo "::group::clojure -P -A${combo}"
+            clojure -P -A"${combo}"
+            echo "::endgroup::"
+          done
+
+          echo "::group::./bin/mage"
+          ./bin/mage
+          echo "::endgroup::"
+
+      - name: Save M2 cache
+        if: steps.m2-lookup.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.m2-path }}
+          key: ${{ steps.cache-spec.outputs.m2-key }}
+
+      # `prepare-frontend` installs bun, points it at the store path, and runs a frozen-lockfile install,
+      # which is what fills the store. Patches are deliberately not applied: a store cached with patches
+      # already in place breaks any pull request that changes or upgrades a patched dependency.
+      #
+      # This also runs when only the Cypress cache is missing, because `bun run cypress install` below
+      # needs the node_modules this step creates. Narrowing the condition to the bun store alone would
+      # leave that step with no Cypress binary to run.
+      - name: Install front-end dependencies
+        if: steps.bun-lookup.outputs.cache-hit != 'true' || steps.cypress-lookup.outputs.cache-hit != 'true'
+        uses: ./.github/actions/prepare-frontend
+        with:
+          apply-patches: "false"
+
+      - name: Save bun store
+        if: steps.bun-lookup.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.bun-store-path }}
+          key: ${{ steps.cache-spec.outputs.bun-store-key }}
+
+      - name: Ensure that Cypress executable is ready
+        if: steps.cypress-lookup.outputs.cache-hit != 'true'
+        shell: bash
+        run: |
+          bun run cypress install
+          bun run cypress cache path
+          bun run cypress cache list
+          bun run cypress verify
+
+      - name: Save Cypress binary
+        if: steps.cypress-lookup.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.cypress-path }}
+          key: ${{ steps.cache-spec.outputs.cypress-key }}

.github/workflows/check-backport-script.yml

@@ -3,11 +3,11 @@ name: Prevent backport.sh from being merged
 on:
   pull_request:
     types: [opened, synchronize, reopened]
-  merge_group:
 
 jobs:
   check-backport-script:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     steps:
       - name: Checkout code
         uses: actions/checkout@v6

.github/workflows/chromatic.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_all: ${{ steps.changes.outputs.frontend_all }}

.github/workflows/cljs.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       cljs: ${{ steps.changes.outputs.cljs }}

.github/workflows/codeql.yml

@@ -1,39 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-  pull_request:
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      codeql: ${{ steps.changes.outputs.codeql }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-  analyze:
-    needs: files-changed
-    if: needs.files-changed.outputs.codeql == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
-      with:
-        languages: javascript
-        config-file: ./.github/codeql/codeql-config.yml
-        trap-caching: false
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4

.github/workflows/containerize-uberjar.yml

@@ -67,33 +67,6 @@ jobs:
       build-args: |
         GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
 
-  run-trivy:
-    needs: [get-container-info, containerize]
-    strategy:
-      matrix:
-        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    name: Run Trivy vulnerability scanner
-    steps:
-      - name: Check out the code
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        env:
-          TRIVY_OFFLINE_SCAN: true
-          repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
-          tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
-        with:
-          image-ref: docker.io/${{ env.repo }}:${{ env.tag }}
-          format: sarif
-          output: trivy-results.sarif
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: "trivy-results.sarif"
-
   post-comment:
     needs: [get-container-info, containerize]
     if: github.event_name == 'pull_request'

.github/workflows/cross-version.yml

@@ -27,7 +27,8 @@ jobs:
   # Generate matrix for scheduled/PR runs
   generate-matrix:
     if: github.event_name != 'workflow_dispatch' && github.repository == 'metabase/metabase'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
@@ -97,9 +98,12 @@ jobs:
       - name: Show logs on failure
         if: failure()
         run: |
-          cd cross-version
-          docker compose logs metabase || true
-          docker compose logs postgres || true
+          for f in cross-version/logs/*.log; do
+            [ -e "$f" ] || continue
+            echo "::group::$f"
+            cat "$f"
+            echo "::endgroup::"
+          done
 
   # Notify Slack on nightly failures
   notify-on-failure:
@@ -221,6 +225,9 @@ jobs:
       - name: Show logs on failure
         if: failure()
         run: |
-          cd cross-version
-          docker compose logs metabase || true
-          docker compose logs postgres || true
+          for f in cross-version/logs/*.log; do
+            [ -e "$f" ] || continue
+            echo "::group::$f"
+            cat "$f"
+            echo "::endgroup::"
+          done

.github/workflows/disabled-drivers-slack-notification.yml

@@ -1,88 +0,0 @@
-name: Disabled Drivers Slack Notification
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 9 * * 1" # every Monday at 9:00 UTC
-
-jobs:
-  notify-disabled-drivers:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-      - uses: actions/setup-node@v6.4.0
-        with:
-          node-version: lts/Jod
-
-      - name: Install Slack SDK
-        run: npm install @slack/web-api
-
-      - name: Check disabled drivers and notify Slack
-        uses: actions/github-script@v9
-        env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        with:
-          script: |
-            const { WebClient } = require('@slack/web-api');
-
-            // Fetch the config
-            const response = await fetch('https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json');
-            const config = await response.json();
-
-            const drivers = config.drivers || [];
-            const lastUpdated = config.metadata?.last_updated || 'unknown';
-            const reason = config.metadata?.reason || 'No reason provided';
-
-            // "skip" is the only status CI reads: the driver is not run at all. A driver that
-            // runs but must not gate is expressed as a suite-level rule in CI Conductor, which
-            // reports it in its own UI.
-            const skipped = drivers.filter(d => d.status === 'skip').map(d => d.name);
-
-            if (skipped.length === 0) {
-              console.log('No drivers are disabled. Skipping Slack notification.');
-              return;
-            }
-
-            const list = (names) => names.map(d => `\`${d}\``).join('  ');
-            const lines = [`:no_entry: *Disabled (not run):* ${list(skipped)}`];
-
-            if (!process.env.SLACK_BOT_TOKEN) {
-              throw new Error('SLACK_BOT_TOKEN is required');
-            }
-
-            const slack = new WebClient(process.env.SLACK_BOT_TOKEN);
-
-            await slack.chat.postMessage({
-              channel: 'engineering-ci',
-              text: 'CI Driver Status Report',
-              blocks: [
-                {
-                  type: 'section',
-                  text: {
-                    type: 'mrkdwn',
-                    text: `*CI Driver Status*\n${lines.join('\n')}`
-                  },
-                  accessory: {
-                    type: 'button',
-                    text: {
-                      type: 'plain_text',
-                      text: 'View Config',
-                      emoji: true
-                    },
-                    url: 'https://github.com/metabase/ci-test-config/blob/master/ci-test-config.json'
-                  }
-                },
-                {
-                  type: 'context',
-                  elements: [
-                    {
-                      type: 'mrkdwn',
-                      text: `${reason} · :clock1: *${lastUpdated}*`
-                    }
-                  ]
-                }
-              ]
-            });
-
-            console.log('Slack notification sent successfully');

.github/workflows/docs-generate-base.yml

@@ -33,6 +33,9 @@ jobs:
       - name: Prepare backend environment
         uses: ./.github/actions/prepare-backend
 
+      - name: Prepare frontend environment
+        uses: ./.github/actions/prepare-frontend
+
       - name: Set up Babashka
         uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
         with:
@@ -75,6 +78,22 @@ jobs:
       - name: Generate usage analytics documentation
         run: ./bin/generate-usage-analytics-docs.bb
 
