API dox include session token

We're now using `VITE_METABASE_INSTANCE_URL` and `VITE_AUTH_PROVIDER_URI`: https://github.com/metabase/metabase-nodejs-react-sdk-embedding-sample/blob/main/.env.example

.clj-kondo/config.edn

@@ -1,30 +1,68 @@
 ;; -*- comment-column: 100; -*-
-{:config-paths ["macros" "src"]
+{:config-paths ["macros" "src" "config"]
  :linters
- {:aliased-namespace-symbol     {:level :warning}
-  :invalid-arity                {:skip-args [metabase.lib.util.match/match]} ; TODO (cam): can we fix these?
+ {;;
+  ;; enabled optional linters (these are disabled by default)
+  ;;
+
+  :aliased-namespace-symbol     {:level :warning}
+  :case-symbol-test             {:level :warning}
+  :condition-always-true        {:level :warning}
+  :def-fn                       {:level :warning}
+  :dynamic-var-not-earmuffed    {:level :warning}
+  :equals-expected-position     {:level :warning, :only-in-test-assertion true}
   :keyword-binding              {:level :warning}
   :main-without-gen-class       {:level :warning}
+  :minus-one                    {:level :warning}
   :misplaced-docstring          {:level :warning}
   :missing-body-in-when         {:level :warning}
   :missing-docstring            {:level :warning}
   :missing-else-branch          {:level :warning}
   :namespace-name-mismatch      {:level :warning}
   :non-arg-vec-return-type-hint {:level :warning}
+  :plus-one                     {:level :warning}
   :reduce-without-init          {:level :warning}
+  :redundant-call               {:level :warning}
   :redundant-fn-wrapper         {:level :warning}
-  :refer-all                    {:level :warning, :exclude [clojure.test]}
+  :self-requiring-namespace     {:level :warning}
   :single-key-in                {:level :warning}
+  :unsorted-imports             {:level :warning}
   :unsorted-required-namespaces {:level :warning}
-  :unused-referred-var          {:exclude {compojure.core [GET DELETE POST PUT]}}
+  :unused-alias                 {:level :warning}
   :use                          {:level :warning}
   :warn-on-reflection           {:level :warning}
 
+  ;;
+  ;; other disabled-by-default linters it would be nice to enable soon
+  ;;
+
+  ;; TODO (cam): most of these either have a ton of things that need to be fixed or cause issues
+  ;; with [[metabase.lib.util.match/match]] and friends -- we need to write a custom hook for those macros so Kondo
+  ;; can understand them.
+
+  #_:docstring-leading-trailing-whitespace
+  #_:equals-false
+  #_:equals-true
+  #_:used-underscored-binding
+
+  ;;
+  ;; disabled linters
+  ;;
+
+  :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
+  :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
+
+  ;;
+  ;; globally-enabled custom linters
+  ;;
+  :metabase/check-defmulti-arglists                    {:level :warning}
+  :metabase/check-me-humanize                          {:level :warning}
   :metabase/defsetting-must-specify-export             {:level :warning}
   :metabase/mbql-query-first-arg                       {:level :warning}
   :metabase/missing-test-expr-requires-in-cljs         {:level :warning}
+  :metabase/modules                                    {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
   :metabase/require-shape-checker                      {:level :warning}
-  :metabase/test-helpers-use-non-thread-safe-functions {:level :warning}
+  :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
   :metabase/validate-logging                           {:level :warning}
   :metabase/validate-mb-driver-tests                   {:level :warning}
   :metabase/validate-mb-once                           {:level :warning}
@@ -47,8 +85,8 @@
      metabase.actions.test-util/with-actions-test-data-and-actions-enabled
      metabase.actions.test-util/with-actions-test-data-tables
      metabase.analytics.snowplow-test/with-fake-snowplow-collector
-     metabase.email-test/with-expected-messages
-     metabase.email-test/with-fake-inbox
+     metabase.channel.email-test/with-expected-messages
+     metabase.channel.email-test/with-fake-inbox
      metabase.test.data.users/with-group
      metabase.test.data.users/with-group-for-user
      metabase.test.data/with-empty-h2-app-db
@@ -128,21 +166,24 @@
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
      metabase.channel.core/send!
-     metabase.models.notification/create-notification!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
-     metabase.pulse/send-pulse!
+     metabase.models.notification/create-notification!
+     metabase.pulse.send/send-pulse!
      metabase.query-processor.store/store-database!
+     ;; Safe in tests, where we typically use a private, temporary index per thread.
+     metabase.search.core/reindex!
+     metabase.util/run-count!
      next.jdbc/execute!}}
 
   :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests
   {:level      :warning
-   :max-length 180}
+   :max-length 150}
 
   ;; this is not enabled here, it is enabled below only for specific namespaces.
   :metabase/disallow-hardcoded-driver-names-in-tests
   ;; don't include `:h2` since that will probably lead to a mountain of tests where we are specifically testing
   ;; middleware or compilation behavior with just H2 since it's the default.
-  {:drivers #{ ;; core drivers
+  {:drivers #{;; core drivers
               #_:h2
               :postgres
               :mysql
@@ -165,21 +206,16 @@
               :vertica}}
 
   ;;
-  ;; disabled linters
+  ;; misc config for built-in linters
   ;;
 
-  :unexpected-recur         {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
-  :used-underscored-binding {:level :off} ; false positives: see https://github.com/clj-kondo/clj-kondo/issues/2152
-
-  ;;
-  ;; TODO (cam): here are some more linters we should experiment with enabling -- some might be useful.
-  ;;
-
-  ;; :docstring-leading-trailing-whitespace {:level :warning}
-  ;; :docstring-no-summary                  {:level :warning}
-  ;; :shadowed-var                          {:level :warning}
-  ;; :def-fn                                {:level :warning}
+  :invalid-arity       {:skip-args [metabase.lib.util.match/match]} ; TODO (cam): can we fix these?
+  :refer-all           {:level :warning, :exclude [clojure.test]}
+  :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
+  ;; TODO -- all of these entries are HACKS and we should fix them by writing real custom Kondo HOOKS for these
+  ;; macros. Please don't add anything new to this list! Talk to your best bud Cam if you don't know how to write a
+  ;; Kondo hook and he will pair with you on it. Thanks! -- Cam
   :unresolved-symbol
   {:exclude
    [(build.uberjar/with-duration-ms)
@@ -190,7 +226,7 @@
     (clojure.test/is [query= =? malli= qv=])
     (clojure.tools.macro/macrolet)
     instaparse.core/transform
-    (metabase.async.streaming-response/streaming-response)
+    (metabase.server.streaming-response/streaming-response)
     (metabase.driver.druid.query-processor-test/druid-query-returning-rows)
     (metabase.lib.util.match/match)
     (metabase.lib.util.match/match-one)
@@ -213,7 +249,7 @@
     metabase.driver.sql-jdbc.execute/set-time-zone-if-supported!                 {:namespaces ["metabase\\.driver.*"]}
     metabase.driver/current-db-time                                              {:namespaces ["metabase.*"]}
     metabase.driver/supports?                                                    {:namespaces ["metabase.*"]}
-    metabase.public-settings.premium-features/enable-enhancements?               {:namespaces ["metabase\\.models.*"]}
+    metabase.premium-features.premium-features/enable-enhancements?              {:namespaces ["metabase\\.models.*"]}
     metabase.query-processor.middleware.resolve-joins/maybe-resolve-source-table {:namespaces ["metabase.*"]}
     metabase.query-processor.util/normalize-token                                {:namespaces ["metabase.*"]}
     schema.core/both                                                             {:namespaces ["metabase.*"]}
@@ -227,232 +263,45 @@
    clojure.core/pr                                    {:message "Use metabase.util.log instead of clojure.core/pr"}
    clojure.core/tap>                                  {:message "Don't use tap> is source code"}
    clojure.core/time                                  {:message "Don't use time in source code"}
+   clojure.test.check/quick-check                     {:message "You probably meant to use clojure.test.check.clojure-test/defspec instead -- quick check will run the tests when it is evaluated rather than when we run the test suite."}
    clojure.java.jdbc/get-connection                   {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/get-connection"}
    clojure.java.jdbc/with-db-connection               {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/with-db-connection"}
    clojure.java.jdbc/with-db-metadata                 {:message "Use sql-jdbc.execute/do-with-connection-with-options + .getMetaData instead of jdbc/with-db-metadata"}
    clojure.pprint/pprint                              {:message "Use metabase.util.log instead of clojure.pprint/pprint"}
    clojure.string/lower-case                          {:message "Use metabase.util/lower-case-en instead of clojure.string/lower-case"}
    clojure.string/upper-case                          {:message "Use metabase.util/upper-case-en instead of clojure.string/upper-case"}
+   compojure.core/context                             {:message "Use metabase.api.util.handlers/route-map-handler instead of compojure.core/context, it is much faster and supports OpenAPI spec generation"}
+   compojure.core/defroutes                           {:message "Use metabase.api.util.handlers/defroutes instead of compojure.core/routes, it supports OpenAPI spec generation."}
+   compojure.core/routes                              {:message "Use metabase.api.util.handlers/routes instead of compojure.core/routes, it supports OpenAPI spec generation."}
    fipp.edn/pprint                                    {:message "Use metabase.util.log instead of fipp.edn/pprint"}
    honeysql.core/call                                 {:message "Use hx/call instead because it is Honey SQL 2 friendly"}
    honeysql.core/raw                                  {:message "Use hx/raw instead because it is Honey SQL 2 friendly"}
    java-time/with-clock                               {:message "Use mt/with-clock"}
    java.util.UUID/randomUUID                          {:message "Use clojure.core/random-uuid instead of java.util.UUID/randomUUID"}
-   malli.core/explainer                               {:message "Use metabase.util.malli.registry/explainer instead of malli.core/explainer"}
+   malli.core/explain                                 {:message "Use metabase.util.malli.registry/explain instead of malli.core/explain because it has built-in caching"}
+   malli.core/explainer                               {:message "Use metabase.util.malli.registry/explainer instead of malli.core/explainer because it has built-in caching"}
+   malli.core/validate                                {:message "Use metabase.util.malli.registry/validate instead of malli.core/validate because it has built-in caching"}
+   malli.core/validator                               {:message "Use metabase.util.malli.registry/validator instead of malli.core/validator because it has built-in caching"}
    me.flowthing.pp/pprint                             {:message "Use metabase.util.log instead of me.flowthing.pp/pprint"}
    medley.core/random-uuid                            {:message "Use clojure.core/random-uuid instead of medley.core/random-uuid"}
    metabase.driver/database-supports?                 {:message "Use metabase.driver.util/supports? instead of metabase.driver/database-supports?"}
-   metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
-   metabase.test/with-temp*                           {:message "Use mt/with-temp instead of mt/with-temp*"}
-   toucan2.tools.with-temp                            {:message "Use mt/with-temp instead of t2.with-temp/with-temp"}}
+   metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}}
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
+   cheshire.core          {:message "Use metabase.util.json instead of cheshire.core directly."}
    clojure.tools.logging  {:message "Use metabase.util.log instead of clojure.tools.logging directly"}
    grouper.core           {:message "Use metabase.util.grouper instead of grouper.core"}
    honeysql.core          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
    honeysql.format        {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
    honeysql.helpers       {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
    honeysql.types         {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
-   honeysql.util          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
-   metabase.util.jvm      {:message "All of metabase.util.jvm is re-exported from metabase.util; prefer that"}}
+   honeysql.util          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}}
 
   :unresolved-var
   {:exclude
    [colorize.core]}
 
-  ;; A "module" is any `metabase.x` namespace in `src`.
-  :metabase/ns-module-checker
-  {:level :warning
-
-   ;; Map of module name => the "core" external public-facing API namespace(s). You have three options here:
-   ;;
-   ;; 1. Special sentinel value `:any` means means this module does not (yet) have external public-facing API
-   ;;    namespace(s). This is mostly a temporary placeholder until we go in and create module namespaces, which means
-   ;;    you should go create one.
-   ;;
-   ;; 2. A set of namespace symbols. All namespaces in other modules will only be allowed to use namespaces from
-   ;;    this set. Ideally this set should only have one namespace, but restricting it to a set of several is still
-   ;;    better than `:any`.
-   ;;
-   ;; 3. `nil` or not listed here -- we default to assuming there is one API namespace that matches the name of the
-   ;;    module itself, e.g. the module namespace for `metabase.setup` would be `metabase.setup`.
-   ;;
-   ;; `nil` or an empty set  Otherwise this should be a set of namespace symbols.
-   ;;
-   ;; PRO TIP: Check out the `dev.deps-graph` namespace for helpful tools to see where a module is used externally.
-   :api-namespaces
-   {metabase.actions               #{metabase.actions.core}
-    metabase.analytics             #{metabase.analytics.prometheus
-                                     metabase.analytics.snowplow
-                                     metabase.analytics.stats
-                                     metabase.analytics.sdk}                                        ; TODO -- consolidate these into a real API namespace.
-    metabase.analyze               #{metabase.analyze}
-    metabase.api                   #{metabase.api.common
-                                     metabase.api.dataset
-                                     metabase.api.permission-graph
-                                     metabase.api.routes}                                           ; TODO -- consolidate these into a real API namespace. I think the `*current-user*` type stuff might need to be moved into a separate module.
-    metabase.async                 #{metabase.async.streaming-response
-                                     metabase.async.streaming-response.thread-pool
-                                     metabase.async.util}                                           ; TODO -- consolidate these into a real API namespace.
-    metabase.audit                 #{metabase.audit}
-    metabase.bootstrap             #{metabase.bootstrap}
-    metabase.cmd                   #{}                                                              ; there are no namespaces here since you shouldn't be using this in any other module.
-    metabase.channel               #{metabase.channel.core}
-    metabase.config                #{metabase.config}
-    metabase.core                  #{metabase.core.initialization-status}                           ; TODO -- only namespace used outside of EE, this probably belongs in `metabase.server` anyway since that's the only place it's used.
-    metabase.db                    #{metabase.db
-                                     metabase.db.metadata-queries                                   ; TODO this should probably be separate from metabase.db
-                                     metabase.db.query                                              ; TODO this is mostly util stuff like `metabase.db.query/query` that we don't even need anymore.
-                                     metabase.db.setup}                                             ; TODO these are only calling `metabase.db.setup/setup-db!` and there's a slightly different version in `metabase.db`
-    metabase.driver                :any                                                             ; TODO -- 19 namespaces!!!! CRY
-    metabase.email                 #{metabase.email
-                                     metabase.email.messages}                                       ; TODO -- consolidate these into a real API namespace.
-    metabase.embed                 #{metabase.embed.settings}
-    metabase.events                #{metabase.events}
-    metabase.formatter             #{metabase.formatter}
-    metabase.integrations          #{metabase.integrations.common
-                                     metabase.integrations.google
-                                     metabase.integrations.ldap
-                                     metabase.integrations.slack}                                   ; TODO -- consolidate these into a real API namespace.
-    metabase.legacy-mbql           #{metabase.legacy-mbql.normalize
-                                     metabase.legacy-mbql.predicates
-                                     metabase.legacy-mbql.schema
-                                     metabase.legacy-mbql.schema.helpers
-                                     metabase.legacy-mbql.util}                                     ; TODO -- consolidate these into a real API namespace.
-    metabase.lib                   :any                                                             ; TODO -- :cry: 34 externally referenced namespaces, but maybe half of them are schema namespaces which technically don't need to be required.
-    metabase.logger                #{metabase.logger}
-    metabase.metabot               #{metabase.metabot}
-    metabase.models                :any                                                             ; TODO -- scream, 62 namespaces used elsewhere, but to be fair a lot of these don't *need* to be required.
-    metabase.moderation            #{metabase.moderation}
-    metabase.notification          #{metabase.notification.core}
-    metabase.permissions           #{metabase.permissions.util}                                     ; TODO -- this is currently the only namespace in this module. Give it a real API namespace?
-    metabase.plugins               #{metabase.plugins
-                                     metabase.plugins.classloader}                                  ; TODO -- not 100% sure the classloader belongs here
-    metabase.public-settings       #{metabase.public-settings
-                                     metabase.public-settings.premium-features}
-    metabase.pulse                 #{metabase.pulse
-                                     metabase.pulse.markdown
-                                     metabase.pulse.parameters
-                                     metabase.pulse.preview
-                                     metabase.pulse.render
-                                     metabase.pulse.render.image-bundle
-                                     metabase.pulse.render.js-svg
-                                     metabase.pulse.render.style}                                   ; TODO -- consolidate these into a real API namespace.
-    metabase.query-processor       :any                                                             ; TODO omg scream, 29 namespaces used outside of the module. WHAT THE HECC
-    metabase.query-analysis        #{metabase.query-analysis
-                                     metabase.query-analysis.failure-map}
-    metabase.related               #{metabase.related}
-    metabase.sample-data           #{metabase.sample-data}
-    metabase.search                #{metabase.search}
-    metabase.server                #{metabase.server
-                                     metabase.server.handler
-                                     metabase.server.middleware.auth
-                                     metabase.server.middleware.exceptions
-                                     metabase.server.middleware.json
-                                     metabase.server.middleware.misc
-                                     metabase.server.middleware.offset-paging
-                                     metabase.server.middleware.session
-                                     metabase.server.protocols
-                                     metabase.server.request.util}                                  ; TODO -- consolidate these into a real API namespace.
-    metabase.setup                 #{metabase.setup}
-    metabase.sync                  #{metabase.sync
-                                     metabase.sync.analyze
-                                     metabase.sync.concurrent
-                                     metabase.sync.field-values
-                                     metabase.sync.schedules
-                                     metabase.sync.sync-metadata
-                                     metabase.sync.sync-metadata.fields
-                                     metabase.sync.sync-metadata.tables
-                                     metabase.sync.util}                                            ; TODO -- consolidate these into a real API namespace.
-    metabase.task                  #{metabase.task
-                                     metabase.task.index-values
-                                     metabase.task.persist-refresh
-                                     ;; We need to expose this to the metabase.search module.
-                                     ;; Ideally, it would just live inside that module.
-                                     metabase.task.search-index}                                    ; TODO -- consolidate these into a real API namespace.
-    metabase.troubleshooting       #{metabase.troubleshooting}
-    metabase.types                 #{metabase.types}
-    metabase.upload                #{metabase.upload}
-    metabase.util                  :any                                                             ; I think util being `:any` is actually something I am ok with. But this has 32 namespaces.
-    metabase.xrays                 #{metabase.xrays}}
-
-   ;; Map of module => other modules you're allowed to use there. You have two options here:
-   ;;
-   ;; 1. `:any` means namespaces in this module are allowed to use any other module -- allowed modules are not
-   ;;    enforced for this module. Module API namespaces for modules that have them defined are still enforced. For
-   ;;    ones that are `nil`, please go in and add a list of allowed modules. `:any` is mostly meant a temporary
-   ;;    placeholder until we can fill these all out, so feel free to fix these.
-   ;;
-   ;; 2. A set of module symbols. This is the list of modules that are allowed to be referenced. An empty set means no
-   ;;    other modules are allowed to be referenced; this is the default for any modules that aren't listed here.
-   :allowed-modules
-   {metabase.actions               :any
-    metabase.analytics             :any
-    metabase.analyze               :any
-    metabase.api                   :any
-    metabase.async                 :any
-    metabase.audit                 :any
-    metabase.auth-provider         #{metabase.util metabase.public-settings}
-    metabase.bootstrap             #{}
-    metabase.cmd                   :any
-    metabase.compatibility         :any
-    metabase.channel               :any
-    metabase.config                #{metabase.plugins}
-    metabase.core                  :any
-    metabase.db                    :any
-    metabase.driver                :any
-    metabase.email                 :any
-    metabase.embed                 :any
-    metabase.events                :any
-    metabase.formatter             :any
-    metabase.integrations          :any
-    metabase.legacy-mbql           :any
-    metabase.lib                   :any
-    metabase.logger                #{metabase.config
-                                     metabase.plugins}
-    metabase.metabot               :any
-    metabase.models                :any
-    metabase.moderation            :any
-    metabase.notification          :any
-    metabase.permissions           :any
-    metabase.plugins               :any
-    metabase.public-settings       :any
-    metabase.pulse                 :any
-    metabase.query-analysis        #{metabase.config
-                                     metabase.driver
-                                     metabase.legacy-mbql
-                                     metabase.lib
-                                     metabase.models
-                                     metabase.public-settings
-                                     metabase.query-processor
-                                     metabase.util}
-    metabase.query-processor       :any
-    metabase.related               :any
-    metabase.sample-data           :any
-    metabase.search                :any
-    metabase.server                :any
-    metabase.setup                 :any
-    metabase.sync                  :any
-    metabase.task                  :any
-    metabase.troubleshooting       :any
-    metabase.types                 #{metabase.util}
-    metabase.upload                :any
-    metabase.util                  :any
-    metabase.xrays                 :any}
-
-   ;; namespaces matching these patterns (with `re-find`) are excluded from the module linter. Since regex literals
-   ;; aren't allowed in EDN just used the `(str <regex>)` version i.e. two slashes instead of one.
-   ;;
-   ;; this is mostly intended for excluding test namespaces or those rare 'glue' namespaces that glue multiple modules
-   ;; together, e.g. `metabase.lib.metadata.jvm`.
-   :ignored-namespace-patterns
-   #{"-test$"                     ; anything ending in `-test`
-     "test[-.]util"               ; anything that contains `test.util` or `test-util`
-     "test\\.impl"                ; anything that contains `test.impl`
-     "^metabase\\.test"           ; anything starting with `metabase.test`
-     "^metabase\\.http-client$"}} ; `metabase.http-client` which is a test-only namespace despite its name.
-
   :consistent-alias
   {:aliases
    {buddy.core.hash                                               buddy-hash
@@ -476,7 +325,6 @@
     clojure.tools.namespace.parse                                 ns.parse
     colorize.core                                                 colorize
     environ.core                                                  env
-    hf.depstar.api                                                depstar
     hiccup.core                                                   hiccup
     hiccup.util                                                   hiccup.util
     honey.sql                                                     sql
@@ -493,6 +341,7 @@
     medley.core                                                   m
     metabase-enterprise.audit-app.pages.common                    common
     metabase-enterprise.sandbox.api.table                         table
+    metabase-enterprise.sandbox.api.util                          sandbox.api.util
     metabase-enterprise.test                                      met
     metabase.analytics.sdk                                        sdk
     metabase.analytics.stats                                      stats
@@ -507,51 +356,10 @@
     metabase.analyze.fingerprint.fingerprinters                   fingerprinters
     metabase.analyze.fingerprint.insights                         insights
     metabase.analyze.fingerprint.schema                           fingerprint.schema
-    metabase.api.activity                                         api.activity
-    metabase.api.alert                                            api.alert
-    metabase.api.automagic-dashboards                             api.magic
-    metabase.api.bookmark                                         api.bookmark
-    metabase.api.card                                             api.card
-    metabase.api.card-test                                        api.card-test
-    metabase.api.collection                                       api.collection
     metabase.api.common                                           api
-    metabase.api.dashboard                                        api.dashboard
-    metabase.api.dashboard-test                                   api.dashboard-test
-    metabase.api.database                                         api.database
-    metabase.api.dataset                                          api.dataset
-    metabase.api.email                                            api.email
-    metabase.api.embed                                            api.embed
-    metabase.api.field                                            api.field
-    metabase.api.geojson                                          api.geojson
-    metabase.api.ldap                                             api.ldap
-    metabase.api.logic-history                                    api.login-history
-    metabase.api.metric                                           api.metric
-    metabase.api.native-query-snippet                             api.native-query-snippet
-    metabase.api.notify                                           api.notify
-    metabase.api.permission-graph                                 api.permission-graph
-    metabase.api.permissions                                      api.permissions
-    metabase.api.permissions-test-util                            perm-test-util
-    metabase.api.pivots                                           api.pivots
-    metabase.api.premium-features                                 api.premium-features
-    metabase.api.preview-embed                                    api.preview-embed
-    metabase.api.public                                           api.public
-    metabase.api.pulse                                            api.pulse
-    metabase.api.revision                                         api.revision
-    metabase.api.search                                           api.search
-    metabase.api.segment                                          api.segment
-    metabase.api.session                                          api.session
-    metabase.api.setting                                          api.setting
-    metabase.api.setup                                            api.setup
-    metabase.api.slack                                            api.slack
-    metabase.api.table                                            api.table
-    metabase.api.task                                             api.task
-    metabase.api.tiles                                            api.tiles
-    metabase.api.timeline                                         api.timeline
-    metabase.api.timeline-event                                   api.timeline-event
-    metabase.api.user                                             api.user
-    metabase.api.util                                             api.util
-    metabase.async.streaming-response.thread-pool                 thread-pool
     metabase.channel.core                                         channel
+    metabase.channel.render.core                                  channel.render
+    metabase.cloud-migration.core                                 cloud-migration
     metabase.cmd.copy.h2                                          copy.h2
     metabase.config                                               config
     metabase.config.file                                          config.file
@@ -592,8 +400,6 @@
     metabase.driver.sql.parameters.substitute                     sql.params.substitute
     metabase.driver.sql.parameters.substitution                   sql.params.substitution
     metabase.eid-translation                                      eid-translation
-    metabase.email-test                                           et
-    metabase.email.messages                                       messages
     metabase.formatter                                            formatter
     metabase.http-client                                          client
     metabase.legacy-mbql.normalize                                mbql.normalize
@@ -601,41 +407,19 @@
     metabase.legacy-mbql.util                                     mbql.u
     metabase.lib.util                                             lib.util
     metabase.lib.util.match                                       lib.util.match
-    metabase.models.activity                                      activity
-    metabase.models.application-permissions-revision              a-perm-revision
-    metabase.models.bookmark                                      bookmark
-    metabase.models.collection                                    collection
-    metabase.models.collection.graph                              graph
-    metabase.models.collection-permission-graph-revision          c-perm-revision
-    metabase.models.channel                                       models.channel
-    metabase.models.dashboard-card                                dashboard-card
-    metabase.models.database                                      database
+    metabase.login-history.core                                   login-history
+    metabase.model-persistence.core                               model-persistence
     metabase.models.dependency                                    dependency
-    metabase.models.field-values                                  field-values
     metabase.models.interface                                     mi
-    metabase.models.moderation-review                             moderation-review
-    metabase.models.native-query-snippet                          native-query-snippet
-    metabase.models.notification                                  models.notification
-    metabase.models.params                                        params
-    metabase.models.permissions                                   perms
-    metabase.models.permissions-group                             perms-group
-    metabase.models.permissions-group-membership                  perms-group-membership
-    metabase.models.permissions-revision                          perms-revision
-    metabase.models.permissions.parse                             perms-parse
-    metabase.models.pulse                                         pulse
-    metabase.models.pulse-channel                                 pulse-channel
-    metabase.models.pulse-channel-recipient                       pulse-channel-recipient
-    metabase.models.query.permissions                             query-perms
-    metabase.models.setting.cache                                 setting.cache
-    metabase.models.timeline                                      timeline
-    metabase.models.timeline-event                                timeline-event
+    metabase.models.setting                                       setting
     metabase.notification.core                                    notification
     metabase.notification.test-util                               notification.tu
+    metabase.permissions.core                                     perms
     metabase.plugins.initialize                                   plugins.init
     metabase.public-settings                                      public-settings
-    metabase.public-settings.premium-features                     premium-features
-    metabase.pulse                                                pulse ; NB some conflicts with metabase.models.pulse
-    metabase.pulse.markdown                                       markdown
+    metabase.public-sharing.core                                  public-sharing
+    metabase.premium-features.core                                premium-features
+    metabase.pulse.core                                           pulse
     metabase.pulse.render                                         render
     metabase.pulse.render.body                                    body
     metabase.pulse.render.style                                   style
@@ -665,31 +449,23 @@
     metabase.query-processor.streaming.xlsx                       qp.xlsx
     metabase.query-processor.timezone                             qp.timezone
     metabase.query-processor.util                                 qp.util
-    metabase.related                                              related
+    metabase.request.core                                         request
+    metabase.revisions.core                                       revisions
     metabase.search.config                                        search.config
     metabase.search.filter                                        search.filter
-    metabase.search.util                                          search.util
-    metabase.search.scoring                                       scoring
-    metabase.server.middleware.auth                               mw.auth
-    metabase.server.middleware.browser-cookie                     mw.browser-cookie
-    metabase.server.middleware.exceptions                         mw.exceptions
-    metabase.server.middleware.json                               mw.json
-    metabase.server.middleware.log                                mw.log
-    metabase.server.middleware.misc                               mw.misc
-    metabase.server.middleware.offset-paging                      mw.offset-paging
-    metabase.server.middleware.security                           mw.security
-    metabase.server.middleware.session                            mw.session
-    metabase.server.middleware.ssl                                mw.ssl
-    metabase.server.request.util                                  req.util
+    metabase.search.in-place.filter                               search.in-place.filter
+    metabase.search.in-place.util                                 search.util
+    metabase.search.in-place.scoring                              scoring
+    metabase.server.core                                          server
     metabase.server.protocols                                     server.protocols
+    metabase.sso.core                                             sso
     metabase.sync.analyze.fingerprint                             sync.fingerprint
-    metabase.sync.field-values                                    field-values
+    metabase.sync.field-values                                    sync.field-values
     metabase.sync.interface                                       i
     metabase.sync.schedules                                       sync.schedules
     metabase.sync.sync-metadata.fields.our-metadata               fields.our-metadata
     metabase.sync.util                                            sync-util
     metabase.sync.util-test                                       sync.util-test
-    metabase.task.sync-databases                                  task.sync-databases
     metabase.test                                                 mt
     metabase.test.data.dataset-definitions                        defs
     metabase.test.data.env.impl                                   tx.env.impl
@@ -701,6 +477,7 @@
     metabase.test.redefs                                          test.redefs
     metabase.test.util.js                                         test.js
     metabase.test.util.timezone                                   test.tz
+    metabase.timeline.core                                        timeline
     metabase.timeseries-query-processor-test.util                 tqpt
     metabase.util.cron                                            u.cron
     metabase.util.currency                                        currency
@@ -720,11 +497,12 @@
     metabase.util.macros                                          u.macros
     metabase.util.malli                                           mu
     metabase.util.malli.schema                                    ms
+    metabase.util.markdown                                        markdown
     metabase.util.password                                        u.password
     metabase.util.schema                                          su
     metabase.util.ui-logic                                        ui-logic
     metabase.util.urls                                            urls
-    metabase.xrays                                                xrays
+    metabase.xrays.core                                           xrays
     metabuild-common.core                                         u
     metabuild-common.output                                       out
     metabuild-common.shell                                        shell
@@ -742,17 +520,15 @@
   clojure.core.cache/defcache                                                           clojure.core/deftype
   clojure.core.logic/defne                                                              clj-kondo.lint-as/def-catch-all
   clojure.test.check.clojure-test/defspec                                               clojure.test/deftest
+  clojure.test.check.properties/for-all                                                 clojure.core/let
   clojurewerkz.quartzite.jobs/defjob                                                    clojure.core/defn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
   metabase.actions.test-util/with-actions                                               clojure.core/let
-  metabase.api.common/defroutes                                                         clojure.core/def
   metabase.api.common/let-404                                                           clojure.core/let
-  metabase.api.search-test/do-test-users                                                clojure.core/let
-  metabase.async.api-response-test/with-response                                        clojure.core/let
+  metabase.channel.impl.http-test/with-captured-http-requests                           clojure.core/fn
+  metabase.channel.impl.http-test/with-server                                           clojure.core/let
   metabase.dashboard-subscription-test/with-dashboard-sub-for-card                      clojure.core/let
-  metabase.channel.http-test/with-captured-http-requests                                clojure.core/fn
-  metabase.channel.http-test/with-server                                                clojure.core/let
   metabase.db.custom-migrations/define-migration                                        clj-kondo.lint-as/def-catch-all
   metabase.db.custom-migrations/define-reversible-migration                             clj-kondo.lint-as/def-catch-all
   metabase.db.data-migrations/defmigration                                              clojure.core/def
@@ -764,20 +540,21 @@
   metabase.driver.sql-jdbc.actions/with-jdbc-transaction                                clojure.core/let
   metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection       clojure.core/let
   metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                 clojure.core/fn
-  metabase.integrations.ldap/with-ldap-connection                                       clojure.core/fn
   metabase.models.collection-test/with-collection-in-location                           clojure.core/let
   metabase.models.json-migration/def-json-migration                                     clj-kondo.lint-as/def-catch-all
-  metabase.models.setting.multi-setting/define-multi-setting                            clojure.core/def
   metabase.models.setting/defsetting                                                    clj-kondo.lint-as/def-catch-all
-  metabase.public-settings.premium-features/defenterprise-schema                        clj-kondo.lint-as/def-catch-all
-  metabase.public-settings.premium-features/define-premium-feature                      clojure.core/def
-  metabase.pulse-test/with-pulse-for-card                                               clojure.core/let
+  metabase.premium-features.core/defenterprise-schema                                   clj-kondo.lint-as/def-catch-all
+  metabase.premium-features.core/define-premium-feature                                 clojure.core/def
+  metabase.premium-features.defenterprise/defenterprise-schema                          clj-kondo.lint-as/def-catch-all
+  metabase.pulse.send-test/with-pulse-for-card                                          clojure.core/let
   metabase.query-processor-test.pipeline-queries-test/pmbql-query                       clojure.core/->
   metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                   clojure.core/->
   metabase.query-processor.error-type/deferror                                          clojure.core/def
   metabase.query-processor.middleware.cache.impl/with-reducible-deserialized-results    clojure.core/let
   metabase.query-processor.middleware.process-userland-query-test/with-query-execution! clojure.core/let
   metabase.query-processor.setup/with-qp-setup                                          clojure.core/let
+  metabase.search.api-test/do-test-users                                                clojure.core/let
+  metabase.sso.ldap/with-ldap-connection                                                clojure.core/fn
   metabase.sync.util/sum-for                                                            clojure.core/for
   metabase.sync.util/with-emoji-progress-bar                                            clojure.core/let
   metabase.test.data.interface/defdataset                                               clojure.core/def
@@ -793,6 +570,7 @@
   metabase.test/with-temp-file                                                          clojure.core/let
   metabase.test/with-user-in-groups                                                     clojure.core/let
   metabase.upload-test/with-upload-table!                                               clojure.core/let
+  metabase.util/with-timer-ms                                                           clojure.core/fn
   metabase.util.files/with-open-path-to-resource                                        clojure.core/let
   metabase.util.malli.defn/defn                                                         schema.core/defn
   metabase.util.malli.defn/defn-                                                        schema.core/defn
@@ -804,6 +582,8 @@
   metabase.util.namespaces/import-fns                                                   potemkin/import-vars
   metabase.util.ssh/with-ssh-tunnel                                                     clojure.core/let
   metabase.xrays.domain-entities.malli/defn                                             schema.core/defn
+  metabuild-common.core/with-open-jar-file-system                                       clojure.core/let
+  metabuild-common.files/with-open-jar-file-system                                      clojure.core/let
   monger.operators/defoperator                                                          clojure.core/def
   potemkin.types/defprotocol+                                                           clojure.core/defprotocol
   potemkin.types/defrecord+                                                             clojure.core/defrecord
@@ -819,25 +599,22 @@
   {cljs.test/deftest                                                                                                         hooks.clojure.test/deftest
    cljs.test/is                                                                                                              hooks.clojure.test/is
    cljs.test/use-fixtures                                                                                                    hooks.clojure.test/use-fixtures
-   clojure.core/ns                                                                                                           hooks.clojure.core/lint-ns
+   clojure.core/defmulti                                                                                                     hooks.clojure.core.defmulti/lint-defmulti
+   clojure.core/ns                                                                                                           hooks.clojure.core.ns/lint-ns
+   clojure.core/require                                                                                                      hooks.clojure.core.require/lint-require
+   clojure.core/requiring-resolve                                                                                            hooks.clojure.core.require/lint-requiring-resolve
    clojure.test/deftest                                                                                                      hooks.clojure.test/deftest
    clojure.test/is                                                                                                           hooks.clojure.test/is
    clojure.test/use-fixtures                                                                                                 hooks.clojure.test/use-fixtures
+   malli.error/humanize                                                                                                      hooks.malli.error/humanize
    metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
    metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
    metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
-   metabase.analytics.prometheus-test/with-prometheus-system!                                                                hooks.common/with-two-bindings
-   metabase.api.alert-test/with-alert-in-collection!                                                                         hooks.common/with-four-bindings
-   metabase.api.automagic-dashboards-test/with-indexed-model!                                                                hooks.metabase.api.automagic-dashboards-test/with-indexed-model!
    metabase.api.card-test/with-card-param-values-fixtures                                                                    hooks.common/let-one-with-optional-value
-   metabase.api.card-test/with-persistence-setup!                                                                            hooks.common/with-one-top-level-binding
    metabase.api.card-test/with-temp-native-card!                                                                             hooks.common/with-two-bindings
    metabase.api.card-test/with-temp-native-card-with-params!                                                                 hooks.common/with-two-bindings
    metabase.api.collection-test/with-french-user-and-personal-collection!                                                    hooks.common/with-two-top-level-bindings
-   metabase.api.common/defendpoint                                                                                           hooks.metabase.api.common/defendpoint
-   metabase.api.common/defendpoint-async                                                                                     hooks.metabase.api.common/defendpoint
-   metabase.api.common/defendpoint-async-schema                                                                              hooks.metabase.api.common/defendpoint
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
    metabase.api.dashboard-test/with-chain-filter-fixtures                                                                    hooks.common/let-one-with-optional-value
    metabase.api.dashboard-test/with-simple-dashboard-with-tabs                                                               hooks.common/with-one-binding
@@ -845,15 +622,10 @@
    metabase.api.embed-test/with-chain-filter-fixtures!                                                                       hooks.common/let-one-with-optional-value
    metabase.api.embed-test/with-temp-card                                                                                    hooks.common/let-one-with-optional-value
    metabase.api.embed-test/with-temp-dashcard                                                                                hooks.common/let-one-with-optional-value
-   metabase.api.persist-test/with-setup!                                                                                     hooks.common/with-one-top-level-binding
-   metabase.api.public-test/with-required-param-card!                                                                        hooks.common/with-one-binding
-   metabase.api.public-test/with-temp-public-card                                                                            hooks.common/let-one-with-optional-value
-   metabase.api.public-test/with-temp-public-dashboard                                                                       hooks.common/let-one-with-optional-value
-   metabase.api.public-test/with-temp-public-dashboard-and-card                                                              hooks.common/with-three-bindings
-   metabase.api.search-test/with-search-items-in-collection                                                                  hooks.metabase.api.search-test/with-search-items-in-collection
-   metabase.api.search-test/with-search-items-in-root-collection                                                             hooks.common/do*
-   metabase.api.user-test/with-temp-user-email                                                                               hooks.common/with-one-binding
-   metabase.async.streaming-response-test/with-start-execution-chan                                                          hooks.common/with-one-binding
+   metabase.api.macros/defendpoint                                                                                           hooks.metabase.api.macros/defendpoint
+   metabase.api.user-test/with-temp-user-email!                                                                              hooks.common/with-one-binding
+   metabase.channel.template.handlebars-helper/defhelper                                                                     hooks.metabase.channel.template.handlebars-helper/defhelper
+   metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
    metabase.dashboard-subscription-test/with-link-card-fixture-for-dashboard                                                 hooks.common/let-second
    metabase.db.schema-migrations-test.impl/test-migrations                                                                   hooks.metabase.db.schema-migrations-test.impl/test-migrations
    metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
@@ -866,22 +638,41 @@
    metabase.lib.test-util.macros/$ids                                                                                        hooks.metabase.test.data/$ids
    metabase.lib.test-util.macros/mbql-query                                                                                  hooks.metabase.test.data/mbql-query
    metabase.lib.test-util.macros/with-testing-against-standard-queries                                                       hooks.metabase.lib.test-util.macros/with-testing-against-standard-queries
+   metabase.model-persistence.api-test/with-persistence-setup!                                                               hooks.common/with-one-top-level-binding
+   metabase.model-persistence.api-test/with-setup!                                                                           hooks.common/with-one-top-level-binding
+   metabase.model-persistence.test-util/with-persistence-enabled!                                                            hooks.metabase.model-persistence.test-util/with-persistence-enabled!
    metabase.models.collection-test/with-collection-hierarchy!                                                                hooks.common/let-one-with-optional-value
    metabase.models.collection-test/with-personal-and-impersonal-collections                                                  hooks.common/with-two-bindings
    metabase.models.dashboard-tab-test/with-dashtab-in-personal-collection                                                    hooks.common/with-one-top-level-binding
    metabase.models.dashboard-test/with-dash-in-collection!                                                                   hooks.common/with-three-bindings
    metabase.models.interface/define-batched-hydration-method                                                                 hooks.metabase.models.interface/define-hydration-method
    metabase.models.interface/define-simple-hydration-method                                                                  hooks.metabase.models.interface/define-hydration-method
-   metabase.models.pulse-test/with-dashboard-subscription-in-collection!                                                     hooks.common/with-four-bindings
-   metabase.models.pulse-test/with-pulse-in-collection!                                                                      hooks.common/with-four-bindings
    metabase.models.setting.multi-setting/define-multi-setting                                                                hooks.metabase.models.setting/define-multi-setting
+   metabase.models.setting.multi-setting/define-multi-setting-impl                                                           hooks.metabase.models.setting/define-multi-setting-impl
    metabase.models.setting/defsetting                                                                                        hooks.metabase.models.setting/defsetting
-   metabase.public-settings.premium-features/defenterprise                                                                   hooks.metabase.public-settings.premium-features/defenterprise
+   metabase.permissions.core/allow-changing-all-users-group-members                                                          hooks.common/do*
+   metabase.permissions.core/disable-perms-cache                                                                             hooks.common/do*
+   metabase.plugins.classloader/require                                                                                      hooks.clojure.core.require/lint-require
+   metabase.premium-features.core/defenterprise                                                                              hooks.metabase.premium-features.defenterprise/defenterprise
+   metabase.premium-features.defenterprise/defenterprise                                                                     hooks.metabase.premium-features.defenterprise/defenterprise
+   metabase.public-sharing.api-test/with-required-param-card!                                                                hooks.common/with-one-binding
+   metabase.public-sharing.api-test/with-temp-public-card                                                                    hooks.common/let-one-with-optional-value
+   metabase.public-sharing.api-test/with-temp-public-dashboard                                                               hooks.common/let-one-with-optional-value
+   metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                                                      hooks.common/with-three-bindings
+   metabase.pulse.api.alert-test/with-alert-in-collection!                                                                   hooks.common/with-four-bindings
+   metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection!                                               hooks.common/with-four-bindings
+   metabase.pulse.models.pulse-test/with-pulse-in-collection!                                                                hooks.common/with-four-bindings
    metabase.pulse.test-util/checkins-query-card                                                                              hooks.metabase.test.data/$ids
    metabase.query-processor-test.expressions-test/calculate-bird-scarcity                                                    hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
    metabase.query-processor-test.filter-test/count-with-filter-clause                                                        hooks.metabase.test.data/$ids
    metabase.query-processor.middleware.cache-test/with-mock-cache!                                                           hooks.common/with-two-bindings
+   metabase.request.core/with-current-request                                                                                hooks.common/with-used-first-arg
+   metabase.request.core/with-current-user                                                                                   hooks.common/with-used-first-arg
+   metabase.request.core/with-limit-and-offset                                                                               hooks.common/with-used-first-two-args
    metabase.sample-data-test/with-temp-sample-database-db                                                                    hooks.common/with-one-binding
+   metabase.search.api-test/with-search-items-in-collection                                                                  hooks.metabase.search.api-test/with-search-items-in-collection
+   metabase.search.api-test/with-search-items-in-root-collection                                                             hooks.common/do*
+   metabase.server.streaming-response-test/with-start-execution-chan                                                         hooks.common/with-one-binding
    metabase.stale-test/with-stale-items                                                                                      hooks.toucan2.tools.with-temp/with-temp
    metabase.test.data.datasets/test-driver                                                                                   hooks.metabase.test.data.datasets/test-driver
    metabase.test.data.datasets/test-drivers                                                                                  hooks.metabase.test.data.datasets/test-drivers
@@ -890,11 +681,13 @@
    metabase.test.data/dataset                                                                                                hooks.metabase.test.data/dataset
    metabase.test.data/mbql-query                                                                                             hooks.metabase.test.data/mbql-query
    metabase.test.data/run-mbql-query                                                                                         hooks.metabase.test.data/mbql-query
+   metabase.test.gentest/with-gentest                                                                                        hooks.metabase.test.gentest/with-gentest
    metabase.test.util.async/with-open-channels                                                                               hooks.common/let-with-optional-value-for-last-binding
    metabase.test.util.log/with-log-level                                                                                     hooks.common/with-ignored-first-arg
    metabase.test.util/discard-setting-changes                                                                                hooks.common/with-ignored-first-arg
    metabase.test.util/with-column-remappings                                                                                 hooks.common/with-ignored-first-arg
    metabase.test.util/with-non-admin-groups-no-root-collection-perms                                                         hooks.common/do*
+   metabase.test.util/with-prometheus-system!                                                                                hooks.common/with-two-bindings
    metabase.test.util/with-temp-file                                                                                         hooks.metabase.test.util/with-temp-file
    metabase.test.util/with-temporary-setting-values                                                                          hooks.metabase.test.util/with-temporary-setting-values
    metabase.test/$ids                                                                                                        hooks.metabase.test.data/$ids
@@ -910,8 +703,10 @@
    metabase.test/with-log-level                                                                                              hooks.common/with-ignored-first-arg
    metabase.test/with-log-messages-for-level                                                                                 hooks.metabase.util.log.capture/with-log-messages-for-level
    metabase.test/with-non-admin-groups-no-root-collection-perms                                                              hooks.common/do*
+   metabase.test/with-persistence-enabled!                                                                                   hooks.metabase.model-persistence.test-util/with-persistence-enabled!
    metabase.test/with-temp                                                                                                   hooks.toucan2.tools.with-temp/with-temp
    metabase.test/with-temp-file                                                                                              hooks.metabase.test.util/with-temp-file
+   metabase.test/with-prometheus-system!                                                                                     hooks.common/with-two-bindings
    metabase.test/with-temporary-setting-values                                                                               hooks.metabase.test.util/with-temporary-setting-values
    metabase.util.log.capture/with-log-messages-for-level                                                                     hooks.metabase.util.log.capture/with-log-messages-for-level
    metabase.util.log/debug                                                                                                   hooks.metabase.util.log/info
@@ -927,46 +722,46 @@
    metabase.util.log/warn                                                                                                    hooks.metabase.util.log/info
    metabase.util.log/warnf                                                                                                   hooks.metabase.util.log/infof
    metabase.util.malli.registry/def                                                                                          hooks.metabase.util.malli.registry/def
-   metabase.util/format-color                                                                                                hooks.metabase.util/format-color}
+   metabase.util/case-enum                                                                                                   hooks.metabase.util/case-enum
+   metabase.util/format-color                                                                                                hooks.metabase.util/format-color
+   metabase.xrays.api.automagic-dashboards-test/with-indexed-model!                                                          hooks.metabase.xrays.api.automagic-dashboards-test/with-indexed-model!}
 
