ask whether to reuse h2

This launches a metabase dev repl.

Configurable:
- database type
- database edition
- backend port
- config file
- token
- metabase edition (oss vs ee)

You can just run `./bin/mage dev-repl` and get an interactive CLI that
will ask you about these settings, launch the database, start the
frontend (on a random port), and start Metabase configured to talk to
that database/frontend.

Or you can specify options from the command line, like
`./bin/mage dev-repl -e ee -t all-features -d postgres`.

.claude/commands/ci-report.md

@@ -0,0 +1,12 @@
+Generate a CI failure report for PR $PR_NUM_OR_URL (or current branch if no argument given).
+
+Run `./bin/mage ci-report $PR_NUM_OR_URL` to generate the report, then:
+
+1. **Summarize the failures** - What tests failed and in which jobs?
+2. **Categorize** - Are these real failures, flaky tests, or infrastructure issues?
+3. **Recommend next steps**:
+   - If flaky: suggest rerunning with `gh run rerun <run-id> --failed -R metabase/metabase`
+   - If real: identify the root cause and suggest fixes
+   - If infrastructure: note the issue type (timeout, OOM, network)
+
+Focus on actionable insights. If all checks are passing, confirm that briefly.

.claude/skills/_shared/clojure-commands.md

@@ -14,6 +14,12 @@
 
 - **Run a test:** `./bin/mage run-tests namespace/test-name`
 - **Run all tests in a namespace:** `./bin/mage run-tests namespace`
+- **Run all tests for a module:** `./bin/mage run-tests test/metabase/notification` Because the module lives in that directory.
+
+Note: the `./bin/mage run-tests` command accepts multiple args, so you can pass
+`./bin/mage run-tests namespace/test-name namespace/other-test namespace/third-test`
+to run 3 tests, or
+`./bin/mage run-tests test/metabase/module1 test/metabase/module2` to run 2 modules.
 
 ## Code Readability
 
@@ -23,6 +29,11 @@
 
 ## REPL Usage
 
+> **Note:** If you have `clojure-mcp` tools available (check for tools like `clojure_eval`),
+> **always prefer those over `./bin/mage -repl`**. The MCP tools provide better integration,
+> richer feedback, and avoid shell escaping issues. Only use `./bin/mage -repl` as a fallback
+> when clojure-mcp is not available.
+
 - **Evaluating Clojure Code:** `./bin/mage -repl '<code>'`
   - See "Sending Code to the REPL" section for more details
 

.claude/skills/_shared/clojure-style-guide.md

@@ -29,7 +29,7 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 
 **Comments:**
 
-- `TODO` format: `;; TODO (Name M/D/YY) -- description`
+- `TODO` format: `;; TODO (Name YYYY-MM-DD) -- description`
 
 ## Code Organization
 
@@ -42,7 +42,7 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 
 - Break up functions > 20 lines
 - Lines ≤ 120 characters
-- No blank lines within definition forms (except pairwise `let`/`cond`)
+- No blank non-comment lines within definition forms (except pairwise `let`/`cond`)
 
 ## Style Conventions
 

.claude/skills/add-malli-schemas/SKILL.md

@@ -0,0 +1,420 @@
+---
+name: add-malli-schemas
+description: Efficiently add Malli schemas to API endpoints in the Metabase codebase with proper patterns, validation timing, and error handling
+---
+
+# Add Malli Schemas to API Endpoints
+
+This skill helps you efficiently and uniformly add Malli schemas to API endpoints in the Metabase codebase.
+
+## Reference Files (Best Examples)
+
+- `src/metabase/warehouses/api.clj` - Most comprehensive schemas, custom error messages
+- `src/metabase/api_keys/api.clj` - Excellent response schemas
+- `src/metabase/collections/api.clj` - Great named schema patterns
+- `src/metabase/timeline/api/timeline.clj` - Clean, simple examples
+
+## Quick Checklist
+
+When adding Malli schemas to an endpoint:
+
+- [ ] Route params have schemas
+- [ ] Query params have schemas with `:optional true` and `:default` where appropriate
+- [ ] Request body has a schema (for POST/PUT)
+- [ ] Response schema is defined (using `:-` after route string)
+- [ ] Use existing schema types from `ms` namespace when possible
+- [ ] Consider creating named schemas for reusable or complex types
+- [ ] Add contextual error messages for validation failures
+
+## Basic Structure
+
+### Complete Endpoint Example
+
+```clojure
+(mr/def ::Color [:enum "red" "blue" "green"])
+
+(mr/def ::ResponseSchema
+  [:map
+   [:id pos-int?]
+   [:name string?]
+   [:color ::Color]
+   [:created_at ms/TemporalString]])
+
+(api.macros/defendpoint :post "/:name" :- ::ResponseSchema
+  "Create a resource with a given name."
+  [;; Route Params:
+   {:keys [name]} :- [:map [:name ms/NonBlankString]]
+   ;; Query Params:
+   {:keys [include archived]} :- [:map
+                                   [:include  {:optional true} [:maybe [:= "details"]]]
+                                   [:archived {:default false} [:maybe ms/BooleanValue]]]
+   ;; Body Params:
+   {:keys [color]} :- [:map [:color ::Color]]
+   ]
+  ;; endpoint implementation, ex:
+  {:id 99
+   :name (str "mr or mrs " name)
+   :color ({"red" "blue" "blue" "green" "green" "red"} color)
+   :created_at (t/format (t/formatter "yyyy-MM-dd'T'HH:mm:ssXXX") (t/zoned-date-time))}
+  )
+```
+
+## Common Schema Patterns
+
+1. Route Params (the 5 in `api/user/id/5`)
+2. Query Params (the sort+asc pair in `api/users?sort=asc`)
+3. Body Params (the contents of a request body. Almost always decoded from json into edn)
+4. The Raw Request map
+
+Of the 4 arguments, deprioritize usage of the raw request unless necessary.
+
+### Route Params
+
+Always required, typically just a map with an ID:
+
+```clojure
+[{:keys [id]} :- [:map [:id ms/PositiveInt]]]
+```
+
+For multiple route params:
+
+```clojure
+[{:keys [id field-id]} :- [:map
+                           [:id ms/PositiveInt]
+                           [:field-id ms/PositiveInt]]]
+```
+
+### Query Params
+
+Add properties for `{:optional true ...}` and `:default` values:
+
+```clojure
+{:keys [archived include limit offset]} :- [:map
+                                            [:archived {:default false} [:maybe ms/BooleanValue]]
+                                            [:include  {:optional true}   [:maybe [:= "tables"]]]
+                                            [:limit    {:optional true} [:maybe ms/PositiveInt]]
+                                            [:offset   {:optional true} [:maybe ms/PositiveInt]]]
+```
+
+### Request Body (POST/PUT)
+
+```clojure
+{:keys [name description parent_id]} :- [:map
+                                         [:name        ms/NonBlankString]
+                                         [:description {:optional true} [:maybe ms/NonBlankString]]
+                                         [:parent_id   {:optional true} [:maybe ms/PositiveInt]]]
+```
+
+### Response Schemas
+
+#### Simple inline response:
+
+```clojure
+(api.macros/defendpoint :get "/:id" :- [:map
+                                        [:id pos-int?]
+                                        [:name string?]]
+  "Get a thing"
+  ...)
+```
+
+#### Named schema for reuse:
+
+```clojure
+(mr/def ::Thing
+  [:map
+   [:id pos-int?]
+   [:name string?]
+   [:description [:maybe string?]]])
+
+(api.macros/defendpoint :get "/:id" :- ::Thing
+  "Get a thing"
+  ...)
+
+(api.macros/defendpoint :get "/" :- [:sequential ::Thing]
+  "Get all things"
+  ...)
+```
+
+## Common Schema Types
+
+### From `metabase.util.malli.schema` (aliased as `ms`)
+
+Prefer the schemas in the ms/* namespace, since they work better with our api infrastructure. 
+
+For example use `ms/PositiveInt` instead of `pos-int?`.
+
+```clojure
+ms/PositiveInt                  ;; Positive integer
+ms/NonBlankString               ;; Non-empty string
+ms/BooleanValue                 ;; String "true"/"false" or boolean
+ms/MaybeBooleanValue            ;; BooleanValue or nil
+ms/TemporalString               ;; ISO-8601 date/time string (for REQUEST params only!)
+ms/Map                          ;; Any map
+ms/JSONString                   ;; JSON-encoded string
+ms/PositiveNum                  ;; Positive number
+ms/IntGreaterThanOrEqualToZero  ;; 0 or positive
+```
+
+**IMPORTANT:** For response schemas, use `:any` for temporal fields, not `ms/TemporalString`!
+Response schemas validate BEFORE JSON serialization, so they see Java Time objects.
+
+### Built-in Malli Types
+
+```clojure
+:string                     ;; Any string
+:boolean                    ;; true/false
+:int                        ;; Any integer
+:keyword                    ;; Clojure keyword
+pos-int?                    ;; Positive integer predicate
+[:maybe X]                  ;; X or nil
+[:enum "a" "b" "c"]         ;; One of these values
+[:or X Y]                   ;; Schema that satisfies X or Y
+[:and X Y]                  ;; Schema that satisfies X and Y
+[:sequential X]             ;; Sequential of Xs
+[:set X]                    ;; Set of Xs
+[:map-of K V]               ;; Map with keys w/ schema K and values w/ schema V
+[:tuple X Y Z]              ;; Fixed-length tuple of schemas X Y Z
+```
+
+Avoid using sequence schemas unless completely necessary.
+
+## Step-by-Step: Adding Schemas to an Endpoint
+
+### Example: Adding return schema to `GET /api/field/:id/related`
+
+**Before:**
+```clojure
+(api.macros/defendpoint :get "/:id/related"
+  "Return related entities."
+  [{:keys [id]} :- [:map [:id ms/PositiveInt]]]
+  (-> (t2/select-one :model/Field :id id) api/read-check xrays/related))
+```
+
+**Step 1:** Check what the function returns (look at `xrays/related`)
+
+**Step 2:** Define response schema based on return type:
+
+```clojure
+(mr/def ::RelatedEntity
+  [:map
+   [:tables [:sequential [:map [:id pos-int?] [:name string?]]]]
+   [:fields [:sequential [:map [:id pos-int?] [:name string?]]]]])
+```
+
+**Step 3:** Add response schema to endpoint:
+
+```clojure
+(api.macros/defendpoint :get "/:id/related" :- ::RelatedEntity
+  "Return related entities."
+  [{:keys [id]} :- [:map [:id ms/PositiveInt]]]
+  (-> (t2/select-one :model/Field :id id) api/read-check xrays/related))
+```
+
+## Advanced Patterns
+
+### Custom Error Messages
+
+```clojure
+(def DBEngineString
+  "Schema for a valid database engine name."
+  (mu/with-api-error-message
+   [:and
+    ms/NonBlankString
+    [:fn
+     {:error/message "Valid database engine"}
+     #(u/ignore-exceptions (driver/the-driver %))]]
+   (deferred-tru "value must be a valid database engine.")))
+```
+
+### Enum with Documentation
+
+```clojure
+(def PinnedState
+  (into [:enum {:error/message "pinned state must be 'all', 'is_pinned', or 'is_not_pinned'"}]
+        #{"all" "is_pinned" "is_not_pinned"}))
+```
+
+### Complex Nested Response
+
+```clojure
+(mr/def ::DashboardQuestionCandidate
+  [:map
+   [:id ms/PositiveInt]
+   [:name ms/NonBlankString]
+   [:description [:maybe string?]]
+   [:sole_dashboard_info
+    [:map
+     [:id ms/PositiveInt]
+     [:name ms/NonBlankString]
+     [:description [:maybe string?]]]]])
+
+(mr/def ::DashboardQuestionCandidatesResponse
+  [:map
+   [:data [:sequential ::DashboardQuestionCandidate]]
+   [:total ms/PositiveInt]])
+```
+
+### Paginated Response Pattern
+
+```clojure
+(mr/def ::PaginatedResponse
+  [:map
+   [:data [:sequential ::Item]]
+   [:total integer?]
+   [:limit {:optional true} [:maybe integer?]]
+   [:offset {:optional true} [:maybe integer?]]])
+```
+
+## Common Pitfalls
+
+### Don't: Forget `:maybe` for nullable fields
+
+```clojure
+[:description ms/NonBlankString]  ;; WRONG - fails if nil
+[:description [:maybe ms/NonBlankString]]  ;; RIGHT - allows nil
+```
+
+### Don't: Forget `:optional true` for optional query params
+
+```clojure
+[:limit ms/PositiveInt]  ;; WRONG - required but shouldn't be
+[:limit {:optional true} [:maybe ms/PositiveInt]]  ;; RIGHT
+```
+
+### Don't: Forget `:default` values for known params
+
+```clojure
+[:limit ms/PositiveInt]  ;; WRONG - required but shouldn't be
+[:limit {:optional true :default 0} [:maybe ms/PositiveInt]]  ;; RIGHT
+```
+
+
+### Don't: Mix up route params, query params, and body
+
+```clojure
+;; WRONG - all in one map
+[{:keys [id name archived]} :- [:map ...]]
+
+;; RIGHT - separate destructuring
+[{:keys [id]} :- [:map [:id ms/PositiveInt]]
+ {:keys [archived]} :- [:map [:archived {:default false} ms/BooleanValue]]
+ {:keys [name]} :- [:map [:name ms/NonBlankString]]]
+```
+
+### Don't: Use `ms/TemporalString` for Java Time objects in response schemas
+
+```clojure
+;; WRONG - Java Time objects aren't strings yet
+[:date_joined ms/TemporalString]
+
+;; RIGHT - schemas validate BEFORE JSON serialization
+[:date_joined :any]  ;; Java Time object, serialized to string by middleware
+[:last_login [:maybe :any]]  ;; Java Time object or nil
+```
+
+**Why:** Response schemas validate the internal Clojure data structures BEFORE they are serialized to JSON. Java Time objects like `OffsetDateTime` get converted to ISO-8601 strings by the JSON middleware, so the schema needs to accept the raw Java objects.
+
+### Don't: Use `[:sequential X]` when the data is actually a set
+
+```clojure
+;; WRONG - group_ids is actually a set
+[:group_ids {:optional true} [:sequential pos-int?]]
+
+;; RIGHT - matches the actual data structure
+[:group_ids {:optional true} [:maybe [:set pos-int?]]]
+```
+
+**Why:** Toucan hydration methods often return sets. The JSON middleware will serialize sets to arrays, but the schema validates before serialization.
+
+### Don't: Create anonymous schemas for reused structures
+
+Use `mr/def` for schemas used in multiple places:
+
+```clojure
+(mr/def ::User
+  [:map
+   [:id pos-int?]
+   [:email string?]
+   [:name string?]])
+```
+
+## Finding Return Types
+
+1. **Look at the function being called**
+
+```clojure
+(api.macros/defendpoint :get "/:id"
+  [{:keys [id]}]
+  (t2/select-one :model/Field :id id))  ;; Returns a Field instance
+```
+
+2. **Check Toucan models for structure**
+
+Look in `src/metabase/*/models/*.clj` for model definitions.
+
+3. **Use clojure-mcp or REPL to inspect**
+
+```bash
+./bin/mage -repl '(require '\''metabase.xrays.core) (doc metabase.xrays.core/related)'
+```
+
+4. **Check tests**
+
+Tests often show the expected response structure.
+
+## Understanding Schema Validation Timing
+
+**CRITICAL CONCEPT:** Schemas validate at different points in the request/response lifecycle:
+
+### Request Parameter Schemas (Query/Body/Route)
+- Validate AFTER JSON parsing
+- Data is already deserialized (strings, numbers, booleans)
+- Use `ms/TemporalString` for date/time inputs
+- Use `ms/BooleanValue` for boolean query params
+
+### Response Schemas
+- Validate BEFORE JSON serialization
+- Data is still in Clojure format (Java Time objects, sets, keywords)
+- Use `:any` for Java Time objects
+- Use `[:set X]` for sets
+- Use `[:enum :keyword]` for keyword enums
+
+### Serialization Flow
+
+```
+Request:  JSON string → Parse → Coerce → Handler
+Response: Handler → Schema Check → Encode → Serialize → JSON string
+```
+
+## Workflow Summary
+
+1. **Read the endpoint** - understand what it does
+2. **Identify params** - route, query, body
+3. **Add parameter schemas** - use existing types from `ms`
+4. **Determine return type** - check the implementation
+5. **Define response schema** - inline or named with `mr/def`
+6. **Test** - ensure the endpoint works and validates correctly
+
+## Testing Your Schemas
+
+After adding schemas, verify:
+
+1. **Valid requests work** - test with correct data
+2. **Invalid requests fail gracefully** - test with wrong types
+3. **Optional params work** - test with/without optional params
+4. **Error messages are clear** - check validation error responses
+
+## Tips
+
+- **Start simple** - begin with basic types, refine later
+- **Reuse schemas** - if you see the same structure twice, make it a named schema
+- **Be specific** - use `ms/PositiveInt` instead of `pos-int?`
+- **Document intent** - add docstrings to named schemas
+- **Follow conventions** - look at similar endpoints in the same namespace
+- **Check the actual data** - use REPL to inspect what's actually returned before serialization
+
+## Additional Resources
+
+- [Malli Documentation](https://github.com/metosin/malli)
+- Metabase Malli utilities: `src/metabase/util/malli/schema.clj`
+- Metabase schema registry: `src/metabase/util/malli/registry.clj`