+      - name: Generate embedding SDK documentation
+        id: generate_embedding_sdk_docs
+        run: |
+          set -e  # Exit on any error
+          echo "Generating embedding SDK documentation..."
+          bun run embedding-sdk:docs:generate
+        continue-on-error: false
+
+      - name: Generate embedding EAJS documentation
+        id: generate_embedding_eajs_docs
+        run: |
+          set -e  # Exit on any error
+          echo "Generating embedding EAJS documentation..."
+          bun run embedding-eajs:docs:generate
+        continue-on-error: false
+
       - name: Check for changes
         id: check_changes
         run: |
@@ -146,6 +165,8 @@ jobs:
           - \`clojure -M:ee:doc api-documentation\`
           - \`clojure -M:ee:doc command-documentation\`
           - \`./bin/generate-usage-analytics-docs.bb\`
+          - \`bun run embedding-sdk:docs:generate\`
+          - \`bun run embedding-eajs:docs:generate\`
 
           Please review the changes and merge if they look correct." \
               --label "Type:Documentation" \

.github/workflows/drivers-stress-test.yml

@@ -770,7 +770,7 @@ jobs:
 
   login-to-ecr:
     if: inputs.driver == 'Vertica'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 15
     permissions:
       id-token: write

.github/workflows/drivers.yml

@@ -6,6 +6,49 @@ on:
       skip:
         type: boolean
         default: false
+      force-run:
+        description: Run the full suite regardless of the diff (master / release branches, ci:run-all label).
+        type: boolean
+        default: false
+  # Run one driver job on demand, against the ref you dispatch on, optionally under a profiler.
+  # Everything else about the job -- credentials, services, test args, quarantine gating -- is
+  # whatever the normal CI run uses, because it is the same job.
+  workflow_dispatch:
+    inputs:
+      driver:
+        description: 'Which driver job to run. Only this one runs; the usual decision rules are bypassed.'
+        type: choice
+        required: true
+        options:
+          - athena
+          - bigquery
+          - clickhouse
+          - databricks
+          - druid-jdbc
+          - h2
+          - mongo
+          - mongo-sharded-cluster
+          - mongo-ssl
+          - mysql-mariadb
+          - oracle
+          - postgres
+          - presto-jdbc
+          - redshift
+          - snowflake
+          - sparksql
+          - sqlite
+          - sqlserver
+          - vertica
+      tests:
+        description: 'Optional: run only these tests, comma- or space-separated, e.g. metabase.driver.bigquery-cloud-sdk-test/sync-test. Bare namespaces work too. Blank runs the job''s usual set.'
+        type: string
+        required: false
+        default: ''
+      profile:
+        description: 'Profile the test run and attach a flamegraph to the job. Adds sampling overhead.'
+        type: boolean
+        required: false
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-drivers
@@ -15,8 +58,16 @@ concurrency:
 # ci-conductor (secrets: inherit is already set on the drivers call in
 # run-tests.yml). See DEV-2224.
 env:
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  # Both read by the test-driver action, which is what actually runs the tests. Set here rather than
+  # passed as inputs to each job so that turning either on is one line, not one line per driver.
+  # Empty (and so off) on workflow_call, where neither input exists.
+  #
+  # ONLY_TESTS replaces the job's own test selection, so every matrix leg of the chosen driver runs
+  # the whole list -- BigQuery, for instance, has three legs.
+  PROFILE_TESTS: ${{ inputs.profile }}
+  ONLY_TESTS: ${{ inputs.tests }}
 
 jobs:
   # This job determines which driver tests should run based on PR context.
@@ -45,29 +96,11 @@ jobs:
       sqlite-should-run: ${{ steps.driver-decisions.outputs.sqlite-should-run }}
       sqlserver-should-run: ${{ steps.driver-decisions.outputs.sqlserver-should-run }}
       vertica-should-run: ${{ steps.driver-decisions.outputs.vertica-should-run }}
-      # Per-driver quarantine conflict flags (set when driver is quarantined but has file changes)
-      athena-quarantine-conflict: ${{ steps.driver-decisions.outputs.athena-quarantine-conflict }}
-      bigquery-quarantine-conflict: ${{ steps.driver-decisions.outputs.bigquery-quarantine-conflict }}
-      clickhouse-quarantine-conflict: ${{ steps.driver-decisions.outputs.clickhouse-quarantine-conflict }}
-      databricks-quarantine-conflict: ${{ steps.driver-decisions.outputs.databricks-quarantine-conflict }}
-      druid-quarantine-conflict: ${{ steps.driver-decisions.outputs.druid-quarantine-conflict }}
-      druid-jdbc-quarantine-conflict: ${{ steps.driver-decisions.outputs.druid-jdbc-quarantine-conflict }}
-      mongo-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-quarantine-conflict }}
-      mongo-ssl-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-ssl-quarantine-conflict }}
-      mongo-sharded-cluster-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-quarantine-conflict }}
-      mysql-mariadb-quarantine-conflict: ${{ steps.driver-decisions.outputs.mysql-mariadb-quarantine-conflict }}
-      oracle-quarantine-conflict: ${{ steps.driver-decisions.outputs.oracle-quarantine-conflict }}
-      postgres-quarantine-conflict: ${{ steps.driver-decisions.outputs.postgres-quarantine-conflict }}
-      presto-jdbc-quarantine-conflict: ${{ steps.driver-decisions.outputs.presto-jdbc-quarantine-conflict }}
-      redshift-quarantine-conflict: ${{ steps.driver-decisions.outputs.redshift-quarantine-conflict }}
-      snowflake-quarantine-conflict: ${{ steps.driver-decisions.outputs.snowflake-quarantine-conflict }}
-      sparksql-quarantine-conflict: ${{ steps.driver-decisions.outputs.sparksql-quarantine-conflict }}
-      sqlite-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlite-quarantine-conflict }}
-      sqlserver-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlserver-quarantine-conflict }}
-      vertica-quarantine-conflict: ${{ steps.driver-decisions.outputs.vertica-quarantine-conflict }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
       - name: Fetch base branch
         if: github.event_name == 'pull_request' && github.event.pull_request.base.ref != ''
         run: |
@@ -80,9 +113,10 @@ jobs:
           # branch context, labels, and file changes to decide what runs.
           MAGE_ARGS=(
             --git-ref="${BASE_REF}"
-            --is-master-or-release="${IS_MASTER_OR_RELEASE}"
+            --force-run="${FORCE_RUN}"
             --pr-labels="${{ join(github.event.pull_request.labels.*.name, ',') }}"
             --skip="${{ inputs.skip }}"
+            --only-driver="${ONLY_DRIVER}"
           )
           echo "Running:"
           echo "./bin/mage -driver-decisions ${MAGE_ARGS[*]}"
@@ -96,12 +130,13 @@ jobs:
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> "$GITHUB_OUTPUT"
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }}
-          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-x') }}
+          FORCE_RUN: ${{ inputs.force-run }}
+          ONLY_DRIVER: ${{ inputs.driver }}
         shell: bash
 
   be-tests-athena-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.athena-should-run == 'true' || needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.athena-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -118,16 +153,6 @@ jobs:
       MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY }}
     name: Athena
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Athena driver is quarantined but you changed files in modules/drivers/athena/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Athena tests, add the label: break-quarantine-athena"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Athena driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test Athena driver
       id: test-driver
@@ -138,19 +163,10 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' || needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 70
     strategy:
@@ -187,16 +203,6 @@ jobs:
       MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
     name: BigQuery ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::BigQuery driver is quarantined but you changed files in modules/drivers/bigquery-cloud-sdk/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run BigQuery tests, add the label: break-quarantine-bigquery"
-        echo ""
-        echo "If you merge without testing, you risk breaking the BigQuery driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -211,15 +217,6 @@ jobs:
         test-args: ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -229,7 +226,7 @@ jobs:
 
   be-tests-clickhouse-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.clickhouse-should-run == 'true' || needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.clickhouse-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -253,16 +250,6 @@ jobs:
       MB_CLICKHOUSE_TEST_NGINX_PORT: 8127
     name: Clickhouse ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::ClickHouse driver is quarantined but you changed files in modules/drivers/clickhouse/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run ClickHouse tests, add the label: break-quarantine-clickhouse"
-        echo ""
-        echo "If you merge without testing, you risk breaking the ClickHouse driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -293,15 +280,6 @@ jobs:
         test-args: ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -311,7 +289,7 @@ jobs:
 