   :macroexpand
-  {clojurewerkz.quartzite.jobs/build                                             macros.quartz/build-job
-   clojurewerkz.quartzite.schedule.cron/schedule                                 macros.quartz/schedule
-   clojurewerkz.quartzite.schedule.simple/schedule                               macros.quartz/simple-schedule
-   clojurewerkz.quartzite.triggers/build                                         macros.quartz/build-trigger
-   metabase-enterprise.sandbox.test-util/with-gtaps!                             macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                    macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.serialization.test-util/with-world                        macros.metabase-enterprise.serialization.test-util/with-world
-   metabase-enterprise.test/with-gtaps!                                          macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.test/with-gtaps-for-user!                                 macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!   macros.metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!
-   metabase-enterprise.query-reference-validation.api-test/with-test-setup!      macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
-   metabase.api.card-test/with-ordered-items                                     macros.metabase.api.card-test/with-ordered-items
-   metabase.api.collection-test/with-collection-hierarchy!                       macros.metabase.api.collection-test/with-collection-hierarchy!
-   metabase.api.collection-test/with-some-children-of-collection!                macros.metabase.api.collection-test/with-some-children-of-collection!
-   metabase.api.common/define-routes                                             macros.metabase.api.common/define-routes
-   metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing!     macros.metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing!
-   metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing! macros.metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
-   metabase.api.public-test/with-sharing-enabled-and-temp-card-referencing!      macros.metabase.api.public-test/with-sharing-enabled-and-temp-card-referencing!
-   metabase.api.public-test/with-sharing-enabled-and-temp-dashcard-referencing!  macros.metabase.api.public-test/with-sharing-enabled-and-temp-dashcard-referencing!
-   metabase.lib.filter/deffilter                                                 macros.metabase.lib.filter/deffilter
-   metabase.lib.common/defop                                                     macros.metabase.lib.common/defop
-   metabase.models.params.chain-filter-test/chain-filter                         macros.metabase.models.params.chain-filter-test/chain-filter
-   metabase.models.params.chain-filter-test/chain-filter-search                  macros.metabase.models.params.chain-filter-test/chain-filter
-   metabase.models.query-analysis-test/with-test-setup                           macros.metabase.models.query-analysis-test/with-test-setup
-   metabase.models.user-test/with-groups                                         macros.metabase.models.user-test/with-groups
-   metabase.query-processor.streaming/streaming-response                         macros.metabase.query-processor.streaming/streaming-response
-   metabase.related-test/with-world                                              macros.metabase.related-test/with-world
-   metabase.task.setup.query-analysis-setup/with-test-setup!                     macros.metabase.task.setup.query-analysis-setup/with-test-setup!
-   metabase.test.data.users/with-group-for-user                                  macros.metabase.test.data.users/with-group-for-user
-   metabase.test.util/with-temp-env-var-value!                                   macros.metabase.test.util/with-temp-env-var-value!
-   metabase.test.util/with-temporary-raw-setting-values                          macros.metabase.test.util/with-temporary-raw-setting-values
-   metabase.test/with-group-for-user                                             macros.metabase.test.data.users/with-group-for-user
-   metabase.test/with-persistence-enabled!                                       macros.metabase.test.persistence/with-persistence-enabled!
-   metabase.test/with-temp-env-var-value!                                        macros.metabase.test.util/with-temp-env-var-value!
-   metabase.test/with-temporary-raw-setting-values                               macros.metabase.test.util/with-temporary-raw-setting-values
-   metabase.util.namespaces/import-fn                                            macros.metabase.util.namespaces/import-fn
-   metabase.xrays.domain-entities.malli/define-getters-and-setters               macros.metabase.xrays.domain-entities.malli/define-getters-and-setters}}
+  {clojurewerkz.quartzite.jobs/build                                                    macros.quartz/build-job
+   clojurewerkz.quartzite.schedule.cron/schedule                                        macros.quartz/schedule
+   clojurewerkz.quartzite.schedule.simple/schedule                                      macros.quartz/simple-schedule
+   clojurewerkz.quartzite.triggers/build                                                macros.quartz/build-trigger
+   metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!          macros.metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!
+   metabase-enterprise.query-reference-validation.api-test/with-test-setup!             macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
+   metabase-enterprise.sandbox.test-util/with-gtaps!                                    macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                           macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.serialization.test-util/with-world                               macros.metabase-enterprise.serialization.test-util/with-world
+   metabase-enterprise.test/with-gtaps!                                                 macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.test/with-gtaps-for-user!                                        macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase.api.card-test/with-ordered-items                                            macros.metabase.api.card-test/with-ordered-items
+   metabase.api.collection-test/with-collection-hierarchy!                              macros.metabase.api.collection-test/with-collection-hierarchy!
+   metabase.api.collection-test/with-some-children-of-collection!                       macros.metabase.api.collection-test/with-some-children-of-collection!
+   metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing!            macros.metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing!
+   metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!        macros.metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
+   metabase.lib.common/defop                                                            macros.metabase.lib.common/defop
+   metabase.lib.filter/deffilter                                                        macros.metabase.lib.filter/deffilter
+   metabase.models.params.chain-filter-test/chain-filter                                macros.metabase.models.params.chain-filter-test/chain-filter
+   metabase.models.params.chain-filter-test/chain-filter-search                         macros.metabase.models.params.chain-filter-test/chain-filter
+   metabase.models.query-analysis-test/with-test-setup                                  macros.metabase.models.query-analysis-test/with-test-setup
+   metabase.models.user-test/with-groups                                                macros.metabase.models.user-test/with-groups
+   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!     macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!
+   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing! macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing!
+   metabase.query-analysis.task.test-setup/with-test-setup!                             macros.metabase.query-analysis.task.test-setup/with-test-setup!
+   metabase.query-processor.streaming/streaming-response                                macros.metabase.query-processor.streaming/streaming-response
+   metabase.test.data.users/with-group-for-user                                         macros.metabase.test.data.users/with-group-for-user
+   metabase.test.util/with-temp-env-var-value!                                          macros.metabase.test.util/with-temp-env-var-value!
+   metabase.test.util/with-temporary-raw-setting-values                                 macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.test/with-group-for-user                                                    macros.metabase.test.data.users/with-group-for-user
+   metabase.test/with-temp-env-var-value!                                               macros.metabase.test.util/with-temp-env-var-value!
+   metabase.test/with-temporary-raw-setting-values                                      macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.util.namespaces/import-fn                                                   macros.metabase.util.namespaces/import-fn
+   metabase.xrays.domain-entities.malli/define-getters-and-setters                      macros.metabase.xrays.domain-entities.malli/define-getters-and-setters
+   metabase.xrays.related-test/with-world                                               macros.metabase.xrays.related-test/with-world}}
 
  :config-in-comment
  {:linters {:unresolved-symbol {:level :off}}}
@@ -1021,9 +816,9 @@
 
    :hooks
    {:analyze-call
-    {clojure.core/defmacro hooks.clojure.core/non-thread-safe-form-should-end-with-exclamation
-     clojure.core/defn     hooks.clojure.core/non-thread-safe-form-should-end-with-exclamation
-     clojure.core/defn-    hooks.clojure.core/non-thread-safe-form-should-end-with-exclamation}}}
+    {clojure.core/defmacro hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation
+     clojure.core/defn     hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation
+     clojure.core/defn-    hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation}}}
 
   source-namespaces
   {:linters

.clj-kondo/config/modules/config.edn

@@ -0,0 +1,731 @@
+;; A "module" is any `metabase.<module>.core` namespace in `src`.
+;;
+;; ## `api`:
+;;
+;; Map of module name => the "core" external public-facing API namespace(s). You have three options here:
+;;
+;; 1. Special sentinel value `:any` means means this module does not (yet) have external public-facing API
+;;    namespace(s). This is mostly a temporary placeholder until we go in and create module namespaces, which means
+;;    you should go create one.
+;;
+;; 2. A set of namespace symbols. All namespaces in other modules will only be allowed to use namespaces from
+;;    this set. Ideally this set should only have one namespace, but restricting it to a set of several is still
+;;    better than `:any`.
+;;
+;; 3. `nil` or not listed here -- we default to assuming there is (some subset) of the 'standard' API namespaces
+;;    `<module>.api`, `<module>.core`, and `<module>.init`
+;;
+;; ## `uses`:
+;;
+;; Map of module => other modules you're allowed to use there. You have two options here:
+;;
+;; 1. `:any` means namespaces in this module are allowed to use any other module -- allowed modules are not
+;;    enforced for this module. Module API namespaces for modules that have them defined are still enforced. For
+;;    ones that are `nil`, please go in and add a list of allowed modules. `:any` is mostly meant a temporary
+;;    placeholder until we can fill these all out, so feel free to fix these.
+;;
+;; 2. A set of module symbols. This is the list of modules that are allowed to be referenced. An empty set means no
+;;    other modules are allowed to be referenced; this is the default for any modules that aren't listed here.
+;;
+;; ## Tips
+;;
+;; PRO TIP: Check out the [[dev.deps-graph]] namespace for helpful tools to see where a module is used externally, and
+;; for tools for calculating this config.
+{:metabase/modules
+ {actions
+  {:api  #{metabase.actions.api metabase.actions.core}
+   :uses #{analytics api driver legacy-mbql lib model-persistence models query-processor search util}}
+
+  activity-feed
+  {:api  #{metabase.activity-feed.api metabase.activity-feed.init}
+   :uses #{api config db events models util}}
+
+  analytics
+  {:api  #{metabase.analytics.core
+           metabase.analytics.prometheus
+           metabase.analytics.snowplow}
+   :uses #{api
+           config
+           db
+           driver
+           eid-translation
+           integrations
+           models
+           premium-features
+           public-settings
+           server
+           util}}
+  analyze
+  {:api  #{metabase.analyze.core metabase.analyze.query-results}
+   :uses #{config driver legacy-mbql lib models sync util}}
+
+  api
+  {:api #{metabase.api.cache
+          metabase.api.card
+          metabase.api.collection
+          metabase.api.common
+          metabase.api.common.validation
+          metabase.api.dashboard
+          metabase.api.dataset
+          metabase.api.field
+          metabase.api.macros
+          metabase.api.open-api
+          metabase.api.query-metadata
+          metabase.api.routes
+          metabase.api.routes.common
+          metabase.api.table
+          metabase.api.user
+          metabase.api.util.handlers}
+   :uses :any}
+
+  audit {:api  #{metabase.audit}
+         :uses #{db models}}
+
+  auth-provider
+  {:api  #{metabase.auth-provider}
+   :uses #{premium-features}}
+
+  bookmarks
+  {:api  #{metabase.bookmarks.api}
+   :uses #{api db models util}}
+
+  channel
+  {:api  #{metabase.channel.api
+           metabase.channel.core
+           metabase.channel.email
+           metabase.channel.email.messages
+           metabase.channel.init
+           metabase.channel.render.core
+           metabase.channel.template.core}
+   :uses #{analytics
+           api
+           config
+           db
+           driver
+           events
+           formatter
+           integrations
+           lib
+           models
+           notification
+           permissions
+           premium-features
+           public-settings
+           query-processor
+           timeline
+           types
+           util}}
+
+  cloud-migration
+  {:api  #{metabase.cloud-migration.api
+           metabase.cloud-migration.core
+           metabase.cloud-migration.init}
+   :uses #{api cmd config db models premium-features util}}
+
+  cmd
+  {:api  #{metabase.cmd
+           metabase.cmd.copy
+           metabase.cmd.dump-to-h2}
+   :uses #{api config db legacy-mbql models plugins query-processor search util}}
+
+  ;; technically this 'uses' `enterprise/core` and `test` since it tries to load them to see if they exists so we know
+  ;; if EE/test code is available; however we can ignore them since they're not real usages.
+  config
+  {:api  #{metabase.config}
+   :uses #{}}
+
+  ;; this is not actually a real module, but comes from one of our libraries.
+  connection-pool
+  {:api  #{metabase.connection-pool}
+   :uses #{}}
+
+  core
+  {:api  #{metabase.core.initialization-status}
+   :uses :any}
+
+  db
+  {:api  #{metabase.db metabase.db.metadata-queries metabase.db.query metabase.db.setup}
+   :uses #{auth-provider config connection-pool driver legacy-mbql lib plugins query-processor task util}}
+
+  driver
+  {:api #{metabase.driver
+          metabase.driver.common
+          metabase.driver.common.parameters
+          metabase.driver.common.parameters.dates
+          metabase.driver.common.parameters.operators
+          metabase.driver.common.parameters.parse
+          metabase.driver.common.parameters.values
+          metabase.driver.ddl.interface
+          metabase.driver.h2
+          metabase.driver.impl
+          metabase.driver.init
+          metabase.driver.mysql
+          metabase.driver.postgres
+          metabase.driver.sql
+          metabase.driver.sql-jdbc.connection
+          metabase.driver.sql-jdbc.execute
+          metabase.driver.sql-jdbc.execute.diagnostic
+          metabase.driver.sql-jdbc.sync
+          metabase.driver.sql.query-processor
+          metabase.driver.sql.query-processor.deprecated
+          metabase.driver.sql.util
+          metabase.driver.sync
+          metabase.driver.util}
+   :uses #{actions
+           auth-provider
+           config
+           connection-pool
+           db
+           legacy-mbql
+           lib
+           logger
+           models
+           plugins
+           premium-features
+           public-settings
+           pulse
+           query-processor
+           sync
+           upload
+           util}}
+
+  eid-translation
+  {:api  #{metabase.eid-translation}
+   :uses #{}}
+
+  embed
+  {:api  #{metabase.embed.settings}
+   :uses #{analytics models premium-features util}}
+
+  events
+  {:api  #{metabase.events metabase.events.init metabase.events.notification}
+   :uses #{api driver models notification premium-features util}}
+
+  formatter
+  {:api  #{metabase.formatter}
+   :uses #{models public-settings query-processor types util}}
+
+  indexed-entities
+  {:api  #{metabase.indexed-entities.api metabase.indexed-entities.init}
+   :uses #{analytics api driver legacy-mbql lib models query-processor search sync task util}}
+
+  integrations
+  {:api  #{metabase.integrations.slack}
+   :uses #{events models util}}
+
+  legacy-mbql
+  {:api #{metabase.legacy-mbql.normalize
+          metabase.legacy-mbql.predicates
+          metabase.legacy-mbql.schema
+          metabase.legacy-mbql.schema.helpers
+          metabase.legacy-mbql.util}
+   :uses #{lib models types util}}
+
+  lib
+  {:api #{metabase.lib.binning
+          metabase.lib.binning.util
+          metabase.lib.card
+          metabase.lib.convert
+          metabase.lib.core
+          metabase.lib.equality
+          metabase.lib.field
+          metabase.lib.filter
+          metabase.lib.ident
+          metabase.lib.join.util
+          metabase.lib.metadata
+          metabase.lib.metadata.calculation
+          metabase.lib.metadata.jvm
+          metabase.lib.metadata.protocols
+          metabase.lib.normalize
+          metabase.lib.options
+          metabase.lib.query
+          metabase.lib.schema
+          metabase.lib.schema.actions
+          metabase.lib.schema.binning
+          metabase.lib.schema.common
+          metabase.lib.schema.expression
+          metabase.lib.schema.expression.temporal
+          metabase.lib.schema.expression.window
+          metabase.lib.schema.id
+          metabase.lib.schema.info
+          metabase.lib.schema.literal
+          metabase.lib.schema.metadata
+          metabase.lib.schema.parameter
+          metabase.lib.schema.template-tag
+          metabase.lib.schema.temporal-bucketing
+          metabase.lib.schema.util
+          metabase.lib.temporal-bucket
+          metabase.lib.types.isa
+          metabase.lib.util
+          metabase.lib.util.match
+          metabase.lib.walk}
+   :uses #{config driver legacy-mbql models types util}}
+
+  logger
+  {:api  #{metabase.logger metabase.logger.init}
+   :uses #{config plugins}}
+
+  login-history
+  {:api #{metabase.login-history.api
+          metabase.login-history.core
+          metabase.login-history.init}
+   :uses #{analytics api channel models request util}}
+
+  model-persistence
+  {:api #{metabase.model-persistence.api
+          metabase.model-persistence.core
+          metabase.model-persistence.init}
+   :uses #{api db driver events lib models premium-features public-settings query-processor request task util}}
+
+  models
+  {:api #{metabase.models.api-key
+          metabase.models.application-permissions-revision
+          metabase.models.audit-log
+          metabase.models.cache-config
+          metabase.models.card
+          metabase.models.card.metadata
+          metabase.models.collection
+          metabase.models.collection-permission-graph-revision
+          metabase.models.collection.graph
+          metabase.models.collection.root
+          metabase.models.dashboard
+          metabase.models.dashboard-card
+          metabase.models.dashboard-tab
+          metabase.models.dashboard.constants
+          metabase.models.database
+          metabase.models.dispatch
+          metabase.models.field
+          metabase.models.field-usage
+          metabase.models.field-values
+          metabase.models.humanization
+          metabase.models.init
+          metabase.models.interface
+          metabase.models.moderation-review
+          metabase.models.native-query-snippet
+          metabase.models.native-query-snippet.permissions
+          metabase.models.notification
+          metabase.models.params
+          metabase.models.params.chain-filter
+          metabase.models.params.custom-values
+          metabase.models.params.field-values
+          metabase.models.params.shared
+          metabase.models.query
+          metabase.models.query-analysis
+          metabase.models.query.permissions
+          metabase.models.resolution
+          metabase.models.secret
+          metabase.models.serialization
+          metabase.models.setting
+          metabase.models.setting.cache
+          metabase.models.setting.multi-setting
+          metabase.models.table
+          metabase.models.task-history
+          metabase.models.user
+          metabase.models.user-parameter-value
+          metabase.models.view-log-impl
+          metabase.models.visualization-settings}
+   :uses #{analytics
+           analyze
+           api
+           audit
+           channel
+           config
+           db
+           driver
+           events
+           legacy-mbql
+           lib
+           moderation
+           permissions
+           plugins
+           premium-features
+           public-settings
+           public-sharing
+           pulse
+           query-analysis
+           query-processor
+           request
+           search
+           server
+           setup
+           sync
+           task
+           types
+           util
+           enterprise/advanced-permissions}}
+
+  moderation
+  {:api  #{metabase.moderation}
+   :uses #{models util}}
+
+  notification
+  {:api  #{metabase.notification.core
+           metabase.notification.init
+           metabase.notification.payload.core
+           metabase.notification.payload.execute}
+   :uses #{analytics api channel events models permissions premium-features public-settings query-processor request util}}
+
+  permissions
+  {:api  #{metabase.permissions.api
+           metabase.permissions.core
+           metabase.permissions.models.data-permissions
+           metabase.permissions.models.permissions
+           metabase.permissions.models.permissions-group
+           metabase.permissions.util}
+   :uses #{api audit config db models plugins premium-features request server util}}
+
+  plugins
+  {:api  #{metabase.plugins metabase.plugins.classloader}
+   :uses #{config driver util}}
+
+  premium-features
+  {:api  #{metabase.premium-features.core
+           metabase.premium-features.token-check}
+   :uses #{config db models plugins util}}
+
+  public-settings
+  {:api  #{metabase.public-settings}
+   :uses #{api config models premium-features util}}
+
+  public-sharing
+  {:api  #{metabase.public-sharing.api
+           metabase.public-sharing.core
+           metabase.public-sharing.init}
+   :uses #{actions analytics api db events lib models query-processor request util}}
+
+  pulse
+  {:api  #{metabase.pulse.api
+           metabase.pulse.core
+           metabase.pulse.init
+           metabase.pulse.task.send-pulses}
+   :uses #{api channel config db driver events integrations models notification permissions plugins premium-features
+           query-processor request task util
+           enterprise/advanced-config enterprise/advanced-permissions enterprise/sandbox}}
+
+  query-analysis
+  {:api  #{metabase.query-analysis.core metabase.query-analysis.init}
+   :uses #{config driver legacy-mbql lib public-settings query-processor task util}}
+
+  query-processor
+  {:api #{metabase.query-processor
+          metabase.query-processor.card
+          metabase.query-processor.compile
+          metabase.query-processor.dashboard
+          metabase.query-processor.debug
+          metabase.query-processor.error-type
+          metabase.query-processor.interface
+          metabase.query-processor.metadata
+          metabase.query-processor.middleware.annotate
+          metabase.query-processor.middleware.cache-backend.db
+          metabase.query-processor.middleware.constraints
+          metabase.query-processor.middleware.fetch-source-query
+          metabase.query-processor.middleware.fetch-source-query-legacy
+          metabase.query-processor.middleware.limit
+          metabase.query-processor.middleware.permissions
+          metabase.query-processor.middleware.wrap-value-literals
+          metabase.query-processor.pipeline
+          metabase.query-processor.pivot
+          metabase.query-processor.preprocess
+          metabase.query-processor.reducible
+          metabase.query-processor.schema
+          metabase.query-processor.setup
+          metabase.query-processor.store
+          metabase.query-processor.streaming
+          metabase.query-processor.streaming.common
+          metabase.query-processor.streaming.interface
+          metabase.query-processor.timezone
+          metabase.query-processor.util
+          metabase.query-processor.util.add-alias-info
+          metabase.query-processor.util.nest-query
+          metabase.query-processor.util.persisted-cache
+          metabase.query-processor.util.relative-datetime
+          metabase.query-processor.util.transformations.nest-breakouts
+          metabase.query-processor.writeback}
+   :uses #{analytics
+           analyze
+           api
+           audit
+           config
+           db
+           driver
+           events
+           formatter
+           legacy-mbql
+           lib
+           model-persistence
+           models
+           permissions
+           premium-features
+           public-settings
+           request
+           server
+           types
+           util}}
+
+  request
+  {:api  #{metabase.request.core}
+   :uses #{api config models permissions public-settings util}}
+
+  revisions
+  {:api  #{metabase.revisions.api metabase.revisions.core metabase.revisions.init}
+   :uses #{api config events models util}}
+
+  sample-data
+  {:api  #{metabase.sample-data}
+   :uses #{plugins sync util}}
+
+  search
+  {:api #{metabase.search.api
+          metabase.search.appdb.scoring
+          metabase.search.config
+          metabase.search.core
+          metabase.search.in-place.scoring
+          metabase.search.ingestion
+          metabase.search.init
+          metabase.search.spec}
+   :uses #{analytics api audit config db driver models permissions premium-features public-settings request task util}}
+
+  segments
+  {:api  #{metabase.segments.api}
+   :uses #{api events legacy-mbql lib models permissions search util xrays}}
+
+  server
+  {:api #{metabase.server.core
+          metabase.server.middleware.json
+          metabase.server.middleware.session
+          metabase.server.streaming-response}
+   :uses #{analytics api config core db driver models premium-features public-settings request util enterprise/sso}}
+
+  session
+  {:api  #{metabase.session.api metabase.session.init metabase.session.models.session}
+   :uses #{api channel config db driver events login-history models public-settings request sso task util}}
+
+  setup
+  {:api  #{metabase.setup.api metabase.setup.core}
+   :uses #{analytics
+           api
+           channel
+           config
+           db
+           embed
+           events
+           integrations
+           models
+           permissions
+           premium-features
+           public-settings
+           request
+           session
+           util}}
+
+  sso
+  {:api  #{metabase.sso.api
+           metabase.sso.core
+           metabase.sso.init}
+   :uses #{api models permissions premium-features util}}
+
+  sync
+  {:api #{metabase.sync.api
+          metabase.sync.concurrent
+          metabase.sync.core
+          metabase.sync.init
+          metabase.sync.schedules
+          metabase.sync.task.sync-databases
+          metabase.sync.util}
+   :uses #{analyze api audit config db driver events lib models plugins query-processor task util}}
+
+  task
+  {:api #{metabase.task
+          metabase.task.bootstrap
+          metabase.task.init
+          metabase.task.notification}
+   :uses #{analytics
+           channel
+           config
+           db
+           driver
+           integrations
+           models
+           notification
+           plugins
+           premium-features
+           public-settings
+           query-processor
+           util
+           enterprise/task}}
+
+  tiles
+  {:api  #{metabase.tiles.api
+           metabase.tiles.init}
+   :uses #{api legacy-mbql models query-processor util}}
+
+  timeline
+  {:api  #{metabase.timeline.api metabase.timeline.core}
+   :uses #{analytics api models util}}
+
+  types
+  {:api  #{metabase.types}
+   :uses #{util}}
+
+  upload
+  {:api  #{metabase.upload}
+   :uses #{analytics api driver events legacy-mbql lib model-persistence models permissions public-settings sync util}}
+
+  user-key-value
+  {:api  #{metabase.user-key-value.api metabase.user-key-value.init}
+   :uses #{api config lib util}}
+
+  util
+  {:api :any
+   :uses #{config driver legacy-mbql lib models plugins premium-features public-settings}}
+
+  xrays
+  {:api  #{metabase.xrays.api metabase.xrays.core}
+   :uses #{analyze api db driver legacy-mbql lib models public-settings query-processor util}}
+
+  enterprise/advanced-config
+  {:api  #{metabase-enterprise.advanced-config.api.logs
+           metabase-enterprise.advanced-config.models.pulse-channel
+           metabase-enterprise.advanced-config.file}
+   :uses #{api db driver models premium-features setup sync util}}
+
+  enterprise/advanced-permissions
+  {:api  #{metabase-enterprise.advanced-permissions.api.routes
+           metabase-enterprise.advanced-permissions.api.util
+           metabase-enterprise.advanced-permissions.common
+           metabase-enterprise.advanced-permissions.models.permissions.group-manager}
+   :uses #{api audit driver lib models permissions premium-features query-processor util enterprise/sandbox}}
+
+  enterprise/airgap
+  {:api  #{}
+   :uses #{premium-features util}}
+
+  enterprise/api
+  {:api  #{metabase-enterprise.api.routes
+           metabase-enterprise.api.routes.common}
+   :uses :any}
+
+  enterprise/audit-app
+  {:api  #{metabase-enterprise.audit-app.api.routes}
+   :uses #{api
+           audit
+           db
+           driver
+           lib
+           models
+           permissions
+           plugins
+           premium-features
+           query-processor
+           sync
+           util
+           enterprise/serialization}}
+
+  enterprise/auth-provider
+  {:api  #{}
+   :uses #{premium-features util}}
+
+  enterprise/billing
+  {:api  #{metabase-enterprise.billing.api.routes}
+   :uses #{api premium-features util}}
+
+  enterprise/cache
+  {:api  #{metabase-enterprise.cache.strategies}
+   :uses #{api models premium-features query-processor util}}
+
+  enterprise/content-verification
+  {:api  #{metabase-enterprise.content-verification.api.routes}
+   :uses #{api models moderation util enterprise/api}}
+
+  enterprise/core
+  {:api  #{metabase-enterprise.core.init}
+   :uses #{enterprise/enhancements}}
+
+  enterprise/dashboard-subscription-filters
+  {:api  #{}
+   :uses #{premium-features}}
+
+  enterprise/enhancements
+  {:api  #{metabase-enterprise.enhancements.init}
+   :uses #{models premium-features sso util enterprise/sso}}
+
+  enterprise/llm
+  {:api  #{metabase-enterprise.llm.api}
+   :uses #{analytics analyze api models query-processor util}}
+
+  enterprise/query-reference-validation
+  {:api  #{metabase-enterprise.query-reference-validation.api}
+   :uses #{api models public-settings request util}}
+
+  enterprise/sandbox
+  {:api #{metabase-enterprise.sandbox.api.routes
+          metabase-enterprise.sandbox.api.util}
+   :uses #{api
+           audit
+           db
+           legacy-mbql
+           lib
+           models
+           permissions
+           plugins
+           premium-features
+           query-processor
+           request
+           util
+           enterprise/advanced-permissions
+           enterprise/api}}
+
+  enterprise/scim
+  {:api  #{metabase-enterprise.scim.api metabase-enterprise.scim.routes}
+   :uses #{analytics api models permissions public-settings server util enterprise/serialization}}
+
+  enterprise/search
+  {:api  #{}
+   :uses #{premium-features search}}
+
+  enterprise/serialization
+  {:api #{metabase-enterprise.serialization.api
+          metabase-enterprise.serialization.cmd
+          metabase-enterprise.serialization.v2.backfill-ids}
+   :uses #{analytics api config db legacy-mbql lib logger models plugins premium-features public-settings setup util}}
+
+  enterprise/snippet-collections
+  {:api  #{}
+   :uses #{models permissions premium-features util}}
+
+  enterprise/sso
+  {:api #{metabase-enterprise.sso.api.routes
+          metabase-enterprise.sso.integrations.sso-settings
+          metabase-enterprise.sso.integrations.sso-utils}
+   :uses #{api channel embed events models premium-features public-settings request session sso util enterprise/scim}}
+
+  enterprise/stale
+  {:api  #{metabase-enterprise.stale.routes}
+   :uses #{analytics api embed models premium-features public-settings request util}}
+
+  enterprise/stats
+  {:api  #{}
+   :uses #{driver premium-features enterprise/advanced-config enterprise/scim enterprise/sso}}
+
+  enterprise/task
+  {:api  #{metabase-enterprise.task.truncate-audit-tables}
+   :uses #{premium-features query-processor task util enterprise/cache}}
+
+  enterprise/upload-management
+  {:api  #{metabase-enterprise.upload-management.api}
+   :uses #{api models upload util}}}
+
+ ;; namespaces matching these patterns (with `re-find`) are excluded from the module linter. Since regex literals
+ ;; aren't allowed in EDN just used the `(str <regex>)` version i.e. two slashes instead of one.
+ ;;
+ ;; this is mostly intended for excluding test namespaces or those rare 'glue' namespaces that glue multiple modules
+ ;; together, e.g. `metabase.lib.metadata.jvm`.
+ :linters
+ {:metabase/modules
+  {:ignored-namespace-patterns
+   #{"-test$"                           ; anything ending in `-test`
+     "test[-.]util"                     ; anything that contains `test.util` or `test-util`
+     "test\\.impl"                      ; anything that contains `test.impl`
+     "test-setup"                       ; anything that contains `test-setup`
+     "^metabase(?:-enterprise)?\\.test" ; anything starting with `metabase.test` or `metabase-enterprise.test`
+     "^metabase\\.http-client$"}}}}     ; `metabase.http-client` which is a test-only namespace despite its name.