.claude/skills/analytics-events/SKILL.md

@@ -0,0 +1,504 @@
+---
+name: analytics-events
+description: Add product analytics events to track user interactions in the Metabase frontend
+allowed-tools: Read, Write, Edit, Grep, Glob
+---
+
+# Frontend Analytics Events Skill
+
+This skill helps you add product analytics (Snowplow) events to track user interactions in the Metabase frontend codebase.
+
+## Quick Reference
+
+Analytics events in Metabase use Snowplow with typed event schemas. All events must be defined in TypeScript types before use.
+
+**Key Files:**
+- `frontend/src/metabase-types/analytics/event.ts` - Event type definitions
+- `frontend/src/metabase-types/analytics/schema.ts` - Schema registry
+- `frontend/src/metabase/lib/analytics.ts` - Core tracking functions
+- Feature-specific `analytics.ts` files - Tracking function wrappers
+
+## Quick Checklist
+
+When adding a new analytics event:
+
+- [ ] Define event type in `frontend/src/metabase-types/analytics/event.ts`
+- [ ] Add event to appropriate union type (e.g., `DataStudioEvent`, `SimpleEvent`)
+- [ ] Create tracking function in feature's `analytics.ts` file
+- [ ] Import and call tracking function at the interaction point
+- [ ] Use `trackSimpleEvent()` for basic events (most common)
+
+## Event Schema Types
+
+### 1. Simple Events (Most Common)
+
+Use `SimpleEventSchema` for straightforward tracking. It supports these standard fields:
+
+```typescript
+type SimpleEventSchema = {
+  event: string;                    // Required: Event name (snake_case)
+  target_id?: number | null;        // Optional: ID of affected entity
+  triggered_from?: string | null;   // Optional: UI location/context
+  duration_ms?: number | null;      // Optional: Duration in milliseconds
+  result?: string | null;           // Optional: Outcome (e.g., "success", "failure")
+  event_detail?: string | null;     // Optional: Additional detail/variant
+};
+```
+
+**When to use:** 90% of events fit this schema. Use for clicks, opens, closes, creates, deletes, etc.
+
+### 2. Custom Schemas (legacy, no events are being added)
+
+Consider adding new event schema only in very special cases.
+
+**Examples:** `DashboardEventSchema`, `CleanupEventSchema`, `QuestionEventSchema`
+
+## Step-by-Step: Adding a Simple Event
+
+### Example: Track when a user applies filters in a table picker
+
+#### Step 1: Define Event Types
+
+Add event type definitions to `frontend/src/metabase-types/analytics/event.ts`:
+
+```typescript
+export type DataStudioTablePickerFiltersAppliedEvent = ValidateEvent<{
+  event: "data_studio_table_picker_filters_applied";
+}>;
+
+export type DataStudioTablePickerFiltersClearedEvent = ValidateEvent<{
+  event: "data_studio_table_picker_filters_cleared";
+}>;
+```
+
+#### Step 2: Add to Union Type
+
+Find or create the appropriate union type and add your events:
+
+```typescript
+export type DataStudioEvent =
+  | DataStudioLibraryCreatedEvent
+  | DataStudioTablePublishedEvent
+  | DataStudioGlossaryCreatedEvent
+  | DataStudioGlossaryEditedEvent
+  | DataStudioGlossaryDeletedEvent
+  | DataStudioTablePickerFiltersAppliedEvent  // <- Add here
+  | DataStudioTablePickerFiltersClearedEvent; // <- Add here
+```
+
+#### Step 3: Create Tracking Functions
+
+In your feature's `analytics.ts` file (e.g., `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`):
+
+```typescript
+import { trackSimpleEvent } from "metabase/lib/analytics";
+
+export const trackDataStudioTablePickerFiltersApplied = () => {
+  trackSimpleEvent({
+    event: "data_studio_table_picker_filters_applied",
+  });
+};
+
+export const trackDataStudioTablePickerFiltersCleared = () => {
+  trackSimpleEvent({
+    event: "data_studio_table_picker_filters_cleared",
+  });
+};
+```
+
+#### Step 4: Use in Components
+
+Import and call the tracking function at the interaction point:
+
+```typescript
+import {
+  trackDataStudioTablePickerFiltersApplied,
+  trackDataStudioTablePickerFiltersCleared,
+} from "metabase-enterprise/data-studio/analytics";
+
+function FilterPopover({ filters, onSubmit }) {
+  const handleReset = () => {
+    trackDataStudioTablePickerFiltersCleared(); // <- Track here
+    onSubmit(emptyFilters);
+  };
+
+  return (
+    <form
+      onSubmit={(event) => {
+        event.preventDefault();
+        trackDataStudioTablePickerFiltersApplied(); // <- Track here
+        onSubmit(form);
+      }}
+    >
+      {/* form content */}
+    </form>
+  );
+}
+```
+
+## Using SimpleEventSchema Fields
+
+### Example: Event with target_id
+
+```typescript
+// Type definition
+export type DataStudioLibraryCreatedEvent = ValidateEvent<{
+  event: "data_studio_library_created";
+  target_id: number | null;
+}>;
+
+// Tracking function
+export const trackDataStudioLibraryCreated = (id: CollectionId) => {
+  trackSimpleEvent({
+    event: "data_studio_library_created",
+    target_id: Number(id),
+  });
+};
+
+// Usage
+trackDataStudioLibraryCreated(newLibrary.id);
+```
+
+### Example: Event with triggered_from
+
+```typescript
+// Type definition
+export type NewButtonClickedEvent = ValidateEvent<{
+  event: "new_button_clicked";
+  triggered_from: "app-bar" | "empty-collection";
+}>;
+
+// Tracking function
+export const trackNewButtonClicked = (location: "app-bar" | "empty-collection") => {
+  trackSimpleEvent({
+    event: "new_button_clicked",
+    triggered_from: location,
+  });
+};
+
+// Usage
+<Button onClick={() => {
+  trackNewButtonClicked("app-bar");
+  handleCreate();
+}}>
+  New
+</Button>
+```
+
+### Example: Event with event_detail
+
+```typescript
+// Type definition
+export type MetadataEditEvent = ValidateEvent<{
+  event: "metadata_edited";
+  event_detail: "type_casting" | "semantic_type_change" | "visibility_change";
+  triggered_from: "admin" | "data_studio";
+}>;
+
+// Tracking function
+export const trackMetadataChange = (
+  detail: "type_casting" | "semantic_type_change" | "visibility_change",
+  location: "admin" | "data_studio"
+) => {
+  trackSimpleEvent({
+    event: "metadata_edited",
+    event_detail: detail,
+    triggered_from: location,
+  });
+};
+
+// Usage
+trackMetadataChange("semantic_type_change", "data_studio");
+```
+
+### Example: Event with result and duration
+
+```typescript
+// Type definition
+export type MoveToTrashEvent = ValidateEvent<{
+  event: "moved-to-trash";
+  target_id: number | null;
+  triggered_from: "collection" | "detail_page" | "cleanup_modal";
+  duration_ms: number | null;
+  result: "success" | "failure";
+  event_detail: "question" | "model" | "metric" | "dashboard";
+}>;
+
+// Tracking function
+export const trackMoveToTrash = (params: {
+  targetId: number | null;
+  triggeredFrom: "collection" | "detail_page" | "cleanup_modal";
+  durationMs: number | null;
+  result: "success" | "failure";
+  itemType: "question" | "model" | "metric" | "dashboard";
+}) => {
+  trackSimpleEvent({
+    event: "moved-to-trash",
+    target_id: params.targetId,
+    triggered_from: params.triggeredFrom,
+    duration_ms: params.durationMs,
+    result: params.result,
+    event_detail: params.itemType,
+  });
+};
+
+// Usage with timing
+const startTime = Date.now();
+try {
+  await moveToTrash(item);
+  trackMoveToTrash({
+    targetId: item.id,
+    triggeredFrom: "collection",
+    durationMs: Date.now() - startTime,
+    result: "success",
+    itemType: "question",
+  });
+} catch (error) {
+  trackMoveToTrash({
+    targetId: item.id,
+    triggeredFrom: "collection",
+    durationMs: Date.now() - startTime,
+    result: "failure",
+    itemType: "question",
+  });
+}
+```
+
+## Naming Conventions
+
+### Event Names (snake_case)
+
+```typescript
+// Good
+"data_studio_library_created"
+"table_picker_filters_applied"
+"metabot_chat_opened"
+
+// Bad
+"DataStudioLibraryCreated"  // Wrong case
+"tablePickerFiltersApplied" // Wrong case
+"filters-applied"            // Use underscore, not hyphen
+```
+
+### Event Type Names (PascalCase with "Event" suffix)
+
+```typescript
+// Good
+DataStudioLibraryCreatedEvent
+TablePickerFiltersAppliedEvent
+MetabotChatOpenedEvent
+
+// Bad
+dataStudioLibraryCreated      // Wrong case
+DataStudioLibraryCreated      // Missing "Event" suffix
+```
+
+### Tracking Function Names (camelCase with "track" prefix)
+
+```typescript
+// Good
+trackDataStudioLibraryCreated
+trackTablePickerFiltersApplied
+trackMetabotChatOpened
+
+// Bad
+DataStudioLibraryCreated      // Missing "track" prefix
+track_library_created         // Wrong case
+logLibraryCreated             // Use "track" prefix
+```
+
+## Common Patterns
+
+### Pattern 1: Feature-Specific Union Types
+
+Group related events together:
+
+```typescript
+export type DataStudioEvent =
+  | DataStudioLibraryCreatedEvent
+  | DataStudioTablePublishedEvent
+  | DataStudioGlossaryCreatedEvent;
+
+export type MetabotEvent =
+  | MetabotChatOpenedEvent
+  | MetabotRequestSentEvent
+  | MetabotFixQueryClickedEvent;
+
+// Then add to SimpleEvent union
+export type SimpleEvent =
+  | /* other events */
+  | DataStudioEvent
+  | MetabotEvent
+  | /* more events */;
+```
+
+### Pattern 2: Conditional Tracking
+
+Track different events based on user action:
+
+```typescript
+const handleSave = async () => {
+  if (isNewItem) {
+    await createItem(data);
+    trackItemCreated(newItem.id);
+  } else {
+    await updateItem(id, data);
+    trackItemUpdated(id);
+  }
+};
+```
+
+## Common Pitfalls
+
+### Don't: Add custom fields to SimpleEvent
+
+```typescript
+// WRONG - SimpleEvent doesn't support custom fields
+export const trackFiltersApplied = (filters: FilterState) => {
+  trackSimpleEvent({
+    event: "filters_applied",
+    data_layer: filters.dataLayer,      // ❌ Not in SimpleEventSchema
+    data_source: filters.dataSource,    // ❌ Not in SimpleEventSchema
+    with_owner: filters.hasOwner,       // ❌ Not in SimpleEventSchema
+  });
+};
+
+// RIGHT - Use only standard SimpleEventSchema fields
+export const trackFiltersApplied = () => {
+  trackSimpleEvent({
+    event: "filters_applied",
+  });
+};
+
+// Or use event_detail for a single variant
+export const trackFilterApplied = (filterType: string) => {
+  trackSimpleEvent({
+    event: "filter_applied",
+    event_detail: filterType,  // ✓ "data_layer", "data_source", etc.
+  });
+};
+```
+
+### Don't: Forget to add event to union type
+
+```typescript
+// Define the event
+export type NewFeatureClickedEvent = ValidateEvent<{
+  event: "new_feature_clicked";
+}>;
+
+// ❌ WRONG - Forgot to add to SimpleEvent union
+// Event won't be recognized by TypeScript
+
+// ✓ RIGHT - Add to appropriate union
+export type SimpleEvent =
+  | /* other events */
+  | NewFeatureClickedEvent;
+```
+
+### Don't: Mix up event name formats
+
+```typescript
+// WRONG
+event: "dataStudioLibraryCreated"  // camelCase
+event: "data-studio-library-created"  // kebab-case
+event: "Data_Studio_Library_Created"  // Mixed case
+
+// RIGHT
+event: "data_studio_library_created"  // snake_case
+```
+
+### Don't: Track PII or sensitive data
+
+```typescript
+// WRONG - Don't track user emails, names, or sensitive data
+trackSimpleEvent({
+  event: "user_logged_in",
+  event_detail: user.email,  // ❌ PII
+});
+
+// RIGHT - Track non-sensitive identifiers only
+trackSimpleEvent({
+  event: "user_logged_in",
+  target_id: user.id,  // ✓ Just the ID
+});
+```
+
+### Don't: Forget to track both success and failure
+
+```typescript
+// WRONG - Only tracking success
+try {
+  await saveData();
+  trackDataSaved();
+} catch (error) {
+  // ❌ No tracking for failure case
+}
+
+// RIGHT - Track both outcomes
+try {
+  await saveData();
+  trackDataSaved({ result: "success" });
+} catch (error) {
+  trackDataSaved({ result: "failure" });
+}
+```
+
+## Testing Analytics Events
+
+While developing, you can verify events are firing:
+
+1. **Check browser console** - When `SNOWPLOW_ENABLED=true` in dev, events are logged
+2. **Use shouldLogAnalytics** - Set in `metabase/env` to see all analytics in console
+3. **Check Snowplow debugger** - Browser extension for Snowplow events
+
+Example console output:
+
+```
+[SNOWPLOW EVENT | event sent:true], data_studio_table_picker_filters_applied
+```
+
+## File Organization
+
+### Where to put tracking functions:
+
+```
+Feature-specific analytics functions:
+frontend/src/metabase/{feature}/analytics.ts
+enterprise/frontend/src/metabase-enterprise/{feature}/analytics.ts
+
+Event type definitions (all in one place):
+frontend/src/metabase-types/analytics/event.ts
+
+Core tracking utilities:
+frontend/src/metabase/lib/analytics.ts
+```
+
+## Real-World Examples
+
+See these files for reference:
+
+- **Simple events**: `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`
+- **Events with variants**: `frontend/src/metabase/dashboard/analytics.ts`
+- **Complex events**: `frontend/src/metabase/query_builder/analytics.js`
+- **Event type examples**: `frontend/src/metabase-types/analytics/event.ts`
+
+## Workflow Summary
+
+1. **Identify the user interaction** to track
+2. **Decide on event name** (snake_case, descriptive)
+3. **Define event type** in `event.ts` using `ValidateEvent`
+4. **Add to union type** (create feature union if needed)
+5. **Create tracking function** in feature's `analytics.ts`
+6. **Import and call** at the interaction point
+7. **Test** that events fire correctly
+
+## Tips
+
+- **Be specific** - `filters_applied` is better than `action_performed`
+- **Use past tense** - `library_created` not `create_library`
+- **Group related events** - Create feature-specific event union types
+- **Track meaningful actions** - Not every click needs tracking
+- **Consider the data** - What would you want to analyze later?
+- **Stay consistent** - Follow existing naming patterns in the codebase
+- **Document context** - Use `triggered_from` to track where the action happened

.claude/skills/clojure-review/SKILL.md

@@ -54,14 +54,14 @@ Use this to scan through changes efficiently:
 - [ ] Public vars in `src` or `enterprise/backend/src` have useful docstrings
 - [ ] Docstrings use Markdown conventions
 - [ ] References use `[[other-var]]` not backticks
-- [ ] `TODO` comments include author and date: `;; TODO (Name 1/1/25) -- description`
+- [ ] `TODO` comments include author and date: `;; TODO (Name 2025-01-01) -- description`
 
 ### Code Organization
 
 - [ ] Everything `^:private` unless used elsewhere
 - [ ] No `declare` when avoidable (public functions near end)
 - [ ] Functions under 20 lines when possible
-- [ ] No blank lines within definition forms (except pairwise constructs in `let`/`cond`)
+- [ ] No blank, non-comment lines within definition forms (except pairwise constructs in `let`/`cond`)
 - [ ] Lines ≤ 120 characters
 
 ### Tests
@@ -118,7 +118,7 @@ Quick scan for common issues:
 | `update-db`, `save-model`                    | Missing `!` for side effects: `update-db!`, `save-model!`   |
 | `snake_case_var`                             | Should use kebab-case                                       |
 | Public var without docstring                 | Add docstring explaining purpose                            |
-| `;; TODO fix this`                           | Missing author/date: `;; TODO (Name 1/1/25) -- description` |
+| `;; TODO fix this`                           | Missing author/date: `;; TODO (Name 2025-01-01) -- description` |
 | `(defn foo ...)` in namespace used elsewhere | Should be `(defn ^:private foo ...)`                        |
 | Function > 20 lines                          | Consider breaking up into smaller functions                 |
 | `/api/dashboards/:id`                        | Use singular: `/api/dashboard/:id`                          |

.claude/skills/clojure-write/SKILL.md

@@ -5,6 +5,16 @@ description: Guide Clojure and ClojureScript development using REPL-driven workf
 
 # Clojure Development Skill
 
+## Tool Preference
+
+When `clojure-mcp` tools are available (e.g., `clojure_eval`, `clojure_edit`), **always use them**
+instead of shell commands like `./bin/mage -repl`. The MCP tools provide:
+- Direct REPL integration without shell escaping issues
+- Better error messages and feedback
+- Structural Clojure editing that prevents syntax errors
+
+Only fall back to `./bin/mage` commands when clojure-mcp is not available.
+
 @./../_shared/development-workflow.md
 @./../_shared/clojure-style-guide.md
 @./../_shared/clojure-commands.md

.claude/skills/docs-review/SKILL.md

@@ -54,8 +54,6 @@ Run through the diff looking for these issues:
 
 **Formatting:**
 
-- [ ] Backticks on UI elements (should use **bold**)
-- [ ] Backticks used as quotation marks
 - [ ] Ampersands as "and" substitute (except proper nouns)
 - [ ] Inconsistent list formatting
 
@@ -74,7 +72,6 @@ Run through the diff looking for these issues:
 
 | Pattern                       | Issue                                         |
 | ----------------------------- | --------------------------------------------- |
-| `Button name` or `UI element` | Should use **bold** not backticks             |
 | we can do X, our feature      | Should be "Metabase" or "it"                  |
 | click here, read more here    | Need descriptive link text                    |
 | easy, simple, just            | Remove condescending qualifiers               |
@@ -108,13 +105,10 @@ Suggested fix or explanation
 
 **Examples:**
 
-> **Issue 1: Backticks on UI elements**
-> Line 42: This uses backticks for the UI element. Use **bold** instead: **Filter** not `Filter`.
-
-> **Issue 2: Formal tone**
+> **Issue 1: Formal tone**
 > Line 15: This could be more conversational. Consider: "You can't..." instead of "You cannot..."
 
-> **Issue 3: Vague heading**
+> **Issue 2: Vague heading**
 > Line 8: The heading could be more specific. Try stating the point directly: "Run migrations before upgrading" vs "Upgrade process"
 
 ### PR review mode format
@@ -145,10 +139,11 @@ When posting to GitHub (PR mode), use the **pending review workflow**:
    - All comments will appear together as one cohesive review
 