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -326,16 +304,6 @@ jobs:
           CLUSTER_SIZE: nano-quickstart
     name: Druid (JDBC)
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Druid JDBC driver is quarantined but you changed files in modules/drivers/druid-jdbc/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Druid JDBC tests, add the label: break-quarantine-druid-jdbc"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Druid JDBC driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test Druid JDBC driver
       id: test-driver
@@ -346,19 +314,10 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 50
     strategy:
@@ -398,16 +357,6 @@ jobs:
       MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
     name: Databricks
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Databricks driver is quarantined but you changed files in modules/drivers/databricks/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Databricks tests, add the label: break-quarantine-databricks"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Databricks driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test Databricks driver
       id: test-driver
@@ -417,19 +366,10 @@ jobs:
         artifact-suffix: ${{ matrix.job.name }}
         test-args: ${{ matrix.job.test-args }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 50
     strategy:
@@ -470,16 +410,6 @@ jobs:
       MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
     name: Databricks (Multi-Catalog)
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Databricks driver is quarantined but you changed files in modules/drivers/databricks/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Databricks tests, add the label: break-quarantine-databricks"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Databricks driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test Databricks driver with multi-catalog
       id: test-driver
@@ -489,15 +419,6 @@ jobs:
         artifact-suffix: ${{ matrix.job.name }}
         test-args: ${{ matrix.job.test-args }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-h2:
     needs: determine-driver-skips
@@ -518,15 +439,6 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-h2-oss:
     needs: determine-driver-skips
@@ -548,15 +460,6 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
@@ -621,21 +524,9 @@ jobs:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: mysql
@@ -688,15 +579,6 @@ jobs:
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -706,7 +588,7 @@ jobs:
 
   be-tests-mongo:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.mongo-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -743,16 +625,6 @@ jobs:
           MONGO_INITDB_ROOT_PASSWORD: metasample123
     name: ${{ matrix.version.name }} ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::MongoDB driver is quarantined but you changed files in modules/drivers/mongo/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run MongoDB tests, add the label: break-quarantine-mongo"
-        echo ""
-        echo "If you merge without testing, you risk breaking the MongoDB driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -767,15 +639,6 @@ jobs:
         test-args: ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -785,7 +648,7 @@ jobs:
 
   be-tests-mongo-ssl:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -803,16 +666,6 @@ jobs:
       MB_TEST_MONGO_REQUIRES_SSL: true
     name: "${{ matrix.version.name }} (SSL)"
     steps:
-      - name: Fail on quarantine conflict
-        if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
-        run: |
-          echo "::error::MongoDB SSL driver is quarantined but you changed files in modules/drivers/mongo/"
-          echo ""
-          echo "Your changes will NOT be tested because the driver is currently quarantined."
-          echo "To run MongoDB SSL tests, add the label: break-quarantine-mongo-ssl"
-          echo ""
-          echo "If you merge without testing, you risk breaking the MongoDB SSL driver!"
-          exit 1
       - uses: actions/checkout@v6
       - name: Spin up Mongo docker container
         run: >-
@@ -848,19 +701,10 @@ jobs:
             :exclude-tags '[:mongo-sharded-cluster-tests :mb/transforms-python-test]'
             :only-tags [:mb/driver-tests]
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -873,16 +717,6 @@ jobs:
           - "27017:17017"
     name: MongoDB Sharded Cluster
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::MongoDB Sharded Cluster driver is quarantined but you changed files in modules/drivers/mongo/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run MongoDB Sharded Cluster tests, add the label: break-quarantine-mongo-sharded-cluster"
-        echo ""
-        echo "If you merge without testing, you risk breaking the MongoDB Sharded Cluster driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test MongoDB driver (Sharded cluster)
       id: test-driver
@@ -892,19 +726,10 @@ jobs:
         test-args: >-
           :only metabase.driver.mongo.sharded-cluster-test
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-oracle:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.oracle-should-run == 'true' || needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.oracle-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -955,16 +780,6 @@ jobs:
           - "1521:${{ matrix.version.port }}"
     name: ${{ matrix.version.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Oracle driver is quarantined but you changed files in modules/drivers/oracle/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Oracle tests, add the label: break-quarantine-oracle"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Oracle driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test ${{ matrix.version.name }}
       id: test-driver
@@ -976,15 +791,6 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-postgres:
     needs: determine-driver-skips
@@ -1018,21 +824,9 @@ jobs:
             needs-python-runner: true
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: postgres
@@ -1079,15 +873,6 @@ jobs:
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -1097,7 +882,7 @@ jobs:
 
   be-tests-presto-jdbc-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -1120,16 +905,6 @@ jobs:
         env:
           JAVA_TOOL_OPTIONS: "-Xmx2g"
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Presto JDBC driver is quarantined but you changed files in modules/drivers/presto-jdbc/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Presto JDBC tests, add the label: break-quarantine-presto-jdbc"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Presto JDBC driver!"
-        exit 1
     - uses: actions/checkout@v6
     - uses: ./.github/actions/await-port
       with:
@@ -1165,19 +940,10 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' || needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 50
     strategy:
@@ -1222,16 +988,6 @@ jobs:
       MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
     name: ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Redshift driver is quarantined but you changed files in modules/drivers/redshift/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Redshift tests, add the label: break-quarantine-redshift"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Redshift driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1248,15 +1004,6 @@ jobs:
           ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: ${{ !matrix.job.skip && !cancelled() }}
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1266,7 +1013,7 @@ jobs:
 
   be-tests-snowflake-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.snowflake-should-run == 'true' || needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.snowflake-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 70
     strategy:
@@ -1306,16 +1053,6 @@ jobs:
       MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
     name: Snowflake ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Snowflake driver is quarantined but you changed files in modules/drivers/snowflake/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Snowflake tests, add the label: break-quarantine-snowflake"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Snowflake driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1330,15 +1067,6 @@ jobs:
         test-args: ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1348,7 +1076,7 @@ jobs:
 