.clj-kondo/config/test-helpers/config.edn

@@ -0,0 +1,132 @@
+{:linters
+ {:metabase/test-helpers-use-non-thread-safe-functions
+  ;; TODO -- seems silly to maintain different blacklists and whitelists here than we use for the deftest `^:parallel`
+  ;; checker...
+  {:explicitly-safe
+   #{ ;; these toucan methods might actually set global values if it's used outside of a transaction,
+     ;; but since mt/with-temp runs in a transaction, so we'll ignore them in this case.
+     toucan2.core/delete!
+     toucan2.core/update!
+     toucan2.core/insert!
+     toucan2.core/insert-returning-instance!
+     toucan2.core/insert-returning-instances!
+     toucan2.core/insert-returning-pk!
+     toucan2.core/insert-returning-pks!
+     clojure.core.async/<!!
+     clojure.core.async/>!!
+     clojure.core.async/alts!!
+     clojure.core.async/close!
+     clojure.core.async/poll!
+     clojure.core.memoize/memo-clear!
+     clojure.core/conj!
+     clojure.core/persistent!
+     clojure.core/reset!
+     clojure.core/swap!
+     clojure.core/volatile!
+     clojure.core/vreset!
+     clojure.core/vswap!
+     clojure.java.jdbc/execute!
+     methodical.core/add-aux-method-with-unique-key!
+     methodical.core/remove-aux-method-with-unique-key!
+     next.jdbc/execute!
+
+     ;; Definitely thread safe
+     metabase.test.util.dynamic-redefs/patch-vars!
+
+     ;; TODO: most of these symbols shouldn't be here, we should go through them and
+     ;; find the functions/macros that use them and make sure their names end with !
+     ;; best way to do this is try remove each of these and rely on kondo output to find places where it's used
+     clojure.test/grant-collection-perms!
+     clojure.test/grant-collection-perms-fn!
+     clojure.test/grant-perms-fn!
+     clojure.test/purge-old-entries!
+     clojure.test/revoke-collection-perms!
+     clojure.test/save-results!
+     metabase-enterprise.advanced-permissions.models.permissions/update-db-download-permissions!
+     metabase-enterprise.internal-user/install-internal-user!
+     metabase-enterprise.sso.integrations.saml-test/call-with-login-attributes-cleared!
+     metabase.actions.actions/perform-action!
+     metabase.actions.models/insert!
+     metabase.analytics.snowplow-test/fake-track-event-impl!
+     metabase.analytics.snowplow/track-event-impl!
+     metabase.channel.email-test/reset-inbox!
+     metabase.channel.email/send-email!
+     metabase.cmd.dump-to-h2/dump-to-h2!
+     metabase.cmd.load-from-h2/load-from-h2!
+     metabase.core.core/ensure-audit-db-installed!
+     metabase.db.schema-migrations-test.impl/run-migrations-in-range!
+     metabase.db.setup/migrate!
+     metabase.db.setup/setup-db!
+     metabase.db/migrate!
+     metabase.db/setup-db!
+     metabase.driver.mongo-test/create-database-from-row-maps!
+     metabase.driver.postgres-test/create-enums-db!
+     metabase.driver.postgres-test/drop-if-exists-and-create-db!
+     metabase.driver.sql-jdbc.execute/execute-statement!
+     metabase.indexed-entities.models.model-index/add-values!
+     metabase.indexed-entities.task.index-values/job-init!
+     metabase.model-persistence.models.persisted-info/ready-database!
+     metabase.model-persistence.task.persist-refresh/job-init!
+     metabase.model-persistence.task.persist-refresh/refresh-tables!
+     metabase.model-persistence.task.persist-refresh/schedule-persistence-for-database!
+     metabase.models.collection.graph-test/clear-graph-revisions!
+     metabase.models.collection.graph-test/do-with-n-temp-users-with-personal-collections!
+     metabase.models.field-values/create-or-update-full-field-values!
+     metabase.models.moderation-review/create-review!
+     metabase.models.on-demand-test/add-dashcard-with-parameter-mapping!
+     metabase.models.setting-test/test-user-local-allowed-setting!
+     metabase.models.setting-test/test-user-local-only-setting!
+     metabase.models.setting.cache/restore-cache!
+     metabase.models.setting/set!
+     metabase.models.setting/validate-settings-formatting!
+     metabase.permissions.models.permissions/grant-application-permissions!
+     metabase.permissions.models.permissions/grant-collection-read-permissions!
+     metabase.permissions.models.permissions/grant-collection-readwrite-permissions!
+     metabase.permissions.models.permissions/grant-full-data-permissions!
+     metabase.permissions.models.permissions/grant-native-readwrite-permissions!
+     metabase.permissions.models.permissions/grant-permissions!
+     metabase.permissions.models.permissions/revoke-application-permissions!
+     metabase.permissions.models.permissions/revoke-data-perms!
+     metabase.permissions.models.permissions/update-data-perms-graph!
+     metabase.permissions.models.permissions/update-group-permissions!
+     metabase.permissions.test-util/with-restored-perms!
+     metabase.public-sharing.api-test/add-card-to-dashboard!
+     metabase.pulse.send/send-notifications!
+     metabase.pulse.send/send-pulse!
+     metabase.query-processor.streaming.interface/begin!
+     metabase.query-processor.streaming.interface/finish!
+     metabase.query-processor.streaming.interface/write-row!
+     metabase.sample-data/try-to-extract-sample-database!
+     metabase.setup.core/create-token!
+     metabase.sso.ldap-test-util/start-ldap-server!
+     metabase.sync.core/sync-database!
+     metabase.sync.sync-metadata.fields.sync-metadata/update-field-metadata-if-needed!
+     metabase.sync.sync-metadata/sync-db-metadata!
+     metabase.sync.util-test/sync-database!
+     metabase.sync.util/store-sync-summary!
+     metabase.task/delete-task!
+     metabase.test.data.bigquery-cloud-sdk/execute!
+     metabase.test.data.impl.get-or-create/set-test-db-permissions!
+     metabase.test.data.impl/copy-db-tables-and-fields!
+     metabase.test.data.impl/get-or-create-database!
+     metabase.test.data.impl/get-or-create-default-dataset!
+     metabase.test.data.interface/create-db!
+     metabase.test.data.interface/destroy-db!
+     metabase.test.data.oracle/create-user!
+     metabase.test.data.oracle/drop-user!
+     metabase.test.data.sql-jdbc.load-data/make-insert!
+     metabase.test.data.users/clear-cached-session-tokens!
+     metabase.test.initialize/do-initialization!
+     metabase.test.initialize/initialize-if-needed!
+     metabase.test.util.log/ensure-unique-logger!
+     metabase.test.util.log/set-ns-log-level!
+     metabase.test.util/do-with-temp-env-var-value!
+     metabase.test.util/restore-raw-setting!
+     metabase.test.util/upsert-raw-setting!
+     metabase.test/initialize-if-needed!
+     metabase.test/test-helpers-set-global-values!
+     metabase.test/with-temp-env-var-value!
+     metabase.upload-test/set-local-infile!
+     metabase.util.files/create-dir-if-not-exists!
+     metabase.util.ssh-test/start-mock-servers!
+     metabase.util.ssh-test/stop-mock-servers!}}}}

.clj-kondo/macros/metabase/api/common.clj

@@ -1,7 +0,0 @@
-(ns macros.metabase.api.common)
-
-(defmacro define-routes
-  "Macro for api.common/define-routes"
-  [& args]
-  `(do (def ~'routes "docstring" nil)
-       ~@args))

.clj-kondo/macros/metabase/api/public_test.clj

@@ -1,13 +0,0 @@
-(ns macros.metabase.api.public-test)
-
-(defmacro with-sharing-enabled-and-temp-card-referencing!
-  [table-kw field-kw [card-binding] & body]
-  `(let [~card-binding [~table-kw ~field-kw]]
-     ~@body))
-
-(defmacro with-sharing-enabled-and-temp-dashcard-referencing!
-  [table-kw field-kw [dash-binding card-binding dashcard-binding] & body]
-  `(let [~dash-binding             [~table-kw ~field-kw]
-         ~(or card-binding '_)     nil
-         ~(or dashcard-binding '_) nil]
-     ~@body))

.clj-kondo/macros/metabase/public_sharing/api_test.clj

@@ -0,0 +1,13 @@
+(ns macros.metabase.public-sharing.api-test)
+
+(defmacro with-sharing-enabled-and-temp-card-referencing!
+  [table-kw field-kw [card-binding] & body]
+  `(let [~card-binding [~table-kw ~field-kw]]
+     ~@body))
+
+(defmacro with-sharing-enabled-and-temp-dashcard-referencing!
+  [table-kw field-kw [dash-binding card-binding dashcard-binding] & body]
+  `(let [~dash-binding             [~table-kw ~field-kw]
+         ~(or card-binding '_)     nil
+         ~(or dashcard-binding '_) nil]
+     ~@body))

.clj-kondo/macros/metabase/query_analysis/task/test_setup.clj

@@ -0,0 +1,13 @@
+(ns macros.metabase.query-analysis.task.test-setup
+  (:require [macros.common]))
+
+(defmacro with-test-setup!
+  "Set up the data required to test the Query Analysis related tasks"
+  [& body]
+  `(let [~(macros.common/ignore-unused 'c1) 1
+         ~(macros.common/ignore-unused 'c2) 2
+         ~(macros.common/ignore-unused 'c3) 3
+         ~(macros.common/ignore-unused 'c4) 4
+         ~(macros.common/ignore-unused 'archived) 5
+         ~(macros.common/ignore-unused 'invalid) 6]
+     ~@body))

.clj-kondo/macros/metabase/related_test.clj

@@ -1,13 +0,0 @@
-(ns macros.metabase.related-test
-  (:require [macros.common]))
-
-(defmacro with-world [& body]
-  `(let [~(macros.common/ignore-unused 'collection-id) nil
-         ~(macros.common/ignore-unused 'metric-id-a) nil
-         ~(macros.common/ignore-unused 'metric-id-b) nil
-         ~(macros.common/ignore-unused 'segment-id-a) nil
-         ~(macros.common/ignore-unused 'segment-id-b) nil
-         ~(macros.common/ignore-unused 'card-id-a) nil
-         ~(macros.common/ignore-unused 'card-id-b) nil
-         ~(macros.common/ignore-unused 'card-id-c) nil]
-     ~@body))

.clj-kondo/macros/metabase/task/setup/query_analysis_setup.clj

@@ -1,13 +0,0 @@
-(ns macros.metabase.task.setup.query-analysis-setup
-  (:require [macros.common]))
-
-(defmacro with-test-setup!
-  "Set up the data required to test the Query Analysis related tasks"
-  [& body]
-  `(let [~(macros.common/ignore-unused 'c1) 1
-         ~(macros.common/ignore-unused 'c2) 2
-         ~(macros.common/ignore-unused 'c3) 3
-         ~(macros.common/ignore-unused 'c4) 4
-         ~(macros.common/ignore-unused 'archived) 5
-         ~(macros.common/ignore-unused 'invalid) 6]
-     ~@body))

.clj-kondo/macros/metabase/test/persistence.clj

@@ -1,5 +0,0 @@
-(ns macros.metabase.test.persistence)
-
-(defmacro with-persistence-enabled! [[persist-fn-sym] & body]
-  `(clojure.core/let [~persist-fn-sym (fn [])]
-     ~@body))

.clj-kondo/macros/metabase/xrays/related_test.clj

@@ -0,0 +1,13 @@
+(ns macros.metabase.xrays.related-test
+  (:require [macros.common]))
+
+(defmacro with-world [& body]
+  `(let [~(macros.common/ignore-unused 'collection-id) nil
+         ~(macros.common/ignore-unused 'metric-id-a) nil
+         ~(macros.common/ignore-unused 'metric-id-b) nil
+         ~(macros.common/ignore-unused 'segment-id-a) nil
+         ~(macros.common/ignore-unused 'segment-id-b) nil
+         ~(macros.common/ignore-unused 'card-id-a) nil
+         ~(macros.common/ignore-unused 'card-id-b) nil
+         ~(macros.common/ignore-unused 'card-id-c) nil]
+     ~@body))

.clj-kondo/src/hooks/clojure/core.clj

@@ -1,329 +0,0 @@
-(ns hooks.clojure.core
-  (:require
-   [clj-kondo.hooks-api :as hooks]
-   [clojure.string :as str]
-   [hooks.common]))
-
-;;; TODO -- seems silly to maintain different blacklists and whitelists here than we use for the deftest `^:parallel`
-;;; checker... those lists live in the Clj Kondo config file
-(def ^:private symbols-allowed-in-fns-not-ending-in-an-exclamation-point
-  '#{;; these toucan methods might actually set global values if it's used outside of a transaction,
-     ;; but since mt/with-temp runs in a transaction, so we'll ignore them in this case.
-     toucan2.core/delete!
-     toucan2.core/update!
-     toucan2.core/insert!
-     toucan2.core/insert-returning-instance!
-     toucan2.core/insert-returning-instances!
-     toucan2.core/insert-returning-pk!
-     toucan2.core/insert-returning-pks!
-     clojure.core.async/<!!
-     clojure.core.async/>!!
-     clojure.core.async/alts!!
-     clojure.core.async/close!
-     clojure.core.async/poll!
-     clojure.core.memoize/memo-clear!
-     clojure.core/conj!
-     clojure.core/persistent!
-     clojure.core/reset!
-     clojure.core/swap!
-     clojure.core/volatile!
-     clojure.core/vreset!
-     clojure.core/vswap!
-     clojure.java.jdbc/execute!
-     methodical.core/add-aux-method-with-unique-key!
-     methodical.core/remove-aux-method-with-unique-key!
-     next.jdbc/execute!
-
-     ;; Definitely thread safe
-     metabase.test.util.dynamic-redefs/patch-vars!
-
-     ;; TODO: most of these symbols shouldn't be here, we should go through them and
-     ;; find the functions/macros that use them and make sure their names end with !
-     ;; best way to do this is try remove each of these and rely on kondo output to find places where it's used
-     clojure.test/grant-collection-perms!
-     clojure.test/grant-collection-perms-fn!
-     clojure.test/grant-perms-fn!
-     clojure.test/purge-old-entries!
-     clojure.test/revoke-collection-perms!
-     clojure.test/save-results!
-     metabase-enterprise.advanced-permissions.models.permissions/update-db-download-permissions!
-     metabase-enterprise.internal-user/install-internal-user!
-     metabase-enterprise.sso.integrations.saml-test/call-with-login-attributes-cleared!
-     metabase.actions/perform-action!
-     metabase.analytics.snowplow-test/fake-track-event-impl!
-     metabase.analytics.snowplow/track-event-impl!
-     metabase.api.public-test/add-card-to-dashboard!
-     metabase.cmd.dump-to-h2/dump-to-h2!
-     metabase.cmd.load-from-h2/load-from-h2!
-     metabase.core/ensure-audit-db-installed!
-     metabase.db.schema-migrations-test.impl/run-migrations-in-range!
-     metabase.db.setup/migrate!
-     metabase.db.setup/setup-db!
-     metabase.db/migrate!
-     metabase.db/setup-db!
-     metabase.driver.mongo-test/create-database-from-row-maps!
-     metabase.driver.postgres-test/create-enums-db!
-     metabase.driver.postgres-test/drop-if-exists-and-create-db!
-     metabase.driver.sql-jdbc.execute/execute-statement!
-     metabase.email-test/reset-inbox!
-     metabase.email/send-email!
-     metabase.models.action/insert!
-     metabase.models.collection.graph-test/clear-graph-revisions!
-     metabase.models.collection.graph-test/do-with-n-temp-users-with-personal-collections!
-     metabase.models.field-values/create-or-update-full-field-values!
-     metabase.models.model-index/add-values!
-     metabase.models.moderation-review/create-review!
-     metabase.models.on-demand-test/add-dashcard-with-parameter-mapping!
-     metabase.models.permissions/grant-application-permissions!
-     metabase.models.permissions/grant-collection-read-permissions!
-     metabase.models.permissions/grant-collection-readwrite-permissions!
-     metabase.models.permissions/grant-full-data-permissions!
-     metabase.models.permissions/grant-native-readwrite-permissions!
-     metabase.models.permissions/grant-permissions!
-     metabase.models.permissions/revoke-application-permissions!
-     metabase.models.permissions/revoke-data-perms!
-     metabase.models.permissions/update-data-perms-graph!
-     metabase.models.permissions/update-group-permissions!
-     metabase.models.persisted-info/ready-database!
-     metabase.models.setting-test/test-user-local-allowed-setting!
-     metabase.models.setting-test/test-user-local-only-setting!
-     metabase.models.setting.cache/restore-cache!
-     metabase.models.setting/set!
-     metabase.models.setting/validate-settings-formatting!
-     metabase.permissions.test-util/with-restored-perms!
-     metabase.pulse/send-notifications!
-     metabase.pulse/send-pulse!
-     metabase.query-processor.streaming.interface/begin!
-     metabase.query-processor.streaming.interface/finish!
-     metabase.query-processor.streaming.interface/write-row!
-     metabase.sample-data/try-to-extract-sample-database!
-     metabase.setup/create-token!
-     metabase.sync.sync-metadata.fields.sync-metadata/update-field-metadata-if-needed!
-     metabase.sync.sync-metadata/sync-db-metadata!
-     metabase.sync.util-test/sync-database!
-     metabase.sync.util/store-sync-summary!
-     metabase.sync/sync-database!
-     metabase.task.index-values/job-init!
-     metabase.task.persist-refresh/job-init!
-     metabase.task.persist-refresh/refresh-tables!
-     metabase.task.persist-refresh/schedule-persistence-for-database!
-     metabase.task/delete-task!
-     metabase.test.data.bigquery-cloud-sdk/execute!
-     metabase.test.data.impl/copy-db-tables-and-fields!
-     metabase.test.data.impl/get-or-create-database!
-     metabase.test.data.impl/get-or-create-default-dataset!
-     metabase.test.data.impl.get-or-create/set-test-db-permissions!
-     metabase.test.data.interface/create-db!
-     metabase.test.data.interface/destroy-db!
-     metabase.test.data.oracle/create-user!
-     metabase.test.data.oracle/drop-user!
-     metabase.test.data.sql-jdbc.load-data/make-insert!
-     metabase.test.data.users/clear-cached-session-tokens!
-     metabase.test.initialize/do-initialization!
-     metabase.test.initialize/initialize-if-needed!
-     metabase.test.integrations.ldap/start-ldap-server!
-     metabase.test.util.log/ensure-unique-logger!
-     metabase.test.util.log/set-ns-log-level!
-     metabase.test.util/do-with-temp-env-var-value!
-     metabase.test.util/restore-raw-setting!
-     metabase.test.util/upsert-raw-setting!
-     metabase.test/initialize-if-needed!
-     metabase.test/test-helpers-set-global-values!
-     metabase.test/with-temp-env-var-value!
-     metabase.upload-test/set-local-infile!
-     metabase.util.files/create-dir-if-not-exists!
-     metabase.util.ssh-test/start-mock-servers!
-     metabase.util.ssh-test/stop-mock-servers!})
-
-(defn- end-with-exclamation?
-  [s]
-  (str/ends-with? s "!"))
-
-(defn- explicitly-safe? [qualified-symbol]
-  (contains? symbols-allowed-in-fns-not-ending-in-an-exclamation-point qualified-symbol))
-
-(defn- explicitly-unsafe? [config qualified-symbol]
-  (contains? (get-in config [:linters :metabase/validate-deftest :parallel/unsafe]) qualified-symbol))
-
-(defn- unsafe? [config qualified-symbol]
-  (and (or (end-with-exclamation? qualified-symbol)
-           (explicitly-unsafe? config qualified-symbol))
-       (not (explicitly-safe? qualified-symbol))))
-
-(defn- non-thread-safe-form-should-end-with-exclamation*
-  [{[defn-or-defmacro form-name] :children, :as node} config]
-  (when-not (and (:string-value form-name)
-                 (end-with-exclamation? (:string-value form-name)))
-    (letfn [(walk [f form]
-              (f form)
-              (doseq [child (:children form)]
-                (walk f child)))
-            (check-node [form]
-              (when-let [qualified-symbol (hooks.common/node->qualified-symbol form)]
-                (when (unsafe? config qualified-symbol)
-                  (hooks/reg-finding!
-                   (assoc (meta form-name)
-                          :message (format "The name of this %s should end with `!` because it contains calls to non thread safe form `%s`. [:metabase/test-helpers-use-non-thread-safe-functions]"
-                                           (:string-value defn-or-defmacro) qualified-symbol)
-                          :type :metabase/test-helpers-use-non-thread-safe-functions)))))]
-      (walk check-node node))
-    node))
-
-(defn non-thread-safe-form-should-end-with-exclamation
-  "Used to ensure defn and defmacro in test namespace to have name ending with `!` if it's non-thread-safe.
-  A function or a macro can be defined as 'not thread safe' when their funciton name ends with a `!`.
-
-  Only used in tests to identify thread-safe/non-thread-safe test helpers. See #37126"
-  [{:keys [node cljc lang config]}]
-  (when (or (not cljc)
-            (= lang :clj))
-    (non-thread-safe-form-should-end-with-exclamation* node config))
-  {:node node})
-
-(comment
-  (require '[clj-kondo.core :as clj-kondo])
-  (def form (str '(defmacro a
-                    [x]
-                    `(fun-call x))))
-
-  (def form "(defmacro a
-           [x]
-           `(some! ~x))")
-
-  (def form "(defun f
-           [x]
-           (let [g! (fn [] 1)]
-           (g!)))")
-
-  (str (hooks/parse-string form))
-  (hooks/sexpr (hooks/parse-string form))
-
-  (binding [hooks/*reload* true]
-    (-> form
-        (with-in-str (clj-kondo/run! {:lint ["-"]}))
-        :findings))
-
-  (do (non-thread-safe-form-should-end-with-exclamation* (hooks/parse-string form)) nil))
-
-(defn- ns-form-node->require-node [ns-form-node]
-  (some (fn [node]
-          (when (and (hooks/list-node? node)
-                     (let [first-child (first (:children node))]
-                       (and (hooks/keyword-node? first-child)
-                            (= (hooks/sexpr first-child) :require))))
-            node))
-        (:children ns-form-node)))
-
-(defn- lint-require-shapes [ns-form-node]
-  (doseq [node (-> ns-form-node
-                   ns-form-node->require-node
-                   :children
-                   rest)]
-    (cond
-      (not (hooks/vector-node? node))
-      (hooks/reg-finding! (assoc (meta node)
-                                 :message "All :required namespaces should be wrapped in vectors [:metabase/require-shape-checker]"
-                                 :type    :metabase/require-shape-checker))
-
-      (hooks/vector-node? (second (:children node)))
-      (hooks/reg-finding! (assoc (meta node)
-                                 :message "Don't use prefix forms inside :require [:metabase/require-shape-checker]"
-                                 :type    :metabase/require-shape-checker)))))
-
-(defn- require-node->namespace-symb-nodes [require-node]
-  (let [[_ns & args] (:children require-node)]
-    (into []
-          ;; prefixed namespace forms are NOT SUPPORTED!!!!!!!!1
-          (keep (fn [node]
-                  (cond
-                    (hooks/vector-node? node)
-                    ;; propagate the metadata attached to this vector in case there's a `:clj-kondo/ignore` form.
-                    (vary-meta (first (:children node)) (partial merge (meta require-node) (meta node)))
-
-                    ;; this should also be dead code since we require requires to be vectors
-                    (hooks/token-node? node)
-                    (vary-meta node (partial merge (meta require-node)))
-
-                    :else
-                    (printf "Don't know how to figure out what namespace is being required in %s\n" (pr-str node)))))
-          args)))
-
-(defn- ns-form-node->ns-symb [ns-form-node]
-  (some-> (some (fn [node]
-                  (when (and (hooks/token-node? node)
-                             (not= (hooks/sexpr node) 'ns))
-                    node))
-                (:children ns-form-node))
-          hooks/sexpr))
-
-(defn- module
-  "E.g.
-
-    (module 'metabase.qp.middleware.wow) => 'metabase.qp"
-  [ns-symb]
-  (some-> (re-find #"^metabase\.[^.]+" (str ns-symb)) symbol))
-
-(defn- ignored-namespace? [ns-symb config]
-  (some
-   (fn [pattern-str]
-     (re-find (re-pattern pattern-str) (str ns-symb)))
-   (:ignored-namespace-patterns config)))
-
-(defn- module-api-namespaces
-  "Set API namespaces for a given module. `:any` means you can use anything, there are no API namespaces for this
-  module (yet). If unspecified, the default is just the namespace with the same name as the module e.g.
-  `metabase.db`."
-  [module config]
-  (let [module-config (get-in config [:api-namespaces module])]
-    (cond
-      (= module-config :any)
-      nil
-
-      (set? module-config)
-      module-config
-
-      :else
-      #{module})))
-
-(defn- lint-modules [ns-form-node config]
-  (let [ns-symb (ns-form-node->ns-symb ns-form-node)]
-    (when-not (ignored-namespace? ns-symb config)
-      (when-let [current-module (module ns-symb)]
-        (let [allowed-modules               (get-in config [:allowed-modules current-module])
-              required-namespace-symb-nodes (-> ns-form-node
-                                                ns-form-node->require-node
-                                                require-node->namespace-symb-nodes)]
-          (doseq [node  required-namespace-symb-nodes
-                  :let  [clj-kondo-ignore (some-> (meta node) :clj-kondo/ignore hooks/sexpr set)]
-                  :when (not (contains? clj-kondo-ignore :metabase/ns-module-checker))
-                  :let  [required-namespace (hooks/sexpr node)
-                         required-module    (module required-namespace)]
-                  ;; ignore stuff not in a module i.e. non-Metabase stuff.
-                  :when required-module
-                  :let  [in-current-module? (= required-module current-module)]
-                  :when (not in-current-module?)
-                  :let  [allowed-module?           (or (= allowed-modules :any)
-                                                       (contains? (set allowed-modules) required-module))
-                         module-api-namespaces     (module-api-namespaces required-module config)
-                         allowed-module-namespace? (or (empty? module-api-namespaces)
-                                                       (contains? module-api-namespaces required-namespace))]]
-            (when-let [error (cond
-                               (not allowed-module?)
-                               (format "Module %s should not be used in the %s module. [:metabase/ns-module-checker :allowed-modules %s]"
-                                       required-module
-                                       current-module
-                                       current-module)
-
-                               (not allowed-module-namespace?)
-                               (format "Namespace %s is not an allowed external API namespace for the %s module. [:metabase/ns-module-checker :api-namespaces %s]"
-                                       required-namespace
-                                       required-module
-                                       required-module))]
-              (hooks/reg-finding! (assoc (meta node)
-                                         :message error
-                                         :type    :metabase/ns-module-checker)))))))))
-
-(defn lint-ns [x]
-  (lint-require-shapes (:node x))
-  (lint-modules (:node x) (get-in x [:config :linters :metabase/ns-module-checker]))
-  x)

.clj-kondo/src/hooks/clojure/core/defmulti.clj

@@ -0,0 +1,52 @@
+(ns hooks.clojure.core.defmulti
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]
+   [hooks.common]))
+
+(defn- check-arglists [report-node arglists]
+  (letfn [(reg-bad-arglists! []
+            (hooks/reg-finding!
+             (assoc (meta report-node)
+                    :message ":arglists should be a quoted list of vectors [:metabase/check-defmulti-arglists]"
+                    :type :metabase/check-defmulti-arglists)))
+          (reg-bad-arg! []
+            (hooks/reg-finding!
+             (assoc (meta report-node)
+                    :message ":arglists should contain actual arg names, not underscore (unused) symbols [:metabase/check-defmulti-arglists]"
+                    :type    :metabase/check-defmulti-arglists)))
+          (underscore-arg? [arg]
+            (and (symbol? arg)
+                 (str/starts-with? arg "_")))
+          (check-arglist [arglist]
+            (cond
+              (not (vector? arglist))        (reg-bad-arglists!)
+              (some underscore-arg? arglist) (reg-bad-arg!)))]
+    (if-not (and (seq? arglists)
+                 (= (first arglists) 'quote)
+                 (seq (second arglists)))
+      (reg-bad-arglists!)
+      (let [[_quote arglists] arglists]
+        (doseq [arglist arglists]
+          (check-arglist arglist))))))
+
+(defn- defmulti-check-for-arglists-metadata
+  "Make sure a [[defmulti]] has an attribute map with `:arglists` metadata."
+  [node]
+  (let [[_defmulti _symb & args] (:children node)
+        [_docstring & args]      (if (hooks/string-node? (first args))
+                                   args
+                                   (cons nil args))
+        attr-map                 (when (hooks/map-node? (first args))
+                                   (first args))
+        arglists                 (some-> attr-map hooks/sexpr :arglists seq)]
+    (if-not (seq? arglists) ; should be a list or at least list-like
+      (hooks/reg-finding!
+       (assoc (meta node)
+              :message "All defmultis should have an attribute map with :arglists metadata. [:metabase/check-defmulti-arglists]"
+              :type    :metabase/check-defmulti-arglists))
+      (check-arglists attr-map arglists))))
+
+(defn lint-defmulti [x]
+  (defmulti-check-for-arglists-metadata (:node x))
+  x)