 **Comment format example:**
-```
-**Issue 1: Backticks on UI elements**
 
-This uses backticks for the UI element. Use **bold** instead: **Filter** not `Filter`.
+```
+**Issue 1: Formal tone**
+
+This could be more conversational. Consider: "You can't..." instead of "You cannot..."
 ```
 
 **IMPORTANT**:

.clj-kondo/config.edn

@@ -65,8 +65,10 @@
   :metabase/missing-test-expr-requires-in-cljs               {:level :warning}
   :metabase/modules                                          {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
   :metabase/namespace-name                                   {:level :warning}
+  :metabase/no-jsqlparser-imports                            {:level :warning}
   :metabase/require-shape-checker                            {:level :warning}
   :metabase/test-helpers-use-non-thread-safe-functions       {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
+  :metabase/tests-must-live-in-known-modules                 {:level :warning}
   :metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
   :metabase/validate-defendpoint-query-params-use-kebab-case {:level :warning}
   :metabase/validate-logging                                 {:level :warning}
@@ -218,7 +220,8 @@
   ;; misc config for built-in linters
   ;;
 
-  :invalid-arity       {:skip-args [metabase.lib.util.match/match]}                    ; TODO (cam): can we fix these?
+  :invalid-arity       {:skip-args [metabase.lib.util.match/match
+                                    metabase.lib.util.match/match-lite]}                    ; TODO (cam): can we fix these?
   :refer-all           {:level :warning, :exclude [clojure.test]}
   :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
@@ -229,9 +232,6 @@
   {:exclude
    [(build.uberjar/with-duration-ms)
     (cljs.test/is [=? malli=])
-    (clojure.core.logic/fresh)
-    (clojure.core.logic/matcha)
-    (clojure.core.logic/run)
     (clojure.test/is [=? malli= qv=])
     (clojure.tools.macro/macrolet)
     instaparse.core/transform
@@ -240,7 +240,6 @@
     (metabase.lib.util.match/match)
     (metabase.lib.util.match/match-one)
     (metabase.lib.util.match/match-lite)
-    (metabase.lib.util.match/match-lite-recursive)
     (metabase.lib.util.match/replace)
     (metabase.lib.util.match/replace-in)
     (metabase.driver-api.core/match)
@@ -298,9 +297,11 @@
    metabase.lib.convert/->legacy-MBQL                 {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.core/->legacy-MBQL                    {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
+   metabase-enterprise.transforms.interface/execute!  {:message "Use metabase-enterprise.transforms.execute/execute! instead of metabase-enterprise.transforms.interface/execute!"}
    next.jdbc/active-tx?                               {:message "Use metabase.app-db.core/in-transaction? to see if we are in a transaction"}
    toucan2.core/debug                                 {:message "Don't commit code using t2/debug"}
-   toucan2.tools.debug/debug                          {:message "Don't commit code using t2/debug"}}
+   toucan2.tools.debug/debug                          {:message "Don't commit code using t2/debug"}
+   macaw.core/parsed-query                            {:message "Use metabase.driver.util/parsed-query instead of macaw.core/parsed-query"}}
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
@@ -410,7 +411,6 @@
  :lint-as
  {cljs.cache/defcache                                                                   clojure.core/deftype
   clojure.core.cache/defcache                                                           clojure.core/deftype
-  clojure.core.logic/defne                                                              clj-kondo.lint-as/def-catch-all
   clojure.test.check.clojure-test/defspec                                               clojure.test/deftest
   clojure.test.check.properties/for-all                                                 clojure.core/let
   clojurewerkz.quartzite.jobs/defjob                                                    clojure.core/defn
@@ -452,8 +452,8 @@
   metabase.premium-features.settings/define-premium-feature                             clojure.core/def
   metabase.pulse.dashboard-subscription-test/with-dashboard-sub-for-card                clojure.core/let
   metabase.pulse.send-test/with-pulse-for-card                                          clojure.core/let
-  metabase.query-processor-test.pipeline-queries-test/pmbql-query                       clojure.core/->
-  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                   clojure.core/->
+  metabase.query-processor.pipeline-queries-test/pmbql-query                       clojure.core/->
+  metabase.query-processor.pipeline-queries-test/run-pmbql-query                   clojure.core/->
   metabase.query-processor.error-type/deferror                                          clojure.core/def
   metabase.query-processor.middleware.cache.impl/with-reducible-deserialized-results    clojure.core/let
   metabase.query-processor.middleware.process-userland-query-test/with-query-execution! clojure.core/let
@@ -524,8 +524,10 @@
    metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
    metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
+   metabase-enterprise.dependencies.api-test/with-dependents-test!                                                           hooks.common/with-two-bindings
    metabase-enterprise.metabot-v3.tools.dependencies-test/with-dependent-transforms!                                         hooks.common/with-two-bindings
    metabase-enterprise.semantic-search.db.connection/with-migrate-tx                                                         hooks.common/let-one-with-optional-value
+   metabase-enterprise.serialization.api-test/with-serialization-test-data!                                                  hooks.common/with-three-bindings
    metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
    metabase-enterprise.transforms-python.drivers-test/with-test-table                                                        hooks.common/with-two-bindings
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
@@ -543,7 +545,7 @@
    metabase.dashboards-rest.api-test/with-simple-dashboard-with-tabs                                                         hooks.common/with-one-binding
    metabase.dashboards.models.dashboard-tab-test/with-dashtab-in-personal-collection                                         hooks.common/with-one-top-level-binding
    metabase.dashboards.models.dashboard-test/with-dash-in-collection!                                                        hooks.common/with-three-bindings
-   metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
+   metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor.expressions-test/calculate-bird-scarcity
    metabase.driver.mongo-test/with-describe-table-for-sample                                                                 hooks.metabase.driver.mongo-test/with-describe-table-for-sample
    metabase.driver.oracle-test/with-temp-user                                                                                hooks.common/let-one-with-optional-value
    metabase.driver/register!                                                                                                 hooks.metabase.driver/register!
@@ -580,11 +582,11 @@
    metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection!                                               hooks.common/with-four-bindings
    metabase.pulse.models.pulse-test/with-pulse-in-collection!                                                                hooks.common/with-four-bindings
    metabase.pulse.test-util/checkins-query-card                                                                              hooks.metabase.test.data/$ids
-   metabase.queries.api.card-test/with-card-param-values-fixtures                                                            hooks.common/let-one-with-optional-value
-   metabase.queries.api.card-test/with-temp-native-card                                                                      hooks.common/with-two-bindings
-   metabase.queries.api.card-test/with-temp-native-card-with-params                                                          hooks.common/with-two-bindings
-   metabase.query-processor-test.expressions-test/calculate-bird-scarcity                                                    hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
-   metabase.query-processor-test.filter-test/count-with-filter-clause                                                        hooks.metabase.test.data/$ids
+   metabase.queries-rest.api.card-test/with-card-param-values-fixtures                                                       hooks.common/let-one-with-optional-value
+   metabase.queries-rest.api.card-test/with-temp-native-card                                                                 hooks.common/with-two-bindings
+   metabase.queries-rest.api.card-test/with-temp-native-card-with-params                                                     hooks.common/with-two-bindings
+   metabase.query-processor.expressions-test/calculate-bird-scarcity                                                         hooks.metabase.query-processor.expressions-test/calculate-bird-scarcity
+   metabase.query-processor.filter-test/count-with-filter-clause                                                             hooks.metabase.test.data/$ids
    metabase.query-processor.middleware.cache-test/with-mock-cache!                                                           hooks.common/with-two-bindings
    metabase.request.core/with-current-request                                                                                hooks.common/with-used-first-arg
    metabase.request.core/with-current-user                                                                                   hooks.common/with-used-first-arg
@@ -683,7 +685,7 @@
    metabase.parameters.chain-filter-test/chain-filter-search                                    macros.metabase.parameters.chain-filter-test/chain-filter
    metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-card-referencing!        macros.metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-card-referencing!
    metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-dashcard-referencing!    macros.metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-dashcard-referencing!
-   metabase.queries.api.card-test/with-ordered-items                                            macros.metabase.queries.api.card-test/with-ordered-items
+   metabase.queries-rest.api.card-test/with-ordered-items                                       macros.metabase.queries-rest.api.card-test/with-ordered-items
    metabase.query-analysis.models.query-analysis-test/with-test-setup                           macros.metabase.query-analysis.models.query-analysis-test/with-test-setup
    metabase.query-analysis.task.test-setup/with-test-setup!                                     macros.metabase.query-analysis.task.test-setup/with-test-setup!
    metabase.query-processor.streaming/streaming-response                                        macros.metabase.query-processor.streaming/streaming-response
@@ -752,7 +754,10 @@
   ;; `metabase-enterprise.sandbox.query-processor*-test`
   ;;
   {:pattern "^metabase(?:((?:-enterprise\\.sandbox)?\\.query-processor)|(?:\\.driver\\.sql(?!server)(?!ite))).*-test$"
-   :name    general-qp-and-driver-test-namespaces}]
+   :name    general-qp-and-driver-test-namespaces}
+
+  {:pattern "(?:^mage.*)"
+   :name    mage-namespaces}]
 
  :config-in-ns
  {test-namespaces
@@ -776,9 +781,10 @@
 
   source-namespaces
   {:linters
-   {:metabase/validate-escaped-single-quotes-in-i18n {:level :warning}
-    :metabase/validate-string-or-str-args-to-i18n {:level :warning}
-    :metabase/discourage-millis-duration {:level :warning}
+   {:metabase/discourage-millis-duration               {:level :warning}
+    :metabase/validate-defendpoint-has-response-schema {:level :warning}
+    :metabase/validate-escaped-single-quotes-in-i18n   {:level :warning}
+    :metabase/validate-string-or-str-args-to-i18n      {:level :warning}
 
     :discouraged-var
     {clojure.core/with-redefs {:message "Don't use with-redefs outside of tests"}
@@ -907,6 +913,7 @@
      clojure.core/every?          {:message "Use metabase.util.performance/every?"}
      clojure.core/mapv            {:message "Use metabase.util.performance/mapv"}
      clojure.core/run!            {:message "Use metabase.util.performance/run!"}
+     clojure.core/get-in          {:message "Use metabase.util.performance/get-in"}
      clojure.core/select-keys     {:message "Use metabase.util.performance/select-keys"}
      clojure.core/some            {:message "Use metabase.util.performance/some"}
      clojure.core/update-keys     {:message "Use metabase.util.performance/update-keys"}
@@ -947,4 +954,11 @@
      toucan2.tools.with-temp/with-temp         {:message "Use lib.tu/mock-metadata-provider in QP tests. Exceptions: tests for code that doesn't use MPs or models not supported by MPs"}}
 
     :metabase/disallow-hardcoded-driver-names-in-tests
-    {:level :warning}}}}}
+    {:level :warning}}}
+
+  mage-namespaces
+  {:linters
+   {:discouraged-java-method
+    {java.lang.System {exit
+                       {:level :error
+                        :message "Don't use System/exit directly. Instead use mage.util/exit and let mage handle exiting the process"}}}}}}}

.clj-kondo/config/modules/config.edn

@@ -10,7 +10,7 @@
 ;; ## `team`:
 ;;
 ;; The team that owns this module. This has to match one of the team names in `.github/team.json` EXACTLY. You can
-;; run [metabase.core.modules-test/all-modules-have-teams-test]] to make sure you did this correctly.
+;; run [[metabase.core.modules-test/all-modules-have-teams-test]] to make sure you did this correctly.
 ;;
 ;; ## `api`:
 ;;
@@ -39,6 +39,17 @@
 ;; 2. A set of module symbols. This is the list of modules that are allowed to be referenced. An empty set means no
 ;;    other modules are allowed to be referenced; this is the default for any modules that aren't listed here.
 ;;
+;; ## `friends`:
+;;
+;; 'Friend' in the C++ sense; set of modules that are allowed free access into the internals of this module including
+;; namespaces that are not `:api` namespaces. This is useful when writing modules that are 'extensions' of other
+;; modules, for example `enterprise/search` might be enterprise extensions of `search`, or `search-rest` might be the
+;; REST API component for `search`.
+;;
+;;    search
+;;    {...
+;;     :friends #{enterprise/search search-rest}}
+;;
 ;; ## Tips
 ;;
 ;; PRO TIP: Check out the [[dev.deps-graph]] namespace for helpful tools to see where a module is used externally, and
@@ -93,7 +104,6 @@
            config
            events
            models
-           premium-features
            util}}
 
   analytics
@@ -106,7 +116,6 @@
    :uses #{api
            app-db
            appearance
-           channel
            config
            driver
            eid-translation
@@ -170,7 +179,8 @@
 
   api-routes
   {:team "UX West"
-   :api  #{metabase.api-routes.core}
+   :api  #{metabase.api-routes.cmd
+           metabase.api-routes.core}
    :uses :any}
 
   app-db
@@ -237,8 +247,7 @@
    :api  #{metabase.bookmarks.api}
    :uses #{api
            app-db
-           config
-           premium-features
+           collections
            queries
            util}}
 
@@ -267,6 +276,7 @@
            events
            models
            premium-features
+           request
            settings
            util}}
 
@@ -352,7 +362,8 @@
   {:team "UX West"
    :api  #{metabase.collections.core
            metabase.collections.models.collection
-           metabase.collections.models.collection.root}
+           metabase.collections.models.collection.root
+           metabase.collections.schema}
    :uses #{api
            api-keys
            app-db
@@ -368,11 +379,11 @@
 
   collections-rest
   {:team "UX West"
-   :api  #{metabase.collections-rest.api}
+   :api  #{metabase.collections-rest.api
+           metabase.collections-rest.init}
    :uses #{api
            app-db
            collections
-           config
            eid-translation
            events
            lib-be
@@ -383,9 +394,24 @@
            queries
            request
            revisions
+           settings
            upload
            util}}
 
+  comments
+  {:team "UX West"
+   :api  #{metabase.comments.api
+           metabase.comments.init}
+   :uses #{analytics
+           api
+           channel
+           events
+           models
+           request
+           users
+           users-rest
+           util}}
+
   ;; technically this 'uses' `enterprise/core` and `test` since it tries to load them to see if they exists so we know
   ;; if EE/test code is available; however we can ignore them since they're not real usages.
   config
@@ -480,6 +506,29 @@
    :api  #{metabase.database-routing.core}
    :uses #{premium-features}}
 
+  documents
+  {:team "UX West"
+   :api  #{metabase.documents.api
+           metabase.documents.core
+           metabase.documents.init
+           metabase.documents.prose-mirror
+           metabase.documents.schema}
+   :uses #{activity-feed
+           api
+           app-db
+           batch-processing
+           collections
+           events
+           models
+           public-sharing
+           queries
+           query-permissions
+           query-processor
+           revisions
+           search
+           util
+           view-log}}
+
   driver
   {:team "Drivers"
    :api  #{metabase.driver
@@ -565,7 +614,6 @@
            metabase.embedding.validation}
    :uses #{analytics
            api
-           config
            premium-features
            server
            settings
@@ -666,19 +714,16 @@
   lib
   {:team "Querying"
    :api  #{metabase.lib.binning
-           metabase.lib.binning.util
-           metabase.lib.card
-           metabase.lib.computed ; temporarily so that `qp.compile` can use it as lib memoization evolves
+           metabase.lib.convert  ; Only so [[metabase.queries.models.card]] can set dynamic vars.
            metabase.lib.core
            metabase.lib.equality
            metabase.lib.field
-           metabase.lib.field.resolution
-           metabase.lib.filter
            metabase.lib.filter.desugar.jvm ; only so [[metabase.legacy-mbql.jvm-util]] can use defined regexes
+           metabase.lib.hierarchy
            metabase.lib.init
-           metabase.lib.join.util
            metabase.lib.metadata
            metabase.lib.metadata.cached-provider
+           metabase.lib.metadata.column
            metabase.lib.metadata.invocation-tracker
            metabase.lib.metadata.protocols
            metabase.lib.metadata.result-metadata
@@ -699,25 +744,28 @@
            metabase.lib.schema.join
            metabase.lib.schema.literal
            metabase.lib.schema.mbql-clause
+           metabase.lib.schema.measure
            metabase.lib.schema.metadata
            metabase.lib.schema.metadata.fingerprint
            metabase.lib.schema.middleware-options
-           metabase.lib.schema.order-by
            metabase.lib.schema.parameter
            metabase.lib.schema.ref
            metabase.lib.schema.settings
            metabase.lib.schema.template-tag
            metabase.lib.schema.temporal-bucketing
            metabase.lib.schema.util
+           metabase.lib.schema.validate
            metabase.lib.temporal-bucket
            metabase.lib.types.isa
            metabase.lib.util
            metabase.lib.util.match
            metabase.lib.walk}
    :uses #{config
+           graph
            legacy-mbql
            types
-           util}}
+           util}
+   :friends #{query-processor}}
 
   lib-be
   {:team "Querying"
@@ -728,6 +776,23 @@
            settings
            util}}
 
+  llm
+  {:team "Metabot"
+   :api  #{metabase.llm.api
+           metabase.llm.init}
+   :uses #{analytics
+           api
+           driver
+           lib
+           lib-be
+           models
+           premium-features
+           request
+           settings
+           sync
+           util
+           warehouse-schema}}
+
   logger
   {:team "DevEx"
    :api  #{metabase.logger.api
@@ -752,6 +817,19 @@
            settings
            util}}
 
+  measures
+  {:team "Querying"
+   :api  #{metabase.measures.api}
+   :uses #{api
+           events
+           lib
+           lib-be
+           models
+           permissions
+           remote-sync
+           search
+           util}}
+
   model-persistence
   {:team "Querying"
    :api  #{metabase.model-persistence.api
@@ -802,6 +880,7 @@
            models
            permissions
            premium-features
+           remote-sync
            util}}
 
   notification
@@ -819,6 +898,7 @@
            config
            dashboards
            driver
+           embedding
            events
            models
            parameters
@@ -881,11 +961,13 @@
   {:team "UX West"
    :api  #{metabase.permissions-rest.api}
    :uses #{api
+           app-db
            audit-app
            events
            permissions
            premium-features
            request
+           settings
            util}}
 
   pivot
@@ -907,12 +989,15 @@
    :api  #{metabase.premium-features.api
            metabase.premium-features.core
            metabase.premium-features.init}
-   :uses #{api
+   :uses #{analytics
+           api
            app-db
            classloader
            config
+           events
            internal-stats
            settings
+           task
            util}}
 
   product-feedback
@@ -969,6 +1054,7 @@
            collections
            config
            driver
+           embedding
            events
            lib
            models
@@ -985,11 +1071,10 @@
 
   queries
   {:team "Querying"
-   :api  #{metabase.queries.api
-           metabase.queries.core
+   :api  #{metabase.queries.core
            metabase.queries.init
            metabase.queries.models.query ; TODO FIXME
-           metabase.queries.schema} ; TODO FIXME
+           metabase.queries.schema}
    :uses #{analytics
            analyze
            api
@@ -1001,8 +1086,7 @@
            config
            content-verification
            dashboards
-           eid-translation
-           embedding
+           documents
            events
            lib
            lib-be
@@ -1015,12 +1099,34 @@
            query-permissions
            query-processor
            request
-           revisions
            search
            util
            view-log
            warehouse-schema}}
 
+  queries-rest
+  {:team "Querying"
+   :api  #{metabase.queries-rest.api}
+   :uses #{analyze
+           api
+           collections
+           eid-translation
+           embedding
+           events
+           lib
+           lib-be
+           models
+           parameters
+           permissions
+           public-sharing
+           queries
+           query-permissions
+           query-processor
+           request
+           revisions
+           search
+           util}}
+
   query-permissions
   {:team "UX West"
    :api  #{metabase.query-permissions.core}
@@ -1115,7 +1221,8 @@
    :api  #{metabase.request.core
            metabase.request.init
            metabase.request.schema}
-   :uses #{api
+   :uses #{analytics
+           api
            config
            embedding
            permissions ; FIXME
@@ -1193,11 +1300,11 @@
            metabase.segments.schema}
    :uses #{api
            events
-           legacy-mbql
            lib
            lib-be
            models
            permissions
+           remote-sync
            search
            util
            xrays}}
@@ -1225,6 +1332,7 @@
            session
            settings
            system
+           users
            util
            enterprise/sso}}
 
@@ -1302,6 +1410,7 @@
            permissions
            premium-features
            settings
+           system
            util}}
 
   startup
@@ -1364,13 +1473,22 @@
            metabase.task-history.core
            metabase.task-history.init}
    :uses #{api
+           app-db
+           config
            models
            permissions
            premium-features
+           query-processor
            request
            task
            util}}
 
+  tenants
+  {:team "Admin Webapp"
+   :api  #{metabase.tenants.core}
+   :uses #{premium-features
+           util}}
+
   testing-api
   {:team "DevEx"
    :api  #{metabase.testing-api.api
@@ -1404,7 +1522,6 @@
    :uses #{analytics
            api
            collections
-           config
            events
            models
            util}}
@@ -1462,6 +1579,7 @@