   be-tests-sparksql-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.sparksql-should-run == 'true' || needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.sparksql-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -1361,16 +1089,6 @@ jobs:
           - "10000:10000"
     name: Spark SQL
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::SparkSQL driver is quarantined but you changed files in modules/drivers/sparksql/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run SparkSQL tests, add the label: break-quarantine-sparksql"
-        echo ""
-        echo "If you merge without testing, you risk breaking the SparkSQL driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test Spark driver
       id: test-driver
@@ -1381,19 +1099,10 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.sqlite-should-run == 'true' || needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.sqlite-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -1401,16 +1110,6 @@ jobs:
       DRIVERS: sqlite
     name: SQLite
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::SQLite driver is quarantined but you changed files that affect it"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run SQLite tests, add the label: break-quarantine-sqlite"
-        echo ""
-        echo "If you merge without testing, you risk breaking the SQLite driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test SQLite driver
       id: test-driver
@@ -1421,19 +1120,10 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   be-tests-sqlserver:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.sqlserver-should-run == 'true' || needs.determine-driver-skips.outputs.sqlserver-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.sqlserver-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
@@ -1472,16 +1162,6 @@ jobs:
           MSSQL_MEMORY_LIMIT_MB: 1024
     name: ${{ matrix.version.name }} ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.sqlserver-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::SQL Server driver is quarantined but you changed files in modules/drivers/sqlserver/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run SQL Server tests, add the label: break-quarantine-sqlserver"
-        echo ""
-        echo "If you merge without testing, you risk breaking the SQL Server driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1496,15 +1176,6 @@ jobs:
         test-args: ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1539,20 +1210,11 @@ jobs:
   #       junit-name: 'be-tests-starburst-ee'
   #       test-args: >-
   #         :only-tags [:mb/driver-tests]
-  #   - name: Upload Test Results
-  #     uses: ./.github/actions/upload-test-results
-  #     if: always()
-  #     with:
-  #       input-path: ./target/junit/
-  #       output-name: ${{ github.job }}
-  #       bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-  #       role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-  #       aws-region: ${{ vars.AWS_REGION }}
 
   login-to-ecr:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 15
     permissions:
       id-token: write
@@ -1583,7 +1245,7 @@ jobs:
 
   be-tests-vertica-ee:
     needs: [determine-driver-skips, login-to-ecr]
-    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -1599,16 +1261,6 @@ jobs:
           password: ${{ needs.login-to-ecr.outputs.docker_password }}
     name: Vertica
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Vertica driver is quarantined but you changed files in modules/drivers/vertica/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Vertica tests, add the label: break-quarantine-vertica"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Vertica driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Make plugins directory
       run: mkdir plugins
@@ -1621,42 +1273,34 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
 
   drivers-tests-result:
     needs:
       - determine-driver-skips
       # if you add a driver job, you must add it to this list for it to be a required check
-      - be-tests-h2
       - be-tests-athena-ee
-      - be-tests-snowflake-ee
       - be-tests-bigquery-cloud-sdk-ee
+      - be-tests-clickhouse-ee
       - be-tests-databricks-ee
+      - be-tests-databricks-multi-catalog-ee
       - be-tests-druid-jdbc-ee
-      - be-tests-mysql-mariadb
+      - be-tests-h2
+      - be-tests-h2-oss
       - be-tests-mongo
-      - be-tests-mongo-ssl
       - be-tests-mongo-sharded-cluster-ee
+      - be-tests-mongo-ssl
+      - be-tests-mysql-mariadb
       - be-tests-oracle
       - be-tests-postgres
       - be-tests-presto-jdbc-ee
       - be-tests-redshift-ee
+      - be-tests-snowflake-ee
       - be-tests-sparksql-ee
       - be-tests-sqlite-ee
       - be-tests-sqlserver
+      - be-tests-vertica-ee
       # - be-tests-starburst-ee
-      # TODO(rileythomp, 2025-08-20): Re-enable vertica tests once the docker image is updated
-      # - be-tests-vertica-ee
-      - be-tests-clickhouse-ee
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     name: drivers-tests-result
     if: always() && !cancelled()

.github/workflows/e2e-coverage-manifest.yml

@@ -66,7 +66,8 @@ jobs:
   # one place (SHARDS below); the matrix is generated from it.
   setup:
     name: Build shard matrix
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       matrix: ${{ steps.gen.outputs.matrix }}
       count: ${{ steps.gen.outputs.count }}

.github/workflows/e2e-matrix-builder.yml

@@ -21,7 +21,7 @@ on:
 
 jobs:
   build-matrix:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       matrix: ${{ steps.matrix.outputs.config }}
@@ -35,7 +35,7 @@ jobs:
           sparse-checkout-cone-mode: false
       - uses: actions/setup-node@v6.4.0
         with:
-          node-version: lts/Jod # 22.x.x
+          node-version: lts/Krypton # 24.x.x
       - name: Build e2e matrix
         uses: actions/github-script@v9
         id: matrix

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -88,7 +88,7 @@ on:
 jobs:
   determine-test-type:
     name: Determine test type
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       type: ${{ steps.detect.outputs.type }}
@@ -106,7 +106,7 @@ jobs:
   workflow-summary:
     name: Stress test inputs
     needs: [determine-test-type]
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary

.github/workflows/e2e-test.yml

@@ -41,7 +41,7 @@ env:
   # (e.g. "https://conductor.<host>"); each consumer appends the path it needs
   # (the reporter POSTs to "/webhooks/failed-tests"). Callers pass
   # `secrets: inherit`; reporting no-ops when it's unset.
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   # Shared secret sent as the `x-internal-secret` header to authenticate.
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
   REPO_ID: ${{ github.event.repository.id }}
@@ -216,17 +216,6 @@ jobs:
             echo "No ./target/junit directory; nothing to process."
           fi
 
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          # Related to our custom upload to S3
-          output-name: e2e-${{ inputs.name }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-
       - name: Quarantine gate
         # Only one of the two run steps executes; the other reports `skipped`. Only gate on actual failure.
         if: ${{ !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure') }}

.github/workflows/e2e-tests.yml

@@ -24,7 +24,7 @@ jobs:
 
   reset-e2e-test-comment:
     if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Remove test results comment
@@ -138,7 +138,7 @@ jobs:
   e2e-tests-result:
     needs:
       - e2e-tests
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     name: e2e-tests-result
     if: always() && !cancelled()

.github/workflows/embedding-sdk-component-tests.yml

@@ -8,7 +8,7 @@ env:
   TERM: xterm
   TZ: US/Pacific # to make Node match the instance tz
   MB_EDITION: "ee"
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
   REPO_ID: ${{ github.event.repository.id }}
   COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
@@ -111,16 +111,6 @@ jobs:
             echo "No ./target/junit directory; nothing to process."
           fi
 
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-embedding-sdk-react-${{ matrix.react-version }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-
       - name: Quarantine gate
         if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
@@ -159,7 +149,8 @@ jobs:
              await core.summary.addRaw(summary).write();
 
   decide-target-ref:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       target-ref: ${{ steps.get-target-ref.outputs.value }}
     steps:
@@ -186,6 +177,7 @@ jobs:
     timeout-minutes: 45
     env:
       MB_RUN_MODE: "e2e"
+      MB_WAREHOUSE_ALLOWED_NETWORKS: "allow-all"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       CI_CONDUCTOR_TEST_SUITE: embedding-sdk-component-backward-compatibility
       # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
@@ -290,16 +282,6 @@ jobs:
             echo "No ./target/junit directory; nothing to process."
           fi
 
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-embedding-sdk
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-
       - name: Quarantine gate
         if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -100,6 +100,7 @@ jobs:
     env:
       MB_EDITION: ee
       MB_RUN_MODE: e2e
+      MB_WAREHOUSE_ALLOWED_NETWORKS: "allow-all"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
@@ -211,6 +212,7 @@ jobs:
     env:
       MB_EDITION: ee
       MB_RUN_MODE: e2e
+      MB_WAREHOUSE_ALLOWED_NETWORKS: "allow-all"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
@@ -278,6 +280,7 @@ jobs:
     env:
       MB_EDITION: ee
       MB_RUN_MODE: e2e
+      MB_WAREHOUSE_ALLOWED_NETWORKS: "allow-all"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
@@ -373,7 +376,7 @@ jobs:
       # Host apps are the only suite here running through Metabase's Cypress config,
       # whose `after:spec` hook reports failures and writes QUARANTINE_FAILURES_FILE.
       # Sample-app suites load their own config (no-op), so ci-conductor is scoped to this job.
-      CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+      CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
       CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
       CI_CONDUCTOR_TEST_SUITE: embedding-sdk-host-app
       REPO_ID: ${{ github.event.repository.id }}