.clj-kondo/src/hooks/clojure/core/defn.clj

@@ -0,0 +1,76 @@
+(ns hooks.clojure.core.defn
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]
+   [hooks.common]))
+
+(defn- end-with-exclamation?
+  [s]
+  (str/ends-with? s "!"))
+
+(defn- explicitly-safe? [config qualified-symbol]
+  (contains? (get-in config [:linters :metabase/test-helpers-use-non-thread-safe-functions :explicitly-safe])
+             qualified-symbol))
+
+(defn- explicitly-unsafe? [config qualified-symbol]
+  (contains? (get-in config [:linters :metabase/validate-deftest :parallel/unsafe]) qualified-symbol))
+
+(defn- unsafe? [config qualified-symbol]
+  (and (or (end-with-exclamation? qualified-symbol)
+           (explicitly-unsafe? config qualified-symbol))
+       (not (explicitly-safe? config qualified-symbol))))
+
+(defn- non-thread-safe-form-should-end-with-exclamation*
+  [{[defn-or-defmacro form-name] :children, :as node} config]
+  (when-not (and (:string-value form-name)
+                 (end-with-exclamation? (:string-value form-name)))
+    (letfn [(walk [f form]
+              (f form)
+              (doseq [child (:children form)]
+                (walk f child)))
+            (check-node [form]
+              (when-let [qualified-symbol (hooks.common/node->qualified-symbol form)]
+                (when (unsafe? config qualified-symbol)
+                  (hooks/reg-finding!
+                   (assoc (meta form-name)
+                          :message (format "The name of this %s should end with `!` because it contains calls to non thread safe form `%s`. [:metabase/test-helpers-use-non-thread-safe-functions]"
+                                           (:string-value defn-or-defmacro) qualified-symbol)
+                          :type :metabase/test-helpers-use-non-thread-safe-functions)))))]
+      (walk check-node node))
+    node))
+
+(defn non-thread-safe-form-should-end-with-exclamation
+  "Used to ensure defn and defmacro in test namespace to have name ending with `!` if it's non-thread-safe.
+  A function or a macro can be defined as 'not thread safe' when their funciton name ends with a `!`.
+
+  Only used in tests to identify thread-safe/non-thread-safe test helpers. See #37126"
+  [{:keys [node cljc lang config]}]
+  (when (or (not cljc)
+            (= lang :clj))
+    (non-thread-safe-form-should-end-with-exclamation* node config))
+  {:node node})
+
+(comment
+  (require '[clj-kondo.core :as clj-kondo])
+  (def form (str '(defmacro a
+                    [x]
+                    `(fun-call x))))
+
+  (def form "(defmacro a
+           [x]
+           `(some! ~x))")
+
+  (def form "(defun f
+           [x]
+           (let [g! (fn [] 1)]
+           (g!)))")
+
+  (str (hooks/parse-string form))
+  (hooks/sexpr (hooks/parse-string form))
+
+  (binding [hooks/*reload* true]
+    (-> form
+        (with-in-str (clj-kondo/run! {:lint ["-"]}))
+        :findings))
+
+  (do (non-thread-safe-form-should-end-with-exclamation* (hooks/parse-string form)) nil))

.clj-kondo/src/hooks/clojure/core/ns.clj

@@ -0,0 +1,91 @@
+(ns hooks.clojure.core.ns
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common]
+   [hooks.common.modules :as modules]))
+
+(defn- ns-form-node->require-node [ns-form-node]
+  (some (fn [node]
+          (when (and (hooks/list-node? node)
+                     (let [first-child (first (:children node))]
+                       (and (hooks/keyword-node? first-child)
+                            (= (hooks/sexpr first-child) :require))))
+            node))
+        (:children ns-form-node)))
+
+(defn- lint-require-shapes [ns-form-node]
+  (doseq [node (-> ns-form-node
+                   ns-form-node->require-node
+                   :children
+                   rest)]
+    (cond
+      (not (hooks/vector-node? node))
+      (hooks/reg-finding! (assoc (meta node)
+                                 :message "All :required namespaces should be wrapped in vectors [:metabase/require-shape-checker]"
+                                 :type    :metabase/require-shape-checker))
+
+      (hooks/vector-node? (second (:children node)))
+      (hooks/reg-finding! (assoc (meta node)
+                                 :message "Don't use prefix forms inside :require [:metabase/require-shape-checker]"
+                                 :type    :metabase/require-shape-checker)))))
+
+(defn- lint-requires-on-new-lines [ns-form-node]
+  (let [[require-keyword first-require] (-> ns-form-node
+                                            ns-form-node->require-node
+                                            :children)]
+    (when-let [require-keyword-line (:row (meta require-keyword))]
+      (when-let [first-require-line (:row (meta first-require))]
+        (when (= require-keyword-line first-require-line)
+          (hooks/reg-finding! (assoc (meta first-require)
+                                     :message "Put your requires on a newline from the :require keyword [:metabase/require-shape-checker]"
+                                     :type    :metabase/require-shape-checker)))))))
+
+(defn- require-node->namespace-symb-nodes [require-node]
+  (let [[_ns & args] (:children require-node)]
+    (into []
+          ;; prefixed namespace forms are NOT SUPPORTED!!!!!!!!1
+          (keep (fn [node]
+                  (cond
+                    (hooks/vector-node? node)
+                    ;; propagate the metadata attached to this vector in case there's a `:clj-kondo/ignore` form.
+                    (let [symbol-node (first (:children node))]
+                      (hooks.common/merge-ignored-linters symbol-node require-node node))
+
+                    ;; this should also be dead code since we require requires to be vectors
+                    (hooks/token-node? node)
+                    (hooks.common/merge-ignored-linters node require-node)
+
+                    :else
+                    (printf "Don't know how to figure out what namespace is being required in %s\n" (pr-str node)))))
+          args)))
+
+(defn- ns-form-node->ns-symb [ns-form-node]
+  (some-> (some (fn [node]
+                  (when (and (hooks/token-node? node)
+                             (not= (hooks/sexpr node) 'ns))
+                    node))
+                (:children ns-form-node))
+          hooks/sexpr))
+
+(defn- lint-modules [ns-form-node config]
+  (let [ns-symb (ns-form-node->ns-symb ns-form-node)]
+    (when-not (modules/ignored-namespace? config ns-symb)
+      (when-let [current-module (modules/module ns-symb)]
+        (let [required-namespace-symb-nodes (-> ns-form-node
+                                                ns-form-node->require-node
+                                                require-node->namespace-symb-nodes)]
+          (doseq [node  required-namespace-symb-nodes
+                  :when (not (contains? (hooks.common/ignored-linters node) :metabase/modules))
+                  :let  [required-namespace (hooks/sexpr node)
+                         error              (modules/usage-error config current-module required-namespace)]
+                  :when error]
+            (hooks/reg-finding! (assoc (meta node)
+                                       :message error
+                                       :type    :metabase/modules))))))))
+
+(defn lint-ns [x]
+  (doto (:node x)
+    lint-require-shapes
+    lint-requires-on-new-lines
+    (lint-modules (modules/config x)))
+  x)

.clj-kondo/src/hooks/clojure/core/require.clj

@@ -0,0 +1,69 @@
+(ns hooks.clojure.core.require
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common.modules :as modules]))
+
+(defn- lint* [node current-ns config required-namespaces]
+  {:pre [(map? node)
+         (simple-symbol? current-ns)
+         (map? config)
+         (sequential? required-namespaces)
+         (every? simple-symbol? required-namespaces)]}
+  (when-not (modules/ignored-namespace? config current-ns)
+    ;; ignore namespaces outside of the module system
+    (when-let [current-module (modules/module current-ns)]
+      (doseq [required-namespace required-namespaces]
+        ;; ignore namespaces outside of the module system.
+        (when (modules/module required-namespace)
+          (when-let [error (modules/usage-error config current-module required-namespace)]
+            (hooks/reg-finding! (assoc (meta node)
+                                       :message error
+                                       :type    :metabase/modules))))))))
+
+(defn- unwrap-require [node]
+  (case (hooks/tag node)
+    ;; some.namespace of some.namespace/some-var
+    :token
+    (let [sexpr (hooks/sexpr node)]
+      (if (qualified-symbol? sexpr)
+        (symbol (namespace sexpr))
+        sexpr))
+
+    ;; (quote some.namespace)
+    :list
+    (let [[x y] (:children node)]
+      (when (and (hooks/token-node? x)
+                 (= (hooks/sexpr x) 'quote))
+        (recur y)))
+
+    ;; 'some.namespace
+    :quote
+    (recur (first (:children node)))
+
+    ;; something like [some.namespace :as whatever]
+    :vector
+    (recur (first (:children node)))))
+
+(comment
+  (unwrap-require (-> "(requiring-resolve 'metabase.notification.payload.execute/execute-dashboard)"
+                      hooks/parse-string
+                      :children
+                      second)))
+
+(defn- lint-require* [node current-ns config]
+  (let [[_require & args]   (:children node)
+        required-namespaces (keep unwrap-require args)]
+    (lint* node current-ns config required-namespaces)))
+
+(defn- lint-requiring-resolve* [node current-ns config]
+  (let [[_requiring-resolve symb-node] (:children node)
+        required-namespace             (unwrap-require symb-node)]
+    (lint* node current-ns config [required-namespace])))
+
+(defn lint-require [x]
+  (lint-require* (:node x) (:ns x) (modules/config x))
+  x)
+
+(defn lint-requiring-resolve [x]
+  (lint-requiring-resolve* (:node x) (:ns x) (modules/config x))
+  x)

.clj-kondo/src/hooks/clojure/test.clj

@@ -71,11 +71,7 @@
                                      :type :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests)))))))
 
 (defn- ignore? [node error-type]
-  (when-let [ignores (some-> node meta :clj-kondo/ignore hooks/sexpr)]
-    (when-let [ignores (cond
-                         (coll? ignores)    (set ignores)
-                         (keyword? ignores) #{ignores})]
-      (contains? ignores error-type))))
+  (contains? (hooks.common/ignored-linters node) error-type))
 
 (defn deftest-check-no-driver-keywords [node {:keys [drivers], :as _config}]
   ;; fail fast after we see the first error, where we see one hardcoded driver name there are likely several more and we

.clj-kondo/src/hooks/common.clj

@@ -1,7 +1,8 @@
 (ns hooks.common
   (:require
    [clj-kondo.hooks-api :as hooks]
-   [clojure.pprint]))
+   [clojure.pprint]
+   [clojure.set :as set]))
 
 (defn with-macro-meta
   "When introducing internal nodes (let, defn, etc) it is important to provide a meta of an existing token
@@ -9,10 +10,83 @@
   [new-node hook-node]
   (with-meta new-node (meta (first (:children hook-node)))))
 
+;;; Kondo stores information about ignored linters as rewrite-clj forms matching how they are specified in the code, so
+;;; either
+;;;
+;;;    <vector-node [<token-node :discouraged-namespace>]>
+;;;
+;;; or
+;;;
+;;;    <token-node :discouraged-namespace>
+;;;
+;;; these are stored in
+;;;
+;;;     (-> node meta :clj-kondo/ignore :linters).
+;;;
+;;; These are not a convenient shape(s) to work with, so the next few functions abstract that shape out and work with a
+;;; set of keywords like
+;;;
+;;;    #{:discouraged-namespace}
+;;;
+;;; instead.
+
+(defn- unwrap-ignored-linters [linters]
+  (cond
+    (or (hooks/vector-node? linters)
+        (hooks/list-node? linters))
+    (into #{}
+          (map hooks/sexpr)
+          (:children linters))
+
+    (hooks/keyword-node? linters)
+    #{(hooks/sexpr linters)}
+
+    (and (set? linters)
+         (every? keyword? linters))
+    linters
+
+    (and (sequential? linters)
+         (every? keyword? linters))
+    (into #{} linters)
+
+    (keyword? linters)
+    #{linters}))
+
+(defn- wrap-ignored-linters [linters]
+  (hooks/vector-node (mapv hooks/keyword-node linters)))
+
+(defn ignored-linters
+  "Return a set of keywords all ignored linters associated with a node by looking at its metadata."
+  [node]
+  (or (some-> node meta :clj-kondo/ignore :linters unwrap-ignored-linters)
+      ;; deal with the old pre-2024.09 shape mentioned in https://github.com/clj-kondo/clj-kondo/issues/2414
+      (some-> node :meta first hooks/sexpr :clj-kondo/ignore unwrap-ignored-linters)))
+
+(defn update-ignored-linters
+  "Update the `:clj-kondo/ignore` linters in `node`'s metadata. `linters` should be a set of keywords."
+  [node f & args]
+  (letfn [(apply-f [linters]
+            (apply f linters args))
+          (update-linters [linters]
+            (-> (or (unwrap-ignored-linters linters)
+                    #{})
+                apply-f
+                wrap-ignored-linters))]
+    (vary-meta node update-in [:clj-kondo/ignore :linters] update-linters)))
+
+(defn merge-ignored-linters
+  "Merge the ignored linters from `source-nodes` into `node`. You can use this to propagate
+  ignored linters from parent nodes to child nodes."
+  [node & source-nodes]
+  (if-let [linters (not-empty (transduce (map ignored-linters) set/union #{} source-nodes))]
+    (update-ignored-linters node set/union linters)
+    node))
+
 ;;; This stuff is to help debug hooks. Trace a function and it will pretty-print the before & after sexprs.
 ;;;
 ;;;    (hooks.common/trace #'calculate-bird-scarcity)
 
+#_{:clj-kondo/ignore [:discouraged-var]}
 (defn- trace* [f]
   {:pre [(fn? f)]}
   (fn traced-fn [node]
@@ -47,9 +121,9 @@
   [{{[_ & args] :children, :as node} :node}]
   (let [node* (-> (hooks/list-node
                    (list*
-                    (with-meta (hooks/token-node 'do) {:clj-kondo/ignore [:redundant-do]})
+                    (update-ignored-linters (hooks/token-node 'do) conj :redundant-do)
                     (for [arg args]
-                      (vary-meta arg update :clj-kondo/ignore #(conj (vec %) :unused-value)))))
+                      (update-ignored-linters arg conj :unused-value))))
                   (with-meta (meta node)))]
     {:node node*}))
 
@@ -372,7 +446,51 @@
                 body))]
     {:node node*}))
 
-(defn node->qualified-symbol [node]
+(defn with-used-first-two-args
+  "For macros like
+
+    (with-limit-and-offset limit offset
+      ...)
+
+    =>
+
+    (let [_123 limit
+         [_456 offset]
+      ...)
+
+  where the first arg should be linted and appear to be used."
+  [{{[_ x y & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node [(hooks/token-node (gensym "_")) x
+                                    (hooks/token-node (gensym "_")) y])
+                body))]
+    {:node node*}))
+
+(defn with-vec-first-binding
+  "For macros like
+
+    (with-temp-file [binding \"temp.txt\" \"content\"]
+      (slurp binding))
+
+    =>
+    (let [binding nil]
+      (slurp binding))
+
+    where the first arg is a vector of bindings."
+  [{{[_ {[x & _args] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [(or x (hooks/token-node '_)) (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn node->qualified-symbol
+  "If the node is a symbol, return it as a qualified symbol if it's not already. Otherwise return nil."
+  [node]
   (try
     (when (hooks/token-node? node)
       (let [sexpr (hooks/sexpr node)]
@@ -382,8 +500,8 @@
               (and resolved (:ns resolved))
               (symbol (name (:ns resolved)) (name (:name resolved)))
 
-              ;; if it wasn't resolved but is still qualified it's probably using the full namespace name rather than an
-              ;; alias.
+             ;; if it wasn't resolved but is still qualified it's probably using the full namespace name rather than an
+             ;; alias.
               (qualified-symbol? sexpr)
               sexpr)))))
     ;; some symbols like `*count/Integer` aren't resolvable.
@@ -416,9 +534,4 @@
 
   metadata to a node to suppress LSP warnings."
   [node]
-  (letfn [(update-ignores [existing-ignores]
-            (hooks/vector-node
-             (cons
-              (hooks/keyword-node :clojure-lsp/unused-public-var)
-              (:children existing-ignores))))]
-    (vary-meta node update :clj-kondo/ignore update-ignores)))
+  (update-ignored-linters node conj :clojure-lsp/unused-public-var))

.clj-kondo/src/hooks/common/modules.clj

@@ -0,0 +1,81 @@
+(ns hooks.common.modules)
+
+(defn ignored-namespace? [config ns-symb]
+  (some
+   (fn [pattern-str]
+     (re-find (re-pattern pattern-str) (str ns-symb)))
+   (:ignored-namespace-patterns config)))
+
+(defn config [{:keys [config], :as _hook-input}]
+  (merge (get-in config [:linters :metabase/modules])
+         (select-keys config [:metabase/modules])))
+
+(defn module
+  "E.g.
+
+    (module 'metabase.qp.middleware.wow) => 'qp
+    (module 'metabase-enterprise.whatever.core) => enterprise/whatever"
+  [ns-symb]
+  {:pre [(simple-symbol? ns-symb)]}
+  (or (some->> (re-find #"^metabase-enterprise\.([^.]+)" (str ns-symb))
+               second
+               (symbol "enterprise"))
+      (some-> (re-find #"^metabase\.([^.]+)" (str ns-symb))
+              second
+              symbol)))
+
+(defn module-api-namespaces
+  "Set of API namespace symbols for a given module. `:any` means you can use anything, there are no API namespaces for
+  this module (yet). If unspecified, the default is just the `<module>.core` namespace."
+  [config module]
+  (let [module-config (get-in config [:metabase/modules module :api])]
+    (cond
+      (= module-config :any)
+      nil
+
+      (set? module-config)
+      module-config
+
+      :else
+      (let [ns-prefix (if (= (namespace module) "enterprise")
+                        (str "metabase-enterprise." (name module))
+                        (name module))]
+        #{(symbol (str ns-prefix ".api"))
+          (symbol (str ns-prefix ".core"))
+          (symbol (str ns-prefix ".init"))}))))
+
+(defn allowed-modules
+  "Set of namespace symbols that `module` is allowed to use. `:any` means it's allowed to use anything."
+  [config module]
+  (get-in config [:metabase/modules module :uses]))
+
+(defn allowed-module? [config module required-module]
+  (let [allowed-modules (allowed-modules config module)]
+    (or (= allowed-modules :any)
+        (contains? (set allowed-modules) required-module))))
+
+(defn allowed-module-namespace? [config ns-symb]
+  (let [module                (module ns-symb)
+        module-api-namespaces (module-api-namespaces config module)]
+    (or (empty? module-api-namespaces)
+        (contains? module-api-namespaces ns-symb))))
+
+(defn usage-error
+  "Find usage errors when a `required-namespace` is required in the `current-module`. Returns a string describing the
+  error type if there is one, otherwise `nil` if there are no errors."
+  [config current-module required-namespace]
+  ;; ignore stuff not in a module i.e. non-Metabase stuff.
+  (when-let [required-module (module required-namespace)]
+    (when-not (= current-module required-module)
+      (cond
+        (not (allowed-module? config current-module required-module))
+        (format "Module %s should not be used in the %s module. [:metabase/modules %s :uses]"
+                required-module
+                current-module
+                current-module)
+
+        (not (allowed-module-namespace? config required-namespace))
+        (format "Namespace %s is not an allowed external API namespace for the %s module. [:metabase/modules %s :api]"
+                required-namespace
+                required-module
+                required-module)))))

.clj-kondo/src/hooks/malli/error.clj

@@ -0,0 +1,26 @@
+(ns hooks.malli.error
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common]))
+
+(defn humanize [x]
+  (letfn [(check-node [node]
+            (when (hooks/list-node? node)
+              (let [[_ child] (:children node)]
+                (when (hooks/list-node? child)
+                  (let [[symb] (:children child)]
+                    (when-let [qualified-symb (hooks.common/node->qualified-symbol symb)]
+                      (when ('#{malli.core/validate metabase.util.malli.registry/validate}
+                             qualified-symb)
+                        (hooks/reg-finding! (assoc (meta symb)
+                                                   :message "Use malli.error/humanize with explain, NOT with validate. [:metabase/check-me-humanize]"
+                                                   :type :metabase/check-me-humanize)))))))))]
+    (check-node (:node x))
+    x))
+
+(comment
+  (humanize {:node (hooks/parse-string
+                    (pr-str '(malli.error/humanize
+                              (malli.core/validate
+                               metabase.sync.sync-metadata.dbms-version/DBMSVersion
+                               metabase.driver.druid.sync-test/dbms-version))))}))

.clj-kondo/src/hooks/metabase/api/automagic_dashboards_test.clj

@@ -1,28 +0,0 @@
-(ns hooks.metabase.api.automagic-dashboards-test
-  (:require [clj-kondo.hooks-api :as hooks]))
-
-(comment
-
-  (def input (hooks/parse-string
-              "(with-indexed-model! [{:keys [model model-index model-index-value]}
-                                     {:query :some-query}]
-                  :foo :bar :body)"))
-
-  (println (hooks/sexpr input))
-
-  (let [f (load-file ".clj-kondo/hooks/metabase/api/automagic_dashboards_test.clj")]
-    (f {:node input})))
-
-(defn with-indexed-model!
-  [{node :node}]
-  (let [[_macro-call binding-and-query-info & body] (:children node)
-        [binding query-info] (:children binding-and-query-info)
-        node* (hooks/list-node
-               [(hooks/token-node 'do-with-indexed-model!)
-                query-info
-                (hooks/list-node
-                 (list* (hooks/token-node 'fn)
-                        (hooks/vector-node [binding])
-                        body))])]
-    #_(println (hooks/sexpr node*))
-    {:node node*}))

.clj-kondo/src/hooks/metabase/api/common.clj

@@ -1,32 +0,0 @@
-(ns hooks.metabase.api.common
-  (:require
-   [clj-kondo.hooks-api :as api]
-   [clojure.string :as str]
-   [hooks.common]))
-
-(defn route-fn-name
-  "route fn hook"
-  [method route]
-  (let [route (if (vector? route) (first route) route)]
-    (-> (str (name method) route)
-        (str/replace #"/" "_")
-        symbol)))
-
-(defn defendpoint
-  [arg]
-  (letfn [(update-defendpoint [node]
-            (let [[_defendpoint method route & body] (:children node)]
-              (-> (api/list-node
-                   (list
-                    (api/token-node 'do)
-                    (-> (api/token-node (symbol "compojure.core" (str (api/sexpr method))))
-                        (with-meta (meta method)))
-                    (api/list-node
-                     (list*
-                      (api/token-node 'clojure.core/defn)
-                      (-> (api/token-node (route-fn-name (api/sexpr method) (api/sexpr route)))
-                          (with-meta (meta route)))
-                      body))))
-                  (with-meta (meta node))
-                  hooks.common/add-lsp-ignore-unused-public-var-metadata)))]
-    (update arg :node update-defendpoint)))

.clj-kondo/src/hooks/metabase/api/macros.clj

@@ -0,0 +1,56 @@
+(ns hooks.metabase.api.macros
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [hooks.common]))
+
+(defn defendpoint
+  [arg]
+  (letfn [(update-defendpoint [node]
+            (let [[defendpoint method route & more] (:children node)
+                  [result-schema & more] (if (= (api/sexpr (first more)) :-)
+                                           (drop 1 more)
+                                           (cons nil more))
+                  [_docstring & more] (if (api/string-node? (first more))
+                                        more
+                                        (cons nil more))
+                  [metadata & more] (if (api/map-node? (first more))
+                                      more
+                                      (cons nil more))
+                  [params & body] more
+                  [bindings schemas] (when (api/vector-node? params)
+                                       (loop [bindings [], schemas [], [x y & more] (:children params)]
+                                         (cond
+                                           (not x)
+                                           [bindings schemas]
+
+                                           (= (api/sexpr x) :-)
+                                           (recur bindings (conj schemas y) more)
+
+                                           :else
+                                           (recur (conj bindings x) schemas (cons y more)))))]
+              (-> (api/list-node
+                   (list
+                    (api/token-node 'do)
+                    defendpoint
+                    method
+                    route
+                    (api/list-node
+                     (list*
+                      (api/token-node 'do)
+                      (filter some? (list* metadata result-schema schemas))))
+                    (api/list-node
+                     (list*
+                      (api/token-node `let)
+                      (api/vector-node (into []
+                                             cat
+                                             [(mapcat (fn [a-binding]
+                                                        [a-binding (api/map-node {})])
+                                                      (take 4 bindings))
+                                              (mapcat (fn [a-binding]
+                                                        [a-binding (api/list-node (list
+                                                                                   (api/token-node 'clojure.core/constantly)
+                                                                                   (api/token-node 'nil)))])
+                                                      (drop 4 bindings))]))
+                      body))))
+                  (with-meta (meta node)))))]
+    (update arg :node update-defendpoint)))

.clj-kondo/src/hooks/metabase/api/search_test.clj

@@ -1,17 +0,0 @@
-(ns hooks.metabase.api.search-test
-  (:require [clj-kondo.hooks-api :as hooks]))
-
-(defn with-search-items-in-collection [{{[_ & args] :children, :as node} :node}]
-  ;; (println \newline)
-  ;; (clojure.pprint/pprint (hooks/sexpr node))
-  (let [[created-items-sym search-string & body] args
-        node*                                    (hooks/list-node
-                                                  (list*
-                                                   (hooks/token-node 'let)
-                                                   (hooks/vector-node
-                                                    [created-items-sym (hooks/token-node 'nil)])
-                                                   search-string
-                                                   body))]
-    ;; (println '=>)
-    ;; (clojure.pprint/pprint (hooks/sexpr node*))
-    {:node node*}))

.clj-kondo/src/hooks/metabase/channel/template/handlebars_helper.clj

@@ -0,0 +1,25 @@
+(ns hooks.metabase.channel.template.handlebars-helper
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common]))
+
+(defn defhelper
+  "defhelper hook"
+  [{:keys [node]}]
+  (let [[_ helper-name description argvec & body] (:children node)
+        helper-fn-name (symbol (str (hooks/sexpr helper-name) "*"))]
+    {:node (-> (hooks/list-node
+                (list (hooks/token-node 'do)
+                      (hooks/list-node
+                       (list (hooks/token-node 'defn)
+                             (hooks/token-node helper-fn-name)
+                             description
+                             argvec
+                             (hooks/list-node body)))
+                      (hooks/list-node
+                       (list (hooks/token-node 'defn)
+                             helper-name
+                             description
+                             argvec
+                             (hooks/list-node body)))))
+               (with-meta (meta node)))}))

.clj-kondo/src/hooks/metabase/model_persistence/test_util.clj

@@ -0,0 +1,19 @@
+(ns hooks.metabase.model-persistence.test-util
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
+
+(defn with-persistence-enabled! [x]
+  (letfn [(update-node [node]
+            (let [[_symb bindings & body] (:children node)
+                  [fn-binding]            (:children bindings)]
+              (-> (hooks/list-node
+                   (list*
+                    (hooks/token-node `let)
+                    (hooks/vector-node
+                     [fn-binding (hooks/list-node
+                                  (list
+                                   (hooks/token-node `fn)
+                                   (hooks/vector-node [])))])
+                    body))
+                  (with-meta (meta node)))))]
+    (update x :node update-node)))

.clj-kondo/src/hooks/metabase/models/setting.clj

@@ -3,6 +3,7 @@
    [clj-kondo.hooks-api :as hooks]
    [hooks.common :as common]))
 
+;;; TODO -- move this into
 (def ^:private ignored-implicit-export?
   '#{active-users-count
      admin-email
@@ -21,6 +22,7 @@
      database-enable-actions
      deprecation-notice-version
      dismissed-custom-dashboard-toast
+     dismissed-onboarding-sidebar-link
      email-configured?
      email-from-address
      email-from-name
@@ -161,6 +163,7 @@
      token-features
      token-status
      toucan-name
+     trial-banner-dismissal-timestamp
      uncached-setting
      user-visibility
      version
@@ -195,15 +198,18 @@
                                    :message "Setting definition must provide an explicit value for :export? indicating whether the setting should be exported or not with serialization."
                                    :type :metabase/defsetting-must-specify-export))))
 
-    {:node (-> (list
-                (hooks/token-node 'let)
+    {:node (-> (hooks/list-node
+                (list
+                 (hooks/token-node 'let)
                  ;; include description and the options map so they can get validated as well.
-                (hooks/vector-node
-                 [anon-binding docstring
-                  anon-binding (hooks/map-node options-list)])
-                getter-node
-                setter-node)
-               hooks/list-node
+                 (hooks/vector-node
+                  [anon-binding docstring
+                   anon-binding (hooks/map-node options-list)])
+                 (hooks/reg-keyword! (-> (hooks/keyword-node (keyword (hooks/sexpr setting-name)))
+                                         (with-meta (meta setting-name)))
+                                     'metabase.models.setting/defsetting)
+                 getter-node
+                 setter-node))
                (with-meta (meta node)))}))
 
 (defn defsetting
@@ -219,9 +225,11 @@
       (defn my-setting! \"Docstring.\" [_value-or-nil]))
 
   for linting purposes."
-  [{:keys [node]}]
+  [{:keys [node], :as context}]
   (let [[setting-name docstring & options] (rest (:children node))]
-    (defsetting-lint node setting-name docstring options)))
+    (merge
+     context
+     (defsetting-lint node setting-name docstring options))))
 
 (defn define-multi-setting
   "Rewrite a [[metabase.models.define-multi-setting]] form like
@@ -236,9 +244,30 @@
       (defn my-setting! \"Docstring.\" [_value-or-nil]))
 
   for linting purposes."
-  [{:keys [node]}]
+  [{:keys [node], :as context}]
   (let [[setting-name docstring thunk & options] (rest (:children node))]
-    (defsetting-lint node setting-name docstring (concat options [(hooks/token-node :multi-thunk) thunk]))))
+    (merge
+     context
+     (defsetting-lint node setting-name docstring (concat options [(hooks/token-node :multi-thunk) thunk])))))
+
+(defn define-multi-setting-impl
+  [context]
+  (letfn [(update-node [node]
+            (let [[_define-multi-setting-impl setting-name & more] (:children node)]
+              (-> (hooks/list-node
+                   (list*
+                    (hooks/token-node 'do)
+                    ;; For a qualified setting name like `oss-namespace/setting`, then leave the symbol as is, so the
+                    ;; usage of that namespace/var gets recorded. Otherwise for an unqualified name convert it to a
+                    ;; keyword so we don't get unresolved var errors.
+                    (if (and (hooks/token-node? setting-name)
+                             (qualified-symbol? (hooks/sexpr setting-name)))
+                      setting-name
+                      (-> (hooks/keyword-node (keyword (hooks/sexpr setting-name)))
+                          (with-meta (meta setting-name))))
+                    more))
+                  (with-meta (meta node)))))]
+    (update context :node update-node)))
 
 (comment
   (defn- defsetting* [form]

.clj-kondo/src/hooks/metabase/premium_features/defenterprise.clj

@@ -0,0 +1,65 @@
+(ns hooks.metabase.premium-features.defenterprise
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common]))
+
+(defn defenterprise [{node :node}]
+  (let [[_defenterprise fn-name & args] (:children node)
+        [docstring & args]              (if (hooks/string-node? (first args))
+                                          args
+                                          (cons nil args))
+        [_enterprise-namespace & args]   (if (hooks/token-node? (first args))
+                                           args
+                                           (cons nil args))
+        [options fn-tail]               (loop [options (hooks/map-node []), [x y & more :as args] args]
+                                          (if (hooks/keyword-node? x)
+                                            (recur (update options :children concat [x y]) more)
+                                            [options args]))]
+    {:node (hooks/list-node
+            (list
+             (hooks/token-node 'let)
+             (hooks/vector-node
+              [(hooks/token-node '_options) options])
+             (-> (hooks/list-node
+                  (concat
+                   (filter some?
+                           (list (hooks/token-node 'defn)
+                                 fn-name
+                                 docstring))
+                   fn-tail))
+                 (with-meta (meta node))
+                 hooks.common/add-lsp-ignore-unused-public-var-metadata)))}))
+
+(comment
+  (defn- defenterprise* [form]
+    (hooks/sexpr
+     (:node
+      (defenterprise
+        {:node
+         (hooks/parse-string
+          (with-out-str
+            (clojure.pprint/pprint
+             form)))}))))
+
+  (defn- x []
+    (defenterprise*
+      '(defenterprise score-result
+         "Scoring implementation that adds score for items in official collections."
+         :feature :any
+         :fallback score-result-fallback
+         [result]
+         (conj (scoring/weights-and-scores result)
+               {:weight 2
+                :score  (official-collection-score result)
+                :name   "official collection score"}
+               {:weight 2
+                :score  (verified-score result)
+                :name   "verified"}))))
+
+  (defn- y []
+    (defenterprise*
+      '(defenterprise score-result
+         "Score a result, returning a collection of maps with score and weight."
+         metabase-enterprise.search.scoring
+         [result]
+         (weights-and-scores result)))))

.clj-kondo/src/hooks/metabase/public_settings/premium_features.clj

@@ -1,65 +0,0 @@
-(ns hooks.metabase.public-settings.premium-features
-  (:require
-   [clj-kondo.hooks-api :as hooks]
-   [hooks.common]))
-
-(defn defenterprise [{node :node}]
-  (let [[_defenterprise fn-name & args] (:children node)
-        [docstring & args]              (if (hooks/string-node? (first args))
-                                          args
-                                          (cons nil args))
-        [_enterprise-namespace & args]   (if (hooks/token-node? (first args))
-                                           args
-                                           (cons nil args))
-        [options fn-tail]               (loop [options (hooks/map-node []), [x y & more :as args] args]
-                                          (if (hooks/keyword-node? x)
-                                            (recur (update options :children concat [x y]) more)
-                                            [options args]))]
-    {:node (hooks/list-node
-            (list
-             (hooks/token-node 'let)
-             (hooks/vector-node
-              [(hooks/token-node '_options) options])
-             (-> (hooks/list-node
-                  (concat
-                   (filter some?
-                           (list (hooks/token-node 'defn)
-                                 fn-name
-                                 docstring))
-                   fn-tail))
-                 (with-meta (meta node))
-                 hooks.common/add-lsp-ignore-unused-public-var-metadata)))}))
-
-(comment
-  (defn- defenterprise* [form]
-    (hooks/sexpr
-     (:node
-      (defenterprise
-        {:node
-         (hooks/parse-string
-          (with-out-str
-            (clojure.pprint/pprint
-             form)))}))))
-
-  (defn- x []
-    (defenterprise*
-      '(defenterprise score-result
-         "Scoring implementation that adds score for items in official collections."
-         :feature :any
-         :fallback score-result-fallback
-         [result]
-         (conj (scoring/weights-and-scores result)
-               {:weight 2
-                :score  (official-collection-score result)
-                :name   "official collection score"}
-               {:weight 2
-                :score  (verified-score result)
-                :name   "verified"}))))
-
-  (defn- y []
-    (defenterprise*
-      '(defenterprise score-result
-         "Score a result, returning a collection of maps with score and weight."
-         metabase-enterprise.search.scoring
-         [result]
-         (weights-and-scores result)))))

.clj-kondo/src/hooks/metabase/search/api_test.clj

@@ -0,0 +1,17 @@
+(ns hooks.metabase.search.api-test
+  (:require [clj-kondo.hooks-api :as hooks]))
+
+(defn with-search-items-in-collection [{{[_ & args] :children, :as node} :node}]
+  ;; (println \newline)
+  ;; (clojure.pprint/pprint (hooks/sexpr node))
+  (let [[created-items-sym search-string & body] args
+        node*                                    (hooks/list-node
+                                                  (list*
+                                                   (hooks/token-node 'let)
+                                                   (hooks/vector-node
+                                                    [created-items-sym (hooks/token-node 'nil)])
+                                                   search-string
+                                                   body))]
+    ;; (println '=>)
+    ;; (clojure.pprint/pprint (hooks/sexpr node*))
+    {:node node*}))

.clj-kondo/src/hooks/metabase/test/data/datasets.clj

@@ -1,11 +1,13 @@
 (ns hooks.metabase.test.data.datasets
-  (:require [clj-kondo.hooks-api :as hooks]
-            [clojure.set :as set]))
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.set :as set]
+   [hooks.common]))
 
 (defn- only-core-drivers?
   "Whether we're for sure only testing against the 'core' drivers that are also app DB types: `:postgres`, `:mysql`, or
-  `:h2`. Tests like these are ok to mark `:mb/once` or `:mb/driver-tests` since we always run the full test suite
-  against app DB drivers anyway."
+  `:h2`. Tests like these are ok to mark `:mb/driver-tests` since we always run the full test suite against app DB
+  drivers anyway."
   [node]
   (let [drivers (hooks/sexpr (second (:children node)))
         drivers (cond
@@ -15,14 +17,6 @@
     (when drivers
       (empty? (set/difference drivers #{:h2 :mysql :postgres})))))
 