            settings
            setup
            system
+           tenants
            util}}
 
   users-rest
@@ -1475,10 +1593,13 @@
            config
            events
            models
+           notification
            permissions
            premium-features
            request
+           settings
            sso
+           tenants
            users
            util
            enterprise/advanced-permissions}}
@@ -1530,6 +1651,7 @@
            api
            app-db
            audit-app
+           config
            driver
            lib
            lib-be
@@ -1538,6 +1660,7 @@
            permissions
            premium-features
            query-processor
+           remote-sync
            search
            util
            warehouses}}
@@ -1554,6 +1677,8 @@
            lib
            models
            parameters
+           permissions
+           premium-features
            query-processor
            request
            sync
@@ -1561,7 +1686,6 @@
            upload
            util
            warehouse-schema
-           warehouses-rest
            xrays}}
 
   warehouses
@@ -1613,7 +1737,6 @@
            warehouses
            enterprise/advanced-permissions}}
 
-
   xrays
   {:team "Querying"
    :api  #{metabase.xrays.api
@@ -1675,15 +1798,28 @@
            metabase-enterprise.advanced-permissions.common
            metabase-enterprise.advanced-permissions.models.permissions.group-manager}
    :uses #{api
+           audit-app
            lib
            permissions
            premium-features
            query-permissions
            query-processor
+           remote-sync
            util
            warehouses
            enterprise/impersonation}}
 
+  enterprise/agent-api
+  {:team "Metabot"
+   :api  #{metabase-enterprise.agent-api.api}
+   :uses #{api
+           auth-identity
+           query-processor
+           request
+           server
+           util
+           enterprise/metabot-v3}}
+
   enterprise/ai-entity-analysis
   {:team "Metabot"
    :api  #{metabase-enterprise.ai-entity-analysis.api}
@@ -1750,6 +1886,8 @@
            query-permissions
            query-processor
            settings
+           setup
+           startup
            sync
            users-rest
            util
@@ -1774,11 +1912,6 @@
            store-api
            util}}
 
-  enterprise/bookmarks
-  {:team "UX West"
-   :api  #{}
-   :uses #{}}
-
   enterprise/cache
   {:team "UX West"
    :api  #{metabase-enterprise.cache.init}
@@ -1798,20 +1931,6 @@
            util
            enterprise/harbormaster}}
 
-  enterprise/comments
-  {:team "UX West"
-   :api  #{metabase-enterprise.comments.api
-           metabase-enterprise.comments.init}
-   :uses #{analytics
-           api
-           channel
-           events
-           models
-           request
-           users
-           users-rest
-           util}}
-
   enterprise/content-translation
   {:team "UX West"
    :api  #{metabase-enterprise.content-translation.routes}
@@ -1840,6 +1959,22 @@
    :api  #{}
    :uses #{premium-features}}
 
+  enterprise/data-studio
+  {:team "Gadget"
+   :api  #{metabase-enterprise.data-studio.api}
+   :uses #{api
+           collections
+           database-routing
+           driver
+           events
+           models
+           permissions
+           premium-features
+           request
+           sync
+           util
+           warehouse-schema}}
+
   enterprise/database-replication
   {:team "Cloud"
    :api  #{metabase-enterprise.database-replication.api
@@ -1875,8 +2010,10 @@
            metabase-enterprise.dependencies.init}
    :uses #{analyze
            api
+           app-db
            collections
            config
+           documents
            driver
            events
            graph
@@ -1888,34 +2025,12 @@
            premium-features
            queries
            query-processor
+           request
            revisions
            settings
            task
            util
-           enterprise/documents}}
-
-  enterprise/documents
-  {:team "UX West"
-   :api  #{metabase-enterprise.documents.api
-           metabase-enterprise.documents.core
-           metabase-enterprise.documents.init
-           metabase-enterprise.documents.prose-mirror}
-   :uses #{activity-feed
-           api
-           app-db
-           batch-processing
-           collections
-           events
-           models
-           premium-features
-           public-sharing
-           queries
-           query-permissions
-           query-processor
-           revisions
-           search
-           util
-           view-log}}
+           enterprise/transforms}}
 
   enterprise/email
   {:team "UX West"
@@ -1934,6 +2049,7 @@
            appearance
            audit-app
            embedding
+           permissions
            premium-features
            enterprise/sso}}
 
@@ -1975,6 +2091,13 @@
    :uses #{premium-features
            settings}}
 
+  enterprise/library
+  {:team "UX West"
+   :api  #{metabase-enterprise.library.api}
+   :uses #{api
+           collections
+           premium-features}}
+
   enterprise/llm
   {:team "Metabot"
    :api  #{metabase-enterprise.llm.api
@@ -1989,44 +2112,45 @@
            util}}
 
   enterprise/metabot-v3
-  {:team "Metabot"
-   :api  #{metabase-enterprise.metabot-v3.api
-           metabase-enterprise.metabot-v3.client
-           metabase-enterprise.metabot-v3.core
-           metabase-enterprise.metabot-v3.init
-           metabase-enterprise.metabot-v3.tools.api}
-   :uses #{activity-feed
-           api
-           app-db
-           audit-app
-           collections
-           config
-           driver
-           legacy-mbql
-           lib
-           lib-be
-           models
-           native-query-snippets
-           permissions
-           premium-features
-           pulse
-           query-processor
-           request
-           search
-           server
-           settings
-           store-api
-           sync
-           system
-           task
-           users-rest
-           util
-           warehouse-schema
-           warehouses-rest
-           enterprise/dependencies
-           enterprise/documents
-           enterprise/transforms
-           enterprise/transforms-python}}
+  {:team    "Metabot"
+   :api     #{metabase-enterprise.metabot-v3.api
+              metabase-enterprise.metabot-v3.client
+              metabase-enterprise.metabot-v3.core
+              metabase-enterprise.metabot-v3.init
+              metabase-enterprise.metabot-v3.tools.api}
+   :friends #{enterprise/agent-api}
+   :uses    #{activity-feed
+              api
+              app-db
+              audit-app
+              collections
+              config
+              documents
+              driver
+              legacy-mbql
+              lib
+              lib-be
+              models
+              native-query-snippets
+              permissions
+              premium-features
+              pulse
+              query-processor
+              request
+              search
+              server
+              settings
+              store-api
+              sync
+              system
+              task
+              users-rest
+              util
+              warehouse-schema
+              warehouses-rest
+              enterprise/dependencies
+              enterprise/transforms
+              enterprise/transforms-python}}
 
   enterprise/permission-debug
   {:team "UX West"
@@ -2044,17 +2168,6 @@
    :uses #{premium-features
            util}}
 
-  enterprise/public-sharing
-  {:team "UX West"
-   :api  #{metabase-enterprise.public-sharing.api}
-   :uses #{api
-           events
-           premium-features
-           public-sharing
-           public-sharing-rest
-           query-processor
-           util}}
-
   enterprise/remote-sync
   {:team "UX West"
    :api  #{metabase-enterprise.remote-sync.api
@@ -2089,6 +2202,7 @@
            premium-features
            query-processor
            request
+           tenants
            users
            util
            warehouse-schema
@@ -2150,6 +2264,8 @@
            app-db
            appearance
            collections
+           config
+           events
            logger
            models
            plugins
@@ -2165,6 +2281,7 @@
            native-query-snippets
            permissions
            premium-features
+           remote-sync
            util}}
 
   enterprise/sso
@@ -2175,7 +2292,6 @@
    :uses #{api
            appearance
            auth-identity
-           channel
            embedding
            premium-features
            request
@@ -2214,6 +2330,21 @@
            system
            util}}
 
+  enterprise/tenants
+  {:team "Admin Webapp"
+   :api  #{metabase-enterprise.tenants.api}
+   :uses #{api
+           audit-app
+           auth-identity
+           collections
+           events
+           models
+           permissions
+           premium-features
+           request
+           settings
+           util}}
+
   enterprise/transforms
   {:team "Querying"
    :api  #{metabase-enterprise.transforms.api
@@ -2221,19 +2352,25 @@
            metabase-enterprise.transforms.init
            metabase-enterprise.transforms.instrumentation
            metabase-enterprise.transforms.interface
+           metabase-enterprise.transforms.schema
            metabase-enterprise.transforms.util}
    :uses #{analytics
            api
            app-db
+           channel
+           collections
            driver
            events
            lib
            lib-be
            models
+           permissions
            premium-features
            queries
            query-processor
+           remote-sync
            request
+           revisions
            search
            settings
            sync
@@ -2250,6 +2387,11 @@
            app-db
            config
            driver
+           events
+           lib
+           lib-be
+           models
+           permissions
            query-processor
            settings
            util

.clj-kondo/macros/metabase/queries_rest/api/card_test.clj

@@ -1,4 +1,4 @@
-(ns macros.metabase.queries.api.card-test)
+(ns macros.metabase.queries-rest.api.card-test)
 
 (defmacro with-ordered-items
   [collection model-and-name-syms & body]

.clj-kondo/macros/metabase/server/statistics_handler_test.clj

@@ -1,9 +0,0 @@
-(ns macros.metabase.server.statistics-handler-test)
-
-(defmacro with-server
-  [_ _ [connector chan-start-handle chan-finish-handle chan-done-request] & body]
-  `(let [~connector          nil
-         ~chan-start-handle  nil
-         ~chan-finish-handle nil
-         ~chan-done-request  nil]
-     ~@body))

.clj-kondo/src/hooks/clojure/core/ns.clj

@@ -99,12 +99,48 @@
                                      :message "Metabase namespaces should have the form metabase[-enterprise].<module>.* [:metabase/namespace-name]"
                                      :type    :metabase/namespace-name)))))))
 
+(defn- ns-form-node->import-node [ns-form-node]
+  (some (fn [node]
+          (when (and (hooks/list-node? node)
+                     (let [first-child (first (:children node))]
+                       (and (hooks/keyword-node? first-child)
+                            (= (hooks/sexpr first-child) :import))))
+            node))
+        (:children ns-form-node)))
+
+(defn- jsqlparser-import?
+  "Check if a symbol or string represents a jsqlparser import."
+  [s]
+  (str/starts-with? (str s) "net.sf.jsqlparser"))
+
+(defn- lint-jsqlparser-imports [ns-form-node]
+  (when-let [import-node (ns-form-node->import-node ns-form-node)]
+    (doseq [node (rest (:children import-node))
+            :when (not (contains? (hooks.common/ignored-linters node) :metabase/no-jsqlparser-imports))]
+      (cond
+        ;; Handle (net.sf.jsqlparser.foo Bar Baz) form
+        (hooks/list-node? node)
+        (let [package-node (first (:children node))
+              package-name (when package-node (str (hooks/sexpr package-node)))]
+          (when (jsqlparser-import? package-name)
+            (hooks/reg-finding! (assoc (meta node)
+                                       :message "Don't import net.sf.jsqlparser classes directly. This code should be agnostic to the parsing library. [:metabase/no-jsqlparser-imports]"
+                                       :type    :metabase/no-jsqlparser-imports))))
+
+        ;; Handle net.sf.jsqlparser.foo.Bar form (single class import)
+        (hooks/token-node? node)
+        (when (jsqlparser-import? (hooks/sexpr node))
+          (hooks/reg-finding! (assoc (meta node)
+                                     :message "Don't import net.sf.jsqlparser classes directly. This code should be agnostic to the parsing library. [:metabase/no-jsqlparser-imports]"
+                                     :type    :metabase/no-jsqlparser-imports)))))))
+
 (defn lint-ns [x]
   (doto (:node x)
     lint-require-shapes
     lint-requires-on-new-lines
     (lint-modules (modules/config x))
-    lint-namespace-name)
+    lint-namespace-name
+    lint-jsqlparser-imports)
   x)
 
 (comment

.clj-kondo/src/hooks/clojure/test.clj

@@ -2,7 +2,8 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.string :as str]
-   [hooks.common]))
+   [hooks.common]
+   [hooks.common.modules :as modules]))
 
 (defn- warn-about-disallowed-parallel-forms [form config]
   (letfn [(error! [form message]
@@ -102,7 +103,39 @@
                (:children node))))]
     (walk node)))
 
-(defn deftest [{:keys [node cljc lang config]}]
+(defn- test-namespace-lives-outside-of-module-system? [ns-symb]
+  (some (fn [prefix]
+          (str/starts-with? (name ns-symb) prefix))
+        ["build-drivers."
+         "build."
+         "i18n." ; bin/i18n
+         "lint-migrations-file-test"
+         "main-test" ; bin/release-list
+         "metabase.deps-edn-test"
+         "metabase.driver."
+         "metabase.test."
+         "metabase.test.data."
+         "metabuild-common."])) ; utils for build scripts
+
+(let [warned-namespaces (atom #{})]
+  (defn deftest-check-in-valid-module
+    "Check whether a `deftest` lives in a known module -- important so our system to only run a subset of tests based on
+  which modules have changes picks them up correctly. (DEV-1125)"
+    [{:keys [node], ns-symb :ns, :as input}]
+    (when (and ns-symb
+               (not (test-namespace-lives-outside-of-module-system? ns-symb))
+               ;; only warn once per namespace
+               (not (contains? @warned-namespaces ns-symb)))
+      (swap! warned-namespaces conj ns-symb)
+      (let [known-modules  (set (keys (:metabase/modules (modules/config input))))
+            current-module (modules/module ns-symb)]
+        (when (or (not current-module)
+                  (not (contains? known-modules current-module)))
+          (hooks/reg-finding! (assoc (meta node)
+                                     :message (format "All tests must live in a known module; %s is not a known module" (pr-str current-module))
+                                     :type    :metabase/tests-must-live-in-known-modules)))))))
+
+(defn deftest [{:keys [node cljc lang config], :as input}]
   ;; run [[deftest-check-parallel]] only once... if this is a `.cljc` file only run it for the `:clj` analysis, no point
   ;; in running it twice.
   (when (or (not cljc)
@@ -110,7 +143,8 @@
     (deftest-check-parallel node (get-in config [:linters :metabase/validate-deftest])))
   (deftest-check-not-horrifically-long node (get-in config [:linters :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests]))
   (deftest-check-no-driver-keywords node (get-in config [:linters :metabase/disallow-hardcoded-driver-names-in-tests]))
-  {:node node})
+  (deftest-check-in-valid-module input)
+  input)
 
 ;;; this is a hacky way to determine whether these namespaces are required in the `ns` form or not... basically `:ns`
 ;;; will come back as `nil` if they are not.

.clj-kondo/src/hooks/common/modules.clj

@@ -1,4 +1,6 @@
-(ns hooks.common.modules)
+(ns hooks.common.modules
+  (:require
+   [clojure.string :as str]))
 
 (defn ignored-namespace? [config ns-symb]
   (some
@@ -17,14 +19,19 @@
     (module 'metabase-enterprise.whatever.core) => enterprise/whatever"
   [ns-symb]
   {:pre [(simple-symbol? ns-symb)]}
-  (or (some->> (re-find #"^metabase-enterprise\.([^.]+)" (str ns-symb))
-               second
-               (symbol "enterprise"))
-      (some-> (re-find #"^metabase\.([^.]+)" (str ns-symb))
-              second
-              symbol)))
+  ;; treat something like `metabase.driver-test` (for a module that hasn't fully been updated to use `.core`
+  ;; namespaces) as being in the `driver` module
+  (let [ns-symb (if (str/ends-with? (name ns-symb) "-test")
+                  (symbol (str/replace (name ns-symb) #"-test$" ""))
+                  ns-symb)]
+    (or (some->> (re-find #"^metabase-enterprise\.([^.]+)" (str ns-symb))
+                 second
+                 (symbol "enterprise"))
+        (some-> (re-find #"^metabase\.([^.]+)" (str ns-symb))
+                second
+                symbol))))
 
-(defn module-api-namespaces
+(defn- module-api-namespaces
   "Set of API namespace symbols for a given module. `:any` means you can use anything, there are no API namespaces for
   this module (yet). If unspecified, the default is just the `<module>.core` namespace."
   [config module]
@@ -44,6 +51,12 @@
           (symbol (str ns-prefix ".core"))
           (symbol (str ns-prefix ".init"))}))))
 
+(defn- module-friends
+  [config module]
+  "Set of modules that are `:friends` of `module`, i.e. allowed to use *any* namespace from the module, not just the
+  designated [[module-api-namespaces]]."
+  (set (get-in config [:metabase/modules module :friends])))
+
 (defn allowed-modules
   "Set of namespace symbols that `module` is allowed to use. `:any` means it's allowed to use anything."
   [config module]
@@ -54,11 +67,13 @@
     (or (= allowed-modules :any)
         (contains? (set allowed-modules) required-module))))
 
-(defn allowed-module-namespace? [config ns-symb]
+(defn- allowed-module-namespace? [config current-module ns-symb]
   (let [module                (module ns-symb)
-        module-api-namespaces (module-api-namespaces config module)]
+        module-api-namespaces (module-api-namespaces config module)
+        module-friends        (module-friends config module)]
     (or (empty? module-api-namespaces)
-        (contains? module-api-namespaces ns-symb))))
+        (contains? module-api-namespaces ns-symb)
+        (contains? module-friends current-module))))
 
 (defn usage-error
   "Find usage errors when a `required-namespace` is required in the `current-module`. Returns a string describing the
@@ -74,7 +89,7 @@
                 current-module
                 current-module)
 
-        (not (allowed-module-namespace? config required-namespace))
+        (not (allowed-module-namespace? config current-module required-namespace))
         (format "Namespace %s is not an allowed external API namespace for the %s module. [:metabase/modules %s :api]"
                 required-namespace
                 required-module

.clj-kondo/src/hooks/metabase/api/macros.clj

@@ -90,6 +90,10 @@
                                            :else
                                            (recur (conj bindings x) (conj schemas nil) (list* y z more)))))]
               (validate-route! route)
+              (when-not result-schema
+                (api/reg-finding! (assoc (meta node)
+                                         :message "All REST API endpoints should have a detailed response schema"
+                                         :type    :metabase/validate-defendpoint-has-response-schema)))
               (let [[_route-param-schema query-param-schema _body-param-schema] schemas]
                 (when query-param-schema
                   (validate-query-params! query-param-schema)))

.clj-kondo/src/hooks/metabase/query_processor/expressions_test.clj

@@ -1,4 +1,4 @@
-(ns hooks.metabase.query-processor-test.expressions-test
+(ns hooks.metabase.query-processor.expressions-test
   (:require
    [clj-kondo.hooks-api :as hooks]
    [hooks.metabase.test.data :as data]))

.clj-kondo/src/hooks/metabase/settings/models/setting.clj

@@ -97,7 +97,6 @@
      metabot-get-prompt-templates-url
      metabot-prompt-generator-token-limit
      multi-setting-read-only
-     notebook-native-preview-shown
      notebook-native-preview-sidebar-width
      notification-link-base-url
      num-metabot-choices
@@ -119,10 +118,10 @@
      reset-token-ttl-hours
      retired-setting
      retry-initial-interval
-     retry-max-attempts
+     retry-max-retries
      retry-max-interval-millis
      retry-multiplier
-     retry-randomization-factor
+     retry-jitter-factor
      saml-application-name
      saml-attribute-email
      saml-attribute-firstname

.clj-kondo/test/hooks/clojure/core/ns_test.clj

@@ -43,6 +43,17 @@
            '{:metabase/modules {api    {:uses #{search}}
                                 search {:api  #{metabase.search.core}}}}))))
 
+(deftest ^:parallel module-checker-friends-test
+  (is (= []
+         (lint-modules
+          '(ns metabase.search-rest.api
+             (:require
+              [metabase.search.config :as search.config]
+              [metabase.search.core :as search]))
+          '{:metabase/modules {search      {:api     #{metabase.search.core}
+                                            :friends #{search-rest}}
+                               search-rest {:uses #{search}}}}))))
+
 (deftest ^:parallel module-checker-api-namespaces-ignore-test
   (is (empty? (lint-modules
                '(ns metabase.api.search

.cljfmt.edn

@@ -43,9 +43,6 @@
   with-meta                                                                                   [[:default]]
   ;; library stuff. Libraries that specify their own `:style/indent` specs are included in the section after this
   ;; since it is generated automatically.
-  clojure.core.logic/fresh                                                                    [[:block 1]]
-  clojure.core.logic/matcha                                                                   [[:block 1]]
-  clojure.core.logic/run                                                                      [[:block 2]]
   clojure.core.match/match                                                                    [[:block 1]]
   clojure.test.check.properties/for-all                                                       [[:block 1]]
   clojure.test.check.properties/for-all*                                                      [[:block 1]]
@@ -157,7 +154,6 @@
   metabase.lib.util.match/match                                                               [[:inner 0]]
   metabase.lib.util.match/match-one                                                           [[:inner 0]]
   metabase.lib.util.match/match-lite                                                          [[:inner 0]]
-  metabase.lib.util.match/match-lite-recursive                                                [[:inner 0]]
   metabase.lib.util.match/replace                                                             [[:inner 0]]
   metabase.lib.util.match/replace-in                                                          [[:inner 0]]
   metabase.models.interface/define-batched-hydration-method                                   [[:inner 0]]
@@ -176,21 +172,23 @@
   metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard             [[:block 2]]
   metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection                  [[:block 1]]
   metabase.pulse.models.pulse-test/with-pulse-in-collection                                   [[:inner 0]]
-  metabase.queries.api.card-test/with-cards-in-readable-collection                            [[:block 1]]
-  metabase.queries.api.card-test/with-cards-in-writeable-collection                           [[:block 1]]
-  metabase.queries.api.card-test/with-ordered-items                                           [[:inner 0]]
-  metabase.queries.api.card-test/with-temp-native-card                                        [[:block 1]]
-  metabase.queries.api.card-test/with-temp-native-card-with-params                            [[:block 1]]
-  metabase.query-processor-test.pipeline-queries-test/pmbql-query                             [[:block 1]]
-  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                         [[:block 1]]
+  metabase.queries-rest.api.card-test/with-cards-in-readable-collection                       [[:block 1]]
+  metabase.queries-rest.api.card-test/with-cards-in-writeable-collection                      [[:block 1]]
+  metabase.queries-rest.api.card-test/with-ordered-items                                      [[:inner 0]]