.github/workflows/embedding-sdk-labels-reminder.yml

@@ -5,12 +5,11 @@ on:
     types: [auto_merge_enabled, review_requested, labeled, unlabeled, synchronize]
     branches:
       - "master"
-  merge_group:
 
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_embedding_sdk_package_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_package_sources }}

.github/workflows/embedding-sdk.yml

@@ -133,7 +133,7 @@ jobs:
       - embedding-sdk-api-documentation-generation-validation
       - embedding-sdk-component-tests
     if: always() && !cancelled()
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       needs: ${{ toJson(needs) }}

.github/workflows/emotion-stats-update.yml

@@ -1,4 +1,4 @@
-# Weekly count of files importing @emotion/*, uploaded to stats.metabase.com.
+# Weekly count of files importing @emotion/*, imported into eng-stats-importer.
 # Feeds the "Emotion CSS Elimination Progress" chart tracking the migration
 # off Emotion onto Mantine (+ CSS modules as a fallback).
 name: Emotion Stats Update
@@ -11,10 +11,11 @@ on:
 jobs:
   emotion-stats:
     if: github.repository == 'metabase/metabase'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v6
+      - uses: ./.github/actions/prepare-node-bun
       - name: Get Emotion file count
         id: get-emotion-file-count
         run: |
@@ -26,8 +27,6 @@ jobs:
             git grep -l -E "(from|import) ['\"]@emotion/" -- \
               'frontend/**/*.ts' \
               'frontend/**/*.tsx' \
-              'frontend/**/*.js' \
-              'frontend/**/*.jsx' \
               | wc -l || true
           )
 
@@ -35,8 +34,6 @@ jobs:
             git grep -l -E "(from|import) ['\"]@emotion/" -- \
               'enterprise/frontend/**/*.ts' \
               'enterprise/frontend/**/*.tsx' \
-              'enterprise/frontend/**/*.js' \
-              'enterprise/frontend/**/*.jsx' \
               | wc -l || true
           )
 
@@ -44,35 +41,8 @@ jobs:
 
           echo "EMOTION_FILES=$((oss + ee))" >> "$GITHUB_OUTPUT"
       - name: Upload count to Stats
-        uses: actions/github-script@v9
         env:
           EMOTION_FILES: ${{ steps.get-emotion-file-count.outputs.EMOTION_FILES }}
-          API_KEY: ${{ secrets.STATS_API_KEY }}
-        with:
-          script: | # js
-            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
-
-            console.log("EMOTION_FILES", Number(process.env.EMOTION_FILES));
-
-            // Keys become CSV headers and must match the target table's columns
-            // (Metabase slugifies both sides, so casing/spacing is forgiving).
-            const data = [
-              {
-                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
-                'Emotion Files': Number(process.env.EMOTION_FILES),
-              }
-            ];
-
-            // tableId 76283 = "Emotion Files" table on stats.metabase.com.
-            // Auth via x-api-key, sourced from STATS_API_KEY (see env block above).
-            uploadCsvToMb({
-              baseUrl: 'https://stats.metabase.com',
-              tableId: 76283,
-              jsonData: data,
-              mode: 'append',
-            }).then(() => {
-              console.log('Data uploaded successfully');
-            }).catch((error) => {
-              console.error('Error uploading data:', error);
-              process.exit(1);
-            });
+          ENG_STATS_URL: ${{ secrets.ENG_STATS_URL }}
+          API_KEY: ${{ secrets.ENG_STATS_API_KEY }}
+        run: bun .github/scripts/upload-emotion-stats.ts

.github/workflows/escalation-slack-notification.yml

@@ -1,38 +0,0 @@
-name: Escalation Slack Notification
-
-on:
-  issues:
-    types:
-      - labeled
-jobs:
-  on-escalation-label:
-    if: github.event.label.name == '.Escalation'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    steps:
-      - name: Format issue title (escape quotes)
-        uses: actions/github-script@v9
-        id: vars
-        env:
-          ISSUE_TITLE: ${{ github.event.issue.title }}
-        with:
-          script: |
-            core.setOutput('issue_title', process.env.ISSUE_TITLE.replaceAll(/"/g, '\\"'));
-      - name: Send escalated issue ${{ github.event.issue.number }} to Slack
-        id: slack
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
-        with:
-          webhook: ${{ secrets.SLACK_ESCALATIONS_WEBHOOK_URL }}
-          webhook-type: incoming-webhook
-          payload: |
-            {
-              "blocks": [
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "🔥🔥🔥 ${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
-                  }
-                }
-              ]
-            }

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -19,7 +19,7 @@ on:
 jobs:
   workflow-summary:
     name: Stress test inputs
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary

.github/workflows/frontend.yml

@@ -35,7 +35,7 @@ env:
   # Consumed by the report-failures-to-ci-conductor step in fe-tests-unit. Absent
   # (e.g. fork PRs without secret access) the reporter no-ops. Matches the other
   # suite workflows (backend, drivers, e2e, app-db, semantic-search).
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
 
 jobs:
@@ -50,14 +50,17 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
 
-      - name: Get Eslint cache key
-        uses: ./.github/actions/get-cache-keys
-        id: get-cache-keys
-      - name: Restore ESLint cache
-        uses: actions/cache/restore@v5
+      - name: Cache spec
+        id: cache-spec
+        run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
+      # Small enough, and written by few enough jobs, that this one reads and writes its own cache
+      # rather than waiting on cache-warm.
+      - name: ESLint cache
+        uses: actions/cache@v5
         with:
-          path: ${{ github.workspace}}/.eslintcache
-          key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
+          path: ${{ steps.cache-spec.outputs.eslint-path }}
+          key: ${{ steps.cache-spec.outputs.eslint-key }}
+          restore-keys: ${{ steps.cache-spec.outputs.eslint-restore-key }}
 
       - name: Compile CLJS
         run: bun run build-pure:cljs
@@ -113,7 +116,7 @@ jobs:
         # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
       - name: Report failed tests to ci-conductor
-        if: ${{ !cancelled() && steps.fe-tests.outcome == 'failure' }}
+        if: ${{ !cancelled() && ( steps.fe-tests.outcome == 'failure' || github.run_attempt != '1' ) }}
         # This step should NEVER fail the job!
         continue-on-error: true
         uses: ./.github/actions/report-failures-to-ci-conductor
@@ -129,15 +132,6 @@ jobs:
           adapter: frontend
           test-suite: fe-tests-unit
           enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always() && github.event_name != 'workflow_dispatch'
-        with:
-          input-path: ./target/junit
-          output-name: frontend-unit
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
 
   fe-tests-timezones:
     if: ${{ !inputs.skip }}
@@ -182,7 +176,7 @@ jobs:
       - fe-tests-timezones
       - fe-custom-viz
     if: always() && !cancelled()
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       needs: ${{ toJson(needs) }}