-(defn- validate-mb-once [x]
-  (when (:mb/once (meta (:ns x)))
-    (hooks/reg-finding!
-     (assoc (meta (:ns x))
-            :message (str "You should not use test-driver or test-drivers in a namespace marked ^:mb/once"
-                          " [:metabase/validate-mb-once]")
-            :type :metabase/validate-mb-once))))
-
 (defn- validate-mb-driver-tests [x]
   (when-not (:mb/driver-tests (meta (:ns x)))
     (hooks/reg-finding!
@@ -33,7 +27,6 @@
 
 (defn- validate-ns-tags [x]
   (when-not (only-core-drivers? (:node x))
-    (validate-mb-once x)
     (validate-mb-driver-tests x)))
 
 (defn test-drivers [x]
@@ -45,7 +38,7 @@
                     (hooks/token-node 'do)
                     test-drivers
                     (-> drivers-expr
-                        (vary-meta update :clj-kondo/ignore #(conj (vec %) :unused-value)))
+                        (hooks.common/update-ignored-linters conj :unused-value))
                     body))
                   (with-meta (meta node)))))]
     (update x :node update-node)))

.clj-kondo/src/hooks/metabase/test/gentest.clj

@@ -0,0 +1,14 @@
+(ns hooks.metabase.test.gentest
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
+
+(defn with-gentest
+  "(with-gentest {:as limit-spec} [s1 val1 & more] body-form body-form...)"
+  [{{:keys [children] :as node} :node :as orig}]
+  (let [[token limit-spec bindings & body-nodes] children
+        node* (-> (hooks/list-node
+                   (list token limit-spec
+                         (hooks/list-node (list* (hooks/token-node 'let) bindings
+                                                 body-nodes))))
+                  (with-meta (meta node)))]
+    (assoc orig :node node*)))

.clj-kondo/src/hooks/metabase/util.clj

@@ -15,3 +15,17 @@
                                                     actual-arg-count)
                                    :type :format))))))
   x)
+
+(defn case-enum
+  "Lint `(case-enum ...)` like `(condp = ...)`."
+  [x]
+  (letfn [(update-node [node]
+            (let [[_case-enum x & more] (:children node)]
+              (-> (api/list-node
+                   (list*
+                    (api/token-node 'clojure.core/condp)
+                    (api/token-node 'clojure.core/=)
+                    x
+                    more))
+                  (with-meta (meta node)))))]
+    (update x :node update-node)))

.clj-kondo/src/hooks/metabase/xrays/api/automagic_dashboards_test.clj

@@ -0,0 +1,29 @@
+(ns hooks.metabase.xrays.api.automagic-dashboards-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
+
+(comment
+
+  (def input (hooks/parse-string
+              "(with-indexed-model! [{:keys [model model-index model-index-value]}
+                                     {:query :some-query}]
+                  :foo :bar :body)"))
+
+  (println (hooks/sexpr input))
+
+  (let [f (load-file ".clj-kondo/hooks/metabase/xrays/api/automagic_dashboards_test.clj")]
+    (f {:node input})))
+
+(defn with-indexed-model!
+  [{node :node}]
+  (let [[_macro-call binding-and-query-info & body] (:children node)
+        [binding query-info] (:children binding-and-query-info)
+        node* (hooks/list-node
+               [(hooks/token-node 'do-with-indexed-model!)
+                query-info
+                (hooks/list-node
+                 (list* (hooks/token-node 'fn)
+                        (hooks/vector-node [binding])
+                        body))])]
+    #_(println (hooks/sexpr node*))
+    {:node node*}))

.clj-kondo/test/hooks/clojure/core/defmulti_test.clj

@@ -0,0 +1,63 @@
+(ns hooks.clojure.core.defmulti-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.clojure.core.defmulti]))
+
+(defn- lint-defmulti [form]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/check-defmulti-arglists {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (hooks.clojure.core.defmulti/lint-defmulti {:node (hooks/parse-string (pr-str form))})
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(deftest ^:parallel defmulti-missing-arglists-test
+  (testing "missing arglists"
+    (is (=? [{:message "All defmultis should have an attribute map with :arglists metadata. [:metabase/check-defmulti-arglists]"}]
+            (lint-defmulti '(defmulti expand-visualization
+                              (fn [card _ _]
+                                (-> card :visualization first))))))))
+
+(deftest ^:parallel defmulti-invalid-arglists-test
+  (testing "invalid arglists"
+    (are [form] (=? [{:message ":arglists should be a quoted list of vectors [:metabase/check-defmulti-arglists]"}]
+                    (lint-defmulti form))
+      '(defmulti expand-visualization
+         {:arglists '()}
+         (fn [card _ _]
+           (-> card :visualization first)))
+      '(defmulti expand-visualization
+         {:arglists ([a])}              ; unquoted
+         (fn [card _ _]
+           (-> card :visualization first)))
+      '(defmulti expand-visualization
+         {:arglists '[(a)]}
+         (fn [card _ _]
+           (-> card :visualization first)))
+      '(defmulti expand-visualization
+         {:arglists '((a))}
+         (fn [card _ _]
+           (-> card :visualization first))))))
+
+(deftest ^:parallel defmulti-arglists-with-underscore-args-test
+  (testing "arglists, but some symbols are _"
+    (are [form] (=? [{:message ":arglists should contain actual arg names, not underscore (unused) symbols [:metabase/check-defmulti-arglists]"}]
+                    (lint-defmulti form))
+      '(defmulti expand-visualization
+         {:arglists '([card _ _])}
+         (fn [card _ _]
+           (-> card :visualization first)))
+      '(defmulti expand-visualization
+         {:arglists '([card _bad _arg])}
+         (fn [card _ _]
+           (-> card :visualization first))))))
+
+(deftest ^:parallel defmulti-arglists-ok-test
+  (testing "good"
+    (is (= []
+           (lint-defmulti '(defmulti expand-visualization
+                             {:arglists '([card x y])}
+                             (fn [card _ _]
+                               (-> card :visualization first))))))))

.clj-kondo/test/hooks/clojure/core/ns_test.clj

@@ -0,0 +1,74 @@
+(ns hooks.clojure.core.ns-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.clojure.core.ns]))
+
+(defn- lint-ns [form config]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     config
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (hooks.clojure.core.ns/lint-ns {:node   (hooks/parse-string
+                                             (binding [*print-meta* true]
+                                               (pr-str form)))
+                                    :config config})
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(defn- lint-modules [form config]
+  (lint-ns form (assoc-in config [:linters :metabase/modules :level] :warning)))
+
+(deftest ^:parallel module-checker-allowed-modules-test
+  (is (=? [{:message "Module task should not be used in the api module. [:metabase/modules api :uses]"
+            :type :metabase/modules}]
+          (lint-modules
+           '(ns metabase.api.search
+              (:require
+               [metabase.request.core :as request]
+               [metabase.task :as task]))
+           '{:metabase/modules {api     {:uses #{request}}
+                                request {:api #{metabase.request.core}}}}))))
+
+(deftest ^:parallel module-checker-api-namespaces-test
+  (is (=? [{:message "Namespace metabase.search.config is not an allowed external API namespace for the search module. [:metabase/modules search :api]"
+            :type :metabase/modules}]
+          (lint-modules
+           '(ns metabase.api.search
+              (:require
+               [metabase.search.config :as search.config]
+               [metabase.search.core :as search]))
+           '{:metabase/modules {api    {:uses #{search}}
+                                search {:api  #{metabase.search.core}}}}))))
+
+(deftest ^:parallel module-checker-api-namespaces-ignore-test
+  (is (empty? (lint-modules
+               '(ns metabase.api.search
+                  (:require
+                   ^{:clj-kondo/ignore [:metabase/modules]}
+                   [metabase.search.config :as search.config]
+                   [metabase.search.core :as search]))
+               '{:metabase/modules {api    {:uses #{search}}
+                                    search {:api #{metabase.search.core}}}}))))
+
+(deftest ^:parallel module-checker-enterprise-test
+  (is (=? [{:message "Module search should not be used in the enterprise/search module. [:metabase/modules enterprise/search :uses]"
+            :type :metabase/modules}]
+          (lint-modules
+           '(ns metabase-enterprise.search.core
+              (:require
+               [metabase.search.core :as search]))
+           '{:metabase/modules {search {:api #{metabase.search.core}}}}))))
+
+(deftest ^:parallel require-newlines-test
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/require-shape-checker {:level :warnings}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (hooks.clojure.core.ns/lint-ns {:node (hooks/parse-string "
+(ns metabase.task.cache
+  (:require [metabase.task.bunny]
+            [metabase.task.rabbit]))")})
+    (is (=? [{:message "Put your requires on a newline from the :require keyword [:metabase/require-shape-checker]",
+              :type    :metabase/require-shape-checker}]
+            @(:findings clj-kondo.impl.utils/*ctx*)))))

.clj-kondo/test/hooks/clojure/test_test.clj

@@ -3,7 +3,6 @@
    [clj-kondo.hooks-api :as api]
    [clj-kondo.impl.utils]
    [clojure.edn :as edn]
-   [clojure.java.io :as io]
    [clojure.test :refer :all]
    [hooks.clojure.test]))
 
@@ -44,9 +43,13 @@
   (testing "Make sure we keep hooks.clojure.test/driver-keywords up to date"
     (let [driver-keywords (-> (slurp ".clj-kondo/config.edn")
                               edn/read-string
-                              (get-in [:linters :metabase/disallow-hardcoded-driver-names-in-tests :drivers]))]
-      (doseq [^java.io.File file (.listFiles (io/file "modules/drivers"))
-              :when (.isDirectory file)
-              :let [driver (keyword (.getName file))]]
+                              (get-in [:linters :metabase/disallow-hardcoded-driver-names-in-tests :drivers]))
+          driver-modules (->> (slurp "modules/drivers/deps.edn")
+                              edn/read-string
+                              :deps
+                              vals
+                              (keep (comp keyword :local/root))
+                              (into #{}))]
+      (doseq [driver driver-modules]
         (is (contains? driver-keywords driver)
             (format "hooks.clojure.test/driver-keywords should contain %s, please add it" driver))))))

.clj-kondo/test/hooks/common/modules_test.clj

@@ -0,0 +1,10 @@
+(ns hooks.common.modules-test
+  (:require
+   [clojure.test :refer :all]
+   [hooks.common.modules]))
+
+(deftest ^:parallel module-test
+  (are [symb expected] (= expected
+                          (hooks.common.modules/module symb))
+    'metabase.qp.middleware.wow        'qp
+    'metabase-enterprise.whatever.core 'enterprise/whatever))

.clj-kondo/test/hooks/common_test.clj

@@ -1,10 +1,39 @@
-(ns ^:mb/once hooks.common-test
+(ns hooks.common-test
   (:require
    [clj-kondo.hooks-api :as api]
    [clj-kondo.impl.utils]
    [clojure.test :refer :all]
    [hooks.common]))
 
+(deftest ^:parallel ignored-linters-test
+  (doseq [ignored [":metabase/modules"
+                   "[:metabase/modules]"
+                   "(:metabase/modules)"]
+          prefix ["#_"
+                  "^"]
+          :let [s (format "%s{:clj-kondo/ignore %s} [metabase.search.config :as search.config]"
+                          prefix
+                          ignored)]]
+    (testing (pr-str s)
+      (is (= #{:metabase/modules}
+             (hooks.common/ignored-linters (api/parse-string s)))))))
+
+(deftest ^:parallel merge-ignored-linters-test
+  (let [node-1  (api/parse-string "#_{:clj-kondo/ignore [:a]} [:a]")
+        node-2  (api/parse-string "#_{:clj-kondo/ignore [:b]} [:b]")
+        node-3  (api/parse-string "#_{:clj-kondo/ignore [:c]} [:c]")
+        node-1' (hooks.common/merge-ignored-linters node-1 node-2 node-3)]
+    (is (= #{:a :b :c}
+           (hooks.common/ignored-linters node-1')))
+    (testing "Updated metadata should match the shape Kondo expects"
+      (is (=? {:clj-kondo/ignore {:linters api/vector-node?}}
+              (meta node-1')))
+      (let [children (-> node-1' meta :clj-kondo/ignore :linters :children)]
+        (is (= (count children) 3))
+        (is (every? api/keyword-node? children))
+        (is (= [:a :b :c]
+               (sort (map api/sexpr children))))))))
+
 (deftest ^:parallel node->qualified-symbol-test
   (binding [clj-kondo.impl.utils/*ctx* {:namespaces (atom nil)}]
     (is (= 'metabase.util.i18n/tru

.clj-kondo/test/hooks/metabase/api/common_test.clj

@@ -1,35 +0,0 @@
-(ns hooks.metabase.api.common-test
-  (:require
-   [clj-kondo.hooks-api :as api]
-   [clojure.test :refer :all]
-   [hooks.metabase.api.common]))
-
-(deftest ^:parallel defendpoint-test
-  (is (= '(do
-            compojure.core/POST
-            (clojure.core/defn
-              POST_:id_copy
-              "Copy a `Card`, with the new name 'Copy of _name_'"
-              [id]
-              {id [:maybe ms/PositiveInt]}
-              (let [orig-card (api/read-check Card id)
-                    new-name (str (trs "Copy of ") (:name orig-card))
-                    new-card (assoc orig-card :name new-name)]
-                (-> (card/create-card! new-card @api/*current-user*)
-                    hydrate-card-details
-                    (assoc :last-edit-info (last-edit/edit-information-for-user @api/*current-user*))))))
-         (-> {:node (-> '(api/defendpoint POST "/:id/copy"
-                           "Copy a `Card`, with the new name 'Copy of _name_'"
-                           [id]
-                           {id [:maybe ms/PositiveInt]}
-                           (let [orig-card (api/read-check Card id)
-                                 new-name  (str (trs "Copy of ") (:name orig-card))
-                                 new-card  (assoc orig-card :name new-name)]
-                             (-> (card/create-card! new-card @api/*current-user*)
-                                 hydrate-card-details
-                                 (assoc :last-edit-info (last-edit/edit-information-for-user @api/*current-user*)))))
-                        pr-str
-                        api/parse-string)}
-             hooks.metabase.api.common/defendpoint
-             :node
-             api/sexpr))))

.clj-kondo/test/hooks/metabase/api/macros_test.clj

@@ -0,0 +1,71 @@
+(ns hooks.metabase.api.macros-test
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clojure.test :refer :all]
+   [hooks.metabase.api.macros]))
+
+(defn- is-valid-node [x]
+  (is (api/node? x))
+  (doseq [child (:children x)]
+    (is-valid-node child)))
+
+(deftest ^:parallel defendpoint-test
+  (letfn [(defendpoint [form]
+            (let [node (-> form pr-str api/parse-string)]
+              (is-valid-node node)
+              (-> {:node node}
+                  hooks.metabase.api.macros/defendpoint
+                  :node
+                  api/sexpr)))]
+    (are [form expected] (= expected
+                            (defendpoint form))
+      '(api.macros/defendpoint :post "/" :- [:map [:collection_id :int]]
+         "Create a new [[Timeline]]."
+         [_route-params
+          _query-params
+          {:keys [icon], collection-id :collection_id, :as body} :- [:map
+                                                                     [:name    ms/NonBlankString]
+                                                                     [:default {:optional true} [:maybe :boolean]]]]
+         (body icon)
+         (body collection-id))
+      '(do
+         api.macros/defendpoint
+         :post
+         "/"
+         (do
+           [:map [:collection_id :int]]
+           [:map
+            [:name    ms/NonBlankString]
+            [:default {:optional true} [:maybe :boolean]]])
+         (clojure.core/let [_route-params {}
+                            _query-params {}
+                            {:keys [icon], collection-id :collection_id, :as body} {}]
+           (body icon)
+           (body collection-id)))
+
+      '(api.macros/defendpoint :post "/"
+         [_route-params
+          _query-params
+          body
+          request
+          respond
+          raise]
+         (try
+           (respond :x)
+           (catch Throwable e
+             (raise e))))
+      '(do
+         api.macros/defendpoint
+         :post
+         "/"
+         (do)
+         (clojure.core/let [_route-params {}
+                            _query-params {}
+                            body          {}
+                            request       {}
+                            respond       (clojure.core/constantly nil)
+                            raise         (clojure.core/constantly nil)]
+           (try
+             (respond :x)
+             (catch Throwable e
+               (raise e))))))))

.clj-kondo/test/hooks/metabase/model_persistence/test_util_test.clj

@@ -0,0 +1,19 @@
+(ns hooks.metabase.model-persistence.test-util-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.test :refer :all]
+   [hooks.metabase.model-persistence.test-util]))
+
+(deftest ^:parallel with-persistence-enabled-test
+  (is (= '(clojure.core/let [persist-models! (clojure.core/fn [])]
+            (persist-models!)
+            :wow)
+         (as-> '(mt/with-persistence-enabled! [persist-models!]
+                  (persist-models!)
+                  :wow) <>
+           (pr-str <>)
+           (hooks/parse-string <>)
+           {:node <>}
+           (hooks.metabase.model-persistence.test-util/with-persistence-enabled! <>)
+           (:node <>)
+           (hooks/sexpr <>)))))

.clj-kondo/test/hooks/metabase/util/log_test.clj

@@ -1,4 +1,4 @@
-(ns ^:mb/once hooks.metabase.util.log-test
+(ns hooks.metabase.util.log-test
   (:require
    [clj-kondo.hooks-api :as api]
    [clj-kondo.impl.utils]

.cljfmt.edn

@@ -13,6 +13,8 @@
   "test"
   "enterprise/backend"
   "bin/build"
+  "bin/lint-migrations-file"
+  "bin/release-list"
   "modules/drivers"
   ".clj-kondo/src"
   ".clj-kondo/test"
@@ -91,7 +93,7 @@
   metabase-enterprise.test/with-gtaps!                                                 [[:inner 0]]
   metabase-enterprise.test/with-gtaps-for-user!                                        [[:inner 0]]
   metabase-enterprise.test/with-user-attributes                                        [[:block 2]]
-  metabase.actions-test/with-actions-test-data-and-actions-permissively-enabled        [[:block 0]]
+  metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled [[:block 0]]
   metabase.actions.test-util/with-actions                                              [[:block 1]]
   metabase.actions.test-util/with-actions-disabled                                     [[:block 0]]
   metabase.actions.test-util/with-actions-enabled                                      [[:block 0]]
@@ -100,7 +102,6 @@
   metabase.actions.test-util/with-actions-test-data-tables                             [[:block 1]]
   metabase.actions.test-util/with-empty-db                                             [[:inner 0]]
   metabase.actions.test-util/with-temp-test-data                                       [[:inner 0]]
-  metabase.api.alert-test/with-alert-in-collection                                     [[:block 1]]
   metabase.api.card-test/with-cards-in-readable-collection                             [[:block 1]]
   metabase.api.card-test/with-cards-in-writeable-collection                            [[:block 1]]
   metabase.api.card-test/with-ordered-items                                            [[:inner 0]]
@@ -112,9 +113,6 @@
   metabase.api.common/check                                                            [[:default]]
   metabase.api.common/define-routes                                                    [[:block 0]]
   metabase.api.common/let-404                                                          [[:block 1]]
-  metabase.api.common.internal/auto-coerce                                             [[:block 1]]
-  metabase.api.common.internal/auto-parse                                              [[:block 1]]
-  metabase.api.common.internal-test/no-route-regexes                                   [[:block 0]]
   metabase.api.embed-test/do-response-formats                                          [[:block 1]]
   metabase.api.embed-test/with-embedding-enabled-and-new-secret-key                    [[:block 0]]
   metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing             [[:block 3]]
@@ -124,17 +122,6 @@
   metabase.api.embed-test/with-temp-dashcard                                           [[:block 1]]
   metabase.api.preview-embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
   metabase.api.preview-embed-test/with-new-secret-key                                  [[:block 0]]
-  metabase.api.public-test/with-sharing-enabled-and-temp-card-referencing              [[:block 3]]
-  metabase.api.public-test/with-sharing-enabled-and-temp-dashcard-referencing          [[:block 3]]
-  metabase.api.public-test/with-temp-public-card                                       [[:block 1]]
-  metabase.api.public-test/with-temp-public-dashboard                                  [[:block 1]]
-  metabase.api.public-test/with-temp-public-dashboard-and-card                         [[:block 1]]
-  metabase.api.search-test/do-test-users                                               [[:block 1]]
-  metabase.api.session/http-401-on-error                                               [[:block 0]]
-  metabase.async.streaming-response/streaming-response                                 [[:block 2]]
-  metabase.async.streaming-response-test/with-streaming-response-thread-pool           [[:block 0]]
-  metabase.async.streaming-response-test/with-test-driver-db!                          [[:block 0]]
-  metabase.async.util/cancelable-thread                                                [[:block 0]]
   metabase.cmd.copy/step                                                               [[:block 1]]
   metabase.cmd.copy/with-connection-rollback-only                                      [[:block 1]]
   metabase.cmd.copy/with-disabled-db-constraints                                       [[:block 2]]
@@ -177,11 +164,19 @@
   metabase.models.params.chain-filter-test/with-clean-field-values-for-field           [[:block 1]]
   metabase.models.params.chain-filter-test/with-fk-field-to-field-remapping            [[:block 0]]
   metabase.models.params.chain-filter-test/with-human-readable-values-remapping        [[:block 0]]
-  metabase.models.pulse-test/with-dashboard-subscription-in-collection                 [[:block 1]]
-  metabase.models.pulse-test/with-pulse-in-collection                                  [[:inner 0]]
-  metabase.models.setting/defsetting                                                   [[:block 1]]
   metabase.models.setting.multi-setting/define-multi-setting                           [[:inner 0]]
+  metabase.models.setting/defsetting                                                   [[:block 1]]
   metabase.models.task-history/with-task-history                                       [[:block 1]]
+  metabase.permissions.core/allow-changing-all-users-group-members                     [[:block 0]]
+  metabase.permissions.core/disable-perms-cache                                        [[:block 0]]
+  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing      [[:block 3]]
+  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing  [[:block 3]]
+  metabase.public-sharing.api-test/with-temp-public-card                               [[:block 1]]
+  metabase.public-sharing.api-test/with-temp-public-dashboard                          [[:block 1]]
+  metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                 [[:block 1]]
+  metabase.pulse.api.alert-test/with-alert-in-collection                               [[:block 1]]
+  metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection           [[:block 1]]
+  metabase.pulse.models.pulse-test/with-pulse-in-collection                            [[:inner 0]]
   metabase.query-processor-test.pipeline-queries-test/pmbql-query                      [[:block 1]]
   metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                  [[:block 1]]
   metabase.query-processor.debug/debug>                                                [[:block 0]]
@@ -192,9 +187,20 @@
   metabase.query-processor.store/with-metadata-provider                                [[:inner 0]]
   metabase.query-processor.streaming/streaming-response                                [[:block 1]]
   metabase.query-processor.test-util/format-rows-by                                    [[:default]]
+  metabase.request.core/as-admin                                                       [[:block 0]]
+  metabase.request.core/with-current-request                                           [[:inner 0]]
+  metabase.request.core/with-current-user                                              [[:inner 0]]
+  metabase.request.core/with-limit-and-offset                                          [[:inner 0]]
+  metabase.request.session/as-admin                                                    [[:block 0]]
+  metabase.request.session/with-current-user                                           [[:inner 0]]
   metabase.sample-data-test/with-temp-sample-database-db                               [[:block 1]]
+  metabase.search.api-test/do-test-users                                               [[:block 1]]
   metabase.server.middleware.session/as-admin                                          [[:block 0]]
   metabase.server.middleware.session/with-current-user                                 [[:inner 0]]
+  metabase.server.streaming-response-test/with-streaming-response-thread-pool          [[:block 0]]
+  metabase.server.streaming-response-test/with-test-driver-db!                         [[:block 0]]
+  metabase.server.streaming-response/streaming-response                                [[:block 2]]
+  metabase.session.api/http-401-on-error                                               [[:block 0]]
   metabase.sync.fetch-metadata/log-if-error                                            [[:block 1]]
   metabase.sync.sync-metadata.fields-test/with-test-db                                 [[:block 0]]
   metabase.sync.util/do-with-start-and-finish-debug-logging                            [[:default]]
@@ -269,12 +275,14 @@
   metabase.upload.types/with-currency                                                  [[:default]]
   metabase.upload.types/with-parens                                                    [[:default]]
   metabase.util/auto-retry                                                             [[:block 1]]
+  metabase.util/case-enum                                                              [[:block 1]]
   metabase.util/ignore-exceptions                                                      [[:block 0]]
   metabase.util/or-with                                                                [[:block 1]]
   metabase.util/profile                                                                [[:block 1]]
   metabase.util/prog1                                                                  [[:inner 0]]
   metabase.util/varargs                                                                [[:inner 0]]
   metabase.util/with-us-locale                                                         [[:block 0]]
+  metabase.util.async/cancelable-thread                                                [[:block 0]]
   metabase.util.date-2/with-time-zone-same-instant                                     [[:default]]
   metabase.util.encryption-test/with-secret-key                                        [[:block 1]]
   metabase.util.honey-sql-2/with-database-type-info                                    [[:default]]

.dir-locals.el

@@ -20,13 +20,8 @@
  (clojure-mode
   ;; Specify which arg is the docstring for certain macros
   ;; (Add more as needed)
-  (eval . (put 'defendpoint-schema                 'clojure-doc-string-elt 3))
-  (eval . (put 'defendpoint                        'clojure-doc-string-elt 3))
-  (eval . (put 'defendpoint-async                  'clojure-doc-string-elt 3))
   (eval . (put 'define-premium-feature             'clojure-doc-string-elt 2))
-  (eval . (put 'api/defendpoint-schema             'clojure-doc-string-elt 3))
-  (eval . (put 'api/defendpoint                    'clojure-doc-string-elt 3))
-  (eval . (put 'api/defendpoint-async              'clojure-doc-string-elt 3))
+  (eval . (put 'api.macros/defendpoint             'clojure-doc-string-elt 3))
   (eval . (put 'defsetting                         'clojure-doc-string-elt 2))
   (eval . (put 'setting/defsetting                 'clojure-doc-string-elt 2))
   (eval . (put 's/defn                             'clojure-doc-string-elt 2))

.eslintrc.js

@@ -17,7 +17,7 @@ module.exports = {
       {
         vars: "all",
         args: "none",
-        varsIgnorePattern: "^_",
+        varsIgnorePattern: "^_.+$",
         ignoreRestSiblings: true,
       },
     ],
@@ -108,7 +108,6 @@ module.exports = {
           "When",
           "Then",
           "describeWithSnowplow",
-          "describeEE",
         ],
       },
     ],
@@ -220,10 +219,10 @@ module.exports = {
         "@typescript-eslint/no-unused-vars": [
           "error",
           {
-            argsIgnorePattern: "^_",
-            varsIgnorePattern: "^_",
+            argsIgnorePattern: "^_.+$",
+            varsIgnorePattern: "^_.+$",
             ignoreRestSiblings: true,
-            destructuredArrayIgnorePattern: "^_",
+            destructuredArrayIgnorePattern: "^_.+$",
           },
         ],
         // This was introduced in 6.0.0
@@ -253,5 +252,36 @@ module.exports = {
       extends: ["plugin:jest-formatting/recommended"],
       files: ["*.cy.spec.ts", "*.cy.spec.js"],
     },
+    {
+      files: ["frontend/src/**/*"],
+      rules: {
+        "no-restricted-syntax": [
+          "error",
+          {
+            selector: "Literal[value=/mb-base-color-/]",
+            message:
+              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
+          },
+        ],
+      },
+    },
+    {
+      files: ["frontend/src/metabase/**/*"],
+      rules: {
+        "no-restricted-syntax": [
+          "error",
+          {
+            selector: "Literal[value=/mb-base-color-/]",
+            message:
+              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
+          },
+          {
+            selector:
+              "CallExpression[callee.property.name='legacyQuery'] > ObjectExpression > Property[key.name='useStructuredQuery'][value.value=true]",
+            message: "StructuredQuery usage is forbidden. Use MLv2",
+          },
+        ],
+      },
+    },
   ],
 };

.github/CODEOWNERS

@@ -1,16 +1,257 @@
 # Before changing this file, make sure you have read how we use it:
 # https://www.notion.so/metabase/Pull-Request-Code-Review-Guide-374f05df889748b69d67af753f9bc9b8?pvs=4#36550c04ceab40b5a8b8bee6264b090c
-# TL;DR: if @camsaul hasn't been involved you're probably doing it wrong
 
-src/metabase @camsaul
-modules @camsaul
-enterprise/backend @camsaul
-enterprise/backend/src/metabase_enterprise/advanced_permissions @noahmoss
-enterprise/backend/src/metabase_enterprise/audit_app @noahmoss
-enterprise/backend/src/metabase_enterprise/sso @noahmoss
-enterprise/backend/src/metabase_enterprise/task/truncate_audit_table.clj @noahmoss
-enterprise/backend/src/metabase_enterprise/internal_user.clj @noahmoss
+enterprise/frontend/src/embedding-sdk @metabase/embedding
+frontend/src/metabase/embedding-sdk @metabase/embedding
 frontend/src/metabase/ui @metabase/core-frontend-admin-webapp
-src/metabase/**/*permissions* @noahmoss
-src/metabase/integrations @noahmoss
 snowplow/* @metabase/data
+e2e @filiphric
+
+.github @metabase/devexp
+.clj-kondo @metabase/devexp
+
+#
+# Backend modules <=> teams that own them
+#
+
+modules/drivers @metabase/drivers
+
+enterprise/backend/src/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/api @metabase/devexp
+enterprise/backend/test/metabase_enterprise/api @metabase/devexp
+
+enterprise/backend/src/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/billing @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/billing @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/cache @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/cache @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/core @metabase/devexp
+enterprise/backend/test/metabase_enterprise/core @metabase/devexp
+
+enterprise/backend/src/metabase_enterprise/dashboard_subscription_filters @metabase/core-workflows
+enterprise/backend/test/metabase_enterprise/dashboard_subscription_filters @metabase/core-workflows
+
+enterprise/backend/src/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
+
+# enterprise/backend/src/metabase_enterprise/llm
+# enterprise/backend/test/metabase_enterprise/llm
+
+enterprise/backend/src/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/scim @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/scim @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/search @metabase/core-workflows
+enterprise/backend/test/metabase_enterprise/search @metabase/core-workflows
+
+enterprise/backend/src/metabase_enterprise/serialization @metabase/core-workflows
+enterprise/backend/test/metabase_enterprise/serialization @metabase/core-workflows
+
+enterprise/backend/src/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/sso @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/sso @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/stale @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/stale @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/stats @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/stats @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/task @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/task @metabase/core-backend-admin-webapp
+
+enterprise/backend/src/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
+enterprise/backend/test/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
+
+src/metabase/actions @metabase/core-backend-admin-webapp
+test/metabase/actions @metabase/core-backend-admin-webapp
+
+src/metabase/activity_feed @metabase/core-backend-admin-webapp
+test/metabase/activity_feed @metabase/core-backend-admin-webapp
+
+src/metabase/analytics @metabase/core-backend-admin-webapp
+test/metabase/analytics @metabase/core-backend-admin-webapp
+
+src/metabase/analyze @metabase/drivers
+test/metabase/analyze @metabase/drivers
+
+src/metabase/api @metabase/devexp
+test/metabase/api @metabase/devexp
+
+src/metabase/audit @metabase/core-backend-admin-webapp
+test/metabase/audit @metabase/core-backend-admin-webapp
+
+src/metabase/auth_provider @metabase/core-backend-admin-webapp
+test/metabase/auth_provider @metabase/core-backend-admin-webapp
+
+src/metabase/bookmarks @metabase/core-backend-admin-webapp
+test/metabase/bookmarks @metabase/core-backend-admin-webapp
+
+src/metabase/cmd @metabase/devexp
+test/metabase/cmd @metabase/devexp
+
+src/metabase/channel @metabase/core-workflows
+test/metabase/channel @metabase/core-workflows
+
+src/metabase/cloud_migration @metabase/core-workflows
+test/metabase/cloud_migration @metabase/core-workflows
+
+src/metabase/cmd @metabase/devexp
+test/metabase/cmd @metabase/devexp
+
+src/metabase/config @metabase/devexp
+test/metabase/config @metabase/devexp
+
+src/metabase/core @metabase/devexp
+test/metabase/core @metabase/devexp
+
+src/metabase/db @metabase/core-backend-admin-webapp
+test/metabase/db @metabase/core-backend-admin-webapp
+
+src/metabase/driver @metabase/drivers
+test/metabase/driver @metabase/drivers
+
+src/metabase/eid_translation @metabase/core-backend-admin-webapp
+test/metabase/eid_translation @metabase/core-backend-admin-webapp
+
+src/metabase/embed @metabase/embedding
+test/metabase/embed @metabase/embedding
+
+src/metabase/events @metabase/devexp
+test/metabase/events @metabase/devexp
+
+src/metabase/formatter @metabase/core-backend-querying
+test/metabase/formatter @metabase/core-backend-querying
+
+src/metabase/indexed_entities @metabase/core-backend-querying
+test/metabase/indexed_entities @metabase/core-backend-querying
+
+src/metabase/integrations @metabase/core-workflows
+test/metabase/integrations @metabase/core-workflows
+
+src/metabase/legacy_mbql @metabase/core-backend-querying
+test/metabase/legacy_mbql @metabase/core-backend-querying
+
+src/metabase/lib @metabase/core-backend-querying
+test/metabase/lib @metabase/core-backend-querying
+
+src/metabase/logger @metabase/devexp
+test/metabase/logger @metabase/devexp
+
+src/metabase/login_history @metabase/core-backend-admin-webapp
+test/metabase/login_history @metabase/core-backend-admin-webapp
+
+src/metabase/model_persistence @metabase/core-backend-querying
+test/metabase/model_persistence @metabase/core-backend-querying
+
+src/metabase/models @metabase/devexp
+test/metabase/models @metabase/devexp
+
+src/metabase/moderation @metabase/core-backend-admin-webapp
+test/metabase/moderation @metabase/core-backend-admin-webapp
+
+src/metabase/notification @metabase/core-workflows
+test/metabase/notification @metabase/core-workflows
+
+src/metabase/permissions @metabase/core-backend-admin-webapp
+test/metabase/permissions @metabase/core-backend-admin-webapp
+
+src/metabase/plugins @metabase/devexp
+test/metabase/plugins @metabase/devexp
+
+src/metabase/premium_features @metabase/core-backend-admin-webapp
+test/metabase/premium_features @metabase/core-backend-admin-webapp
+
+src/metabase/public_settings @metabase/core-backend-admin-webapp
+test/metabase/public_settings @metabase/core-backend-admin-webapp
+
+src/metabase/public_sharing @metabase/core-backend-admin-webapp
+test/metabase/public_sharing @metabase/core-backend-admin-webapp
+
+src/metabase/pulse @metabase/core-workflows
+test/metabase/pulse @metabase/core-workflows
+
+src/metabase/query_analysis @metabase/core-backend-querying
+test/metabase/query_analysis @metabase/core-backend-querying
+
+src/metabase/query_processor @metabase/core-backend-querying
+test/metabase/query_processor @metabase/core-backend-querying
+
+src/metabase/request @metabase/devexp
+test/metabase/request @metabase/devexp
+
+src/metabase/revisions @metabase/core-backend-admin-webapp
+test/metabase/revisions @metabase/core-backend-admin-webapp
+
+src/metabase/sample_data @metabase/core-backend-admin-webapp
+test/metabase/sample_data @metabase/core-backend-admin-webapp
+
+src/metabase/search @metabase/core-workflows
+test/metabase/search @metabase/core-workflows
+
+src/metabase/segments @metabase/core-backend-querying
+test/metabase/segments @metabase/core-backend-querying
+
+src/metabase/server @metabase/devexp
+test/metabase/server @metabase/devexp
+
+src/metabase/session @metabase/core-backend-admin-webapp
+test/metabase/session @metabase/core-backend-admin-webapp
+
+src/metabase/setup @metabase/core-backend-admin-webapp
+test/metabase/setup @metabase/core-backend-admin-webapp
+
+src/metabase/sso @metabase/core-backend-admin-webapp
+test/metabase/sso @metabase/core-backend-admin-webapp
+
+src/metabase/sync @metabase/drivers
+test/metabase/sync @metabase/drivers
+
+src/metabase/task @metabase/devexp
+test/metabase/task @metabase/devexp
+
+src/metabase/tiles @metabase/core-backend-dashviz
+test/metabase/tiles @metabase/core-backend-dashviz
+
+src/metabase/timeline @metabase/core-backend-dashviz
+test/metabase/timeline @metabase/core-backend-dashviz
+
+src/metabase/types @metabase/core-backend-querying
+test/metabase/types @metabase/core-backend-querying
+
+src/metabase/upload @metabase/core-backend-admin-webapp
+test/metabase/upload @metabase/core-backend-admin-webapp
+
+src/metabase/user_key_value @metabase/core-backend-admin-webapp
+test/metabase/user_key_value @metabase/core-backend-admin-webapp
+
+src/metabase/util @metabase/devexp
+test/metabase/util @metabase/devexp
+
+src/metabase/xrays @metabase/core-backend-querying
+test/metabase/xrays @metabase/core-backend-querying