+  metabase.queries-rest.api.card-test/with-temp-native-card                                   [[:block 1]]
+  metabase.queries-rest.api.card-test/with-temp-native-card-with-params                       [[:block 1]]
   metabase.query-processor.debug/debug>                                                       [[:block 0]]
   metabase.query-processor.error-type/deferror                                                [[:block 1]]
   metabase.query-processor.middleware.cache-backend.interface/with-cached-results             [[:block 4]]
   metabase.query-processor.middleware.process-userland-query-test/with-query-execution        [[:block 1]]
+  metabase.query-processor.pipeline-queries-test/pmbql-query                                  [[:block 1]]
+  metabase.query-processor.pipeline-queries-test/run-pmbql-query                              [[:block 1]]
   metabase.query-processor.store/cached                                                       [[:block 1]]
   metabase.query-processor.store/with-metadata-provider                                       [[:inner 0]]
   metabase.query-processor.streaming/streaming-response                                       [[:block 1]]
   metabase.query-processor.test-util/format-rows-by                                           [[:default]]
+  metabase.query-processor.timeseries-test.util/test-timeseries-drivers                       [[:block 0]]
+  metabase.query-processor.timeseries-test/run-mbql-query                                     [[:inner 0]]
   metabase.request.core/as-admin                                                              [[:block 0]]
   metabase.request.core/with-current-request                                                  [[:inner 0]]
   metabase.request.core/with-current-user                                                     [[:inner 0]]
@@ -278,12 +276,9 @@
   metabase.test/with-temp-vals-in-db                                                          [[:block 3]]
   metabase.test/with-test-user                                                                [[:inner 0]]
   metabase.test/with-user-in-groups                                                           [[:inner 0]]
-  metabase.timeseries-query-processor-test.util/test-timeseries-drivers                       [[:block 0]]
-  metabase.timeseries-query-processor-test/run-mbql-query                                     [[:inner 0]]
   metabase.upload.impl-test/with-upload-table!                                                [[:inner 0]]
   metabase.upload.types/with-currency                                                         [[:default]]
   metabase.upload.types/with-parens                                                           [[:default]]
-  metabase.util/for-map                                                                       [[:block 1]]
   metabase.util.async/cancelable-thread                                                       [[:block 0]]
   metabase.util.date-2/with-time-zone-same-instant                                            [[:default]]
   metabase.util.encryption-test/with-secret-key                                               [[:block 1]]
@@ -304,6 +299,7 @@
   metabase.util.queue-test/await-test-while                                                   [[:block 1]]
   metabase.util/auto-retry                                                                    [[:block 1]]
   metabase.util/case-enum                                                                     [[:block 1]]
+  metabase.util/for-map                                                                       [[:block 1]]
   metabase.util/ignore-exceptions                                                             [[:block 0]]
   metabase.util/or-with                                                                       [[:block 1]]
   metabase.util/profile                                                                       [[:block 1]]

.codespellignore

@@ -1,23 +1,35 @@
-Brite
 afterAll
 ags
 altho
+Brite
 cancelation
 cancelations
+caracteres
+copyin
 datas
 edn
 eduction
+hasTable
 hasTables
 horizontalX
 horizontalY
 juxt
 methodd
+nd
 notIn
+optionA
+ot
 pass-thru
+requestor
+re-use
+re-used
 ser
 serieses
 sortings
+titel
 trs
 trsn
 tru
 trun
+unparseable
+withs

.codespellrc

@@ -1,3 +1,24 @@
 [codespell]
-skip = *.csv,*.edn,*.geojson,*.json,*.tsv,*.xml,docs/developers-guide/drivers/driver-tests.md,docs/developers-guide/e2e-tests.md,docs/questions/query-builder/expressions-list.md,docs/questions/visualizations/country-codes.md,e2e/test/scenarios/admin/i18n/content-translation/constants.ts,frontend/src/cljs,frontend/src/metabase/querying/expressions/tokenizer/lezer.js,frontend/src/metabase/static-viz/constants/char-sizes.ts,frontend/src/metabase/visualizations/lib/mapping_codes.ts,modules/drivers/mongo/src/metabase/driver/mongo/operators.clj
+skip =
+    *.csv,
+    *.edn,
+    *.geojson,
+    *.json,
+    *.tsv,
+    *.unit.spec.*,
+    *.xml,
+    docs/developers-guide/drivers/driver-tests.md,
+    docs/developers-guide/e2e-tests.md,
+    docs/questions/query-builder/expressions-list.md,
+    docs/questions/visualizations/country-codes.md,
+    e2e/test/scenarios/admin/i18n/content-translation/constants.ts,
+    frontend/src/cljs,
+    frontend/src/metabase/querying/expressions/tokenizer/lezer.js,
+    frontend/src/metabase/query_builder/components/NativeQueryEditor/CodeMirrorEditor/language.ts,
+    frontend/src/metabase/static-viz/constants/char-sizes.ts,
+    frontend/src/metabase/visualizations/lib/mapping_codes.ts,
+    frontend/*/mocks/*,
+    modules/drivers/mongo/src/metabase/driver/mongo/operators.clj,
+    src/metabase/analyze/classifiers/name.clj,
+    src/metabase/util/currency.cljc,
 ignore-words = .codespellignore

.env.example

@@ -0,0 +1,160 @@
+# ==============================================================================
+# 0. METABASE DEVELOPMENT ENVIRONMENT
+# ==============================================================================
+#
+# Central configuration for local Metabase development.
+# Copy to .env and uncomment/modify values as needed.
+#
+# Usage:
+#   op inject --in-file .env.example --out-file .env    (populate using CLI)
+#   cp .env.example .env                                (populate manually)
+#
+# Hint: Auto-load environment variables with mise or direnv:
+#   mise    - mise.toml: [settings] env_file = ".env"   (https://mise.jdx.dev)
+#   direnv  - Create .envrc with: dotenv .env           (https://direnv.net)
+#
+# Full Metabase environment configuration reference:
+# https://www.metabase.com/docs/latest/configuring-metabase/environment-variables
+#
+# ⚠️ Make sure the same var is not exported multiple times in different contexts.
+
+
+# ==============================================================================
+# 1. GLOBAL CONTEXT
+# ==============================================================================
+#
+# Shared credentials and tokens used across multiple dev workflows.
+
+# GitHub - For gh CLI, API access, and CI integrations
+# https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
+# GITHUB_TOKEN=your-PAT
+
+# AWS - For S3, Athena, Redshift, and other AWS services
+# https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
+# AWS_ACCESS_KEY_ID=your-access-key
+# AWS_SECRET_ACCESS_KEY=your-secret-key
+# AWS_REGION=us-east-1
+
+# Docker Hub - Avoid rate limits when pulling images
+# https://docs.docker.com/security/for-developers/access-tokens/
+# DOCKER_USERNAME=your-username
+# DOCKER_PASSWORD=your-access-token
+
+# ==============================================================================
+# 2. LOCAL METABASE DEVELOPMENT
+# ==============================================================================
+#
+# Settings for running Metabase locally. Most have sensible defaults—only
+# configure what you need.
+
+# 2.1 Application Database
+# ------------------------------------------------------------------------------
+# Where Metabase stores its own data (dashboards, users, settings, etc.).
+# https://www.metabase.com/docs/latest/installation-and-operation/configuring-application-database
+
+# Option A: Individual connection parameters
+# MB_DB_TYPE="postgres"
+# MB_DB_HOST="localhost"
+# MB_DB_PORT=5432
+# MB_DB_DBNAME="metabase"
+# MB_DB_USER="<username>"
+# MB_DB_PASS="<password>"
+
+# Option B: Single connection URI (overrides individual params)
+# MB_DB_CONNECTION_URI="jdbc:postgresql://localhost:5432/metabase?user=<username>&password=<password>"
+
+# 2.2 Server & Integrations
+# ------------------------------------------------------------------------------
+# https://www.metabase.com/docs/latest/configuring-metabase/customizing-jetty-webserver
+
+# Jetty server (defaults: localhost:3000)
+# MB_JETTY_HOST="localhost"
+# MB_JETTY_PORT=3000
+
+# SMTP for testing email notifications (use with maildev/maildev container)
+MB_EMAIL_SMTP_HOST="localhost"
+MB_EMAIL_SMTP_PORT=1025
+MB_EMAIL_SMTP_USERNAME="admin"
+MB_EMAIL_SMTP_PASSWORD="admin"
+
+# 2.3 Feature Flags & Tokens
+# ------------------------------------------------------------------------------
+
+# Use staging server for license validation (avoids hitting production)
+METASTORE_DEV_SERVER_URL="https://token-check.staging.metabase.com"
+
+# Metabase license token
+# Uncomment this line only when running local dev and NEVER when running Cypress
+# Tests need to start from zero, and set different tokens programmatically (on-demand)
+# MB_PREMIUM_EMBEDDING_TOKEN="op://Shared/Metabase License Dev Tokens/Licenses/MB_ALL_FEATURES_TOKEN"
+
+# Skip embedding SDK build for faster frontend compilation
+# SKIP_EMBEDDING_SDK="true"
+
+
+# ==============================================================================
+# 3. E2E / CYPRESS TESTING
+# ==============================================================================
+#
+# Configuration for running Cypress end-to-end tests locally.
+#
+# The whole environment is already orchestrated via deps.edn using :e2e alias.
+# Treat it as a source of truth for JVM flags and ENVs whether you decide to run
+# backend on your own, or using `yarn test-cypress` (local test runner).
+#
+# You don't _have to_ export any of these vars (except for the tokens below).
+# Things will still work.
+
+# 3.1. E2E Application Database (H2 required)
+# ------------------------------------------------------------------------------
+
+# Whether to run the enterprise or the open-source Metabase version
+MB_EDITION="ee"
+
+# Which file to use for the ephemeral testing application database?
+# MB_DB_FILE="./e2e/tmp/cypress-test.db"
+
+# Where does Cypress go to look for the application? (defaults: localhost:4000)
+# MB_JETTY_HOST="localhost"
+# MB_JETTY_PORT=4000
+
+# 3.2 E2E Local Runner Setup
+# ------------------------------------------------------------------------------
+
+# Whether to run true e2e test suite, or SDK component tests (e2e | component)
+CYPRESS_TESTING_TYPE="e2e"
+
+# Whether to start Cypress in an interactive (open) mode with full GUI
+CYPRESS_GUI="true"
+
+# Whether to generate application database dumps (colloquially "snapshots")
+# Keep this enabled unless you're experimenting, or know what you're doing.
+GENERATE_SNAPSHOTS="true"
+
+# E2E tests run the backend from source by default.
+# To run tests against a JAR instead, set the JAR_PATH variable.
+#
+# Hint: build the JAR with ./bin/build.sh
+# JAR_PATH="target/uberjar/metabase.jar"
+
+# 3.3 E2E Tokens
+# ------------------------------------------------------------------------------
+#
+# These make sense for Metabase core devs only
+# op inject --in-file .env.example --out-file .env
+
+CYPRESS_MB_ALL_FEATURES_TOKEN="op://Shared/Metabase License Dev Tokens/Licenses/MB_ALL_FEATURES_TOKEN"
+CYPRESS_MB_STARTER_CLOUD_TOKEN="op://Shared/Metabase License Dev Tokens/Licenses/MB_STARTER_CLOUD_TOKEN"
+CYPRESS_MB_PRO_CLOUD_TOKEN="op://Shared/Metabase License Dev Tokens/Licenses/MB_PRO_CLOUD_TOKEN"
+CYPRESS_MB_PRO_SELF_HOSTED_TOKEN="op://Shared/Metabase License Dev Tokens/Licenses/MB_PRO_SELF_HOSTED_TOKEN"
+
+# 3.4 E2E Misc.
+# ------------------------------------------------------------------------------
+
+# To make Node.js match the instance tz
+TZ="US/Pacific"
+
+# Export this environment variable when running tests on Apple Silicon.
+# DO NOT USE Docker Desktop. Use Orbstack instead. Metabase will fail to connect
+# to the dockerized Mongo QA database otherwise.
+EXPERIMENTAL_DOCKER_DESKTOP_FORCE_QEMU=1

.eslintignore

@@ -1,5 +0,0 @@
-frontend/src/cljs
-frontend/src/cljs_release
-e2e/support/cypress_sample_database.js
-e2e/support/cypress_sample_instance_data.js
-e2e/embedding-sdk-host-apps

.eslintrc.js

@@ -8,7 +8,13 @@ const path = require("path");
 // can use this flag to enable it. This is set to true in CI
 const shouldLintCssModules =
   process.env.LINT_CSS_MODULES === "true" || process.env.CI;
-const plugins = ["react", "no-only-tests", "ttag", "i18next"];
+const plugins = [
+  "react",
+  "no-only-tests",
+  "ttag",
+  "i18next",
+  "metabase",
+];
 if (shouldLintCssModules) {
   plugins.push("postcss-modules");
 }
@@ -176,10 +182,11 @@ module.exports = {
     {
       files: ["*.js", "*.jsx", "*.ts", "*.tsx"],
       rules: {
-        "jtag-missing-key": "error",
-        "no-unconditional-metabase-links-render": "error",
-        "no-color-literals": "error",
-        "no-literal-metabase-strings": "error",
+        "metabase/jtag-missing-key": "error",
+        "metabase/no-unconditional-metabase-links-render": "error",
+        "metabase/no-color-literals": "error",
+        "metabase/no-literal-metabase-strings": "error",
+        "metabase/no-oss-reinitialize-import": "error",
         "depend/ban-dependencies": [
           "error",
           {
@@ -213,9 +220,9 @@ module.exports = {
         "rspack.embedding-sdk-bundle.config.js",
       ],
       rules: {
-        "no-color-literals": "off",
-        "no-unconditional-metabase-links-render": "off",
-        "no-literal-metabase-strings": "off",
+        "metabase/no-color-literals": "off",
+        "metabase/no-unconditional-metabase-links-render": "off",
+        "metabase/no-literal-metabase-strings": "off",
       },
     },
     {
@@ -240,6 +247,7 @@ module.exports = {
       plugins: ["@typescript-eslint"],
       rules: {
         "prefer-rest-params": "off",
+        "react/prop-types": "off", // TypeScript handles prop validation
         "@typescript-eslint/explicit-module-boundary-types": "off",
         "@typescript-eslint/no-inferrable-types": "off",
         "@typescript-eslint/no-explicit-any": "off",
@@ -335,7 +343,7 @@ module.exports = {
         "import/no-default-export": "off",
         "import/order": "off",
         "import/no-unresolved": "off",
-        "no-color-literals": "off",
+        "metabase/no-color-literals": "off",
       },
     },
     {

.gitattributes

@@ -0,0 +1,7 @@
+# Custom merge driver for YAML migration files
+# Treats each changeset as an atomic unit to avoid conflicts within changesets
+# Execute this in your shell to enable custom merge driver:
+# echo '\n[include]\npath=../.gitconfig' >> .git/config
+#
+# TODO (Bryan 12/12/25) -- reenable this when we can completely verify correctness
+# resources/migrations/*.yaml merge=yaml-migrations

.gitconfig

@@ -0,0 +1,7 @@
+# execute this in your shell to enable custom merge driver:
+# echo '\n[include]\npath=../.gitconfig' >> .git/config
+#
+# TODO (Bryan 12/12/25) -- reenable this when we can completely verify correctness
+# [merge "yaml-migrations"]
+#     name = YAML migration changeset-aware merge
+#     driver = mage -merge-yaml-migrations %O %A %B %L %P

.github/ISSUE_TEMPLATE/epic.md

@@ -1,23 +0,0 @@
----
-name: Epic (Internal Use)
-about: This issue is used to track a feature/project that may span several days
-  to weeks to implement. This is used by the core Metabase team to project plan
-  and manage work.
-title: "[Epic] Title"
-labels: ".Epic"
----
-
-### Links
-
-- [product doc](LINK_TO_PRODUCT_DOC)
-- [technical design doc](LINK_TO_TECHNICAL_DESIGN_DOC)
-- [testing plan](LINK_TO_TESTING_PLAN)
-- feature branch: `BRANCH_NAME`
-- issue links: _related issues, if any_
-
-### Implementation Plan
-
-```[tasklist]
-#### Milestone 1
-- [ ] _Add tasks here_
-```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -7,16 +7,13 @@ assignees: ''
 
 ---
 
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+**What problem will this feature request solve?**
 
-**Describe the solution you'd like**
+**Describe the solution you'd like.**
 A clear and concise description of what you want to happen.
 
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
+**How does this feature request impact you?**
+For example, is it a minor inconvenience, or does it block important work?
 
-**How important is this feature to you?**
-
-**Additional context**
+**Additional information**
 Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/task.md

@@ -1,14 +0,0 @@
----
-name: Task (Internal Use)
-about: This issue is used to track a smaller feature/task that does not require
-  being broken down to milestones. This is used by the core Metabase team to
-  project plan and manage work.
-labels: ".Task"
-
----
-
-**Context**
-
-
-- issue links: _related issues if any_
-

.github/PULL_REQUEST_TEMPLATE.md

@@ -25,3 +25,4 @@ _Upload a demo video or before/after screenshots if sensible or remove the secti
 ### Checklist
 
 - [ ] Tests have been added/updated to cover changes in this PR
+- [ ] If adding new Loki tests: they pass [stress testing](https://github.com/metabase/metabase/actions/workflows/loki-stress-test-flake-fix.yml)

.github/actions/maximize-disk-space/action.yml

@@ -0,0 +1,19 @@
+name: Maximize disk space
+description: Removes unused stuff from GH runner
+
+runs:
+  using: "composite"
+  steps:
+    - name: Maximize build space
+      shell: bash
+      run: |
+        echo "-- Dotnet"
+        sudo rm -rf /usr/share/dotnet
+        echo "-- Android"
+        sudo rm -rf /usr/local/lib/android
+        echo "-- Haskell"
+        sudo rm -rf /opt/ghc
+        echo "-- CodeQL"
+        sudo rm -rf /opt/hostedtoolcache/CodeQL
+
+        df -h

.github/actions/prepare-cypress/action.yml

@@ -16,7 +16,7 @@ runs:
   using: "composite"
   steps:
     - name: Install Chrome v111
-      uses: browser-actions/setup-chrome@v1
+      uses: browser-actions/setup-chrome@v2
       with:
         # https://chromium.cypress.io/linux/stable/111.0.5563.146
         chrome-version: 1097615

.github/actions/prepare-frontend/action.yml

@@ -1,4 +1,5 @@
 name: Prepare front-end environment
+description: "Prepare the front-end environment for the CI build"
 inputs:
   node-version:
     description: "The version of Node.js to use, overriding .nvmrc"

.github/actions/test-driver/action.yml

@@ -9,56 +9,30 @@ inputs:
   build-static-viz:
     required: true
     default: false
-
-outputs:
-  quarantine-skipped:
-    description: Whether the driver test was skipped due to quarantine
-    value: ${{ steps.check-driver.outputs.skip }}
+  logs-artifact-suffix:
+    required: false
+    description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
+  edition:
+    required: false
+    default: 'ee'
+    description: Edition to test (oss or ee)
 
 runs:
   using: "composite"
   steps:
-    - name: Check if driver is ignored
-      id: check-driver
-      shell: bash
-      run: |
-        # If DRIVERS env var is not set, proceed with tests
-        if [ -z "$DRIVERS" ]; then
-          echo "No DRIVERS env var set. Proceeding with tests."
-          echo "skip=false" >> $GITHUB_OUTPUT
-          exit 0
-        fi
-
-        # Fetch CI config and check if driver should be skipped
-        curl -sSf -o ci-test-config.json https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json || true
-
-        # Check if the driver is in the ignored list (gracefully handle missing/invalid config)
-        IS_IGNORED=$(jq --arg driver "$DRIVERS" '.ignored.drivers // [] | contains([$driver])' ci-test-config.json 2>/dev/null || echo "false")
-
-        if [ "$IS_IGNORED" = "true" ]; then
-          echo "⚠️  Driver '$DRIVERS' is in the ignored list. Skipping tests."
-          echo "View the ignored list here: https://github.com/metabase/ci-test-config/blob/master/ci-test-config.json"
-          echo "skip=true" >> $GITHUB_OUTPUT
-        else
-          echo "Driver '$DRIVERS' is not ignored. Proceeding with tests."
-          echo "skip=false" >> $GITHUB_OUTPUT
-        fi
-
     - name: Prepare back-end environment
-      if: steps.check-driver.outputs.skip != 'true'
       uses: ./.github/actions/prepare-backend
     - name: Prepare front-end environment
-      if: ${{ steps.check-driver.outputs.skip != 'true' && inputs.build-static-viz == 'true' }}
+      if: ${{ inputs.build-static-viz == 'true' }}
       uses: ./.github/actions/prepare-frontend
     - name: Build static viz frontend
-      if: ${{ steps.check-driver.outputs.skip != 'true' && inputs.build-static-viz == 'true' }}
+      if: ${{ inputs.build-static-viz == 'true' }}
       run: yarn build-static-viz
       shell: bash
       env:
         MB_EDITION: ee
     - name: Test database driver
-      if: steps.check-driver.outputs.skip != 'true'
-      run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
+      run: clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash
       id: run-test
       # Trunk Quarantine controls the final state of the run in the CI!
@@ -70,7 +44,7 @@ runs:
       # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
       # test.outcome gives us access to the result before `continue-on-error` overrides it and sets it to 'success'.
       # We want test reports even if the test step gets cancelled (e.g. times out), hence we match anything that is not a 'success'.
-      if: ${{ steps.run-test.outcome != 'success' && steps.check-driver.outputs.skip != 'true' }}
+      if: ${{ steps.run-test.outcome != 'success' }}
       with:
         path: "target/junit/**/*_test.xml"
         name: JUnit Test Report ${{ inputs.junit-name }}
@@ -79,10 +53,10 @@ runs:
         list-tests: failed
         fail-on-error: false
     - name: Upload Logs on Failure
-      if: always() && steps.run-test.outcome != 'success' && steps.check-driver.outputs.skip != 'true'
+      if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v4
       with:
-        name: test-logs-${{ github.job }}
+        name: ${{ format('test-logs-{0}{1}', github.job, inputs.logs-artifact-suffix && format('-{0}', inputs.logs-artifact-suffix) || '') }}
         path: logs/test-log.json
         retention-days: 1
       # Failing to upload the artifact should never affect the outcome of the whole test run.

.github/actions/upload-test-results/action.yml

@@ -20,7 +20,7 @@ inputs:
     required: true
   variant:
     required: false
-    default: ''
+    default: ""
 
 runs:
   using: "composite"
@@ -56,3 +56,4 @@ runs:
         org-slug: metabase
         dry-run: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == true }} # quarantine, but do not upload results
         token: ${{ inputs.trunk-api-token }}
+        use-cache: true

.github/file-paths.yaml

@@ -11,15 +11,19 @@ shared_specs: &shared_specs
   - "test/**/*.cljc"
   - "test/**/*.cljs"
 
-frontend_ci: &frontend_ci
+shared_ci: &shared_ci
   - ".github/actions/prepare-frontend/**"
   - ".github/actions/prepare-backend/**"
-  - ".github/workflows/frontend.yml"
+  - ".github/workflows/run-tests.yml"
 
-frontend_embedding_sdk_ci: &frontend_embedding_sdk_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
-  - ".github/workflows/embedding-sdk*.yml"
+shared_e2e: &shared_e2e
+  - "e2e/runner/**"
+  - "e2e/snapshot-creators/**"
+  - "e2e/support/**"
+
+frontend_ci: &frontend_ci
+  - *shared_ci
+  - ".github/workflows/frontend.yml"
 
 frontend_configs: &frontend_configs
   - "yarn.lock"
@@ -41,14 +45,12 @@ frontend_sources: &frontend_sources
   - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
   - "frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
 
+# Used only in .github/workflows/conventional-commit-pr-title-reminder.yml
 frontend_embedding_sources:
   - "enterprise/frontend/src/{embedding,embedding-*}/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
   - "enterprise/frontend/src/metabase-enterprise/{embedding,embedding-*}**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
 
-frontend_embedding_sdk_sources:
-  - *frontend_configs
-  - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
-
+# Used only in .github/workflows/embedding-sdk-labels-reminder.yml
 frontend_embedding_sdk_package_sources:
   - "enterprise/frontend/src/embedding-sdk-package/**/!(*.spec).{js,jsx,ts,tsx,css}"
 
@@ -76,8 +78,7 @@ frontend_loki_ci: &frontend_loki_ci
   - ".storybook/**"
 
 backend_ci: &backend_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