.github/workflows/generative-query-test.yml

@@ -1,58 +0,0 @@
-name: Generative Query Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      context-seed:
-        description: 'Context seed (empty = random)'
-        type: number
-      iteration-seed:
-        description: 'Iteration seed (for iteration replay, empty = dependent on Context seed)'
-        type: number
-      iterations:
-        description: 'Iterations (number of test iterations, overrides seconds)'
-        type: number
-      seconds:
-        description: 'Seconds (Number of seconds after which next iteration will not start)'
-      test:
-        description: 'Test or namespace to run'
-        default: metabase.query-processor.generative-test/execution-with-cards-test
-      ref:
-        description: 'Ref to run generative tests on'
-        default: qgen-ms2
-
-# TODO: Consider renaming the job in next milestones
-jobs:
-  generative-query-test:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 90
-    name: Generative Query Test
-    env:
-      CI: 'true'
-      MB_GENTEST_CONTEXT_SEED: ${{ inputs.context-seed }}
-      MB_GENTEST_ITERATION_SEED: ${{ inputs.iteration-seed }}
-      MB_GENTEST_LIMIT_ITERATIONS: ${{ inputs.iterations }}
-      MB_GENTEST_LIMIT_SECONDS: ${{ inputs.seconds }}
-      MB_GENTEST_RUN: true
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref }}
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-
-      - name: Run test
-        run: clojure -X:dev:ci:test:ee:ee-dev :only '${{ inputs.test }}'
-
-      - name: Publish Test Report (JUnit)
-        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
-        if: failure()
-        with:
-          path: "target/junit/**/*_test.xml"
-          name: JUnit Test Report (Generative Query test)
-          reporter: java-junit
-          list-suites: failed
-          list-tests: failed
-          fail-on-error: false

.github/workflows/i18n.yml

@@ -1,51 +0,0 @@
-name: i18n
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-  pull_request:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      i18n: ${{ steps.changes.outputs.i18n }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  verify-i18n-files:
-    needs: files-changed
-    if: needs.files-changed.outputs.i18n == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v6
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - name: Install xgettext if necessary
-        run: |
-          if ! command -v xgettext > /dev/null; then
-            sudo apt install gettext
-          fi
-      - name: Check xgettext version
-        run: xgettext --version
-      - name: Check i18n tags/make sure template can be built
-        run: ./bin/i18n/update-translation-template
-      - name: Verify i18n translations (.po files)
-        run: ./bin/i18n/build-translation-resources

.github/workflows/js-stats-update.yml

@@ -1,52 +0,0 @@
-name: JS Stats Update
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: 40 1 * * 4 # every Thursday at 1:40
-
-jobs:
-  js-stats:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v6
-      - name: get JS file count
-        id: get-js-file-count
-        run: |
-          oss=$(find ./frontend/src/metabase -type f -name "*.js" -o -name "*.jsx" | wc -l)
-          ee=$(find ./enterprise/frontend/src/metabase-enterprise -type f -name "*.js" -o -name "*.jsx" | wc -l)
-
-          echo $((oss + ee)) javascript files
-
-          echo "JS_FILES=$((oss + ee))" >> "$GITHUB_OUTPUT"
-      - name: Upload count to Stats
-        uses: actions/github-script@v9
-        env:
-          JS_FILES: ${{ steps.get-js-file-count.outputs.JS_FILES }}
-          API_KEY: ${{ secrets.STATS_API_KEY }}
-        with:
-          script: | # js
-            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
-
-            console.log("JS_FILES", Number(process.env.JS_FILES));
-
-            const data = [
-              {
-                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
-                'Js files': Number(process.env.JS_FILES),
-              }
-            ];
-
-            uploadCsvToMb({
-              baseUrl: 'https://stats.metabase.com',
-              tableId: 73270,
-              jsonData: data,
-              mode: 'append',
-            }).then(() => {
-              console.log('Data uploaded successfully');
-            }).catch((error) => {
-              console.error('Error uploading data:', error);
-              process.exit(1);
-            });

.github/workflows/kondo-ratchets-self-heal.yml

@@ -37,6 +37,8 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           persist-credentials: false
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
       - name: Lower ignore budgets to match the source tree
         run: ./bin/mage fix-kondo-ratchets
       - name: Check for changes

.github/workflows/linear-pr-links.yml

@@ -6,7 +6,8 @@ on:
 
 jobs:
   add-issue-references:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     steps:
       - name: Checkout code
         uses: actions/checkout@v6

.github/workflows/lint.security.yml

@@ -0,0 +1,111 @@
+name: Lint Security
+
+on:
+  schedule:
+    - cron: "0 11 * * *" # Daily at 11:00 UTC
+  workflow_dispatch: # manually run security scans
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  codeql:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    env:
+      # disables overlay DB cache
+      CODEQL_OVERLAY_DATABASE_MODE: none
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: javascript
+          config-file: ./.github/codeql/codeql-config.yml
+          # disable caching since this only runs daily and the CodeQL cache is large
+          trap-caching: false
+          dependency-caching: false
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+
+  trivy:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - edition: ee
+            repo: metabase/metabase-enterprise-head
+            tag: latest
+          - edition: oss
+            repo: metabase/metabase-head
+            tag: latest
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    name: Run Trivy for (${{ matrix.edition }})
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Run Vulnerability Scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        env:
+          TRIVY_OFFLINE_SCAN: true
+        with:
+          image-ref: docker.io/${{ matrix.repo }}:${{ matrix.tag }}
+          format: sarif
+          output: trivy-results-${{ matrix.edition }}.sarif
+          # disable caching since this only runs daily so rate limiting isn't an issue
+          cache: false
+
+      - name: Upload Results to Github Security
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: trivy-results-${{ matrix.edition }}.sarif
+          category: trivy-${{ matrix.edition }}
+
+  notify:
+    needs: [codeql, trivy]
+    if: ${{ failure() && github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            release
+            .github
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Notify Slack of Failed Scans
+        uses: actions/github-script@v9
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendSlackMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const scans = [
+              ['CodeQL', '${{ needs.codeql.result }}'],
+              ['Trivy', '${{ needs.trivy.result }}'],
+            ];
+            const failed = scans.filter(([, result]) => result === 'failure').map(([name]) => name);
+
+            if (failed.length === 0) {
+              console.log('No scan reported a failure. Skipping Slack notification.');
+              return;
+            }
+
+            const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const list = failed.map(name => `\`${name}\``).join(', ');
+
+            await sendSlackMessage({
+              channelName: 'engineering-ci',
+              message: `:rotating_light: Daily security scan failed (${list}) — see <${runUrl}|run logs>`,
+            }).catch(console.error);