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -66,12 +66,13 @@ body:
         Copy and paste the JSON from `Admin -> Troubleshooting`.
         _This will be automatically formatted into code, so no need for backticks._
       placeholder: |
-        - Your browser and the version: (e.g., Chrome 52.1, Firefox 48.0, Safari 11.1, …)
-        - Your operating system: (e.g., OS X 10.10, Windows 10.1809, Ubuntu 16.04, …)
-        - Your databases: (e.g, MySQL, Postgres, MongoDB, …)
-        - Metabase version: (e.g., 0.19.3)
-        - Metabase hosting environment: (e.g., Elastic Beanstalk, Docker, Heroku, Jar-file on Ubuntu, …)
-        - Metabase internal database: (e.g., H2 (default), Postgres or MySQL)
+        {"browser-info": {
+           "language": "en-US",
+           "platform": "MacIntel",
+           "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+           "vendor": "Google Inc."},
+         "metabase-info": {
+           "databases": [ "postgres",...
       render: JSON
     validations:
       required: true

.github/ISSUE_TEMPLATE/epic.md

@@ -5,20 +5,19 @@ about: This issue is used to track a feature/project that may span several days
   and manage work.
 title: "[Epic] Title"
 labels: ".Epic"
-
 ---
 
-**Links**
-- product doc: _link to product doc_
-- eng doc: _link to technical design doc, if any_
-- feature branch: `branch-name` _this should be the feature branch where this work will be done in. PRs will be delivered against this branch_
-- issue links: _related issues if any_
+### Links
 
-**Implementation Plan**
+- [product doc](LINK_TO_PRODUCT_DOC)
+- [technical design doc](LINK_TO_TECHNICAL_DESIGN_DOC)
+- [testing plan](LINK_TO_TESTING_PLAN)
+- feature branch: `BRANCH_NAME`
+- issue links: _related issues, if any_
 
+### Implementation Plan
 
-***Milestone 1***
-_insert tasklist here_
-
-***Milestone 2***
-
+```[tasklist]
+#### Milestone 1
+- [ ] _Add tasks here_
+```

.github/PULL_REQUEST_TEMPLATE/cypress_repro.md

@@ -5,7 +5,7 @@ PENDING CI / PENDING REVIEW / READY _(choose one and update accordingly)_
 - Reproduces #XXXXX
 
 ### How to test this manually?
-- `yarn test-cypress-open`
+- `yarn test-cypress`
 - `relative/path/to/the/file`
 > _(For still unfixed bug)_
 - Replace `it.skip()` with `it.only()` to run the test in isolation

.github/actions/build-e2e-matrix/action.yml

@@ -1,70 +0,0 @@
-name: Build E2E Matrix
-description: Build and output a custom matrix for E2E tests.
-
-outputs:
-  matrix:
-    description: Parameterized matrix in JSON format
-    value: ${{ steps.matrix.outputs.result }}
-
-runs:
-  using: "composite"
-  steps:
-    - uses: actions/github-script@v7
-      id: matrix
-      with:
-        script: | # js
-          const java = 11;
-
-          const defaultRunner = "ubuntu-22.04";
-
-          const defaultOptions = {
-            "java-version": java,
-            runner: defaultRunner,
-            edition: "ee",
-            context: "folder"
-          };
-
-          const testSets = [
-            ["actions", {} ],
-            ["admin", {} ],
-            ["admin-2", {} ],
-            ["binning", {} ],
-            ["collections", {} ],
-            ["custom-column", {} ],
-            ["dashboard", {} ],
-            ["dashboard-cards", {} ],
-            ["dashboard-filters", {} ],
-            ["embedding", {} ],
-            ["embedding-sdk", { context: "embedding-sdk" } ],
-            ["filters", {} ],
-            ["filters-reproductions", {}],
-            ["joins", {} ],
-            ["metrics", {} ],
-            ["models", {} ],
-            ["native", {} ],
-            ["native-filters", {} ],
-            ["onboarding", {} ],
-            ["organization", {} ],
-            ["permissions", {} ],
-            ["question", {} ],
-            ["question-reproductions", {} ],
-            ["search", {}],
-            ["sharing", {} ],
-            ["visualizations-charts", {} ],
-            ["visualizations-tabular", {} ],
-            ["oss-subset", { edition: 'oss', context: "special" } ],
-            ["slow", { context: "special" } ],
-            ["flaky", { context: "special" } ],
-            ["mongo", { context: "qa-database" } ],
-          ];
-
-          const config = testSets.map(([name, specialOptions]) => {
-            return {
-              ...defaultOptions,
-              ...specialOptions,
-              name,
-            }
-          });
-
-          const matrix = { include: config };
-          return matrix;

.github/actions/build-ee-extra/action.yml

@@ -2,6 +2,9 @@ name: Build ee-extra
 description: Build Metabase Enterprise Edition with extra features
 
 inputs:
+  java-version:
+    required: true
+    default: 21
   iam-role:
     description: "The IAM role to assume"
     required: true
@@ -12,10 +15,10 @@ runs:
     - name: Prepare Java
       uses: actions/setup-java@v3
       with:
-        java-version: '17'
+        java-version: ${{ inputs.java-version }}
         distribution: 'temurin'
     - name: Reveal its original version.properties
-      run: jar xf  ./bin/docker/metabase.jar version.properties && cat version.properties
+      run: jar xf ./bin/docker/metabase.jar version.properties && cat version.properties
       shell: bash
     - name: get major version
       id: major_version
@@ -27,7 +30,7 @@ runs:
       shell: bash
     - uses: actions/setup-node@v4
       with:
-        node-version: lts/Hydrogen # 18.x.x
+        node-version: lts/Jod # 22.x.x
     - run: rm package.json && npm install yaml
       shell: bash
     - name: parse drivers registry
@@ -61,10 +64,7 @@ runs:
           const extraDrivers = {
             firebolt: getDriverUrl('firebolt'),
             starburst: getDriverUrl('starburst'),
-            exasol: getDriverUrl('exasol'),
-            exasol_jdbc: drivers.find(d => d.name === 'exasol').deps[0],
             clickhouse: getDriverUrl('clickhouse'),
-            ocient: getDriverUrl('ocient'),
             materialize: getDriverUrl('materialize'),
           };
 
@@ -81,22 +81,11 @@ runs:
         curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).starburst }}
       shell: bash
       working-directory: modules
-    - name: Download Exasol driver
-      run: |
-        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).exasol }}
-        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).exasol_jdbc }}
-      shell: bash
-      working-directory: modules
     - name: Download Clickhouse driver
       run: |
         curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).clickhouse }}
       shell: bash
       working-directory: modules
-    - name: Download Ocient driver
-      run: |
-        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).ocient }}
-      shell: bash
-      working-directory: modules
     - name: Download Materialize driver
       run: |
         curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).materialize }}
@@ -106,7 +95,8 @@ runs:
       run: jar uf bin/docker/metabase.jar modules/*.jar
       shell: bash
     - name: Launch uberjar
-      run: java -jar ./bin/docker/metabase.jar &
+      run: >-
+        java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./bin/docker/metabase.jar &
       shell: bash
     - name: Wait for Metabase to start
       run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done

.github/actions/create-backport/action.yml

@@ -0,0 +1,101 @@
+name: Create Backport PR
+
+inputs:
+  target-version: # major version number like 34 or 86
+    required: true
+  backport-commit:
+    required: true
+  github-token:
+    required: true
+  github-token-2: # need a second token to approve the PR
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - id: create_backport_pull_request
+      name: Create backport pull request
+      env:
+        TARGET_VERSION: ${{ inputs.target-version }}
+        TARGET_BRANCH: release-x.${{ inputs.target-version }}.x
+        ORIGINAL_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+        ORIGINAL_TITLE: ${{ github.event.pull_request.title }}
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        COMMIT: ${{ inputs.backport-commit }}
+      shell: bash
+      run: |
+        git config --global user.email "metabase-bot@metabase.com"
+        git config --global user.name "Metabase bot"
+
+        BACKPORT_BRANCH="backport-$TARGET_VERSION-$COMMIT"
+
+        # Checkout the target branch and create a new backport branch
+        git checkout ${TARGET_BRANCH}
+        git fetch --all
+        git checkout -b ${BACKPORT_BRANCH}
+        git cherry-pick ${COMMIT} || true
+
+        CONFLICTS=$(git ls-files -u | wc -l)
+        if [ "$CONFLICTS" -gt 0 ]; then
+          git cherry-pick --abort
+
+          echo "Could not cherry pick because of a conflict"
+          echo "has-conflicts=true" >> $GITHUB_OUTPUT
+
+          # Add a shell script for resolving conflicts
+          echo "git reset HEAD~1" > ./backport.sh
+          echo "rm ./backport.sh" >> ./backport.sh
+          echo "git cherry-pick ${COMMIT}" >> ./backport.sh
+          echo "echo 'Resolve conflicts and force push this branch'" >> ./backport.sh
+          chmod +x ./backport.sh
+          git add ./backport.sh
+          git commit -m "Add backport resolution script"
+
+          PR_BODY=$(cat <<-END
+          #${ORIGINAL_PULL_REQUEST_NUMBER}
+          > [!IMPORTANT]
+          > Manual conflict resolution is required.
+          Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking.
+        END
+          )
+        else
+          echo "has-conflicts=false" >> $GITHUB_OUTPUT
+          PR_BODY="#${ORIGINAL_PULL_REQUEST_NUMBER}"
+        fi
+
+        git push -u origin ${BACKPORT_BRANCH}
+
+        BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
+        BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
+
+        echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT
+        echo "New PR has been created: #${BACKPORT_PR_NUMBER}"
+
+        git checkout ${{ github.sha }}
+
+    - name: Auto approve backport PR
+      if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
+      uses: juliangruber/approve-pull-request-action@v1
+      with:
+        github-token: ${{ inputs.github-token-2 }}
+        number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
+
+    - name: Enable Pull Request Automerge
+      if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
+      uses: peter-evans/enable-pull-request-automerge@v2
+      with:
+        token: ${{ inputs.github-token }}
+        pull-request-number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
+        merge-method: squash
+
+    - uses: ./.github/actions/notify-pull-request
+      if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'true' }}
+      with:
+        include-log: false
+        message: Manual conflict resolution is required on \#${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
+
+    - uses: ./.github/actions/notify-pull-request
+      if: ${{ failure() }}
+      with:
+        include-log: true
+        message: Something went wrong while creating backport

.github/actions/e2e-download-uberjar/action.yml

@@ -68,10 +68,3 @@ runs:
     - name: Unzip Metabase artifact containing an uberjar
       run: unzip mb.zip
       shell: bash
-
-    - name: Get the version info
-      run: |
-        jar xf target/uberjar/metabase.jar version.properties
-        cat version.properties
-        mv version.properties resources/
-      shell: bash

.github/actions/e2e-prepare-containers/action.yml

@@ -90,7 +90,7 @@ runs:
 
         if ${{ inputs.webhook }}; then
           echo -e "${Y}Starting webhook test container..." &&
-          docker run -d -p 9080:8080/tcp tarampampam/webhook-tester serve --create-session 00000000-0000-0000-0000-000000000000 &&
+          docker run -d -p 9080:8080/tcp tarampampam/webhook-tester:1.1.0 serve --create-session 00000000-0000-0000-0000-000000000000 &&
           while ! nc -z localhost 9080; do sleep 1; done &&
           echo -e "${G}Webhook tester is up and running!"
         fi

.github/actions/find-squashed-commit/action.yml

@@ -28,3 +28,5 @@ runs:
       env:
         PULL_REQUEST_NUMBER: ${{ inputs.pull-request-number }}
         BASE_REF: ${{ inputs.base-ref }}
+    - run: git checkout ${{ github.sha }} # return to original commit
+      shell: bash

.github/actions/get-latest-release-branch/action.yml

@@ -1,41 +0,0 @@
-name: Get latest release branch
-
-outputs:
-  branch-name:
-    value: ${{ steps.get-latest-release-branch.outputs.result }}
-
-runs:
-  using: "composite"
-  steps:
-    - uses: actions/github-script@v7
-      id: get-latest-release-branch
-      with:
-        result-encoding: string
-        script: |
-          const releaseBranches = await github.rest.git.listMatchingRefs({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            ref: "heads/release-x.",
-          });
-
-          const getVersionFromBranch = branch => {
-            const match = branch.match(/release-x\.(.*?)\.x$/);
-            return match && parseInt(match[1]);
-          };
-          const latestReleaseBranch = releaseBranches.data
-            .filter(branch => getVersionFromBranch(branch.ref) !== null)
-            .reduce(
-              (prev, current) =>
-                getVersionFromBranch(prev.ref) > getVersionFromBranch(current.ref)
-                  ? prev
-                  : current,
-              { ref: "" },
-            );
-          const latestReleaseBranchName = latestReleaseBranch.ref.replace(
-            /^refs\/heads\//,
-            "",
-          );
-
-          console.log(`Latest release branch: ${latestReleaseBranchName}`);
-
-          return latestReleaseBranchName;

.github/actions/notify-pull-request/action.yml

@@ -10,10 +10,17 @@ runs:
   using: "composite"
   steps:
     - uses: actions/github-script@v7
-      id: get-latest-release-branch
+      id: notify-pull-request
       with:
         result-encoding: string
-        script: |
+        script: | # js
+          const pr = context.payload.pull_request ?? context.payload.issue;
+
+          if (!pr) {
+            console.error("This action can only be run on pull requests");
+            return;
+          }
+
           const message = "${{ inputs.message }}"
           const shouldIncludeLog = ${{ inputs.include-log }}.toString() === "true";
           const author = context.payload.sender.login;
@@ -27,7 +34,7 @@ runs:
           }
 
           github.rest.issues.createComment({
-            issue_number: context.payload.issue.number,
+            issue_number: pr.number,
             owner: context.repo.owner,
             repo: context.repo.repo,
             body,

.github/actions/prepare-backend/action.yml

@@ -2,10 +2,10 @@ name: Prepare back-end environment
 inputs:
   java-version:
     required: true
-    default: '11'
+    default: '21'
   clojure-version:
     required: true
-    default: '1.11.1.1262'
+    default: '1.12.0.1488'
   m2-cache-key:
     description: 'Key to cache M2 packages from Maven Central'
     required: true

.github/actions/prepare-frontend/action.yml

@@ -33,18 +33,5 @@ runs:
         path: node_modules
         key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock', '**/patches/*.patch') }}
 
-    - name: Get yarn cache directory path
-      id: yarn-cache-dir-path
-      if: steps.node-modules-cache.outputs.cache-hit != 'true'
-      run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
-      shell: bash
-
-    - uses: actions/cache@v4
-      if: steps.node-modules-cache.outputs.cache-hit != 'true'
-      with:
-        path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-        restore-keys: ${{ runner.os }}-yarn-
-
     - run: yarn install --frozen-lockfile --prefer-offline
       shell: bash

.github/actions/test-driver/action.yml

@@ -5,19 +5,24 @@ inputs:
     default: "driver"
   test-args:
     required: false
+  build-static-viz:
+    required: true
+    default: false
 
 runs:
   using: "composite"
   steps:
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
       with:
         m2-cache-key: driver
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+      if: ${{ inputs.build-static-viz == 'true' }}
     - name: Build static viz frontend
       run: yarn build-static-viz
       shell: bash
+      if: ${{ inputs.build-static-viz == 'true' }}
     - name: Test database driver
       run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash

.github/auto_request_review.yml

@@ -5,9 +5,9 @@
 files:
   # migrations related files
   'resources/migrations/**':
-    - team:core-backend-components
+    - team:core-workflows
   'src/metabase/db/custom_migrations.clj':
-    - team:core-backend-components
+    - team:core-workflows
 
 options:
   ignore_draft: true

.github/file-paths.yaml

@@ -5,6 +5,7 @@ default: &default
 shared_sources: &shared_sources
   - "src/**/*.cljc"
   - "src/**/*.cljs"
+  - "package.json"
 
 shared_specs: &shared_specs
   - "test/**/*.cljc"
@@ -79,7 +80,6 @@ backend_specs: &backend_specs
   - "test_modules/**"
   - "modules/drivers/*/test/**"
   - "test_config/**"
-  - "dev/**"
   - "test_resources/**"
 
 backend_all: &backend_all
@@ -94,14 +94,13 @@ sources: &sources
   - *backend_sources
 
 e2e_ci: &e2e_ci
-  - ".github/actions/build-e2e-matrix/**"
   - ".github/actions/prepare-frontend/**"
   - ".github/actions/prepare-backend/**"
   - ".github/actions/prepare-uberjar-artifact/**"
   - ".github/actions/e2e-prepare-containers/**"
   - ".github/actions/prepare-cypress/**"
   - ".github/actions/run-snowplow-micro/**"
-  - ".github/workflows/e2e-tests.yml"
+  - ".github/workflows/e2e-*"
 
 e2e_specs: &e2e_specs
   - "**/*.cy.*.js"

.github/scripts/handle-mochawesome-report.js

@@ -1,4 +1,5 @@
 const fs = require("fs");
+const { merge } = require("mochawesome-merge");
 
 const logger = { debug: console.debug, error: console.error };
 
@@ -50,15 +51,16 @@ const extractTestResultsInfo = ({ results, stats }) => {
   };
 };
 
-function parseReport() {
-  const content = fs.readFileSync(
-    "./cypress/reports/cypress-test-report.json",
-    "utf-8",
-  );
+async function generateReport() {
+  const files = ["./cypress/reports/mochareports/*.json"];
 
-  const data = JSON.parse(content);
+  return await merge({ files });
+}
 
-  return extractTestResultsInfo(data).failedTests.map(test => ({
+exports.generateReport = generateReport;
+
+function parseReport(report) {
+  return extractTestResultsInfo(report).failedTests.map(test => ({
     title: test.fullTitle,
     error: test.err?.message,
     path: test.path,

.github/scripts/run-presto-kerberos-integration-test.sh

@@ -10,9 +10,9 @@ export PATH="$PATH:$JAVA_HOME/bin"
 which java
 
 # install clojure version needed for Metabase
-curl -O https://download.clojure.org/install/linux-install-1.11.0.1100.sh
-chmod +x linux-install-1.11.0.1100.sh
-./linux-install-1.11.0.1100.sh
+curl -O https://download.clojure.org/install/linux-install-1.12.0.1488.sh
+chmod +x linux-install-1.12.0.1488.sh
+./linux-install-1.12.0.1488.sh
 
 RESOURCES_DIR=/app/source/resources
 

.github/team.json

@@ -12,42 +12,58 @@
         "metamben",
         "lbrdnk",
         "appleby",
-        "uladzimirdev"
+        "uladzimirdev",
+        "wzimrin",
+        "ericnormand"
       ]
     },
     {
       "name": "Drivers",
       "label": ".Team/Drivers",
-      "members": ["snoe"]
+      "projectUrl": "https://github.com/orgs/metabase/projects/98/views/1",
+      "members": [
+        "snoe",
+        "rileythomp"
+      ]
     },
     {
       "name": "Embedding",
       "label": ".Team/Embedding",
       "projectUrl": "https://github.com/orgs/metabase/projects/88/views/1",
-      "members": ["WiNloSt", "deniskaber", "oisincoveney", "npretto", "heypoom"]
+      "members": [
+        "WiNloSt",
+        "oisincoveney",
+        "npretto",
+        "heypoom",
+        "sanex3339"
+      ]
     },
     {
-      "name": "BEC",
-      "label": ".Team/BackendComponents",
+      "name": "Workflows",
+      "label": ".Team/Workflows",
       "projectUrl": "https://github.com/orgs/metabase/projects/50/views/1",
       "members": [
-        "tsmacdonald",
         "qnkhuat",
         "piranha",
-        "crisptrutski"
+        "crisptrutski",
+        "deniskaber",
+        "wotbrew",
+        "spalt08",
+        "stasgavrylov"
       ]
     },
     {
       "name": "Admin Webapp",
       "label": ".Team/AdminWebapp",
       "members": [
-        "noahmoss",
-        "escherize",
         "npfitz",
         "johnswanson",
         "rafpaf",
         "sloansparger",
-        "iethree"
+        "iethree",
+        "nvoxland",
+        "fraserdrops",
+        "edpaget"
       ]
     },
     {
@@ -56,14 +72,17 @@
       "members": [
         "alxnddr",
         "kulyk",
-        "adam-james-v"
+        "tsplude",
+        "lorem--ipsum",
+        "noahmoss"
       ]
     },
     {
       "name": "DevEx",
       "label": ".Team/DevEx",
       "members": [
-        "camsaul"
+        "camsaul",
+        "escherize"
       ]
     }
   ]

.github/workflows/auto-backport.yml

@@ -5,8 +5,16 @@ on:
 
 jobs:
   create-backport:
-    if: github.event.pull_request.merged == true && (contains(github.event.pull_request.labels.*.name, 'backport') && github.event.action == 'closed' || github.event.label.name == 'backport')
-    runs-on: ubuntu-22.04
+    if: | # the PR must be closed and have a backport label
+      (github.event.pull_request.merged == true || github.event.action == 'closed') && (
+        contains(github.event.pull_request.labels.*.name, 'backport') ||
+        contains(github.event.pull_request.labels.*.name, 'double-backport') ||
+        contains(github.event.pull_request.labels.*.name, 'triple-backport') ||
+        github.event.label.name == 'backport' ||
+        github.event.label.name == 'double-backport' ||
+        github.event.label.name == 'triple-backport'
+      )
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
@@ -19,91 +27,68 @@ jobs:
           pull-request-number: ${{ github.event.pull_request.number }}
           base-ref: ${{ github.event.pull_request.base.ref }}
 
-      - uses: ./.github/actions/get-latest-release-branch
-        name: Get latest release branch
-        id: get_latest_release_branch
-
-      - id: create_backport_pull_request
-        name: Create backport pull request
-        run: |
-          git config --global user.email "metabase-bot@metabase.com"
-          git config --global user.name "Metabase bot"
-
-          BACKPORT_BRANCH="backport-$COMMIT"
-
-          # Checkout the target branch and create a new backport branch
-          git checkout ${TARGET_BRANCH}
-          git fetch --all
-          git checkout -b ${BACKPORT_BRANCH}
-          git cherry-pick ${COMMIT} || true
-
-          CONFLICTS=$(git ls-files -u | wc -l)
-          if [ "$CONFLICTS" -gt 0 ]; then
-            git cherry-pick --abort
-
-            echo "Could not cherry pick because of a conflict"
-            echo "has-conflicts=true" >> $GITHUB_OUTPUT
-
-            # Add a shell script for resolving conflicts
-            echo "git reset HEAD~1" > ./backport.sh
-            echo "rm ./backport.sh" >> ./backport.sh
-            echo "git cherry-pick ${COMMIT}" >> ./backport.sh
-            echo "echo 'Resolve conflicts and force push this branch'" >> ./backport.sh
-            chmod +x ./backport.sh
-            git add ./backport.sh
-            git commit -m "Add backport resolution script"
-
-            PR_BODY=$(cat <<-END
-            #${ORIGINAL_PULL_REQUEST_NUMBER}
-            > [!IMPORTANT]
-            > Manual conflict resolution is required.
-            Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking.
-          END
-            )
-          else
-            echo "has-conflicts=false" >> $GITHUB_OUTPUT
-            PR_BODY="#${ORIGINAL_PULL_REQUEST_NUMBER}"
-          fi
-
-          git push -u origin ${BACKPORT_BRANCH}
-
-          BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
-          BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
-
-          echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT
-          echo "New PR has been created"
-
-          git checkout master
-        env:
-          TARGET_BRANCH: ${{ steps.get_latest_release_branch.outputs.branch-name }}
-          ORIGINAL_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
-          ORIGINAL_TITLE: ${{ github.event.pull_request.title }}
-          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          COMMIT: ${{ steps.find_commit.outputs.commit }}
-
-      - name: Auto approve backport PR
-        if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
-        uses: juliangruber/approve-pull-request-action@v1
+      - name: how many backports?
+        id: how-many-backports
+        uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
+          script: | # js
+            const labels = [
+              ...${{ toJson(github.event.pull_request.labels) }},
+              { name:"${{ github.event.label.name }}" }
+            ];
 
-      - name: Enable Pull Request Automerge
-        if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
-        uses: peter-evans/enable-pull-request-automerge@v2
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          pull-request-number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
-          merge-method: squash
+            const backportLabelNames = labels.filter(label => label.name.includes('backport')).map(label => label.name);
 
-      - uses: ./.github/actions/notify-pull-request
-        if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'true' }}
-        with:
-          include-log: false
-          message: Manual conflict resolution is required
+            let result = 1;
 
-      - uses: ./.github/actions/notify-pull-request
-        if: ${{ failure() }}
+            if (backportLabelNames.includes("triple-backport")) {
+              result = 3;
+            } else if (backportLabelNames.includes("double-backport")) {
+              result = 2;
+            }
+
+            console.log("backports", result);
+            return result;
+
+      - name: get release versions
+        id: get-latest-release-version
+        uses: actions/github-script@v7
         with:
-          include-log: true
-          message: Something went wrong while creating a backport
+          script: | # js
+            const currentVersion = Number(${{ vars.CURRENT_VERSION }});
+
+            const result =  {
+              latest: currentVersion,
+              secondLatest: currentVersion - 1,
+              thirdLatest: currentVersion - 2,
+            };
+
+            console.log(result);
+
+            return result;
+
+      - name: Single Backport
+        uses: ./.github/actions/create-backport
+        with:
+          target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).latest }}
+          backport-commit: ${{ steps.find_commit.outputs.commit }}
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          github-token-2: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Double Backport
+        if: ${{ fromJson(steps.how-many-backports.outputs.result) >= 2 }}
+        uses: ./.github/actions/create-backport
+        with:
+          target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).secondLatest }}
+          backport-commit: ${{ steps.find_commit.outputs.commit }}
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          github-token-2: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Triple Backport
+        if: ${{ fromJson(steps.how-many-backports.outputs.result) >= 3 }}
+        uses: ./.github/actions/create-backport
+        with:
+          target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).thirdLatest }}
+          backport-commit: ${{ steps.find_commit.outputs.commit }}
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          github-token-2: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/backend-cloverage.yml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   be-linter-cloverage:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 90
     steps:

.github/workflows/backend.yml

@@ -1,72 +1,22 @@
 name: Backend
 
 on:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review, labeled]
+  workflow_call:
+    inputs:
+      skip:
+        type: boolean
+        default: false
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-backend
   cancel-in-progress: true
 
 jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    outputs:
-      backend_all: ${{ steps.changes.outputs.backend_all }}
-      frontend_sources: ${{ steps.changes.outputs.frontend_sources }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  static-viz-files-changed:
-    needs: files-changed
-    if: needs.files-changed.outputs.backend_all != 'true' && needs.files-changed.outputs.frontend_sources == 'true'
-    name: Check whether static-viz files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    outputs:
-      static_viz: ${{ steps.static_viz.outputs.static_viz }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "files-changed"
-      - name: Build static-viz frontend
-        run: yarn build-static-viz
-      - name: Upload Static Viz Bundle Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: static-viz-bundle-${{ github.sha }}
-          path: resources/frontend_client/app/dist
-
-      - name: Check for static viz changes
-        uses: dorny/paths-filter@v3.0.0
-        id: static_viz
-        with:
-          token: ${{ github.token }}
-          filters: .github/static-viz-sources.yaml
-
   be-linter-clj-kondo:
-    needs: [files-changed, static-viz-files-changed]
-    if: |
-      !cancelled() &&
-      (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
+    if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
     timeout-minutes: 10
+    name: Clj-Kondo
     steps:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
@@ -77,13 +27,10 @@ jobs:
         run: ./bin/kondo.sh
 
   be-linter-eastwood:
-    needs: [files-changed, static-viz-files-changed]
-    if: |
-      !cancelled() &&
-      github.event.pull_request.draft == false &&
-      (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
+    if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
     timeout-minutes: 20
+    name: Eastwood
     steps:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
@@ -93,95 +40,100 @@ jobs:
       - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
         name: Run Eastwood linter
 
-  # Because it's not possible to conditionally run only `java-11-ee` test in the draft mode,
-  # we have to extract that job manually here. Backend developers have requested that this
-  # test runs at all times to give them an early warning sign is something is broken.
-  be-tests-java-11-ee-pre-check:
-    needs: [files-changed, static-viz-files-changed]
-    if: |
-      !cancelled() &&
-      github.event.pull_request.draft == true &&
-      (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
-    runs-on: ubuntu-22.04
-    name: be-tests-java-11-ee-pre-check
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: java-11-ee-pre-check
-
-      - run: yarn install --frozen-lockfile --prefer-offline
-      - name: Build static viz frontend
-        run: yarn build-static-viz
-
-      - name: Run tests
-        run: clojure -X:dev:ci:test:ee:ee-dev
-
-      - name: Publish Test Report (JUnit)
-        uses: dorny/test-reporter@v1
-        if: failure()
-        with:
-          path: "target/junit/**/*_test.xml"
-          name: JUnit Test Report be-tests-java-11-ee-pre-check
-          reporter: java-junit
-          list-suites: failed
-          list-tests: failed
-          fail-on-error: false
-
   be-tests:
-    needs: [files-changed, static-viz-files-changed]
-    if: |
-      !cancelled() &&
-      github.event.pull_request.draft == false &&
-      (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
+    if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    name: be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
-        edition: [oss, ee]
-        java-version: [11, 17, 21]
+        java-version: [21]
+        job:
+          - name: Enterprise Tests
+            edition: ee
+            build-static-viz: 'false'
+            test-args: >-
+              :only '"enterprise/backend/test"'
+          - name: EE App DB Tests (Part 1)
+            edition: ee
+            build-static-viz: 'true'
+            test-args: >-
+              :only '["test" ".clj-kondo/test"]'
+              :partition/total 2
+              :partition/index 0
+          - name: EE App DB Tests (Part 2)
+            edition: ee
+            build-static-viz: 'true'
+            test-args: >-
+              :only '["test" ".clj-kondo/test"]'
+              :partition/total 2
+              :partition/index 1
+          - name: OSS App DB Tests (Part 1)
+            edition: oss
+            build-static-viz: 'true'
+            test-args: >-
+              :only '["test" ".clj-kondo/test"]'
+              :partition/total 2
+              :partition/index 0
+          - name: OSS App DB Tests (Part 2)
+            edition: oss
+            build-static-viz: 'true'
+            test-args: >-
+              :only '["test" ".clj-kondo/test"]'
+              :partition/total 2
+              :partition/index 1
+    name: "Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
+    env:
+      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
+      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
+      # it in to the command below.
+      __ADDITIONAL_EXCLUDED_TAG__: >-
+        ${{
+          (
+            github.event_name == 'push' &&
+            (
+              github.ref == 'master' ||
+              startsWith(github.ref, 'release-')
+            ) &&
+            ''
+          ) ||
+          ':mb/old-migrations-test'
+        }}
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
+        if: ${{ matrix.job.build-static-viz == 'true' }}
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: be-tests
+          java-version: "${{ matrix.java-version }}"
       # Depending on which files changed, we might either have to build static-viz
       # from scratch or download the previously built artifact
       - name: Build static-viz frontend
-        if: needs.files-changed.outputs.backend_all == 'true'
+        if: ${{ matrix.job.build-static-viz == 'true' && !inputs.skip }}
         run: yarn build-static-viz
       - name: Download Static Viz Bundle Artifact
-        if: needs.static-viz-files-changed.outputs.static_viz == 'true'
+        if: ${{ matrix.job.build-static-viz == 'true' && !inputs.skip }}
         uses: actions/download-artifact@v4
         with:
           name: static-viz-bundle-${{ github.sha }}
           path: resources/frontend_client/app/dist
 
-      - name: Run tests
+      - name: "Test Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
         id: run-java-tests
-        if: matrix.java-version != 21
-        run: clojure -X:dev:ci:test:${{ matrix.edition }}:${{ matrix.edition }}-dev
-
-      - name: If using Java 21, only run tests on `master`
-        id: run-java-tests-21
-        if: matrix.java-version == 21 && github.ref_name == 'master'
-        run: clojure -X:dev:ci:test:${{ matrix.edition }}:${{ matrix.edition }}-dev
+        run: >-
+          clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev
+          :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          ${{ matrix.job.test-args }}
 
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always() && (steps.run-java-tests.conclusion != 'skipped' || steps.run-java-tests-21.conclusion != 'skipped')
         with:
           input-path: ./target/junit/
-          output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
+          output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
           aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
@@ -193,74 +145,37 @@ jobs:
         if: failure()
         with:
           path: "target/junit/**/*_test.xml"
-          name: JUnit Test Report be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
+          name: JUnit Test Report be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
           reporter: java-junit
           list-suites: failed
           list-tests: failed
           fail-on-error: false
 
-  be-tests-stub:
-    needs: [be-tests]
-    if: |
-      !cancelled() &&
-      github.event.pull_request.draft == false && needs.be-tests.result == 'skipped'
-    runs-on: ubuntu-22.04
-    name: be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
-    timeout-minutes: 5
-    strategy:
-      fail-fast: false
-      matrix:
-        edition: [oss, ee]
-        java-version: [11, 17, 21]
-    steps:
-      - run: |
-          echo "Didn't run due to conditional filtering"
-
   # checks that all the namespaces we actually ship can be compiled, without any dependencies that we don't ship (such
   # as `:dev` dependencies). See #27009 for more context.
   be-check:
-    needs: [files-changed, static-viz-files-changed]
-    if: |
-      !cancelled() &&
-      github.event.pull_request.draft == false &&
-      (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
+    if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    name: be-check-java-${{ matrix.java-version }}
     timeout-minutes: 10
     strategy:
       matrix:
-        java-version: [11, 17, 21]
+        java-version: [21]
+    name: "Check Java ${{ matrix.java-version }}"
     steps:
       - uses: actions/checkout@v4
       - name: Prepare backend
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: be-check
+      # TODO -- we should probably also check WITHOUT ee -- do a check with only OSS namespaces on the classpath
       - name: Check namespaces
         run: clojure -M:ee:drivers:check
 