+  - *shared_ci
   - ".github/actions/test-driver/**"
   - ".github/workflows/backend.yml"
   - ".github/workflows/drivers.yml"
@@ -117,9 +118,9 @@ sources: &sources
   - *backend_sources
 
 e2e_ci: &e2e_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
+  - *shared_ci
   - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/actions/fetch-artifact/action.yml"
   - ".github/actions/e2e-prepare-containers/**"
   - ".github/actions/prepare-cypress/**"
   - ".github/workflows/e2e-*"
@@ -127,18 +128,27 @@ e2e_ci: &e2e_ci
 e2e_specs: &e2e_specs
   - e2e/!(test-host-app)**/*.cy.*.{js,ts}
 
-e2e_embedding_sdk:
-  - *frontend_embedding_sdk_ci
-  - *sources
-  - "e2e/component/**/*.cy.*.{js,ts}"
+embedding_sdk_ci: &embedding_sdk_ci
+  - *shared_ci
+  - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/actions/fetch-artifact/action.yml"
+  - ".github/actions/prepare-cypress/**"
+  - ".github/workflows/embedding-sdk*.yml"
 
-e2e_embedding_sdk_compatibility:
+embedding_sdk_components:
   - *default
-  - *frontend_embedding_sdk_ci
+  - *embedding_sdk_ci
+  - *sources
+  - *shared_e2e
+  - "e2e/test-component/**/*.cy.*.{js,jsx,ts,tsx}"
+
+embedding_sdk_host_sample_apps:
+  - *default
+  - *embedding_sdk_ci
   - *frontend_sources
   - *backend_sources
+  - *shared_e2e
   - "e2e/embedding-sdk-host-apps/**"
-  - "e2e/runner/embedding-sdk/**"
   - "e2e/test-host-app/**/*.cy.*.{js,ts}"
 
 snowplow: &snowplow

.github/scripts/find-linear-issue.js

@@ -0,0 +1,40 @@
+async function findLinearIssue({ githubIssueUrl, linearApiKey }) {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: linearApiKey,
+    },
+    body: JSON.stringify({
+      query: `
+        query {
+          attachmentsForURL(url: "${githubIssueUrl}") {
+            nodes {
+              issue { identifier }
+            }
+          }
+        }
+      `,
+    }),
+  });
+
+  const data = await response.json();
+
+  if (!response.ok) {
+    return { success: false, message: `Linear API error: ${response.status}` };
+  }
+
+  if (!data.data?.attachmentsForURL?.nodes?.length) {
+    return {
+      success: false,
+      message: `No Linear issue linked to ${githubIssueUrl}`,
+    };
+  }
+
+  return {
+    success: true,
+    issue: data.data.attachmentsForURL.nodes[0].issue.identifier,
+  };
+}
+
+module.exports = { findLinearIssue };

.github/scripts/generate-llms-txt.js

@@ -0,0 +1,317 @@
+const fs = require("fs");
+const path = require("path");
+
+const REPO = "metabase/metabase";
+const OUTPUT_FILE = "llms.txt";
+
+// Sections to generate llms-<name>-full.txt for.
+// Each section can define a preamble (introductory content before the main docs).
+const LLMS_FULL_TO_GENERATE = [
+  {
+    section: "embedding",
+    getPreamble: (branch) =>
+      aboveVersion(branch, 57) ? getModularEmbeddingGotchaNotes() : "",
+  },
+];
+
+/**
+ * List directory recursively to get markdown files
+ *
+ * @param {string} docsPath - full path to docs directory
+ * @returns {Array} list of markdown file objects with fullPath and relativePath
+ */
+function getMarkdownFilesList(docsPath) {
+  if (!fs.existsSync(docsPath)) {
+    console.error(`Error: Docs directory '${docsPath}' does not exist`);
+    process.exit(1);
+  }
+
+  const entries = fs.readdirSync(docsPath, {
+    recursive: true,
+    withFileTypes: true,
+  });
+
+  return entries
+    .filter((entry) => {
+      return (
+        entry.isFile() &&
+        // Only markdown files
+        entry.name.endsWith(".md") &&
+        // Ignore README.md
+        entry.name !== "README.md" &&
+        // Ignore node_modules and hidden directories
+        !entry.parentPath
+          .split(path.sep)
+          .some((dir) => dir === "node_modules" || dir.startsWith("."))
+      );
+    })
+    .map((entry) => {
+      const fullPath = path
+        .join(entry.parentPath, entry.name)
+        .replace(/\\/g, "/");
+
+      const relativePath = path
+        .relative(docsPath, fullPath)
+        .replace(/\\/g, "/");
+
+      return { fullPath, relativePath };
+    });
+}
+
+/**
+ * Generate llms.txt file with links to all markdown files in docs/
+ *
+ * @param {string} branch - branch name (e.g. 'master' or 'release-x.58.x')
+ * @param {Array} files - list of all markdown file objects
+ * @param {Array<Object>} sectionsConfig - list of section config objects to generate complete references for
+ */
+function generateLlmsTxt(branch, files, sectionsConfig) {
+  const baseUrl = `https://raw.githubusercontent.com/${REPO}/refs/heads/${branch}`;
+
+  const filesToExtract = files
+    // Files in embedding/sdk/api/snippets does not exist in the repo.
+    .filter(
+      (file) => !file.relativePath.startsWith("embedding/sdk/api/snippets"),
+    );
+
+  const entries = filesToExtract.map((file) => {
+    const content = fs.readFileSync(file.fullPath, "utf8");
+    const title = extractTitle(content, file.relativePath);
+    const url = `${baseUrl}/docs/${file.relativePath}`;
+
+    return { title, url, path: file.relativePath };
+  });
+
+  // Generate table of contents entries
+  const tableOfContents = entries.map(
+    (entry) => `- [${entry.title}](${entry.url})`,
+  );
+
+  // Generate complete references entries
+  const completeReferences = sectionsConfig
+    .filter((config) =>
+      files.some((file) => file.relativePath.startsWith(`${config.section}/`)),
+    )
+    .map((config) => {
+      const capitalized =
+        config.section.charAt(0).toUpperCase() + config.section.slice(1);
+      return `- [${capitalized} - Complete Reference](${baseUrl}/llms-${config.section}-full.txt)`;
+    });
+
+  // Generate llms.txt content using template literal
+  const content = `# Metabase Documentation
+Metabase - The simplest, fastest way to get business intelligence and analytics to everyone in your company.
+
+## Table of Contents
+
+${tableOfContents.join("\n")}
+
+## Complete References
+
+These files are very large and are around 90,000 tokens. Do not use by default unless the context window is huge or RAG is supported in your editor.
+
+${completeReferences.join("\n")}
+`;
+
+  fs.writeFileSync(OUTPUT_FILE, content, "utf8");
+
+  console.log(
+    `✅ Generated ${OUTPUT_FILE} with ${entries.length} markdown files`,
+  );
+  console.log(`   Branch: ${branch}`);
+  console.log(`   Base URL: ${baseUrl}`);
+}
+
+/**
+ * Generate llms-full.txt files for specified sections
+ *
+ * @param {string} branch - branch name (e.g., 'master', 'release-x.58.x')
+ * @param {Array} files - list of all markdown file objects
+ * @param {Array<Object>} sectionsConfig - list of section config objects to generate full files for
+ */
+function generateLlmsFullFiles(branch, files, sectionsConfig) {
+  const baseUrl = `https://raw.githubusercontent.com/${REPO}/refs/heads/${branch}`;
+
+  sectionsConfig.forEach((config) => {
+    generateLlmsFullTxt(branch, config, files, baseUrl);
+  });
+}
+
+/**
+ * LLMs are likely to pay attention to the very first lines.
+ *
+ * We add the most important context for LLMs to avoid
+ * confusion and pitfalls like out-of-date APIs in trained data.
+ *
+ * @returns {string} Markdown formatted gotcha notes
+ */
+function getModularEmbeddingGotchaNotes() {
+  return `> **Important Version Notes**
+>
+> Watch out for these deprecated props and gotchas for Metabase 57 onwards, for modular embedding:
+>
+> 1. \`config\` prop on MetabaseProvider no longer exist - it is replaced by \`authConfig\`.
+> 2. \`authProviderUri\` field no longer exist.
+> 3. \`jwtProviderUri\` optional field only exists in v58+. This is used to make JWT auth faster by skipping the \`GET /auth/sso\` discovery request. Not needed for initial implementation.
+> 4. \`fetchRequestToken\` is not needed by default. This is only used to customize how the SDK fetches the request token.
+> 5. Numeric IDs must be integers not strings, e.g. \`dashboardId={1}\`. When the ID is retrieved from the URL and it is numeric, convert it to an integer via \`parseInt\` before passing it to the SDK. IDs can also be strings for entity ids, so you should not parse all IDs as numbers if entity ids are also to be expected.
+`;
+}
+
+/**
+ * Generate llms-full.txt file for a specific section
+ * @param {string} branch - The branch name
+ * @param {Object} config - Section config object with section name and optional getPreamble function
+ * @param {Array} files - Array of all markdown file objects
+ * @param {string} baseUrl - Base URL for raw GitHub links
+ */
+function generateLlmsFullTxt(branch, config, files, baseUrl) {
+  const { section, getPreamble } = config;
+
+  // Filter docs for this section
+  const sectionFiles = files.filter((file) =>
+    file.relativePath.startsWith(`${section}/`),
+  );
+
+  if (sectionFiles.length === 0) {
+    console.log(`   Skipping llms-full.txt for ${section} (no files found)`);
+    return;
+  }
+
+  // Build content
+  const sectionCapitalized = section.charAt(0).toUpperCase() + section.slice(1);
+  const header = `# Metabase ${sectionCapitalized} - Complete Reference for AI agents
+
+> Table of contents: ${baseUrl}/${OUTPUT_FILE}
+
+`;
+
+  // Add preamble if provided (e.g., version-specific notes, warnings)
+  const preamble = getPreamble ? getPreamble(branch) : "";
+
+  // Concatenate all documents
+  const docs = sectionFiles
+    .map((file) => readAndCleanMarkdown(file.fullPath))
+    .join("\n");
+
+  // Write llms-full.txt file at repo root
+  const content = header + preamble + "\n" + docs;
+  const llmsFullPath = `llms-${section}-full.txt`;
+  fs.writeFileSync(llmsFullPath, content, "utf8");
+
+  console.log(
+    `✅ Generated ${llmsFullPath} with ${sectionFiles.length} documents`,
+  );
+}
+
+/**
+ * Extract title from markdown file frontmatter or filename.
+ *
+ * We try to extract the title in this order: 1) YAML frontmatter
+ * 2) first H1 heading, and 3) the Markdown file name.
+ *
+ * Example Markdown and frontmatter format:
+ * ```markdown
+ * ---
+ * title: "Getting Started"
+ * description: "A guide"
+ * ---
+ * # Getting Started
+ * ```
+ *
+ * @param {string} content - file content
+ * @param {string} filePath - relative file path
+ * @returns {string} title of content
+ */
+function extractTitle(content, filePath) {
+  // Try to extract title from YAML frontmatter
+  // First, match against the YAML frontmatter delimiter `---`
+  const frontmatterMatch = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n/);
+
+  if (frontmatterMatch) {
+    // Then, match against the title property
+    // Example: `title: "My Page"`
+    const frontmatter = frontmatterMatch[1];
+    const titleMatch = frontmatter.match(/^title:\s*(.+)$/m);
+
+    // Remove quotes if present
+    if (titleMatch) {
+      return titleMatch[1].trim().replace(/^["']|["']$/g, "");
+    }
+  }
+
+  // Try to extract title from first H1 heading
+  // Example: `# My Page`
+  const h1Match = content.match(/^#\s+(.+)$/m);
+
+  if (h1Match) {
+    return h1Match[1].trim();
+  }
+
+  // Fallback to filename, e.g. `my-page.md`
+  const filename = path.basename(filePath, ".md");
+
+  // Convert kebab-case or snake_case to Title Case
+  // `my-page.md` would become "My Page"
+  return filename
+    .split(/[-_]/)
+    .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+    .join(" ");
+}
+
+/**
+ * Read and clean markdown file content
+ *
+ * @param {string} filePath - full path to the markdown file
+ * @returns {string} cleaned markdown content with separator
+ */
+function readAndCleanMarkdown(filePath) {
+  let content = fs.readFileSync(filePath, "utf8");
+
+  // Strip YAML frontmatter
+  content = content.replace(/^---\s*\n[\s\S]*?\n---\s*\n/, "");
+
+  // Strip Jekyll/Liquid template syntax
+  content = content.replace(/\{%.*?%\}/g, "");
+  content = content.replace(/\{\{.*?\}\}/g, "");
+
+  return `${content.trim()}\n\n---\n`;
+}
+
+/**
+ * Check if branch version is above target version
+ * @param {string} branch - Branch name (e.g., 'master', 'release-x.58.x')
+ * @param {number} targetVersion - Target version number
+ * @returns {boolean}
+ */
+function aboveVersion(branch, targetVersion) {
+  if (branch === "master") {
+    return true;
+  }
+
+  // Parse version from release branch like "release-x.58.x" -> 58
+  const match = branch.match(/release-x\.(\d+)\.x/);
+  if (!match) {
+    return false;
+  }
+
+  const version = parseInt(match[1], 10);
+
+  return version >= targetVersion;
+}
+
+// Main execution
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  const docsPath = args[0] || "docs";
+  const branch = args[1] || "master";
+
+  const resolvedDocsPath = path.resolve(docsPath);
+  const markdownFiles = getMarkdownFilesList(resolvedDocsPath);
+
+  // Sort all files upfront for consistent ordering across all generated files
+  markdownFiles.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+
+  generateLlmsTxt(branch, markdownFiles, LLMS_FULL_TO_GENERATE);
+  generateLlmsFullFiles(branch, markdownFiles, LLMS_FULL_TO_GENERATE);
+}

.github/team.json

@@ -50,7 +50,7 @@
         "nemanjaglumac"
       ]
     },
-     {
+    {
       "name": "Metabot",
       "label": ".Team/Metabot",
       "members": [
@@ -86,13 +86,13 @@
         "eliotmetabase",
         "npfitz",
         "johnswanson",
-        "iethree",
         "nvoxland",
         "edpaget",
         "deniskaber",
         "alxnddr",
-        "bpander",
-        "andsalves"
+        "andsalves",
+        "kevinkelleher12",
+        "undrfined"
       ]
     },
     {
@@ -109,6 +109,16 @@
         "uladzimirdev",
         "egorgrushin"
       ]
+    },
+    {
+      "name": "Growth Eng",
+      "label": ".Team/GrowthEng",
+      "members": [
+        "iethree",
+        "bpander",
+        "gantoreno",
+        "losrebellos"
+      ]
     }
   ]
 }

.github/workflows/app-db.yml

@@ -68,8 +68,8 @@ jobs:
           (
             github.event_name == 'push' &&
             (
-              github.ref == 'master' ||
-              startsWith(github.ref, 'release-')
+              github.ref_name == 'master' ||
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||
@@ -182,8 +182,8 @@ jobs:
           (
             github.event_name == 'push' &&
             (
-              github.ref == 'master' ||
-              startsWith(github.ref, 'release-')
+              github.ref_name == 'master' ||
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||
@@ -297,8 +297,8 @@ jobs:
           (
             github.event_name == 'push' &&
             (
-              github.ref == 'master' ||
-              startsWith(github.ref, 'release-')
+              github.ref_name == 'master' ||
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||

.github/workflows/backend.yml

@@ -88,8 +88,8 @@ jobs:
           (
             github.event_name == 'push' &&
             (
-              github.ref == 'master' ||
-              startsWith(github.ref, 'release-')
+              github.ref_name == 'master' ||
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||

.github/workflows/cache-generator.yml

@@ -51,14 +51,19 @@ jobs:
       eslint-cache-key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
       cypress-cache-key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
 
-  generate-m2-cache:
+  generate-caches:
     runs-on: ubuntu-22.04
-    timeout-minutes: 15
+    timeout-minutes: 30
     needs: get-cache-keys
     env:
       M2_CACHE_KEY: ${{ needs.get-cache-keys.outputs.m2-cache-key }}
+      NODE_CACHE_KEY: ${{ needs.get-cache-keys.outputs.node-cache-key }}
+      CYPRESS_CACHE_KEY: ${{ needs.get-cache-keys.outputs.cypress-cache-key }}
+      ESLINT_CACHE_KEY: ${{ needs.get-cache-keys.outputs.eslint-cache-key }}
     steps:
       - uses: actions/checkout@v4
+
+      # Backend preparation and cache
       - name: Prepare backend
         uses: ./.github/actions/prepare-backend
 
@@ -75,16 +80,7 @@ jobs:
             ~/.gitlibs
           key: ${{ env.M2_CACHE_KEY }}
 
-  generate-frontend-caches:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    needs: get-cache-keys
-    env:
-      NODE_CACHE_KEY: ${{ needs.get-cache-keys.outputs.node-cache-key }}
-      ESLINT_CACHE_KEY: ${{ needs.get-cache-keys.outputs.eslint-cache-key }}
-      CYPRESS_CACHE_KEY: ${{ needs.get-cache-keys.outputs.cypress-cache-key }}
-    steps:
-      - uses: actions/checkout@v4
+      # Frontend preparation and caches
       # `prepare-frontend` action (1) prepares Node.js and (2) fetches the node_modules cache if it exists.
       # It then (3) runs `yarn install --frozen-lockfile --prefer-offline` which ensures the local cache is fully populated.
       # IMPORTANT: Caching node_modules after patches are already applied will break any PR that attempts to either:
@@ -111,6 +107,11 @@ jobs:
           yarn cypress verify
         shell: bash
 
+      # Run Prettier to populate its cache (stored in node_modules/.cache/prettier)
+      # so it gets saved as part of the node_modules cache below
+      - name: Run Prettier to populate cache
+        run: yarn lint-prettier-pure
+
       - name: Update node_modules cache
         uses: ./.github/actions/update-cache
         with:
@@ -119,14 +120,21 @@ jobs:
             node_modules
           key: ${{ env.NODE_CACHE_KEY }}
 
-      - name: Update eslint cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: ${{ github.workspace}}/.eslintcache
-          key: ${{ env.ESLINT_CACHE_KEY }}
-
       - name: Update Cypress cache
         uses: ./.github/actions/update-cache
         with:
           path: ~/.cache/Cypress
           key: ${{ env.CYPRESS_CACHE_KEY }}
+
+      # ESLint cache (requires both backend and frontend)
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+
+      - name: Run ESLint to populate cache
+        run: yarn lint-eslint-pure
+
+      - name: Update eslint cache
+        uses: ./.github/actions/update-cache
+        with:
+          path: ${{ github.workspace}}/.eslintcache
+          key: ${{ env.ESLINT_CACHE_KEY }}

.github/workflows/claude-code-bug-fix.yml

@@ -70,6 +70,31 @@ jobs:
               core.setFailed(error.message);
             }
 
+      - name: Find linked Linear issue
+        id: find_linear
+        continue-on-error: true
+        uses: actions/github-script@v7
+        env:
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+          ISSUE_NUMBER: ${{ steps.get_issue.outputs.issue_number }}
+        with:
+          script: |
+            const { findLinearIssue } = require('${{ github.workspace }}/.github/scripts/find-linear-issue.js');
+
+            const githubIssueUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/issues/${process.env.ISSUE_NUMBER}`;
+
+            const result = await findLinearIssue({
+              githubIssueUrl,
+              linearApiKey: process.env.LINEAR_API_KEY
+            });
+
+            if (result.success) {
+              console.log(`Found Linear issue: ${result.issue}`);
+              core.setOutput('linear_issue', result.issue);
+            } else {
+              console.log(`Could not find Linear issue: ${result.message}`);
+            }
+
       - name: Set up git configuration
         run: |
           git config --global user.name "Claude Code[bot]"
@@ -259,6 +284,7 @@ jobs:
             core.setOutput('reviewers', issueCreator);
 
       - name: Create Pull Request
+        id: create_pr
         if: steps.check_changes.outputs.has_changes == 'true'
         uses: peter-evans/create-pull-request@v6
         with:
@@ -279,6 +305,8 @@ jobs:
           body: |
             This PR automatically fixes the bug reported in #${{ env.ISSUE_NUMBER }}.
 
+            ${{ steps.find_linear.outputs.linear_issue && format('Closes {0}', steps.find_linear.outputs.linear_issue) || '' }}
+
             ## Bug Report
             **Original Issue:** #${{ env.ISSUE_NUMBER }}
             **Reporter:** @${{ env.ISSUE_AUTHOR }}
@@ -299,7 +327,6 @@ jobs:
             - If issues are found, either fix them or close this PR
 
             ---
-            Closes #${{ env.ISSUE_NUMBER }}
 
             🤖 Generated with [Claude Code](https://claude.ai/code)
 
@@ -309,6 +336,7 @@ jobs:
             automated-fix
             ci skip
           reviewers: ${{ steps.prepare_reviewers.outputs.reviewers }}
+          assignees: ${{ github.actor }}
 
       - name: Log existing branch update
         if: steps.check_changes.outputs.has_changes == 'true' && env.BRANCH_EXISTS == 'true'

.github/workflows/claude-docs-review.yml

@@ -23,6 +23,7 @@ concurrency:
 jobs:
   review:
     runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
     permissions:
       contents: read
       pull-requests: write
@@ -94,6 +95,8 @@ jobs:
 
             Use the docs-review skill to review all changed documentation files for compliance with the Metabase writing style guide.
 
+            IMPORTANT: Only review markdown files (.md and .mdx). Skip any .txt files or other non-markdown files.
+
             DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
 
           claude_args: |

.github/workflows/clean-cache.yml

@@ -1,33 +0,0 @@
-name: Cleanup caches by a branch
-on:
-  pull_request:
-    types:
-      - closed
-
-jobs:
-  cleanup:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
-
-      - name: Cleanup
-        run: |
-          gh extension install actions/gh-actions-cache
-
-          REPO=${{ github.repository }}
-          BRANCH="refs/pull/${{ github.event.pull_request.number }}/merge"
-
-          echo "Fetching list of cache key"
-          cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH | cut -f 1 )
-
-          ## Setting this to not fail the workflow while deleting cache keys.
-          set +e
-          echo "Deleting caches..."
-          for cacheKey in $cacheKeysForPR
-          do
-              gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
-          done
-          echo "Done"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codespell.yml

@@ -1,19 +1,110 @@
 name: Codespell
 
 on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-  pull_request:
+  schedule:
+    # Run nightly at 4:00 AM UTC
+    - cron: "0 4 * * *"
+  workflow_dispatch:
 
 jobs:
   codespell:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
-      - uses: actions/checkout@v3
-      - uses: codespell-project/actions-codespell@v1
+      - uses: actions/checkout@v4
+
+      - name: Install codespell
+        run: pip install codespell
+
+      - name: Set up git configuration
+        run: |
+          git config --global user.name "Claude Code[bot]"
+          git config --global user.email "noreply@anthropic.com"
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+      - name: Run codespell check
+        id: codespell_check
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          ./bin/mage codespell 2>&1 | tee codespell_output.txt
+
+      - name: Generate GitHub App Token for Claude
+        if: steps.codespell_check.outcome == 'failure'
+        uses: actions/create-github-app-token@v1
+        id: claude-app-token
         with:
-          # keep this list in sync with the list in `mage/src/mage/codespell.yml`
-          path: >-
-            docs
+          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
+          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+
+      - name: Fix spelling errors with Claude Code
+        if: steps.codespell_check.outcome == 'failure'
+        uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ steps.claude-app-token.outputs.token }}
+          prompt: |
+            You are tasked with fixing spelling errors detected by codespell in this repository.
+
+            ## Codespell Output
+            The following spelling errors were detected:
+            ```
+            $(cat codespell_output.txt)
+            ```
+
+            ## Instructions
+            1. **Review the codespell output and identify reported spelling errors** - The usual format codespell uses is `typo ==> correction`
+            2. **Fix every spelling error** - Use the Edit tool to fix each misspelling with the suggested correction
+               - If codespell suggests multiple corrections, choose the most appropriate one based on context
+
+            Human reviewers will verify the changes before merging, so fix all errors reported by codespell.
+          claude_args: |
+            --allowedTools "Write,Read,Glob,Grep,Edit,MultiEdit,Bash(cat*),Bash(ls*)"
+            --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"
+
+      - name: Clean up temporary files
+        if: steps.codespell_check.outcome == 'failure'
+        run: rm -f codespell_output.txt
+
+      - name: Create Pull Request
+        if: steps.codespell_check.outcome == 'failure'
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: claude-fix/codespell-${{ steps.date.outputs.date }}
+          base: master