.github/workflows/lint.yml

@@ -0,0 +1,173 @@
+name: Lint
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-**'
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 10
+    outputs:
+      actionlint: ${{ steps.changes.outputs.actionlint }}
+      actionlint_files: ${{ steps.changes.outputs.actionlint_files }}
+      codeql: ${{ steps.changes.outputs.codeql }}
+      i18n: ${{ steps.changes.outputs.i18n }}
+      openapi: ${{ steps.changes.outputs.openapi }}
+      snowplow: ${{ steps.changes.outputs.snowplow }}
+      yaml: ${{ steps.changes.outputs.yaml }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Test which files changed
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+          list-files: shell
+
+  lint:
+    needs: files-changed
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup frontend env
+        if: |
+          needs.files-changed.outputs.yaml == 'true' ||
+          needs.files-changed.outputs.openapi == 'true'
+        uses: ./.github/actions/prepare-frontend
+
+      # Always required by whitespace linter, also used by OpenAPI spec validation
+      - name: Setup backend env
+        uses: ./.github/actions/prepare-backend
+
+      - name: Setup actionlint
+        if: needs.files-changed.outputs.actionlint == 'true'
+        id: download
+        shell: bash
+        run: |
+          if command -v actionlint; then
+            echo "executable=actionlint" >> "$GITHUB_OUTPUT"
+          else
+            # script sets executable output, for details see: https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
+            bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash)
+          fi
+
+      - parallel:
+        # Deliberately ungated. This guards a coupling that drifts silently, so running it only when a
+        # path filter says .github changed would reintroduce the failure it exists to catch - and the
+        # filters here cover .github/workflows only, not the actions and scripts it also reads.
+        - name: Check cache-warm pre-resolves every alias combination CI uses
+          run: .github/scripts/check-preresolve-aliases.sh
+
+        # Lint whitespace, always runs
+        - name: Run Whitespace Linter
+          run: clojure -T:whitespace-linter lint :whitespace-linter/progress-bar false
+
+        # Lint YAML
+        - name: Lint YAML files
+          if: needs.files-changed.outputs.yaml == 'true'
+          run: bun run lint-yaml
+
+        # Lint Github Actions
+        - name: Run actionlint
+          if: needs.files-changed.outputs.actionlint == 'true'
+          run: ${{ steps.download.outputs.executable }} --color --verbose ${{ needs.files-changed.outputs.actionlint_files }}
+
+        # Generate and Lint OpenAPI spec
+        - name: Generate OpenAPI spec
+          if: needs.files-changed.outputs.openapi == 'true'
+          run: bun run generate-openapi
+
+      # Parallel steps run asynchronously, and explicitly waiting for a parallel step means "if" statements are ignored.
+      # Move OpenAPI validation outside the parallel block so that spec generation happens asynchronously without requiring
+      # an explicit "wait".
+      - name: Validate OpenAPI spec
+        if: needs.files-changed.outputs.openapi == 'true'
+        run: bun run lint-openapi
+
+  i18n:
+    needs: files-changed
+    if: needs.files-changed.outputs.i18n == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Install xgettext if necessary
+        run: |
+          if ! command -v xgettext > /dev/null; then
+            sudo apt install gettext
+          fi
+      - name: Check xgettext version
+        run: xgettext --version
+      - name: Check i18n tags/make sure template can be built
+        run: ./bin/i18n/update-translation-template
+      - name: Verify i18n translations (.po files)
+        run: ./bin/i18n/build-translation-resources
+
+  snowplow:
+    needs: files-changed
+    if: needs.files-changed.outputs.snowplow == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Set up Java
+        uses: actions/setup-java@v5.2.0
+        with:
+          distribution: temurin
+          java-version: 25
+      - name: Set up Babashka
+        uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
+        with:
+          babashka-version: 1.12.197
+      - name: Install igluctl
+        run: |
+          set -euo pipefail
+          curl -fsSL -o "$RUNNER_TEMP/igluctl.zip" https://github.com/snowplow/igluctl/releases/download/0.13.0/igluctl_0.13.0.zip
+          echo "0eac19121fca1431dec44738ada8eacc4242811a95d015ee71e00deec2b4d748  $RUNNER_TEMP/igluctl.zip" | sha256sum -c -
+          unzip -q "$RUNNER_TEMP/igluctl.zip" -d "$RUNNER_TEMP/igluctl"
+          chmod +x "$RUNNER_TEMP/igluctl/igluctl"
+          echo "$RUNNER_TEMP/igluctl" >> "$GITHUB_PATH"
+      - name: Lint (igluctl)
+        # igluctl recursively parses every file as JSON, so it chokes on colocated
+        # *.md docs and on two schemas whose internal `self.version` doesn't match
+        # the filename version (pending Snowcat audit). Stage a filtered copy and
+        # patch only the `self.version` mismatch so igluctl still lints the rest
+        # of those schemas.
+        run: |
+          set -euo pipefail
+          LINT_ROOT="$RUNNER_TEMP/iglu-lint"
+          rm -rf "$LINT_ROOT"
+          mkdir -p "$LINT_ROOT"
+          cp -r snowplow/iglu-client-embedded/schemas "$LINT_ROOT/"
+          find "$LINT_ROOT" -name '*.md' -delete
+          # TODO(BOT-1403): drop these patches once the Snowcat audit fixes the
+          # internal `self.version` mismatch on these two schemas. We rewrite
+          # only `self.version` in the staged copy so the file's path version
+          # matches what igluctl expects; every other lint rule still runs.
+          # Each `sed` invocation uses the schema's wrong/right pair, so it
+          # silently no-ops once the underlying schema is fixed.
+          sed -i 's/"version": "1-0-1"/"version": "1-0-2"/' \
+            "$LINT_ROOT/schemas/com.metabase/embed_share/jsonschema/1-0-2"
+          sed -i 's/"version": "1-0-0"/"version": "1-0-1"/' \
+            "$LINT_ROOT/schemas/com.metabase/serialization/jsonschema/1-0-1"
+          igluctl lint "$LINT_ROOT/schemas"
+      - name: Lint (Metabase schema rules)
+        run: ./bin/lint-snowplow-schemas.bb
+      - name: Test linter rules
+        run: ./bin/lint-snowplow-schemas-test.bb

.github/workflows/loki-stress-test-flake-fix.yml

@@ -21,7 +21,7 @@ on:
 jobs:
   detect-changed-stories:
     name: Detect changed stories
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       story_files: ${{ steps.detect.outputs.story_files }}
@@ -156,6 +156,9 @@ jobs:
 
       - name: Stress-test Loki
         run: |
+          # Loki's output is piped through tee below, and a pipeline normally reports the exit status of its last command.
+          # Without this a failed loki run would look like a pass, because tee itself succeeded.
+          set -o pipefail
           BURN_IN=${{ inputs.burn_in || '10' }}
           STORY_FILES='${{ needs.detect-changed-stories.outputs.story_files }}'
 
@@ -171,8 +174,11 @@ jobs:
 
             if bun run test-visual:loki \
               --reactUri file:./storybook-static \
-              --verboseRenderer; then
+              --verboseRenderer 2>&1 | tee .loki-run.log; then
               echo "✅ Run $i passed"
+            elif grep -q 'No stories were found' .loki-run.log; then
+              echo "::notice::Every story in the changed files is loki-skipped, nothing to stress test"
+              exit 0
             else
               echo "❌ Run $i FAILED"
               FAILED=$((FAILED + 1))

.github/workflows/loki.yml

@@ -2,12 +2,11 @@ name: Loki Visual Regression Testing
 
 on:
   pull_request:
-  merge_group:
 
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_ci: ${{ steps.changes.outputs.frontend_ci }}

.github/workflows/main.yml

@@ -1,39 +0,0 @@
-name: Slack Notification for New Feature Requests
-
-on:
-  issues:
-    types:
-      - labeled
-jobs:
-  on-issue-labeled:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    if: |
-      contains(github.event.issue.labels.*.name, 'Type:New Feature')
-    steps:
-      - name: Setting title
-        uses: actions/github-script@v9
-        id: vars
-        env:
-          ISSUE_TITLE: ${{ github.event.issue.title }}
-        with:
-          script: |
-            core.setOutput('issue_title', process.env.ISSUE_TITLE.replaceAll(/"/g, '\\"'));
-      - name: Send the issue ${{ github.event.issue.number }} to Slack
-        id: slack
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
-        with:
-          webhook: ${{ secrets.SLACK_FEATURE_REQUEST_TRIAGE_WEBHOOK_URL }}
-          webhook-type: incoming-webhook
-          payload: |
-            {
-              "blocks": [
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "New incoming feature request: ${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
-                  }
-                }
-              ]
-            }