-  be-check-stub:
-    needs: [files-changed, static-viz-files-changed, be-check]
-    if: |
-      always() &&
-      github.event.pull_request.draft == false &&
-      needs.be-check.result == 'skipped'
-    runs-on: ubuntu-22.04
-    name: be-check-java-${{ matrix.java-version }}
-    timeout-minutes: 10
-    strategy:
-      matrix:
-        java-version: [11, 17, 21]
-    steps:
-      - run: |
-          echo "Didn't run due to conditional filtering"
-
   be-cljfmt:
-    needs: [files-changed]
-    if: |
-      !cancelled() && needs.files-changed.outputs.backend_all == 'true'
+    if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
     timeout-minutes: 10
+    name: Cljfmt
     steps:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
@@ -269,3 +184,44 @@ jobs:
           m2-cache-key: 'cljfmt'
       - name: Run cljfmt
         run: clojure -T:cljfmt check
+
+  be-tests-result:
+    needs:
+      - be-linter-eastwood
+      - be-linter-clj-kondo
+      - be-cljfmt
+      - be-check
+      - be-tests
+    if: always() && !cancelled()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      needs: ${{ toJson(needs) }}
+    steps:
+      - name: Check backend job status
+        uses: actions/github-script@v7
+        env:
+          needs: ${{ toJson(needs) }}
+        with:
+          script: | # js
+            const needs = JSON.parse(process.env.needs);
+            const jobs = Object.entries(needs).map(
+              ([jobName, jobValues]) => ({
+                name: jobName,
+                result: jobValues.result
+              }));
+
+            // are all jobs skipped or successful?
+            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
+              console.log('All jobs are skipped or successful');
+              process.exit(0);
+            }
+
+            // otherwise, something failed
+            console.log('Some backend jobs failed');
+            jobs.forEach((job) => {
+              if (job.result !== 'success') {
+                console.log(`${job.name} - ${job.result}`);
+              }
+            });
+            process.exit(1);

.github/workflows/backport-reminder.yml

@@ -9,10 +9,11 @@ on:
 jobs:
   backport-reminder:
     name: Decide whether to backport or not
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: jesusvasquez333/verify-pr-label-action@v1.4.0
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
-          valid-labels: 'backport, no-backport'
+          valid-labels: 'no-backport, backport, double-backport, triple-backport'
           disable-reviews: true

.github/workflows/backport.yml

@@ -1,177 +0,0 @@
-# Cherry-picks commits from current branch to a specified one in a command "@metabase-bot backport release-x.40.x"
-name: Backport
-
-on:
-  issue_comment:
-    types: [created]
-
-jobs:
-  create_pull_request:
-    name: Creates a pull request
-    if: contains(github.event.comment.body, '@metabase-bot backport')
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: tibdex/github-app-token@v2.1.0
-        id: generate-token
-        with:
-          app_id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private_key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
-        name: Cherry-pick commits and create PR
-        with:
-          fetch-depth: 0
-      - name: Verify Membership
-        id: verify-membership
-        uses: ./.github/actions/verify-membership
-        with:
-          github_token: ${{ steps.generate-token.outputs.token }}
-          organization_name: metabase
-          username: ${{ github.event.comment.user.login }}
-      - run: |
-          result=${{ steps.verify-membership.outputs.is_member }}
-          if [ $result == false ]; then
-              echo User ${{ github.event.comment.user.login }} is not a member of Metabase organization
-              exit 1
-          fi
-      - uses: actions/github-script@v7
-        id: branch_info
-        with:
-          script: |
-            await github.rest.reactions.createForIssueComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              comment_id: context.payload.comment.id,
-              content: 'eyes',
-            });
-
-            // Example: @metabase-bot backport release-x.40.x
-            const [_botName, _command, targetBranch] = context.payload.comment.body.split(" ");
-            console.log(`Target branch is ${targetBranch}`);
-
-            const { data: originalPullRequest } = await github.rest.pulls.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.payload.issue.number,
-            });
-
-            const { data: commits } = await github.rest.pulls.listCommits({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.payload.issue.number,
-            });
-
-            const targetRef = await github.rest.git.getRef({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              ref: `heads/${targetBranch}`,
-            });
-
-            const backportBranch = `backport-${originalPullRequest.head.ref}-${targetBranch}`
-
-            try {
-              await github.rest.git.getRef({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                ref: `heads/${backportBranch}`,
-              });
-            } catch(e) {
-              if (e.status === 404) {
-                await github.rest.git.createRef({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  ref: `refs/heads/${backportBranch}`,
-                  sha: targetRef.data.object.sha,
-                });
-              }
-            }
-
-            return {
-              backportBranch,
-              targetBranch,
-              originalPullRequest,
-              startSha: commits[0].sha,
-              endSha: commits[commits.length - 1].sha
-            }
-      - id: create_backport_pull_request
-        name: Create backport pull request
-        run: |
-          git config --global user.email "metabase-bot@metabase.com"
-          git config --global user.name "Metabase bot"
-
-          git fetch --all
-
-          git checkout "${BACKPORT_BRANCH}"
-          git reset --hard origin/${TARGET_BRANCH}
-
-          if [[ -z $(git ls-remote --heads origin ${ORIGINAL_HEAD_REF}) ]]; then
-            echo "PR has been merged, searching for a squashed commit in the base branch"
-            echo "searching for a commit in a ${ORIGINAL_BASE_REF} that contains pull request number ${ORIGINAL_PULL_REQUEST_NUMBER}"
-            SQUASHED_COMMIT=$(env -i git log ${ORIGINAL_BASE_REF} --grep="(#${ORIGINAL_PULL_REQUEST_NUMBER})" --format="%H")
-
-            if [ -n "${SQUASHED_COMMIT}" ]; then
-              echo "found commit ${SQUASHED_COMMIT}"
-              git cherry-pick ${SQUASHED_COMMIT}
-            else
-              echo "probably a PR wasn't merged with Squash And Merge button, searching again"
-              SQUASHED_COMMIT=$(env -i git log ${ORIGINAL_BASE_REF} --grep="#${ORIGINAL_PULL_REQUEST_NUMBER}" --format="%H")
-
-              if [ -n "${SQUASHED_COMMIT}" ]; then
-                echo "found commit ${SQUASHED_COMMIT}"
-                git cherry-pick ${SQUASHED_COMMIT}
-              else
-                echo "No squashed commit found for PR #${ORIGINAL_PULL_REQUEST_NUMBER}"
-                exit 1
-              fi
-            fi
-
-          else
-            echo "PR has not been merged, copying all commits"
-            git cherry-pick ${ORIGINAL_BASE_SHA}..${ORIGINAL_HEAD_SHA}
-          fi
-
-          git push origin "${BACKPORT_BRANCH}" --force-with-lease
-
-          if [[ $(gh pr list --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" -s "open") ]]; then
-              echo "PR already exists"
-          else
-              BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "#${ORIGINAL_PULL_REQUEST_NUMBER}")
-              BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
-
-              echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT
-              echo "New PR has been created"
-          fi
-        env:
-          ORIGINAL_TITLE: ${{ fromJson(steps.branch_info.outputs.result).originalPullRequest.title }}
-          ORIGINAL_BASE_REF: ${{ fromJson(steps.branch_info.outputs.result).originalPullRequest.base.ref }}
-          ORIGINAL_BASE_SHA: ${{ fromJson(steps.branch_info.outputs.result).originalPullRequest.base.sha }}
-          ORIGINAL_HEAD_REF: ${{ fromJson(steps.branch_info.outputs.result).originalPullRequest.head.ref }}
-          ORIGINAL_HEAD_SHA: ${{ fromJson(steps.branch_info.outputs.result).originalPullRequest.head.sha }}
-          ORIGINAL_PULL_REQUEST_NUMBER: ${{ fromJson(steps.branch_info.outputs.result).originalPullRequest.number }}
-          TARGET_BRANCH: ${{ fromJson(steps.branch_info.outputs.result).targetBranch }}
-          BACKPORT_BRANCH: ${{ fromJson(steps.branch_info.outputs.result).backportBranch }}
-          START_SHA: ${{ fromJson(steps.branch_info.outputs.result).startSha }}
-          END_SHA: ${{ fromJson(steps.branch_info.outputs.result).endSha }}
-          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
-      - name: Auto approve backport PR
-        uses: juliangruber/approve-pull-request-action@v1
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
-      - name: Enable Pull Request Automerge
-        uses: peter-evans/enable-pull-request-automerge@v2
-        with:
-          token: ${{ steps.generate-token.outputs.token }}
-          pull-request-number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
-          merge-method: squash
-
-  notify_when_failed:
-    runs-on: ubuntu-22.04
-    name: Notify about failure
-    needs: create_pull_request
-    if: ${{ failure() }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/notify-pull-request
-        with:
-          include-log: true
-          message: something went wrong while creating a backport

.github/workflows/bugs-triage-slack-notification.yml

@@ -3,14 +3,13 @@ name: Bugs Slack Notification
 on:
   issues:
     types:
-      - opened
+      - labeled
 jobs:
-  on-issue-opened:
+  on-issue-labeled:
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     if: |
-        contains(github.event.issue.labels.*.name, '.Needs Triage') &&
-        contains(github.event.issue.labels.*.name, 'Type:Bug')
+      github.event.label.name == '.Needs Triage' && contains(github.event.issue.labels.*.name, 'Type:Bug')
     steps:
       - name: Setting title
         uses: actions/github-script@v7
@@ -34,7 +33,7 @@ jobs:
       - name: Send the issue ${{ github.event.issue.number }} to Slack
         id: slack
         if: steps.check_labels.outputs.has_team_label == 'false'
-        uses: slackapi/slack-github-action@v1.23.0
+        uses: slackapi/slack-github-action@v1.26.0
         with:
           payload: |
             {

.github/workflows/build-for-release.yml

@@ -100,21 +100,14 @@ jobs:
             oss: getCanonicalVersion(version, 'oss'),
           };
 
-          const ossReleased = await hasBeenReleased({
+          const released = await hasBeenReleased({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version: versions.oss,
           });
 
-          const eeReleased = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.ee,
-          });
-
-          if (ossReleased || eeReleased) {
+          if (released) {
             throw new Error("This version has already been released!", version);
           }
 
@@ -243,24 +236,11 @@ jobs:
           ./COMMIT-ID
           ./SHA256.sum
 
-  trigger-tests:
-    needs: [build-uberjar-for-release]
-    permissions:
-      actions: write
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    steps:
-      - name: trigger pre-release testing
-        uses: actions/github-script@v7
-        with:
-          script: | # js
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'pre-release.yml',
-              ref: '${{ github.ref }}',
-              inputs: {
-                commit: '${{ inputs.commit }}',
-                version: '${{ inputs.version }}',
-              }
-            });
+  run-pre-release-tests:
+    name: Run pre-release tests for ${{ inputs.version }}
+    needs: build-uberjar-for-release
+    uses: ./.github/workflows/pre-release.yml
+    secrets: inherit
+    with:
+      commit: ${{ inputs.commit }}
+      version: ${{ inputs.version }}

.github/workflows/check-milestone.yml

@@ -16,7 +16,7 @@ jobs:
   set-milestone:
     name: Automatically set milestone
     runs-on: ubuntu-22.04
-    timeout-minutes: 15
+    timeout-minutes: 30
     env:
       isNewReleaseBranch: ${{ github.event_name == 'workflow_dispatch' }}
     permissions:

.github/workflows/chromatic.yml

@@ -43,6 +43,8 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
+      - name: Compile CLJS
+        run: NODE_ENV=development yarn build-pure:cljs
       - name: Publish to Chromatic
         uses: chromaui/action@v10.2.0
         env:

.github/workflows/codenotify.yml

@@ -1,22 +0,0 @@
-name: Codenotify
-
-on:
-  pull_request:
-    types: [opened, synchronize, ready_for_review]
-    # We're currently notifying developers only for frontend source changes.
-    # Update this glob if that ever changes and we start including backend source code changes.
-    paths:
-      - 'frontend/src/metabase/**'
-      - 'enterprise/frontend/src/metabase-enterprise/**'
-
-jobs:
-  codenotify:
-    runs-on: ubuntu-22.04
-    name: Codenotify
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-      - uses: sourcegraph/codenotify@v0.6.4
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/doc-md-links.yml

@@ -1,18 +0,0 @@
-name: Lint doc Markdown links
-
-on:
-  push:
-    paths:
-      - docs/**
-  pull_request:
-    paths:
-      - docs/**
-jobs:
-  markdown-link-check:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Lint doc links
-        run: yarn run docs-lint-links

.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml

@@ -0,0 +1,254 @@
+name: E2E Cross-version Component Tests for Embedding SDK
+
+on:
+  push:
+    branches:
+      - "release-**"
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - "release-**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      e2e_all: ${{ steps.changes.outputs.e2e_all }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  # if this is a test on a release branch, we need to check the build requirements
+  get-build-requirements:
+    if: |
+      !cancelled()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get build dependencies
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const {
+              getBuildRequirements,
+              getVersionFromReleaseBranch,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const targetBranchName = '${{ github.base_ref || github.ref }}';
+
+            const version = getVersionFromReleaseBranch(targetBranchName);
+            const requirements = getBuildRequirements(version);
+
+            return {
+              java_version: requirements.java,
+              node_version: requirements.node,
+            };
+
+  build:
+    needs: [files-changed, get-build-requirements]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == false
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    env:
+      MB_EDITION: ee
+      INTERACTIVE: false
+      # make sure that builds on release branches get licenses, because we use them for releases
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: uberjar
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 11 }}"
+
+      - name: Build uberjar with ./bin/build.sh
+        run: ./bin/build.sh
+
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+  resolve-sdk-version:
+    if: |
+      !cancelled()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      sdk_version: ${{ fromJson(steps.dependencies.outputs.result).sdk_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get latest SDK release for this branch
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const { getSdkVersionFromReleaseBranchName } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const branchName = '${{ github.base_ref || github.ref }}';
+
+            const sdk_version = await getSdkVersionFromReleaseBranchName({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              branchName,
+            });
+
+            return {
+              sdk_version,
+            };
+
+  e2e-tests:
+    needs: [get-build-requirements, build, resolve-sdk-version]
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-tests-embedding-sdk
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # Needed to omit newly added tests for functionality that is not yet released
+      - name: Sparse checkout tests from SDK release commit
+        uses: actions/checkout@v4
+        with:
+          ref: embedding-sdk-${{ needs.resolve-sdk-version.outputs.sdk_version }}
+          path: sdk-release-e2e
+          sparse-checkout: e2e
+
+      - name: Move tests from the release commit into the repo
+        run: |
+          rm -rf ./e2e/support/*
+          mv ./sdk-release-e2e/e2e/support/* ./e2e/support
+
+          rm -rf ./e2e/test-component/*
+          mv ./sdk-release-e2e/e2e/test-component/* ./e2e/test-component
+        shell: bash
+
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Install Embedding SDK package v${{ needs.resolve-sdk-version.outputs.sdk_version }}
+        run: yarn add @metabase/embedding-sdk-react@${{ needs.resolve-sdk-version.outputs.sdk_version }}
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Make app db snapshot
+        run: node e2e/runner/run_cypress_ci.js snapshot --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Run component tests for Embedding SDK
+        run: node e2e/runner/run_cypress_ci.js component --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-cross-version
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();
+
+  e2e-tests-skipped-stub:
+    needs: [e2e-tests]
+    if: |
+      !cancelled() &&
+      needs.e2e-tests.result == 'skipped'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    name: e2e-component-tests-embedding-sdk-cross-version
+    steps:
+      - run: |
+          echo "Didn't run due to conditional filtering"

.github/workflows/e2e-component-tests-embedding-sdk.yml

@@ -0,0 +1,216 @@
+name: E2E Component Tests for Embedding SDK
+
+on:
+  push:
+    branches:
+      - "master"
+      - "release-**"
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      e2e_all: ${{ steps.changes.outputs.e2e_all }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  # if this is a test on a release branch, we need to check the build requirements
+  get-build-requirements:
+    if: |
+      !cancelled() &&
+      contains(github.base_ref || github.ref, 'release-x')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get build dependencies
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const {
+              getBuildRequirements,
+              getVersionFromReleaseBranch,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const targetBranchName = '${{ github.base_ref || github.ref }}';
+
+            const version = getVersionFromReleaseBranch(targetBranchName);
+            const requirements = getBuildRequirements(version);
+
+            return {
+              java_version: requirements.java,
+              node_version: requirements.node,
+            };
+
+  build:
+    needs: [files-changed, get-build-requirements]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == false &&
+      needs.files-changed.outputs.e2e_all == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    env:
+      MB_EDITION: ee
+      INTERACTIVE: false
+      # make sure that builds on release branches get licenses, because we use them for releases
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: uberjar
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
+
+      - name: Build uberjar with ./bin/build.sh
+        run: ./bin/build.sh
+
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+  e2e-tests:
+    needs: [get-build-requirements, build]
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-tests-embedding-sdk
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      CYPRESS_IS_EMBEDDING_SDK: true
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK ${{ needs.get-build-requirements.outputs.java_version || 21 }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ needs.get-build-requirements.outputs.java_version || 21 }}
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+        shell: bash
+
+      - name: Build Embedding SDK package
+        run: yarn build-embedding-sdk
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Make app db snapshot
+        run: node e2e/runner/run_cypress_ci.js snapshot --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Run component tests for Embedding SDK
+        run: node e2e/runner/run_cypress_ci.js component --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-latest
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();
+
+  e2e-tests-skipped-stub:
+    needs: [e2e-tests]
+    if: |
+      !cancelled() &&
+      needs.e2e-tests.result == 'skipped'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    name: e2e-component-tests-embedding-sdk
+    steps:
+      - run: |
+          echo "Didn't run due to conditional filtering"

.github/workflows/e2e-cross-version.yml

@@ -9,6 +9,8 @@ on:
 jobs:
   files-changed:
     name: Check which files changed
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 3
     outputs:
@@ -124,7 +126,7 @@ jobs:
     steps:
       - uses: actions/setup-node@v4
         with:
-          node-version: lts/Hydrogen # 18.x.x
+          node-version: lts/Jod # 22.x.x
       - run: npm install @slack/web-api
       - name: notify slack of failure
         uses: actions/github-script@v7

.github/workflows/e2e-matrix-builder.yml

@@ -0,0 +1,72 @@
+name: E2E Matrix Builder
+
+on:
+  workflow_call:
+    inputs:
+      chunks:
+        required: true
+        type: number
+        default: 30
+    outputs:
+      matrix:
+        value: ${{ jobs.build-matrix.outputs.matrix }}
+      regularChunks:
+        value: ${{ jobs.build-matrix.outputs.regularChunks }}
+
+jobs:
+  build-matrix:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.matrix.outputs.config }}
+      regularChunks: ${{ steps.matrix.outputs.regularChunks }}
+    steps:
+      - uses: actions/setup-node@v3
+        with:
+          node-version: '22.x'
+      - uses: actions/github-script@v7
+        id: matrix
+        env:
+          chunks: ${{ inputs.chunks }}
+        with:
+          script: | # js
+            const java = 21;
+            const defaultRunner = "ubuntu-22.04";
+
+            const defaultOptions = {
+              "java-version": java,
+              runner: defaultRunner,
+              edition: "ee",
+            };
+
+            const allSpecs = "./e2e/test/scenarios/**/*.cy.spec.*";
+
+            // see config.js function getSplittableSpecs for logic that excludes some tests from auto splitting
+            const specialTests = [
+              { name: "embedding-sdk", specs: "./e2e/test/scenarios/embedding-sdk/**.cy.spec.*" },
+              { name: "oss-subset", edition: 'oss', tags: "@OSS @smoke+-@EE", specs: allSpecs },
+              { name: "mongo", tags: "@mongo", specs: allSpecs },
+            ];
+
+            const inputChunks = Number(process.env.chunks);
+            const regularChunks = inputChunks - specialTests.length;
+
+            const regularTests = new Array(regularChunks).fill(1)
+              .map((files, index) => ({
+                name: `e2e-group-${index + 1}`,
+              }));
+
+            // regular chunks need to come before special chunks
+            const testSets = [...regularTests, ...specialTests];
+
+            const config = testSets.map((options) => ({
+              ...defaultOptions,
+              ...options,
+            }));
+
+
+            core.setOutput("regularChunks", JSON.stringify(regularChunks));
+            core.setOutput("config", JSON.stringify({ include: config }));
+
+            console.log({ regularChunks });
+            console.log("matrix config", config);

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -87,22 +87,26 @@ jobs:
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-      - name: Prepare JDK 11
+      - name: Prepare JDK 21
         uses: actions/setup-java@v4
         with:
-          java-version: 11
+          java-version: 21
           distribution: "temurin"
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
       - name: Run Snowplow micro
         uses: ./.github/actions/run-snowplow-micro
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+      - name: Generate database snapshots
+        run: node e2e/runner/run_cypress_ci.js snapshot
 
       # For all options and fine-grained control, take a look at the documentation
       # https://github.com/cypress-io/cypress/tree/develop/npm/grep
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
         run: |
-          yarn run test-cypress-run \
+          node e2e/runner/run_cypress_ci.js e2e \
           --spec '${{ github.event.inputs.spec }}' \
           --env burn=${{ github.event.inputs.burn_in }},grep='${{ github.event.inputs.grep }}' \
           --config-file e2e/support/cypress-stress-test.config.js \

.github/workflows/e2e-test.yml

@@ -0,0 +1,172 @@
+name: E2E Test
+run-name: E2E Test - ${{ inputs.name }}
+
+on:
+  workflow_call:
+    inputs:
+      name:
+        required: true
+        type: string
+      edition: # oss | ee
+        required: false
+        type: string
+        default: ee
+      specs:
+        required: false
+        default: ./e2e/test/scenarios/**/*.cy.spec.*
+        type: string
+      tags:
+        required: false
+        type: string
+      runner:
+        required: false
+        type: string
+        default: ubuntu-22.04
+      total_chunks: # number of chunks
+        required: false
+        type: number
+      split_index: # index of the chunk
+        required: false
+        type: number
+
+jobs:
+  e2e-tests:
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 45
+    name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
+    env:
+      MB_EDITION: ${{ inputs.edition }}
+      DISPLAY: ""
+      QA_DB_ENABLED: true
+      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
+      JOB_NAME: ${{ inputs.name }}
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      MB_EXPERIMENTAL_SEARCH_BLOCK_ON_QUEUE: true
+      MB_SNOWPLOW_AVAILABLE: true
+      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+      CYPRESS_QA_DB_MONGO: ${{ inputs.name == 'mongo' }}
+      CYPRESS_IS_EMBEDDING_SDK: ${{ inputs.name == 'embedding-sdk' }}
+      mongo: ${{ inputs.name == 'mongo' }}
+      postgres: ${{ inputs.name != 'mongo' }}
+      mysql: ${{ inputs.name != 'mongo' }}
+      openldap: true
+      maildev: true
+      webhook: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
+          openldap: ${{ env.openldap }}
+          postgres: ${{ env.postgres }}
+          mysql: ${{ env.mysql }}
+          mongo: ${{ env.mongo }}
+          webhook: ${{ env.webhook }}
+
+      - name: Run Embedding SDK Storybook
+        if: inputs.name == 'embedding-sdk'
+        uses: ./.github/actions/run-embedding-sdk-storybook
+
+      - name: Retrieve uberjar artifact for ${{ inputs.edition }}
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: 21
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Run Snowplow micro
+        uses: ./.github/actions/run-snowplow-micro
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Generate database snapshots
+        run: node e2e/runner/run_cypress_ci.js snapshot
+
+      - name: Run auto-split Cypress tests on ${{ inputs.name }}
+        if: ${{ !inputs.specs }}
+        env:
+          SPLIT: ${{ inputs.total_chunks }}
+          SPLIT_INDEX: ${{ inputs.split_index }}
+          SPLIT_FILE: "./e2e/support/timings.json"
+          SPLIT_OUTPUT_FILE: "newTimes.json"
+          SPLIT_TIME_THRESHOLD: 5.0
+          # do not write cypress-split summary to github
+          SPLIT_SUMMARY: false
+        shell: bash
+        run: |
+          node e2e/runner/run_cypress_ci.js e2e \
+            --env grepTags="-@mongo+-@flaky+-@OSS --@quarantine",grepOmitFiltered=true \
+            --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
+        if: ${{ inputs.specs }}
+        shell: bash
+        run: |
+          node e2e/runner/run_cypress_ci.js e2e \
+          --env grepTags="${{inputs.tags}} --@quarantine",grepOmitFiltered=true \
+          --spec '${{ inputs.specs }}' \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-${{ inputs.name }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-${{ inputs.name }}-${{ inputs.edition }}
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();

.github/workflows/e2e-tests.yml

@@ -1,43 +1,21 @@
 name: E2E Tests
 
 on:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_call:
+    inputs:
+      skip:
+        type: boolean
+        default: false
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-e2e
   cancel-in-progress: true
 
 jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_all: ${{ steps.changes.outputs.e2e_all }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
   e2e-matrix-builder:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    outputs:
-      matrix: ${{ steps.e2e-matrix.outputs.matrix }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Generate matrix for E2E tests
-        id: e2e-matrix
-        uses: ./.github/actions/build-e2e-matrix
+    uses: ./.github/workflows/e2e-matrix-builder.yml
+    with:
+      chunks: 50
 
   # if this is a test on a release branch, we need to check the build requirements
   get-build-requirements:
@@ -71,12 +49,8 @@ jobs:
             };
 
   build:
-    needs: [files-changed, e2e-matrix-builder, get-build-requirements]
-    if: |
-      !cancelled() &&
-      github.event.pull_request.draft == false &&
-      needs.e2e-matrix-builder.result == 'success' &&
-      needs.files-changed.outputs.e2e_all == 'true'
+    needs: [get-build-requirements]
+    if: ${{ !cancelled() && !inputs.skip }}
     runs-on: ubuntu-22.04
     timeout-minutes: 25
     strategy:
@@ -97,7 +71,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: uberjar
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 11 }}"
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
 
       - name: Build uberjar with ./bin/build.sh
         run: ./bin/build.sh
@@ -107,180 +81,97 @@ jobs:
         with:
           name: metabase-${{ matrix.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
 
-  e2e-tests:
-    needs: [build, e2e-matrix-builder]
-    if: |
-      !cancelled() && needs.build.result == 'success'
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 45
-    name: e2e-tests-${{ matrix.name }}-${{ matrix.edition }}
-    env:
-      MB_EDITION: ${{ matrix.edition }}
-      DISPLAY: ""
-      QA_DB_ENABLED: true
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
-      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.even.head.sha }}
-      MB_SNOWPLOW_AVAILABLE: true
-      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJSON(needs.e2e-matrix-builder.outputs.matrix) }}
-
+  reset-e2e-test-comment:
+    if: ${{ github.event_name == 'pull_request' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Prepare Docker containers
-        uses: ./.github/actions/e2e-prepare-containers
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          maildev: true
-          openldap: ${{ startsWith(matrix.name, 'admin') }}
-          postgres: ${{ matrix.name != 'mongo'}}
-          mysql: ${{ matrix.name != 'mongo'}}
-          mongo: ${{ matrix.name == 'mongo'}}
-          webhook: true
-
-      - name: Retrieve uberjar artifact for ${{ matrix.edition }}
-        uses: actions/download-artifact@v4
-        with:
-          name: metabase-${{ matrix.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-
-      - name: Get the version info
-        run: |
-          jar xf target/uberjar/metabase.jar version.properties
-          mv version.properties resources/
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare JDK ${{ matrix.java-version }}
-        uses: actions/setup-java@v4
-        with:
-          java-version: ${{ matrix.java-version }}
-          distribution: "temurin"
-
-      - name: Prepare Cypress environment
-        id: cypress-prep
-        uses: ./.github/actions/prepare-cypress
-
-      - name: Run Snowplow micro
-        uses: ./.github/actions/run-snowplow-micro
-
-      - name: Run OSS-specific Cypress tests
-        if: matrix.edition == 'oss' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags=@OSS,grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run slow and resource-intensive Cypress tests
-        if: matrix.name == 'slow' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="@slow",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run Flaky Cypress tests
-        if: matrix.name == 'flaky' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="@flaky --@quarantine",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run EE Cypress tests on ${{ matrix.name }}
-        if: matrix.context == 'folder' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="-@slow+-@mongo+-@flaky --@quarantine",grepOmitFiltered=true \
-          --folder ${{ matrix.name }} \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run E2E tests that depend on Mongo
-        if: matrix.name == 'mongo'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="@mongo --@quarantine",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-        env:
-          CYPRESS_QA_DB_MONGO: true
-
-      - name: Run Embedding SDK Storybook
-        if: matrix.context == 'embedding-sdk' && github.event_name != 'schedule'
-        uses: ./.github/actions/run-embedding-sdk-storybook
-
-      - name: Run E2E tests for Embedding SDK
-        if: matrix.context == 'embedding-sdk' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="-@slow+-@flaky --@quarantine",grepOmitFiltered=true \
-          --folder 'embedding-sdk' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-        env:
-          CYPRESS_IS_EMBEDDING_SDK: true
-        shell: bash
-
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-${{ matrix.name }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
-      - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: cypress-recording-${{ matrix.name }}-${{ matrix.edition }}
-          path: |
-            ./cypress
-            ./logs/test.log
-          if-no-files-found: ignore
-
-      - name: Publish Summary
-        if: failure()
+      - name: Remove test results comment
         uses: actions/github-script@v7
         with:
-          script: | #js
-            const {
-               parseReport,
-               formatSummary
-             } = require("./.github/scripts/handle-mochawesome-report.js");
+          script: | # js
+            const { owner, repo } = context.repo;
 
-             const report = parseReport();
-             const summary = formatSummary(report);
+            const { data: comments } = await github.rest.issues.listComments({
+              owner,
+              repo,
+              issue_number: context.issue.number,
+            }).catch(console.error);
 
-             await core.summary.addRaw(summary).write();
+            if (!comments) {
+              return;
+            }
 
-  e2e-tests-skipped-stub:
-    needs: [e2e-tests, e2e-matrix-builder]
+            const comment = comments.find((comment) => comment.body.includes('## e2e tests failed on '));
+
+            if (comment) {
+              await github.rest.issues.deleteComment({
+                owner,
+                repo,
+                comment_id: comment.id,
+              });
+            }
+
+  e2e-tests:
+    name: ${{ matrix.name }}-${{ matrix.edition }}
+    uses: ./.github/workflows/e2e-test.yml
+    needs:
+      - e2e-matrix-builder
+      - build
     if: |
-      !cancelled() &&
-      needs.e2e-tests.result == 'skipped'
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 5
-    name: e2e-tests-${{ matrix.name }}-${{ matrix.edition }}
+      !cancelled() && needs.build.result == 'success'
     strategy:
       fail-fast: false
-      matrix: ${{ fromJSON(needs.e2e-matrix-builder.outputs.matrix) }}
+      matrix: ${{ fromJson(needs.e2e-matrix-builder.outputs.matrix) }}
+    secrets: inherit
+    with:
+      name: ${{ matrix.name }}
+      edition: ${{ matrix.edition }}
+      specs: ${{ matrix.specs }}
+      total_chunks: ${{ fromJson(needs.e2e-matrix-builder.outputs.regularChunks) }}
+      split_index: ${{ strategy.job-index }}
+      tags: ${{ matrix.tags }}
+      runner: ${{ matrix.runner }}
+
+  # run this separately to make it non-blocking
+  flaky-e2e-tests:
+    name: Flaky e2e Tests
+    uses: ./.github/workflows/e2e-test.yml
+    needs: build
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    secrets: inherit
+    with:
+      name: Flaky
+      tags: "@flaky"
+      specs: "./e2e/test/scenarios/**/*.cy.spec.*"
+
+  e2e-tests-result:
+    needs:
+     - e2e-tests
+     - flaky-e2e-tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    name: e2e-tests-result
+    if: always() && !cancelled()
+    env:
+      E2E_TESTS_RESULT: ${{ needs.e2e-tests.result }}
+      FLAKY_E2E_TESTS_RESULT: ${{ needs.flaky-e2e-tests.result }}
     steps:
-      - run: |
+      - name: Stub
+        if: ${{ needs.e2e-tests.result == 'skipped' }}
+        run: |
           echo "Didn't run due to conditional filtering"
+      - name: Test results
+        if: ${{ needs.e2e-tests.result != 'skipped' }}
+        run: | # sh
+          echo "E2E Tests: ${{ needs.e2e-tests.result }}"
+          echo "Flaky E2E Tests: ${{ needs.flaky-e2e-tests.result }}"
+
+          if [ "${{ needs.e2e-tests.result }}" != "success" ]; then
+            echo "E2E Tests failed"
+            exit 1
+          fi
 
   pr-env:
     needs: [build]

.github/workflows/flake-issue-creator.yml

@@ -1,34 +0,0 @@
-name: Flake Issue Creator
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 6 * * 1-5' # every weekday at 1am US eastern time
-
-jobs:
-  flake-issue-creator:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
-    - name: Update flake issues
-      uses: actions/github-script@v7
-      env:
-        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-      with:
-        script: | # js
-          const { updateFlakeIssues } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          if (!process.env.SLACK_BOT_TOKEN) {
-            throw new Error('SLACK_BOT_TOKEN is required');
-          }
-
-          await updateFlakeIssues({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-          });

.github/workflows/flake-status.yml

@@ -1,35 +0,0 @@
-name: Flake Status Report
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 6 * * 2,5' # Tuesdays and Fridays at 1am US eastern time
-
-jobs:
-  flake-status-report:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
-    - name: Post Flake Status Report
-      uses: actions/github-script@v7
-      env:
-        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-      with:
-        script: | # js
-          const { summarizeFlakes } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          if (!process.env.SLACK_BOT_TOKEN) {
-            throw new Error('SLACK_BOT_TOKEN is required');
-          }
-
-          await summarizeFlakes({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            channelName: 'engineering-ci'
-          });

.github/workflows/frontend.yml

@@ -1,37 +1,19 @@
 name: Frontend
 
 on:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_call:
+    inputs:
+      skip:
+        type: boolean
+        default: false
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-frontend
   cancel-in-progress: true
 
 jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      frontend_all: ${{ steps.changes.outputs.frontend_all }}
-      e2e_specs: ${{ steps.changes.outputs.e2e_specs }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
   fe-lint:
-    needs: files-changed
-    if: needs.files-changed.outputs.frontend_all == 'true' || needs.files-changed.outputs.e2e_specs == 'true'
+    if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -44,14 +26,15 @@ jobs:
           m2-cache-key: "cljs"
       - name: Compile CLJS
         run: yarn build-pure:cljs
+      - name: Find CSS variables that are used but never defined
+        run: yarn find-never-defined-css-variables
       - name: Run Prettier formatting linter
         run: yarn run lint-prettier-pure
       - name: Run ESLint linter
         run: yarn run lint-eslint-pure
 
   fe-type-check:
-    needs: files-changed
-    if: needs.files-changed.outputs.frontend_all == 'true'
+    if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:
@@ -68,8 +51,7 @@ jobs:
         name: Check types
 
   fe-tests-unit:
-    needs: files-changed
-    if: github.event.pull_request.draft == false && needs.files-changed.outputs.frontend_all == 'true'
+    if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -109,8 +91,7 @@ jobs:
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   fe-tests-timezones:
-    needs: files-changed
-    if: github.event.pull_request.draft == false && needs.files-changed.outputs.frontend_all == 'true'
+    if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -123,3 +104,43 @@ jobs:
           m2-cache-key: "cljs"
       - name: Run frontend timezones tests
         run: yarn run test-timezones
+
+  fe-tests-result:
+    needs:
+      - fe-lint
+      - fe-type-check
+      - fe-tests-unit
+      - fe-tests-timezones
+    if: always() && !cancelled()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      needs: ${{ toJson(needs) }}
+    steps:
+      - name: Check frontend job status
+        uses: actions/github-script@v7
+        env:
+          needs: ${{ toJson(needs) }}
+        with:
+          script: | # js
+            const needs = JSON.parse(process.env.needs);
+            const jobs = Object.entries(needs).map(
+              ([jobName, jobValues]) => ({
+                name: jobName,
+                result: jobValues.result
+              }));
+
+            // are all jobs skipped or successful?
+            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
+              console.log('All jobs are skipped or successful');
+              process.exit(0);
+            }
+
+            // otherwise, something failed
+            console.log('Some frontend jobs failed');
+            jobs.forEach((job) => {
+              if (job.result !== 'success') {
+                console.log(`${job.name} - ${job.result}`);
+              }
+            });
+            process.exit(1);

.github/workflows/generative-query-test.yml

@@ -0,0 +1,53 @@
+name: Generative Query Test
+
+on:
+  workflow_dispatch:
+    inputs:
+      seed:
+        description: 'Seed value (empty = random; logged)'
+        type: number
+      iterations:
+        description: 'Number of test iterations (overrides `seconds`)'
+        type: number
+      seconds:
+        description: 'No further iteration after _this_ number of seconds since test started'
+      ref:
+        description: 'Ref to run generative tests on'
+        default: qgen-milestone-1
+
+jobs:
+  generative-query-test:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    name: Generative Query Test
+    env:
+      CI: 'true'
+      MB_GENTEST_SEED: ${{ inputs.seed }}
+      MB_GENTEST_LIMIT_ITERATIONS: ${{ inputs.iterations }}
+      MB_GENTEST_LIMIT_SECONDS: ${{ inputs.seconds }}
+      # TODO: Remove in favor of cp root with further tests
+      MB_GENTEST_RUN: true
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: generative-query-test
+
+      - name: Run test
+        run: clojure -X:dev:ci:test:ee:ee-dev :only 'metabase.query-processor-test.generative-test'
+
+      - name: Publish Test Report (JUnit)
+        uses: dorny/test-reporter@v1
+        if: failure()
+        with:
+          path: "target/junit/**/*_test.xml"
+          name: JUnit Test Report (Generative Query test)
+          reporter: java-junit
+          list-suites: failed
+          list-tests: failed
+          fail-on-error: false

.github/workflows/links.yml

@@ -0,0 +1,32 @@
+name: Links
+
+on:
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * 0"
+
+jobs:
+  linkChecker:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write # required for peter-evans/create-issue-from-file
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Link Checker
+        id: lychee
+        uses: lycheeverse/lychee-action@v2
+        with:
+          fail: false
+          args: docs --config ./.lychee/config.toml --verbose --no-progress
+          format: markdown
+
+      - name: Create Issue From File
+        if: steps.lychee.outputs.exit_code != 0
+        uses: peter-evans/create-issue-from-file@v5
+        with:
+          title: Link Checker Report
+          content-filepath: ./.lychee/out.md
+          labels: "Type:Documentation"
+          assignees: jeff-bruemmer

.github/workflows/loki-update.yml

@@ -61,9 +61,9 @@ jobs:
         with:
           github-token: ${{secrets.METABASE_AUTOMATION_USER_TOKEN}}
           script: |
-            github.issues.removeLabel({
+            github.rest.issues.removeLabel({
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
               name: 'loki-update'
-            })
+            });

.github/workflows/loki.yml

@@ -49,29 +49,16 @@ jobs:
           m2-cache-key: "cljs"
 
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: NODE_ENV=development yarn build-pure:cljs
 
       - name: Build Storybook
         # We won't be able to use Storybook play's `userEvent` with production build
         # see https://github.com/storybookjs/storybook/issues/19758
         run: NODE_ENV=development yarn build-storybook
 
-      - name: Serve Storybook
-        run: yarn http-server storybook-static -p 6006 &
-        shell: bash
-
-      - name: Wait for Storybook to become available
-        run: |
-          echo "Waiting for Storybook to be served..."
-          while ! curl --silent --fail http://localhost:6006; do
-            sleep 5
-            echo "Retrying..."
-          done
-          echo "Storybook is being served!"
-
       - name: Run Loki Visual Tests
         run: |
-          yarn test-visual:loki
+          yarn loki --requireReference --reactUri file:./storybook-static --chromeFlags='--headless --disable-gpu' --verboseRenderer
 
       - name: Generate Visual Report on Failure
         if: failure()

.github/workflows/main.yml

@@ -0,0 +1,38 @@
+name: Slack Notification for New Feature Requests
+
+on:
+  issues:
+    types:
+      - labeled
+jobs:
+  on-issue-labeled:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: |
+      contains(github.event.issue.labels.*.name, 'Type:New Feature')
+    steps:
+      - name: Setting title
+        uses: actions/github-script@v7
+        id: vars
+        with:
+          script: |
+            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
+      - name: Send the issue ${{ github.event.issue.number }} to Slack
+        id: slack
+        uses: slackapi/slack-github-action@v1.26.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "New incoming feature request: ${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_FEATURE_REQUEST_TRIAGE_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/pre-release.yml

@@ -10,11 +10,18 @@ on:
         required: true
       commit:
         description: "A full-length commit SHA-1 hash"
+        type: string
+        required: true
+  workflow_call:
+    inputs:
+      version:
+        description: "Metabase version (e.g. v0.46.3)"
+        type: string
+        required: true
+      commit:
+        description: "A full-length commit SHA-1 hash"
+        type: string
         required: true
-      auto:
-        description: 'auto-patch release DO NOT SET MANUALLY'
-        type: boolean
-        default: false
 
 jobs:
   release-artifact:
@@ -79,7 +86,7 @@ jobs:
       - name: Upload Metabase ${{ matrix.edition }} JAR as artifact
         uses: actions/upload-artifact@v4
         with:
-          name: metabase-${{ matrix.edition }}-uberjar
+          name: metabase-test-${{ matrix.edition }}-uberjar
           path: |
             ./metabase.jar
             ./COMMIT-ID
@@ -93,7 +100,7 @@ jobs:
     strategy:
       matrix:
         edition: [oss, ee]
-        java-version: [11, 17]
+        java-version: [21]
     steps:
       - name: Prepare JRE (Java Run-time Environment)
         uses: actions/setup-java@v4
@@ -105,9 +112,10 @@ jobs:
       - uses: actions/download-artifact@v4
         name: Retrieve uberjar artifact
         with:
-          name: metabase-${{ matrix.edition }}-uberjar
+          name: metabase-test-${{ matrix.edition }}-uberjar
       - name: Launch uberjar (and keep it running)
-        run: java -jar ./metabase.jar &
+        run: >-
+          java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./metabase.jar &
       - name: Wait for Metabase to start
         run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
 
@@ -142,10 +150,10 @@ jobs:
           maildev: true
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-      - name: Prepare JDK 11
+      - name: Prepare JDK 21
         uses: actions/setup-java@v4
         with:
-          java-version: 11
+          java-version: 21
           distribution: "temurin"
       - name: Prepare Cypress environment
         id: cypress-prep
@@ -155,16 +163,34 @@ jobs:
       - uses: actions/download-artifact@v4
         name: Retrieve uberjar artifact for ${{ matrix.edition }}
         with:
-          name: metabase-${{ matrix.edition }}-uberjar
+          name: metabase-test-${{ matrix.edition }}-uberjar
       - name: Get the version info
         run: |
           jar xf metabase.jar version.properties
           mv version.properties resources/
-      - name: Run a few important Cypress tests as sanity check
+
+      - name: Move jar
+        run: mkdir -p ./target/uberjar && cp metabase.jar ./target/uberjar/metabase.jar
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Make app db snapshot
+        run: node e2e/runner/run_cypress_ci.js snapshot
+
+      - name: Run a few important OSS Cypress tests as sanity check
+        if: ${{ matrix.edition == 'oss' }}
         run: |
-          mkdir -p ./target/uberjar && cp metabase.jar ./target/uberjar/metabase.jar
-          yarn test-cypress-run \
-            --env grepTags="@smoke",grepOmitFiltered=true \
+          node e2e/runner/run_cypress_ci.js e2e \
+            --env grepTags="@smoke+-@EE",grepOmitFiltered=true \
+            --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
+            --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Run a few important EE Cypress tests as sanity check
+        if: ${{ matrix.edition == 'ee' }}
+        run: |
+          node e2e/runner/run_cypress_ci.js e2e \
+            --env grepTags="@smoke+-@OSS",grepOmitFiltered=true \
             --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
             --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
@@ -207,16 +233,16 @@ jobs:
       - uses: actions/download-artifact@v4
         name: Retrieve uberjar artifact
         with:
-          name: metabase-${{ matrix.edition }}-uberjar
+          name: metabase-test-${{ matrix.edition }}-uberjar
       - name: Move the Uberjar to the context dir
         run: mv metabase.jar bin/docker/.
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
         with:
           driver-opts: network=host
       - name: Build ${{ matrix.edition }} container
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           context: bin/docker/.
           platforms: linux/amd64
@@ -233,7 +259,7 @@ jobs:
         timeout-minutes: 3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
           password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
@@ -270,7 +296,7 @@ jobs:
       IMAGE_TAG: ${{ needs.containerize.outputs.image_tag }}
     steps:
       - name: Login to Docker Hub # authenticated, to avoid being rate-throttled
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
           password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
@@ -289,30 +315,6 @@ jobs:
         run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
         timeout-minutes: 3
 
-  trigger-auto-publish:
-    if: ${{ inputs.auto }}
-    needs: [run-sanity-check, check-uberjar-health, verify-docker-pull]
-    permissions:
-      actions: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: trigger auto publish
-        uses: actions/github-script@v7
-        with:
-          script: | # js
-            await github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'release.yml',
-              ref: '${{ github.ref }}',
-              inputs: {
-                commit: '${{ inputs.commit }}',
-                version: '${{ inputs.version }}',
-                auto: true,
-              }
-            });
-
   tests-complete-message:
     if: always()
     runs-on: ubuntu-22.04

.github/workflows/release-embedding-sdk.yml

@@ -1,35 +1,98 @@
 name: Release Metabase Embedding SDK for React
+run-name: Release SDK from ${{ inputs.branch }}
 
 on:
   workflow_dispatch:
     inputs:
-      # TODO: Add a version validation, so the workflow won't fail when publishing to npm
-      sdk_version:
-        description: "SDK version (e.g. 0.1.3)"
-        type: string
-        required: true
-      git_ref:
-        description: "A git commit hash that will be used to build the SDK"
-        type: string
+      branch:
+        description: "Branch we want to release the SDK from"
+        type: choice
         required: true
+        default: "master"
+        options:
+          - master
+          - release-x.51.x
+          - release-x.52.x
+          - release-x.53.x
 
 concurrency:
-  # We want to ensure only one job is running at a time because
+  # We want to ensure only one job is running at a time per branch because
   # there could be a conflict when updating the readme file.
-  group: ${{ github.workflow }}
+  group: ${{ github.workflow }}-${{ inputs.branch }}
   cancel-in-progress: true
 
 jobs:
+  workflow-summary:
+    name: Log inputs
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - name: Generate workflow summary
+        run: |
+          tee -a $GITHUB_STEP_SUMMARY << EOF
+          **Inputs:**
+
+          - \`branch\`: ${{ inputs.branch }}
+
+          triggered by: @${{ github.event.sender.login }}
+          EOF
+
+  determine-version:
+    name: Determine SDK version
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    outputs:
+      sdk_version: ${{ steps.new-sdk-version.outputs.result }}
+    steps:
+      - name: Check out the code using the provided branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.branch }}
+
+      - name: Get current SDK version
+        id: current-sdk-version
+        run: |
+          VERSION=$(jq -r .version ./enterprise/frontend/src/embedding-sdk/package.template.json)
+          echo "sdk_current_version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Get next SDK patch version
+        id: new-sdk-version
+        uses: actions/github-script@v7
+        with:
+          result-encoding: string
+          script: |
+            const currentVersion = "${{ steps.current-sdk-version.outputs.sdk_current_version }}";
+            const [currentVersionWithoutSuffix, suffix] = currentVersion.split("-");
+            const versionParts = currentVersionWithoutSuffix.split(".");
+            versionParts[versionParts.length - 1] = parseInt(versionParts.at(-1)) + 1;
+            const newVersion = versionParts.join(".");
+
+            if (!suffix) {
+              return newVersion;
+            }
+
+            return `${newVersion}-${suffix}`
+
+      - name: Append workflow summary
+        run: |
+          tee -a $GITHUB_STEP_SUMMARY << EOF
+          **Derived inputs:**
+
+          - \`current_version\`: "${{ steps.current-sdk-version.outputs.sdk_current_version }}"
+          - \`next_version\`: "${{ steps.new-sdk-version.outputs.result }}"
+          EOF
+
   check-git-tag:
+    needs: determine-version
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     env:
-      tag: embedding-sdk-${{ inputs.sdk_version }}
+      tag: embedding-sdk-${{ needs.determine-version.outputs.sdk_version }}
     steps:
-      - name: Check out the code using the provided ref
+      - name: Check out the code using the provided branch
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.git_ref }}
+          ref: ${{ inputs.branch }}
           fetch-depth: 0
           fetch-tags: true
 
@@ -48,10 +111,10 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
-      - name: Check out the code using the provided ref
+      - name: Check out the code using the provided branch
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.git_ref }}
+          ref: ${{ inputs.branch }}
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
@@ -65,14 +128,14 @@ jobs:
         run: yarn embedding-sdk:test-unit
 
   build-sdk:
-    needs: test
+    needs: [test, determine-version]
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
-      - name: Check out the code using the provided ref
+      - name: Check out the code using the provided branch
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.git_ref }}
+          ref: ${{ inputs.branch }}
           fetch-depth: 0
           fetch-tags: true
 
@@ -84,14 +147,10 @@ jobs:
         with:
           m2-cache-key: "release-sdk"
 
-      - name: Update readme
-        run: |
-          ./bin/embedding-sdk/release_utils.bash update_readme ${{ inputs.sdk_version }}
-
       - name: Bump published npm package version
         # NOTE: this should happen before "Build SDK bundle" as we inject SDK version into the code during build step
         run: |
-          ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ inputs.sdk_version }}
+          ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ needs.determine-version.outputs.sdk_version }}
 
       - name: Update changelog
         run: |
@@ -116,15 +175,17 @@ jobs:
           path: ./changelog-diff
 
   publish-npm:
-    needs: build-sdk
+    needs: [build-sdk, determine-version]
     runs-on: ubuntu-22.04
     timeout-minutes: 20
+    env:
+      sdk_version: ${{ needs.determine-version.outputs.sdk_version }}
     steps:
-      - name: Check out master to prepare for a SDK version bump PR
+      - name: Check out branch to prepare for a SDK version bump PR
         uses: actions/checkout@v4
         with:
           # when we created version update PR, it would only have diff from 2 files SDK readme and SDK package.json template
-          ref: master
+          ref: ${{ inputs.branch}}
 
       - name: Setup git user
         run: |
@@ -133,11 +194,11 @@ jobs:
 
       - name: Update readme
         run: |
-          bash ./bin/embedding-sdk/release_utils.bash update_readme ${{ inputs.sdk_version }}
+          bash ./bin/embedding-sdk/release_utils.bash update_readme ${{ env.sdk_version }}
 
       - name: Bump published npm package version
         run: |
-          bash ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ inputs.sdk_version }}
+          bash ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ env.sdk_version }}
 
       - name: Retrieve SDK changelog diff
         uses: actions/download-artifact@v4
@@ -151,13 +212,17 @@ jobs:
 
       - name: Create a PR updating readme + published version, and changelog (using GitHub Metabase Automation account)
         run: |
-          git checkout -b update-sdk-version-${{ inputs.sdk_version }}
-          git commit -a -m 'Update Readme version references and published npm version to ${{ inputs.sdk_version }}'
+          # TODO: Remove this step once github includes the new gh CLI version 2.65.0
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          brew install gh
+
+          git checkout -b update-sdk-version-${{ env.sdk_version }}
+          git commit -a -m 'Update Readme version references and published npm version to ${{ env.sdk_version }}'
           git push origin HEAD
-          gh pr create --base master\
+          gh pr create --base ${{ inputs.branch }}\
                        --assignee "${GITHUB_ACTOR}"\
-                       --title "Update SDK version to ${{ inputs.sdk_version }}"\
-                       --body "Update Readme version references and published npm package version to ${{ inputs.sdk_version }}"
+                       --title "docs(sdk): Update SDK version to ${{ env.sdk_version }}"\
+                       --body "Update Readme version references and published npm package version to ${{ env.sdk_version }}"
         env:
           GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
 
@@ -169,7 +234,7 @@ jobs:
 
       - name: Edit PR adding useful information (using Metabase bot app)
         run: |
-          gh pr edit --add-reviewer @metabase/embedding --add-label no-backport
+          gh pr edit --add-reviewer @metabase/embedding,albertoperdomo --add-label no-backport
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
@@ -192,22 +257,29 @@ jobs:
           path: sdk
 
       - name: Publish to NPM
+        working-directory: sdk
         run: |
-          cd sdk
           echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
-          npm publish
+          # Please keep the value in sync with `inputs.branch`'s release branch
+          npm publish --tag ${{fromJson('{"master": "nightly", "release-x.51.x": "51-stable", "release-x.52.x": "52-stable", "release-x.53.x": "53-stable"}')[inputs.branch]}}
+
+      - name: Add `latest` tag to the latest release branch (`release-x.53.x`) deployment
+        if: ${{ inputs.branch == 'release-x.53.x' }}
+        working-directory: sdk
+        run: |
+          npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest
 
   git-tag:
-    needs: publish-npm
+    needs: [publish-npm, determine-version]
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     env:
-      tag: embedding-sdk-${{ inputs.sdk_version }}
+      tag: embedding-sdk-${{ needs.determine-version.outputs.sdk_version }}
     steps:
-      - name: Check out the code using the provided ref
+      - name: Check out the code using the provided branch
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.git_ref }}
+          ref: ${{ inputs.branch }}
 
       # Lightweight tags don't need committer name and email
       - name: Create a new git tag

.github/workflows/release-log.yml

@@ -1,15 +1,21 @@
 name: Update Release Log
-run-name: Update Release Log ${{ inputs.version }}
+run-name: Update Release Log ${{ inputs.version || github.ref_name }}
 
 on:
+  push:
+    branches:
+      - release-x.*
+    tags:
+      - v*
+      - nightly-*
+      - latest-*
+      - beta-*
   workflow_dispatch:
     inputs:
       version:
         description: 'Major Metabase version (e.g. 45, 52, 68)'
         type: number
         required: true
-  schedule:
-    - cron: '45 * * * *' # hourly
   workflow_call:
     inputs:
       version:
@@ -21,9 +27,8 @@ jobs:
   update-release-log:
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    env:
-      VERSION: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')
-        && inputs.version || vars.CURRENT_VERSION }}
+    # don't run this workflow for forks
+    if: ${{ github.event_name != 'push' || github.repository == 'metabase/metabase' }}
     steps:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -33,9 +38,37 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
       - uses: actions/checkout@v4
         with:
+          ref: master # this only works on master
           fetch-depth: 0 # we want all branches and tags
       - name: Install Dependencies
         run: yarn --cwd release --frozen-lockfile && npm i -g tsx
+      - name: Build release scripts
+        run: yarn --cwd release build
+      - name: Get version number
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            const {
+              getVersionFromReleaseBranch,
+              getMajorVersion,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            console.log({ context });
+
+            // if the version is explicitly set, use that
+            if (context.payload?.inputs?.version) {
+              core.exportVariable('VERSION', context.payload.inputs.version);
+              return;
+            }
+
+            // otherwise, get the version from the release branch name
+            const branch = context.payload.ref;
+            const version = getVersionFromReleaseBranch(branch);
+            const majorVersion = getMajorVersion(version);
+
+            console.log({ branch, version, majorVersion });
+            core.exportVariable('VERSION', majorVersion);
+
       - name: generate release Log
         run: cd release && tsx ./src/release-log-run.ts $VERSION > v$VERSION.html
       - name: generate release channel log

.github/workflows/release-patch.yml

@@ -9,10 +9,12 @@ on:
         type: number
         required: true
   schedule:
-    - cron: '15 0 * * 2-6' # every weekday at 7/8:15 pm Eastern Time
+    - cron: '0 21 * * 1-5' # every weekday at 4 pm EST/5 pm EDT
 
 jobs:
   auto-patch-trigger:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     steps:

.github/workflows/release-status.yml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   check-release-status:
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:

.github/workflows/release-tag.yml

@@ -39,6 +39,7 @@ on:
         #   - nightly
         #   - beta
         #   - latest
+        #   - none (skips everything)
         required: true
       tag_rollout:
         description: Rollout % (0-100)
@@ -52,9 +53,20 @@ on:
         description: Apply to OSS
         type: boolean
         default: true
+      dot-x-tag:
+        type: boolean
+        default: false
 
 jobs:
+  green-check-stub:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 2
+    steps:
+    - name: Stub
+      run: echo "Stub to make this job successful even if all the rest of the steps are skipped"
   check-version:
+    # skips everything if the tag_name is 'none' because all later jobs depend on this job
+    if: ${{ inputs.tag_name != 'none' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     outputs:
@@ -92,21 +104,14 @@ jobs:
             oss: getCanonicalVersion(version, 'oss'),
           };
 
-          const ossReleased = await hasBeenReleased({
+          const released = await hasBeenReleased({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version: versions.oss,
           });
 
-          const eeReleased = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.ee,
-          });
-
-          if (!ossReleased || !eeReleased) {
+          if (!released) {
             throw new Error("This version has not been released yet!", version);
           }
 
@@ -185,7 +190,7 @@ jobs:
 
           return upload_path;
 
-    - name: Upload to s3 latest path
+    - name: Upload to s3 ${{ inputs.tag_name }} path
       run: | # sh
         aws s3 cp \
           s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.source_path.outputs.result }}/metabase.jar \
@@ -270,26 +275,26 @@ jobs:
     steps:
     - uses: actions/checkout@v4
       with:
-        fetch-depth: 0 # fetch all history
-    - name: Add and push git tag
+        fetch-depth: 0 # we want all branches and tags
+        fetch-tags: true
+    - name: Add and push git tag for nightly/beta/latest
+      if: ${{ !inputs.dot-x-tag }}
       run: | # sh
-
         if [[ "${{ matrix.edition }}" == "ee" ]]; then
-          git tag -f ${{ inputs.tag_name }}-ee ${{ needs.check-version.outputs.ee }}
+          git tag -f ${{ inputs.tag_name }}-ee ${{ needs.check-version.outputs.oss }}
           git push origin -f ${{ inputs.tag_name }}-ee
         elif [[ "${{ matrix.edition }}" == "oss" ]]; then
           git tag -f ${{ inputs.tag_name }}-oss ${{ needs.check-version.outputs.oss }}
           git push origin -f ${{ inputs.tag_name }}-oss
         fi
-
-  update-release-log:
-    needs: check-version
-    uses: ./.github/workflows/release-log.yml
-    with:
-      version: ${{ fromJSON(vars.CURRENT_VERSION) }} # cast string to number
-    secrets: inherit
+    - name: Add and push git tag for dot X tags
+      if: ${{ inputs.dot-x-tag && matrix.edition == 'oss' }} # we only need one git tag for dot X
+      run: | # sh
+        git tag -f ${{ inputs.tag_name }} ${{ needs.check-version.outputs.oss }}
+        git push origin tag -f ${{ inputs.tag_name }}
 
   update-version-info:
+    if: ${{ !inputs.dot-x-tag }}
     runs-on: ubuntu-22.04
     needs: check-version
     timeout-minutes: 5
@@ -333,7 +338,6 @@ jobs:
           });
 
           fs.writeFileSync('version-info.json', JSON.stringify(newVersionInfo));
-
     - name: Upload new version-info.json to S3
       run: |
         if [[ "${{ matrix.edition }}" == "ee" ]]; then

.github/workflows/release.yml

@@ -11,26 +11,40 @@ on:
       commit:
         description: 'A full-length commit SHA-1 hash'
         required: true
-      skip-docker:
-        description: 'Skip Docker image publishing'
-        type: boolean
-        default: false
-      skip-s3:
-        description: 'Skip S3 artifact publishing'
-        type: boolean
-        default: false
-      skip-version-info:
-        description: 'Skip publishing version-info.json'
-        type: boolean
-        default: false
-      skip-tag:
-        description: 'Skip tagging the release'
-        type: boolean
-        default: false
-      skip-release-notes:
-        description: 'Skip publishing release notes'
+      release-channel:
+        description: 'The release channel to publish to (optional)'
+        type: choice
+        options:
+          - none
+          - latest
+          - beta
+          - nightly
+        required: true
+        default: 'none'
+      auto:
+        description: 'auto-patch release DO NOT SET MANUALLY'
         type: boolean
         default: false
+  workflow_call:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.46.3)'
+        type: string
+        required: true
+      commit:
+        description: 'A full-length commit SHA-1 hash'
+        type: string
+        required: true
+      release-channel:
+        description: 'The release channel to publish to (optional)'
+        type: string
+        # options:
+        #   - none
+        #   - latest
+        #   - beta
+        #   - nightly
+        required: true
+        default: 'none'
       auto:
         description: 'auto-patch release DO NOT SET MANUALLY'
         type: boolean
@@ -74,21 +88,14 @@ jobs:
             oss: getCanonicalVersion(version, 'oss'),
           };
 
-          const ossReleased = await hasBeenReleased({
+          const released = await hasBeenReleased({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version: versions.oss,
           });
 
-          const eeReleased = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.ee,
-          });
-
-          if (ossReleased || eeReleased) {
+          if (released) {
             throw new Error("This version has already been released!", version);
           }
 
@@ -185,6 +192,7 @@ jobs:
       uses: actions/upload-artifact@v4
       with:
         name: metabase-${{ matrix.edition }}-uberjar
+        overwrite: true
         path: |
           ./metabase.jar
           ./COMMIT-ID
@@ -192,7 +200,6 @@ jobs:
           ./version.properties
 
   upload-to-s3:
-    if: ${{ inputs.skip-s3 != true }}
     runs-on: ubuntu-22.04
     needs: download-uberjar
     timeout-minutes: 15
@@ -242,7 +249,6 @@ jobs:
 
 
   verify-s3-download:
-    if: ${{ inputs.skip-s3 != true }}
     runs-on: ubuntu-22.04
     needs: upload-to-s3
     timeout-minutes: 15
@@ -276,7 +282,6 @@ jobs:
       run: grep -q $(sha256sum ./metabase-downloaded.jar) SHA256.sum && echo "checksums match" || exit 1
 
   containerize:
-    if: ${{ inputs.skip-docker != true }}
     runs-on: ubuntu-22.04
     needs: [check-version, download-uberjar]
     timeout-minutes: 15
@@ -291,6 +296,8 @@ jobs:
     steps:
     - uses: actions/checkout@v4
       with:
+        # checkout the commit that was tagged so we get the right dockerfile
+        ref: ${{ inputs.commit }}
         fetch-depth: 0  # IMPORTANT! to get all the tags
     - name: prepare release scripts
       run: cd release && yarn && yarn build
@@ -361,7 +368,6 @@ jobs:
         echo "Finished!"
 
   verify-docker-pull:
-    if: ${{ inputs.skip-docker != true }}
     runs-on: ubuntu-22.04
     needs: containerize
     timeout-minutes: 15
@@ -410,7 +416,6 @@ jobs:
       timeout-minutes: 3
 
   push-tags:
-    if: ${{ inputs.skip-tag != true }}
     permissions: write-all
     needs: [verify-s3-download, verify-docker-pull, check-version]
     runs-on: ubuntu-22.04
@@ -429,21 +434,7 @@ jobs:
           const { tagRelease } = require('${{ github.workspace }}/release/dist/index.cjs');
 
           const OSSversion = '${{ needs.check-version.outputs.oss }}';
-          const EEversion = '${{ needs.check-version.outputs.ee }}';
 
-          // push EE tag
-          await tagRelease({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: EEversion,
-            commitHash: '${{ inputs.commit }}',
-          }).catch((err) => {
-            console.error('Failed to tag release', EEversion, err);
-            process.exit(1);
-          });
-
-          // push OSS tag
           await tagRelease({
             github,
             owner: context.repo.owner,
@@ -454,83 +445,50 @@ jobs:
             console.error('Failed to tag release', OSSversion, err);
             process.exit(1);
           });
-    - name: Reorder release tags to put OSS first
-      run: |
-        git config user.name github-actions
-        git config user.email github-actions@github.com
-        $GITHUB_WORKSPACE/release/reorder-tags.sh ${{ needs.check-version.outputs.ee }} ${{ inputs.commit }}
 
-  trigger-docs-update:
-    if: ${{ !inputs.auto && inputs.skip-release-notes != true }}
-    needs:
-      - push-tags
-      - check-version
+  get-extra-tags:
+    needs: [ check-version ]
     runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    permissions:
-      contents: write
-      pull-requests: write
-    env:
-      NEW_OSS_VERSION: ${{ needs.check-version.outputs.oss }}
-      NEW_EE_VERSION: ${{ needs.check-version.outputs.ee }}
-      GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    outputs:
+      extra_tags: ${{ steps.taglist.outputs.extra_tags }}
     steps:
-      - uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          script: | # js
-            await github.rest.repos.createDispatchEvent({
-              owner: '${{ github.repository_owner }}',
-              repo: '${{ secrets.DOCS_REPO }}',
-              event_type: 'trigger-docs-update',
-              client_payload: {
-                version: '${{ inputs.version }}'
-              }
-            });
       - uses: actions/checkout@v4
         with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-      - name: update releases.md
+          sparse-checkout: release
+      - name: prepare release scripts
+        run: cd release && yarn && yarn build
+      - name: Get extra tags
+        id: taglist
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          result-encoding: string
           script: | # js
-            const fs = require('fs');
+            const { getExtraTagsForVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
 
-            const releaseText = fs.readFileSync('./docs/releases.md', 'utf8');
+            const version = '${{ inputs.version }}';
 
-            const newReleaseText = releaseText
-              .replace(
-                /## Metabase Enterprise Edition releases\n\n/,
-                `## Metabase Enterprise Edition releases\n\n- [${process.env.NEW_EE_VERSION}](https://github.com/metabase/metabase/releases/tag/${process.env.NEW_EE_VERSION})\n`
-              )
-              .replace(
-                /## Metabase Open Source Edition releases\n\n/,
-                `## Metabase Open Source Edition releases\n\n- [${process.env.NEW_OSS_VERSION}](https://github.com/metabase/metabase/releases/tag/${process.env.NEW_OSS_VERSION})\n`
-              );
+            const extra_tags = getExtraTagsForVersion({ version });
 
-            fs.writeFileSync('./docs/releases.md', newReleaseText);
+            console.log({ extra_tags });
+            core.setOutput('extra_tags', JSON.stringify(extra_tags));
 
-      - name: commit and push updates
-        run: | # bash
-          git config --global user.email "metabase-bot@metabase.com"
-          git config --global user.name "Metabase bot"
-
-          git checkout -b docs-add-$NEW_OSS_VERSION
-          cd docs/
-
-          git add releases.md
-          git commit -m "Add $NEW_OSS_VERSION to the list of releases"
-          git push origin docs-add-$NEW_OSS_VERSION --force
-
-      - name: open pr with updates
-        run: | # bash
-          gh pr create --fill \
-            --body "Like it says on the tin 😁" \
-            --label "Type:Documentation" \
-            --label "backport" \
-            --reviewer "jeff-bruemmer" \
-            --assignee "jeff-bruemmer"
+  add-extra-tags:
+    needs:
+      - get-extra-tags
+      - push-tags
+      - verify-docker-pull
+      - verify-s3-download
+    strategy:
+      matrix:
+        tag: ${{ fromJson(needs.get-extra-tags.outputs.extra_tags) }}
+    uses: ./.github/workflows/release-tag.yml
+    secrets: inherit
+    with:
+      version: ${{ inputs.version }}
+      tag_name: ${{ matrix.tag }}
+      tag_ee: ${{ contains(matrix.tag, 'v1') }}
+      tag_oss: ${{ contains(matrix.tag, 'v0') }}
+      dot-x-tag: true
 
   trigger-cloud-issues:
     if: ${{ !inputs.auto }}
@@ -577,8 +535,8 @@ jobs:
             });
 
   draft-release-notes:
-    if: ${{ !inputs.auto && inputs.skip-release-notes != true }}
-    needs: push-tags
+    if: ${{ !inputs.auto }}
+    needs: add-extra-tags
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     permissions: write-all
@@ -586,41 +544,26 @@ jobs:
       AWS_S3_DOWNLOADS_BUCKET: ${{ vars.AWS_S3_DOWNLOADS_BUCKET }}
       DOCKERHUB_OWNER: ${{ vars.DOCKERHUB_OWNER }}
       DOCKERHUB_REPO: ${{ vars.DOCKERHUB_REPO }}
-    strategy:
-      matrix:
-        edition: [oss, ee]
     steps:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: release
       - name: prepare release scripts
         run: cd release && yarn && yarn build
-      - uses: actions/download-artifact@v4
-        name: Retrieve uberjar artifact
-        with:
-          name: metabase-${{ matrix.edition }}-uberjar
-      - name: Read Checksum
-        run: |
-          CHECKSUM=$(cat SHA256.sum)
-          echo "CHECKSUM=$CHECKSUM" >> $GITHUB_ENV
       - name: Publish draft release notes
         uses: actions/github-script@v7
         with:
           result-encoding: string
-          script: |
+          script: | # js
             const { publishRelease, getCanonicalVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
 
             const version = '${{ inputs.version }}';
-            const edition = '${{ matrix.edition }}';
-
-            const canonical_version = getCanonicalVersion(version, edition);
 
             await publishRelease({
               github,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              version: canonical_version,
-              checksum: '${{ env.CHECKSUM }}',
+              version,
             }).then(() => {
               console.log('Successfully published release notes', '${{ inputs.version }}');
             }).catch((err) => {
@@ -629,7 +572,6 @@ jobs:
             });
 
   publish-version-info:
-    if: ${{ !inputs.auto && inputs.skip-version-info != true }}
     runs-on: ubuntu-22.04
     needs: [push-tags, check-version]
     timeout-minutes: 15
@@ -640,6 +582,11 @@ jobs:
       AWS_S3_STATIC_BUCKET: ${{ vars.AWS_S3_STATIC_BUCKET }}
       AWS_REGION: ${{ vars.AWS_REGION }}
     steps:
+    - name: Finish early
+      if: ${{ inputs.auto }}
+      run: |
+        echo "skipping version info update for nightly patch"
+        exit 0
     - name: Configure AWS credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -687,22 +634,20 @@ jobs:
         --distribution-id ${{ vars.AWS_CLOUDFRONT_STATIC_ID }} \
         --paths "/version-info.json" "/version-info-ee.json"
 
-  tag-nightly:
-    if: false
-    needs: [push-tags, verify-docker-pull, verify-s3-download, check-version]
+  set-release-channel:
+    needs: publish-version-info
     uses: ./.github/workflows/release-tag.yml
     secrets: inherit
     with:
       version: ${{ inputs.version }}
-      tag_name: nightly
+      tag_name: ${{ inputs.release-channel }}
       tag_rollout: 100
       tag_ee: true
       tag_oss: true
 
   publish-complete-message:
-    if: ${{ !inputs.auto }}
     runs-on: ubuntu-22.04
-    needs: [draft-release-notes, verify-docker-pull, verify-s3-download, publish-version-info]
+    needs: [set-release-channel, add-extra-tags]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -719,34 +664,7 @@ jobs:
           script: | # js
             const { sendPublishCompleteMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
 
-            await sendPublishCompleteMessage({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              version: '${{ inputs.version }}',
-              runId: '${{ github.run_id }}',
-              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
-              generalChannelName: 'general',
-            }).catch(console.error);
-
-  auto-publish-complete-message:
-    if: ${{ inputs.auto }}
-    runs-on: ubuntu-22.04
-    needs: tag-nightly
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      - name: Send auto publish complete message
-        uses: actions/github-script@v7
-        env:
-          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        with:
-          script: | # js
-            const { sendPublishCompleteMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const isAutoRelease = '${{ inputs.auto }}' === 'true';
 
             await sendPublishCompleteMessage({
               owner: context.repo.owner,
@@ -754,7 +672,7 @@ jobs:
               version: '${{ inputs.version }}',
               runId: '${{ github.run_id }}',
               channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
-              generalChannelName: '',
+              generalChannelName: !isAutoRelease ? '${{ vars.SLACK_GENERAL_CHANNEL }}' : '',
             }).catch(console.error);
 
   manage-milestones:
@@ -787,11 +705,11 @@ jobs:
             owner: context.repo.owner,
             repo: context.repo.repo,
             version,
-          });
+          }).catch(console.error);
 
           await openNextMilestones({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version,
-          });
+          }).catch(console.error);