.github/workflows/mbql-library-changelog.yml

@@ -11,7 +11,8 @@ on:
       - src/metabase/utils/js.cljs
 jobs:
   mbql-library-changelog-check:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     if: ${{ !contains( github.event.pull_request.labels.*.name, '.metabase-lib/no-change' ) }}
     steps:
       # - uses: jesusvasquez333/verify-pr-label-action@v1.4.0

.github/workflows/minimal-tests.yml

@@ -1,254 +0,0 @@
-name: Minimal Tests
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  id-token: write
-  contents: read
-  checks: write
-  actions: read
-
-jobs:
-  # Only run if the PR has the minimal-tests label
-  check-label:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 1
-    outputs:
-      should-run: ${{ steps.check.outputs.result }}
-    steps:
-      - name: Check for minimal-tests label
-        id: check
-        run: |
-          if [[ "${{ contains(github.event.pull_request.labels.*.name, 'minimal-tests') }}" == "true" ]]; then
-            echo "result=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "result=false" >> "$GITHUB_OUTPUT"
-          fi
-
-  # Postgres app-db tests - single version, single job
-  postgres-app-db-test:
-    needs: check-label
-    if: needs.check-label.outputs.should-run == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
-    env:
-      CI: "true"
-      DRIVERS: postgres
-      MB_DB_TYPE: postgres
-      MB_DB_PORT: 5432
-      MB_DB_HOST: localhost
-      MB_DB_DBNAME: mb_test
-      MB_DB_USER: mb_test
-      MB_POSTGRESQL_TEST_USER: mb_test
-    services:
-      postgres:
-        image: postgres:latest
-        ports:
-          - "5432:5432"
-        env:
-          POSTGRES_USER: mb_test
-          POSTGRES_DB: mb_test
-          POSTGRES_HOST_AUTH_METHOD: trust
-    name: Postgres Latest EE App DB Tests (Part 1)
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test Postgres App DB
-        id: test-driver
-        uses: ./.github/actions/test-driver
-        with:
-          build-static-viz: true
-          junit-name: "minimal-be-tests-postgres-ee"
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-          test-args: >-
-            :only '["test" "enterprise/backend/test"]'
-            :exclude-tags '[:mb/driver-tests :mb/transforms-python-test]'
-            :partition/total 2
-            :partition/index 0
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-
-  # Postgres driver tests
-  postgres-driver-test:
-    needs: check-label
-    if: needs.check-label.outputs.should-run == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
-    env:
-      CI: "true"
-      DRIVERS: postgres
-      MB_DB_TYPE: postgres
-      MB_DB_PORT: 5432
-      MB_DB_HOST: localhost
-      MB_DB_DBNAME: mb_test
-      MB_DB_USER: mb_test
-      MB_POSTGRESQL_TEST_USER: mb_test
-    services:
-      postgres:
-        image: postgres:latest
-        ports:
-          - "5432:5432"
-        env:
-          POSTGRES_USER: mb_test
-          POSTGRES_DB: mb_test
-          POSTGRES_HOST_AUTH_METHOD: trust
-    name: Postgres Latest Driver Tests
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test Postgres Driver
-        id: test-driver
-        uses: ./.github/actions/test-driver
-        with:
-          junit-name: "minimal-be-tests-postgres-driver-ee"
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-          test-args: >-
-            :only-tags [:mb/driver-tests]
-            :exclude-tags [:mb/transforms-python-test]
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-
-  # Frontend unit tests
-  frontend-unit-tests:
-    needs: check-label
-    if: needs.check-label.outputs.should-run == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 30
-    env:
-      JEST_JUNIT_OUTPUT_DIR: ./target/junit
-      JEST_JUNIT_OUTPUT_NAME: test-report-frontend-unit.xml
-    name: Frontend Unit Tests
-    steps:
-      - uses: actions/checkout@v6
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - name: Resolve current job id
-        # Resolve JOB_ID before the long test step so the ci-conductor reporter
-        # below can link failures to this exact job. Best-effort.
-        uses: ./.github/actions/resolve-job-id
-      - name: Run frontend unit tests
-        id: run-tests
-        run: bun run test-unit --silent
-        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
-        continue-on-error: true
-      - name: Report failed tests to ci-conductor
-        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
-        # This step should NEVER fail the job!
-        continue-on-error: true
-        uses: ./.github/actions/report-failures-to-ci-conductor
-        with:
-          test-suite: fe-tests-unit
-          adapter: frontend
-      - name: Quarantine gate
-        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
-        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
-        timeout-minutes: 3
-        uses: ./.github/actions/quarantine-gate
-        with:
-          adapter: frontend
-          test-suite: fe-tests-unit
-          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: frontend-unit
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-
-  # Summary job
-  minimal-tests-result:
-    needs:
-      - postgres-app-db-test
-      - postgres-driver-test
-      - frontend-unit-tests
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    name: minimal-tests-result
-    if: always() && !cancelled()
-    steps:
-      - name: Check job status
-        uses: actions/github-script@v9
-        env:
-          needs: ${{ toJson(needs) }}
-        with:
-          script: | # js
-            const needs = JSON.parse(process.env.needs);
-
-            const jobs = Object.entries(needs).map(
-              ([jobName, jobValues]) => ({
-                name: jobName,
-                result: jobValues.result
-              }));
-
-            // Check if all jobs either succeeded or were skipped
-            // Skipped jobs are acceptable (they were intentionally skipped when the label is absent)
-            const allPassedOrSkipped = jobs.every(job =>
-              job.result === 'success' || job.result === 'skipped'
-            );
-
-            // Check if any jobs actually failed (not skipped, not cancelled)
-            const anyFailed = jobs.some(job =>
-              job.result === 'failure'
-            );
-
-            if (allPassedOrSkipped && !anyFailed) {
-              console.log("");
-              console.log("        _------.        ");
-              console.log("       /  ,     \_      ");
-              console.log("     /   /  /{}\ |o\_   ");
-              console.log("    /    \  `--' /-' \  ");
-              console.log("   |      \      \    | ");
-              console.log("  |              |`-, | ");
-              console.log("  /              /__/)/ ");
-              console.log(" |              |       ");
-              console.log("");
-              console.log("All minimal tests have passed. Fast feedback achieved!");
-              process.exit(0);
-            }
-
-            // otherwise, something failed
-            console.log("");
-            console.log("       .::::::::::.                          .::::::::::.       ");
-            console.log("     .::::''''''::::.                      .::::''''''::::.     ");
-            console.log("   .:::'          `::::....          ....::::'          `:::.   ");
-            console.log("  .::'             `:::::::|        |:::::::'             `::.  ");
-            console.log(" .::|               |::::::|_ ___ __|::::::|               |::. ");
-            console.log(" `--'               |::::::|_()__()_|::::::|               `--' ");
-            console.log("  :::               |::-o::|        |::o-::|               :::  ");
-            console.log("  `::.             .|::::::|        |::::::|.             .::'  ");
-            console.log("   `:::.          .::\-----'        `-----/::.          .:::'   ");
-            console.log("     `::::......::::'                      `::::......::::'     ");
-            console.log("       `::::::::::'                          `::::::::::'       ");
-            console.log("");
-            console.log("Minimal tests have failed.");
-
-            jobs.forEach((job) => {
-              if (job.result !== 'success' && job.result !== 'skipped') {
-                console.log(`${job.name} - ${job.result}`);
-              }
-            });
-
-            process.exit(1);