+          delete-branch: true
+          commit-message: |
+            Fix spelling errors detected by codespell (${{ steps.date.outputs.date }})
+
+            🤖 Generated with [Claude Code](https://claude.ai/code)
+
+            Co-Authored-By: Claude <noreply@anthropic.com>
+          committer: "Claude Code[bot] <noreply@anthropic.com>"
+          author: "Claude Code[bot] <noreply@anthropic.com>"
+          title: "Fix spelling errors detected by codespell (${{ steps.date.outputs.date }})"
+          body: |
+            This PR automatically fixes spelling errors detected by the scheduled codespell check.
+
+            ## Automated Fix
+            🤖 This fix was generated automatically by Claude Code based on codespell output.
+
+            **Please review carefully:**
+            - [ ] The spelling fixes are correct
+            - [ ] No code functionality was changed
+            - [ ] Technical terms were preserved correctly
+
+            ---
+
+            🤖 Generated with [Claude Code](https://claude.ai/code)
+
+            Co-Authored-By: Claude <noreply@anthropic.com>
+          labels: |
+            automated-fix
+            backport

.github/workflows/docs-release-generate.yml

@@ -8,7 +8,7 @@ on:
       target_branch:
         description: "Target branch for documentation update"
         required: false
-        default: "release-x.57.x"
+        default: "release-x.58.x"
         type: string
 
 jobs:
@@ -16,6 +16,6 @@ jobs:
     name: Call documentation update for release branch
     uses: ./.github/workflows/docs-generate-base.yml
     with:
-      target_branch: ${{ inputs.target_branch || 'release-x.57.x' }}
+      target_branch: ${{ inputs.target_branch || 'release-x.58.x' }}
     secrets:
       automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers.yml

@@ -12,12 +12,52 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # This job will determine if the tier 3 driver tests should be skipped.
-  # It will always run first.
+  # This job determines which driver tests should run based on PR context.
+  # All decision logic is consolidated in mage driver-decisions.
   determine-driver-skips:
     runs-on: ubuntu-latest
     outputs:
-      skip: ${{ steps.check-branch-and-files-changed.outputs.skip }}
+      # All driver run decisions (from mage driver-decisions)
+      h2-should-run: ${{ steps.driver-decisions.outputs.h2-should-run }}
+      athena-should-run: ${{ steps.driver-decisions.outputs.athena-should-run }}
+      bigquery-should-run: ${{ steps.driver-decisions.outputs.bigquery-should-run }}
+      clickhouse-should-run: ${{ steps.driver-decisions.outputs.clickhouse-should-run }}
+      databricks-should-run: ${{ steps.driver-decisions.outputs.databricks-should-run }}
+      druid-should-run: ${{ steps.driver-decisions.outputs.druid-should-run }}
+      druid-jdbc-should-run: ${{ steps.driver-decisions.outputs.druid-jdbc-should-run }}
+      mongo-should-run: ${{ steps.driver-decisions.outputs.mongo-should-run }}
+      mongo-ssl-should-run: ${{ steps.driver-decisions.outputs.mongo-ssl-should-run }}
+      mongo-sharded-cluster-should-run: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-should-run }}
+      mysql-mariadb-should-run: ${{ steps.driver-decisions.outputs.mysql-mariadb-should-run }}
+      oracle-should-run: ${{ steps.driver-decisions.outputs.oracle-should-run }}
+      postgres-should-run: ${{ steps.driver-decisions.outputs.postgres-should-run }}
+      presto-jdbc-should-run: ${{ steps.driver-decisions.outputs.presto-jdbc-should-run }}
+      redshift-should-run: ${{ steps.driver-decisions.outputs.redshift-should-run }}
+      snowflake-should-run: ${{ steps.driver-decisions.outputs.snowflake-should-run }}
+      sparksql-should-run: ${{ steps.driver-decisions.outputs.sparksql-should-run }}
+      sqlite-should-run: ${{ steps.driver-decisions.outputs.sqlite-should-run }}
+      sqlserver-should-run: ${{ steps.driver-decisions.outputs.sqlserver-should-run }}
+      vertica-should-run: ${{ steps.driver-decisions.outputs.vertica-should-run }}
+      # Per-driver quarantine conflict flags (set when driver is quarantined but has file changes)
+      athena-quarantine-conflict: ${{ steps.driver-decisions.outputs.athena-quarantine-conflict }}
+      bigquery-quarantine-conflict: ${{ steps.driver-decisions.outputs.bigquery-quarantine-conflict }}
+      clickhouse-quarantine-conflict: ${{ steps.driver-decisions.outputs.clickhouse-quarantine-conflict }}
+      databricks-quarantine-conflict: ${{ steps.driver-decisions.outputs.databricks-quarantine-conflict }}
+      druid-quarantine-conflict: ${{ steps.driver-decisions.outputs.druid-quarantine-conflict }}
+      druid-jdbc-quarantine-conflict: ${{ steps.driver-decisions.outputs.druid-jdbc-quarantine-conflict }}
+      mongo-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-quarantine-conflict }}
+      mongo-ssl-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-ssl-quarantine-conflict }}
+      mongo-sharded-cluster-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-quarantine-conflict }}
+      mysql-mariadb-quarantine-conflict: ${{ steps.driver-decisions.outputs.mysql-mariadb-quarantine-conflict }}
+      oracle-quarantine-conflict: ${{ steps.driver-decisions.outputs.oracle-quarantine-conflict }}
+      postgres-quarantine-conflict: ${{ steps.driver-decisions.outputs.postgres-quarantine-conflict }}
+      presto-jdbc-quarantine-conflict: ${{ steps.driver-decisions.outputs.presto-jdbc-quarantine-conflict }}
+      redshift-quarantine-conflict: ${{ steps.driver-decisions.outputs.redshift-quarantine-conflict }}
+      snowflake-quarantine-conflict: ${{ steps.driver-decisions.outputs.snowflake-quarantine-conflict }}
+      sparksql-quarantine-conflict: ${{ steps.driver-decisions.outputs.sparksql-quarantine-conflict }}
+      sqlite-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlite-quarantine-conflict }}
+      sqlserver-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlserver-quarantine-conflict }}
+      vertica-quarantine-conflict: ${{ steps.driver-decisions.outputs.vertica-quarantine-conflict }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -26,29 +66,26 @@ jobs:
         run: |
           # Fetch the base branch to ensure its history is available for diffing
           git fetch --depth=1 origin ${{ github.event.pull_request.base.ref }}:${{ github.event.pull_request.base.ref }}
-          # Only run this if it's a pull request and the base ref exists
-      - name: Check if driver tests should run
-        id: check-branch-and-files-changed
+      - name: Determine which drivers should run
+        id: driver-decisions
         run: |
-          IS_MASTER_OR_RELEASE="${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-') }}"
-          echo "Is master or release: ${IS_MASTER_OR_RELEASE}"
-
-          if [[ "${IS_MASTER_OR_RELEASE}" == "true" ]]; then
-            echo "skip=false" >> $GITHUB_OUTPUT
-            echo "Merging into master or a release branch. All driver tests will run."
-          else
-            echo "Checking for changes in relevant modules..."
-            if ./bin/mage can-skip-driver-tests "${{ github.event.pull_request.base.ref }}"; then
-              echo 'skip=true' >> $GITHUB_OUTPUT
-            else
-              echo 'skip=false' >> $GITHUB_OUTPUT
-            fi
-          fi
+          # All decision logic is in mage - it analyzes module dependencies,
+          # branch context, labels, and file changes to decide what runs.
+          MAGE_ARGS=(
+            --git-ref="${{ github.event.pull_request.base.ref || 'master' }}"
+            --is-master-or-release="${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}"
+            --pr-labels="${{ join(github.event.pull_request.labels.*.name, ',') }}"
+            --skip="${{ inputs.skip }}"
+          )
+          # First call: show human-readable output for debugging
+          ./bin/mage -driver-decisions "${MAGE_ARGS[@]}"
+          # Second call: output only key=value lines for GITHUB_OUTPUT
+          ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> $GITHUB_OUTPUT
         shell: bash
 
   be-tests-athena-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.athena-should-run == 'true' || needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -65,6 +102,16 @@ jobs:
       MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY }}
     name: Athena
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Athena driver is quarantined but you changed files in modules/drivers/athena/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Athena tests, add the label: break-quarantine-athena"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Athena driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Athena driver
       id: test-driver
@@ -76,7 +123,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -88,7 +135,7 @@ jobs:
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' || needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -99,6 +146,7 @@ jobs:
             test-args: >-
               :only-tags [:mb/driver-tests]
               :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
 # DS 2025-09-26 temporarily disabled while we diagnose flakes
 #          - name: Transforms Python Tests
 #            test-args: >-
@@ -116,6 +164,16 @@ jobs:
       MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
     name: BigQuery ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::BigQuery driver is quarantined but you changed files in modules/drivers/bigquery-cloud-sdk/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run BigQuery tests, add the label: break-quarantine-bigquery"
+        echo ""
+        echo "If you merge without testing, you risk breaking the BigQuery driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -128,9 +186,10 @@ jobs:
       with:
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
         test-args: ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -148,7 +207,7 @@ jobs:
 
   be-tests-clickhouse-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.clickhouse-should-run == 'true' || needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -172,6 +231,16 @@ jobs:
       MB_CLICKHOUSE_TEST_NGINX_PORT: 8127
     name: Clickhouse ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::ClickHouse driver is quarantined but you changed files in modules/drivers/clickhouse/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run ClickHouse tests, add the label: break-quarantine-clickhouse"
+        echo ""
+        echo "If you merge without testing, you risk breaking the ClickHouse driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -199,9 +268,10 @@ jobs:
       with:
         junit-name: 'be-tests-clickhouse-ee'
         test-args: ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -219,7 +289,7 @@ jobs:
 
   be-tests-druid-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.druid-should-run == 'true' || needs.determine-driver-skips.outputs.druid-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -234,6 +304,16 @@ jobs:
           CLUSTER_SIZE: nano-quickstart
     name: Druid (Legacy)
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.druid-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Druid driver is quarantined but you changed files in modules/drivers/druid/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Druid tests, add the label: break-quarantine-druid"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Druid driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Druid driver
       id: test-driver
@@ -245,7 +325,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -257,7 +337,7 @@ jobs:
 
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -272,6 +352,16 @@ jobs:
           CLUSTER_SIZE: nano-quickstart
     name: Druid (JDBC)
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Druid JDBC driver is quarantined but you changed files in modules/drivers/druid-jdbc/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Druid JDBC tests, add the label: break-quarantine-druid-jdbc"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Druid JDBC driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Druid JDBC driver
       id: test-driver
@@ -283,7 +373,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -295,7 +385,7 @@ jobs:
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -310,6 +400,16 @@ jobs:
       MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
     name: Databricks
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Databricks driver is quarantined but you changed files in modules/drivers/databricks/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Databricks tests, add the label: break-quarantine-databricks"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Databricks driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Databricks driver
       id: test-driver
@@ -321,7 +421,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -333,7 +433,7 @@ jobs:
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -349,6 +449,16 @@ jobs:
       MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
     name: Databricks (Multi-Catalog)
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Databricks driver is quarantined but you changed files in modules/drivers/databricks/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Databricks tests, add the label: break-quarantine-databricks"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Databricks driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Databricks driver with multi-catalog
       id: test-driver
@@ -360,7 +470,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -371,7 +481,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-h2:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -389,7 +500,38 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  be-tests-h2-oss:
+    needs: determine-driver-skips
+    if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+    name: H2 (OSS)
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test H2 driver (OSS)
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-h2-oss'
+        edition: 'oss'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+          :exclude-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -401,7 +543,7 @@ jobs:
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-should-run == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -459,8 +601,8 @@ jobs:
           (
             github.event_name == 'push' &&
             (
-              github.ref == 'master' ||
-              startsWith(github.ref, 'release-')
+              github.ref_name == 'master' ||
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||
@@ -513,12 +655,13 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: ${{ matrix.version.junit-name }}
+          logs-artifact-suffix: ${{ matrix.version.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
-        if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+        if: always()
         with:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
@@ -536,7 +679,7 @@ jobs:
 
   be-tests-mongo:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -573,6 +716,16 @@ jobs:
           MONGO_INITDB_ROOT_PASSWORD: metasample123
     name: ${{ matrix.version.name }} ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::MongoDB driver is quarantined but you changed files in modules/drivers/mongo/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run MongoDB tests, add the label: break-quarantine-mongo"
+        echo ""
+        echo "If you merge without testing, you risk breaking the MongoDB driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -585,9 +738,10 @@ jobs:
       with:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -605,7 +759,7 @@ jobs:
 
   be-tests-mongo-ssl:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -623,6 +777,16 @@ jobs:
       MB_TEST_MONGO_REQUIRES_SSL: true
     name: "${{ matrix.version.name }} (SSL)"
     steps:
+      - name: Fail on quarantine conflict
+        if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
+        run: |
+          echo "::error::MongoDB SSL driver is quarantined but you changed files in modules/drivers/mongo/"
+          echo ""
+          echo "Your changes will NOT be tested because the driver is currently quarantined."
+          echo "To run MongoDB SSL tests, add the label: break-quarantine-mongo-ssl"
+          echo ""
+          echo "If you merge without testing, you risk breaking the MongoDB SSL driver!"
+          exit 1
       - uses: actions/checkout@v4
       - name: Spin up Mongo docker container
         run: >-
@@ -659,7 +823,7 @@ jobs:
             :only-tags [:mb/driver-tests]
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
-        if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+        if: always()
         with:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
@@ -671,7 +835,7 @@ jobs:
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -684,6 +848,16 @@ jobs:
           - "27017:17017"
     name: MongoDB Sharded Cluster
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::MongoDB Sharded Cluster driver is quarantined but you changed files in modules/drivers/mongo/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run MongoDB Sharded Cluster tests, add the label: break-quarantine-mongo-sharded-cluster"
+        echo ""
+        echo "If you merge without testing, you risk breaking the MongoDB Sharded Cluster driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test MongoDB driver (Sharded cluster)
       id: test-driver
@@ -694,7 +868,7 @@ jobs:
           :only metabase.driver.mongo.sharded-cluster-test
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -706,7 +880,7 @@ jobs:
 
   be-tests-oracle:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.oracle-should-run == 'true' || needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -757,18 +931,29 @@ jobs:
           - "1521:${{ matrix.version.port }}"
     name: ${{ matrix.version.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Oracle driver is quarantined but you changed files in modules/drivers/oracle/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Oracle tests, add the label: break-quarantine-oracle"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Oracle driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test ${{ matrix.version.name }}
       id: test-driver
       uses: ./.github/actions/test-driver
       with:
         junit-name: ${{ matrix.version.junit-name }}
+        logs-artifact-suffix: ${{ matrix.version.name }}
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -780,7 +965,7 @@ jobs:
 
   be-tests-postgres:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.postgres-should-run == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -818,8 +1003,8 @@ jobs:
           (
             github.event_name == 'push' &&
             (
-              github.ref == 'master' ||
-              startsWith(github.ref, 'release-')
+              github.ref_name == 'master' ||
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||
@@ -866,12 +1051,13 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: 'be-tests-${{ matrix.version.junit-name }}'
+          logs-artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
-        if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+        if: always()
         with:
           input-path: ./target/junit/
           output-name: ${{ github.job }}
@@ -889,7 +1075,7 @@ jobs:
 
   be-tests-presto-jdbc-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -912,6 +1098,16 @@ jobs:
         env:
           JAVA_TOOL_OPTIONS: "-Xmx2g"
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Presto JDBC driver is quarantined but you changed files in modules/drivers/presto-jdbc/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Presto JDBC tests, add the label: break-quarantine-presto-jdbc"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Presto JDBC driver!"
+        exit 1
     - uses: actions/checkout@v4
     - uses: ./.github/actions/await-port
       with:
@@ -948,7 +1144,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -960,7 +1156,7 @@ jobs:
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' || needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -972,12 +1168,22 @@ jobs:
             test-args: >-
               :only-tags [:mb/upload-tests]
               :fail-fast? true
-          - name: Redshift (Excluding Upload Tests)
+          - name: Redshift (Excluding Upload Tests) Part 1
             skip: false
             test-args: >-
               :only-tags [:mb/driver-tests]
               :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
               :fail-fast? true
+              :partition/total 2
+              :partition/index 0
+          - name: Redshift (Excluding Upload Tests) Part 2
+            skip: false
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
+              :fail-fast? true
+              :partition/total 2
+              :partition/index 1
           - name: Redshift Transforms Python Tests
             skip: false
             test-args: >-
@@ -995,6 +1201,16 @@ jobs:
       MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
     name: ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Redshift driver is quarantined but you changed files in modules/drivers/redshift/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Redshift tests, add the label: break-quarantine-redshift"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Redshift driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1009,9 +1225,10 @@ jobs:
         junit-name: 'be-tests-redshift-ee'
         test-args: >-
           ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: ${{ !matrix.job.skip && !cancelled() && steps.test-driver.outputs.quarantine-skipped != 'true' }}
+      if: ${{ !matrix.job.skip && !cancelled() }}
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -1029,7 +1246,7 @@ jobs:
 
   be-tests-snowflake-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.snowflake-should-run == 'true' || needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -1040,6 +1257,7 @@ jobs:
             test-args: >-
               :only-tags [:mb/driver-tests]
               :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
 
 # DS 2025-09-26 temporarily disabled while we diagnose flakes
 #          - name: Transforms Python Tests
@@ -1067,6 +1285,16 @@ jobs:
       MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
     name: Snowflake ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Snowflake driver is quarantined but you changed files in modules/drivers/snowflake/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Snowflake tests, add the label: break-quarantine-snowflake"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Snowflake driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1079,9 +1307,10 @@ jobs:
       with:
         junit-name: 'be-tests-snowflake-ee'
         test-args: ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -1099,7 +1328,7 @@ jobs:
 
   be-tests-sparksql-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.sparksql-should-run == 'true' || needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -1112,6 +1341,16 @@ jobs:
           - "10000:10000"
     name: Spark SQL
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::SparkSQL driver is quarantined but you changed files in modules/drivers/sparksql/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run SparkSQL tests, add the label: break-quarantine-sparksql"
+        echo ""
+        echo "If you merge without testing, you risk breaking the SparkSQL driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test Spark driver
       id: test-driver
@@ -1123,7 +1362,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -1135,7 +1374,7 @@ jobs:
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.sqlite-should-run == 'true' || needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -1143,6 +1382,16 @@ jobs:
       DRIVERS: sqlite
     name: SQLite
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::SQLite driver is quarantined but you changed files in modules/drivers/sqlite/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run SQLite tests, add the label: break-quarantine-sqlite"
+        echo ""
+        echo "If you merge without testing, you risk breaking the SQLite driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Test SQLite driver
       id: test-driver
@@ -1154,7 +1403,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -1166,7 +1415,7 @@ jobs:
 
   be-tests-sqlserver:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.sqlserver-should-run == 'true' || needs.determine-driver-skips.outputs.sqlserver-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     strategy:
@@ -1205,6 +1454,16 @@ jobs:
           MSSQL_MEMORY_LIMIT_MB: 1024
     name: ${{ matrix.version.name }} ${{ matrix.job.name }}
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.sqlserver-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::SQL Server driver is quarantined but you changed files in modules/drivers/sqlserver/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run SQL Server tests, add the label: break-quarantine-sqlserver"
+        echo ""
+        echo "If you merge without testing, you risk breaking the SQL Server driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1217,9 +1476,10 @@ jobs:
       with:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
+        logs-artifact-suffix: ${{ matrix.version.name }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}
@@ -1276,7 +1536,7 @@ jobs:
 
   login-to-ecr:
     needs: determine-driver-skips
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -1306,7 +1566,7 @@ jobs:
 
   be-tests-vertica-ee:
     needs: [determine-driver-skips, login-to-ecr]
-    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
+    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -1322,6 +1582,16 @@ jobs:
           password: ${{ needs.login-to-ecr.outputs.docker_password }}
     name: Vertica
     steps:
+    - name: Fail on quarantine conflict
+      if: ${{ needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
+      run: |
+        echo "::error::Vertica driver is quarantined but you changed files in modules/drivers/vertica/"
+        echo ""
+        echo "Your changes will NOT be tested because the driver is currently quarantined."
+        echo "To run Vertica tests, add the label: break-quarantine-vertica"
+        echo ""
+        echo "If you merge without testing, you risk breaking the Vertica driver!"
+        exit 1
     - uses: actions/checkout@v4
     - name: Make plugins directory
       run: mkdir plugins
@@ -1335,7 +1605,7 @@ jobs:
           :exclude-tags [:mb/transforms-python-test]
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
-      if: always() && steps.test-driver.outputs.quarantine-skipped != 'true'
+      if: always()
       with:
         input-path: ./target/junit/
         output-name: ${{ github.job }}

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -22,14 +22,10 @@ on:
         required: false
         default: "ee"
       qa_db:
-        description: "Select the type of Database you want to run your tests with"
-        type: choice
+        description: "Whether to set up and include external QA databases"
+        type: boolean
         required: true
-        default: "none"
-        options:
-          - none
-          - sql
-          - mongo
+        default: false
       enable_network_throttling:
         description: "Enable network throttling simulation (4g slow like in chrome dev tools)"
         type: boolean
@@ -80,21 +76,15 @@ jobs:
     timeout-minutes: 60
     name: Stress test E2E flake fix
     env:
-      DISPLAY: ""
-      QA_DB_ENABLED: ${{ contains(fromJSON('["sql", "mongo"]'), inputs.qa_db) }}
-      CYPRESS_QA_DB_MONGO: ${{ inputs.qa_db == 'mongo' }}
-      MB_RUN_MODE: e2e
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+      TERM: xterm
+      TZ: US/Pacific # to make Node match the instance tz
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      MB_SNOWPLOW_AVAILABLE: true
-      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
       MB_EDITION: ${{ inputs.mb_edition }}
       CYPRESS_ENABLE_NETWORK_THROTTLING: ${{ inputs.enable_network_throttling }}
-      TERM: xterm
-      TZ: US/Pacific # to make node match the instance tz
     steps:
       - uses: actions/checkout@v4
         with:
@@ -109,9 +99,9 @@ jobs:
           maildev: true
           openldap: true
           snowplow: true
-          postgres: ${{ inputs.qa_db == 'sql' }}
-          mysql: ${{ inputs.qa_db == 'sql' }}
-          mongo: ${{ inputs.qa_db == 'mongo' }}
+          postgres: ${{ inputs.qa_db }}
+          mysql: ${{ inputs.qa_db }}
+          mongo: ${{ inputs.qa_db }}
 
       - name: Download Metabase ${{ matrix.edition }} uberjar
         uses: ./.github/actions/e2e-download-uberjar
@@ -120,28 +110,33 @@ jobs:
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-
       - name: Prepare back-end environment
-        if: ${{ needs.determine-test-type.outputs.type == 'component' }}
         uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
+
       - name: Build Embedding SDK package
         if: ${{ needs.determine-test-type.outputs.type == 'component' }}
         run: yarn build-embedding-sdk-package
 
-      - name: Prepare JDK 21
-        uses: actions/setup-java@v4
-        with:
-          java-version: 21
-          distribution: "temurin"
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
+
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
-      - name: Generate database snapshots
-        run: node e2e/runner/run_cypress_ci.js snapshot
+
+      - name: Generate default database snapshot
+        if: inputs.qa_db == false # true boolean, do not use string here!
+        run: |
+          node e2e/runner/run_cypress_ci.js snapshot \
+            --spec "e2e/snapshot-creators/default.cy.snap.js"
+
+      - name: Generate all database snapshots
+        if: inputs.qa_db
+        run: |
+          node e2e/runner/run_cypress_ci.js snapshot
 
       # For all options and fine-grained control, take a look at the documentation
       # https://github.com/cypress-io/cypress/tree/develop/npm/grep

.github/workflows/e2e-test.yml

@@ -29,6 +29,15 @@ on:
         required: false
         type: number
 
+env:
+  DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+  TERM: xterm
+  TZ: US/Pacific # to make Node match the instance tz
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
+  PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+  JOB_NAME: ${{ inputs.name }}
+
 jobs:
   e2e-tests:
     runs-on: ${{ inputs.runner }}
@@ -36,29 +45,12 @@ jobs:
     name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
     env:
       MB_EDITION: ${{ inputs.edition }}
-      DISPLAY: ""
-      QA_DB_ENABLED: true
-      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-      JOB_NAME: ${{ inputs.name }}
-      MB_RUN_MODE: "e2e"
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
       # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      MB_EXPERIMENTAL_SEARCH_BLOCK_ON_QUEUE: true
-      MB_SEARCH_ENGINE: appdb
-      MB_SNOWPLOW_AVAILABLE: true
-      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
-      CYPRESS_QA_DB_MONGO: ${{ inputs.name == 'mongo' }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -80,9 +72,9 @@ jobs:
           openldap: true
           webhook: true
           snowplow: true
-          postgres: ${{ inputs.name != 'mongo' }}
-          mysql: ${{ inputs.name != 'mongo' }}
-          mongo: ${{ inputs.name == 'mongo' }}
+          postgres: true
+          mysql: true
+          mongo: true
 
       - name: Retrieve uberjar artifact for ${{ inputs.edition }}
         uses: ./.github/actions/fetch-artifact
@@ -93,12 +85,8 @@ jobs:
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare JDK 21
-        uses: actions/setup-java@v4
-        with:
-          java-version: 21
-          distribution: "temurin"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
 
       - name: Prepare Cypress environment
         id: cypress-prep
@@ -116,6 +104,9 @@ jobs:
         if: github.run_attempt != '1'
         run: echo "specs=$(cat failed-specs)" >> $GITHUB_ENV
 
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
@@ -125,6 +116,7 @@ jobs:
         run: node e2e/runner/run_cypress_ci.js snapshot
 
       - name: Run auto-split Cypress tests on ${{ inputs.name }}
+        id: split-e2e
         if: ${{ !inputs.specs }}
         env:
           SPLIT: ${{ inputs.total_chunks }}
@@ -148,6 +140,7 @@ jobs:
         continue-on-error: true
 
       - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
+        id: tagged-e2e
         if: ${{ inputs.specs }}
         shell: bash
         env:
@@ -180,7 +173,8 @@ jobs:
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4
-        if: failure()
+        if: |
+          !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure')
         with:
           name: cypress-recording-${{ inputs.name }}-${{ inputs.edition }}
           path: |
@@ -190,10 +184,12 @@ jobs:
 
       - name: Upload Failed Tests
         uses: actions/upload-artifact@v4
-        if: failure()
+        if: |
+          !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure')
         with:
           name: failed-tests-${{ inputs.name }}-${{ inputs.edition }}
           path: ./cypress/test-results
+          if-no-files-found: ignore
 
       - name: Extract chunk-specific changed timings
         id: extract-timings

.github/workflows/embedding-sdk-component-tests.yml

@@ -2,10 +2,12 @@ name: Embedding SDK Component Tests
 
 on:
   workflow_call:
-    inputs:
-      cached-embedding-sdk-dist-artifact-name:
-        required: true
-        type: string
+
+env:
+  DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+  TERM: xterm
+  TZ: US/Pacific # to make Node match the instance tz
+  MB_EDITION: "ee"
 
 jobs:
   sdk-component-tests:
@@ -17,23 +19,29 @@ jobs:
         react-version: [18, 19]
       fail-fast: false
     env:
-      MB_EDITION: ee
-      DISPLAY: ""
-      MB_RUN_MODE: "e2e"
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
       # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
 
     steps:
       - uses: actions/checkout@v4
 
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
+          openldap: false
+          webhook: false
+          snowplow: false
+          postgres: false
+          mysql: false
+          mongo: false
+
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
@@ -44,17 +52,13 @@ jobs:
       - name: Retrieve Embedding SDK dist artifact
         uses: actions/download-artifact@v4
         with:
-          name: ${{ inputs.cached-embedding-sdk-dist-artifact-name }}
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare JDK 21
-        uses: actions/setup-java@v4
-        with:
-          java-version: 21
-          distribution: "temurin"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
 
       - name: Prepare Cypress environment
         id: cypress-prep
@@ -66,7 +70,10 @@ jobs:
       - name: Make app db snapshot
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
-        run: node e2e/runner/run_cypress_ci.js snapshot
+        # Component tests only need the default snapshot
+        run: |
+          node e2e/runner/run_cypress_ci.js snapshot \
+            --spec "e2e/snapshot-creators/default.cy.snap.js"
 
       # Has to be run after the app db snapshot is made, as it is not compatible with React 19
       - name: Change React version to ${{ matrix.react-version }}
@@ -143,8 +150,6 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 45
     env:
-      MB_EDITION: ee
-      DISPLAY: ""
       MB_RUN_MODE: "e2e"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
@@ -153,9 +158,6 @@ jobs:
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
 
     steps:
       - name: Check out the code from the previous commit
@@ -163,6 +165,19 @@ jobs:
         with:
           ref: ${{ needs.decide-target-ref.outputs.target-ref }}
 
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
+          openldap: false
+          webhook: false
+          snowplow: false
+          postgres: false
+          mysql: false
+          mongo: false
+
       - name: Get the actual commit SHA from the checked out branch
         id: get-commit-sha
         run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
@@ -172,6 +187,8 @@ jobs:
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
 
       - name: Attempt to retrieve the ee uberjar artifact from the previous commit
         id: download-uberjar
@@ -192,7 +209,7 @@ jobs:
       - name: Retrieve Embedding SDK dist artifact built from the current commit N
         uses: actions/download-artifact@v4
         with:
-          name: ${{ inputs.cached-embedding-sdk-dist-artifact-name }}
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
 
       - name: Prepare Cypress environment
@@ -205,7 +222,10 @@ jobs:
       - name: Make app db snapshot
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
-        run: node e2e/runner/run_cypress_ci.js snapshot
+        # Component tests only need the default snapshot
+        run: |
+          node e2e/runner/run_cypress_ci.js snapshot \
+            --spec "e2e/snapshot-creators/default.cy.snap.js"
 
       - name: Run component tests for Embedding SDK
         env:

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -2,11 +2,15 @@ name: "[NOT REQUIRED] SDK Compatibility tests"
 
 on:
   workflow_call:
-    inputs:
-      cached-embedding-sdk-dist-artifact-name:
-        required: true
-        type: string
 
+env:
+  DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+  TERM: xterm
+  TZ: US/Pacific # to make Node match the instance tz
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
+  PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+  MB_EDITION: ee
 jobs:
   get-sample-apps-data:
     runs-on: ubuntu-22.04
@@ -104,15 +108,9 @@ jobs:
     name: e2e-sample-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
       MB_EDITION: ee
-      DISPLAY: ""
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
-      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
       MB_RUN_MODE: e2e
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
       SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
       SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
@@ -121,6 +119,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: ./.github/actions/maximize-disk-space
+
       # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
       - name: Set up Docker Compose
         uses: docker/setup-compose-action@v1
@@ -191,6 +191,12 @@ jobs:
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite != 'shoppy-e2e' }}
         run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts ${{ matrix.test_suite }}
 
+      - name: Prune build cache
+        run: docker builder prune -af
+
+      - name: Log free disk space
+        run: df -h /
+
       - name: Run e2e tests for Sample App
         id: run-e2e-tests
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
@@ -235,16 +241,7 @@ jobs:
     timeout-minutes: 45
     name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
-      MB_EDITION: ee
-      DISPLAY: ""
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
-      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-      MB_RUN_MODE: e2e
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
       HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
       id-token: write
@@ -253,9 +250,11 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Retrieve uberjar artifact for ee
-        uses: actions/download-artifact@v4
+        uses: ./.github/actions/fetch-artifact
         with:
           name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"
 
       - name: Retrieve Embedding SDK dist artifact
         uses: actions/download-artifact@v4
@@ -265,22 +264,20 @@ jobs:
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
 
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
 
-      - name: Prepare JDK 21
-        uses: actions/setup-java@v4
-        with:
-          java-version: 21
-          distribution: "temurin"
-
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
       - name: Generate database snapshots
-        run: node e2e/runner/run_cypress_ci.js snapshot
+        run: |
+          node e2e/runner/run_cypress_ci.js snapshot \
+            --spec "e2e/snapshot-creators/default.cy.snap.js"
 
       - name: Prepare and launch Host App
         run: npx tsx ./e2e/runner/embedding-sdk/host-apps/start-ci.ts ${{ matrix.test_suite }}

.github/workflows/embedding-sdk-package-build.yml

@@ -0,0 +1,31 @@
+name: Embedding SDK Package Build
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  group: embedding-sdk-package-${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build-sdk-package:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Build Embedding SDK package
+        run: |
+          # Remove the matchers to not report false positives on every PR
+          # unrelated to embedding (EMB-765)
+          echo "::remove-matcher owner=tsc::"
+          yarn build-embedding-sdk-package
+      - name: Prepare Embedding SDK artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: resources/embedding-sdk

.github/workflows/embedding-sdk.yml

@@ -2,62 +2,39 @@ name: SDK
 
 on:
   workflow_call:
+    inputs:
+      cli-snippets-type-check:
+        description: "Whether to run cli snippets type check."
+        required: true
+        type: boolean
+      docs-snippets-type-check:
+        description: "Whether to run docs snippets type check."
+        required: true
+        type: boolean
+      documentation-validation:
+        description: "Whether to run documentation generation validation check."
+        required: true
+        type: boolean
+      component-tests:
+        description: "Whether to run component tests."
+        required: true
+        type: boolean
+      host-sample-apps-tests:
+        description: "Whether to run host and sample apps compatibility tests."
+        required: true
+        type: boolean
+      skip:
+        description: Whether to skip running tests due to one of the artifacts failing to build.
+        required: true
+        type: boolean
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_embedding_sdk: ${{ steps.changes.outputs.e2e_embedding_sdk }}
-      e2e_embedding_sdk_compatibility: ${{ steps.changes.outputs.e2e_embedding_sdk_compatibility }}
-      frontend_embedding_sdk_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_sources }}
-      embedding_documentation: ${{ steps.changes.outputs.embedding_documentation }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  build-sdk-package:
-    needs: [files-changed]
-    if: |
-      !cancelled() &&
-      (needs.files-changed.outputs.e2e_embedding_sdk == 'true' ||
-      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' ||
-      needs.files-changed.outputs.embedding_documentation == 'true')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - name: Build Embedding SDK package
-        run: |
-          # Remove the matchers to not report false positives on every PR
-          # unrelated to embedding (EMB-765)
-          echo "::remove-matcher owner=tsc::"
-          yarn build-embedding-sdk-package
-      - name: Prepare Embedding SDK artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
-          path: resources/embedding-sdk
-
   embedding-sdk-cli-snippets-type-check:
-    needs: [files-changed, build-sdk-package]
-    if: |
-      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' &&
-      needs.build-sdk-package.result == 'success'
+    if: inputs.cli-snippets-type-check && !inputs.skip
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -73,10 +50,7 @@ jobs:
         run: yarn run embedding-sdk:cli-snippets:type-check
 
   embedding-sdk-docs-snippets-type-check:
-    needs: [files-changed, build-sdk-package]
-    if: |
-      needs.files-changed.outputs.embedding_documentation == 'true' &&
-      needs.build-sdk-package.result == 'success'
+    if: inputs.docs-snippets-type-check && !inputs.skip
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -92,10 +66,7 @@ jobs:
         run: yarn run embedding-sdk:docs-snippets:type-check
 
   embedding-sdk-api-documentation-generation-validation:
-    needs: [files-changed, build-sdk-package]
-    if: |
-      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' &&
-      needs.build-sdk-package.result == 'success'
+    if: inputs.documentation-validation && !inputs.skip
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -143,21 +114,15 @@ jobs:
   # See `Component e2e tests` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
   embedding-sdk-component-tests:
     name: "SDK component tests"
-    needs: [build-sdk-package, files-changed]
-    if: needs.files-changed.outputs.e2e_embedding_sdk == 'true'
+    if: inputs.component-tests && !inputs.skip
     uses: ./.github/workflows/embedding-sdk-component-tests.yml
     secrets: inherit
-    with:
-      cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
 
   not-required-embedding-sdk-apps-compatibility-tests:
     name: "SDK e2e tests for compatibility with (host/sample) apps"
-    needs: [build-sdk-package, files-changed]
-    if: needs.files-changed.outputs.e2e_embedding_sdk_compatibility == 'true'
-    uses: ./.github/workflows/embedding-sdk-e2e-tests.yml
+    if: inputs.host-sample-apps-tests && !inputs.skip
+    uses: ./.github/workflows/embedding-sdk-host-sample-apps-tests.yml
     secrets: inherit
-    with:
-      cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
 
   embedding-sdk-tests-result:
     needs:

.github/workflows/fuzzing.yml

@@ -1,56 +0,0 @@
-name: Fuzzing
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-    paths:
-      - "frontend/src/metabase/querying/expressions/**"
-  pull_request:
-    paths:
-      - "frontend/src/metabase/querying/expressions/**"
-
-jobs:
-  fe-fuzz-lexifier:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/pratt/fuzz.lexifier.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the lexifier
-
-  fe-fuzz-compiler:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.compiler.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the custom expression compiler
-
-  fe-fuzz-string-quoting:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.string.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the custom expression string quoter

.github/workflows/generative-query-test.yml

@@ -16,7 +16,7 @@ on:
         description: 'Seconds (Number of seconds after which next iteration will not start)'
       test:
         description: 'Test or namespace to run'
-        default: metabase.query-processor-test.generative-test/execution-with-cards-test
+        default: metabase.query-processor.generative-test/execution-with-cards-test
       ref:
         description: 'Ref to run generative tests on'
         default: qgen-ms2

.github/workflows/llms-txt-generate.yml

@@ -0,0 +1,198 @@
+name: Generate llms.txt file
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.57.0)'
+        type: string
+        required: true
+      branch:
+        description: 'Target branch (e.g. release-x.57.x)'
+        type: string
+        required: true
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.57.0)'
+        type: string
+        required: true
+      branch:
+        description: 'Target branch (e.g. release-x.57.x)'
+        type: string
+        required: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  check-version:
+    name: Check if minor or major release
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      should_generate: ${{ steps.check.outputs.should_generate }}
+      target_branch: ${{ steps.check.outputs.target_branch }}
+      version: ${{ steps.check.outputs.version }}
+    steps:
+      - name: Check version
+        id: check
+        run: |
+          VERSION="${{ inputs.version }}"
+          BRANCH="${{ inputs.branch }}"
+
+          # Extract version number (e.g., v0.57.0 -> 0.57.0)
+          VERSION_NUM="${VERSION#v}"
+
+          # Count dots to determine version type
+          # Metabase format: v0.MAJOR.MINOR (3 segments) or v0.MAJOR.MINOR.PATCH (4 segments)
+          DOT_COUNT=$(echo "$VERSION_NUM" | tr -cd '.' | wc -c | tr -d ' ')
+
+          # Only proceed if this is a minor or major release (3 segments)
+          # Examples of minor/major releases: v0.57.8, v0.59.0
+          # Skip for patch releases (4 segments): v0.57.8.1
+          # Note: This is a safety check even though the workflow should only be called
+          # for minor/major releases, just in case the workflow is dispatched manually.
+          if [ "$DOT_COUNT" -eq 3 ]; then
+            echo "⏭️  This is a patch release ($VERSION). Skipping llms.txt generation."
+            echo "should_generate=false" >> $GITHUB_OUTPUT
+          else
+            echo "✅ This is a minor or major release ($VERSION). Proceeding with llms.txt generation for branch: $BRANCH"
+            echo "should_generate=true" >> $GITHUB_OUTPUT
+          fi
+
+          echo "target_branch=$BRANCH" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+  generate-llms-txt:
+    name: Generate llms.txt
+    needs: check-version
+    if: needs.check-version.outputs.should_generate == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    steps:
+
+      - name: Get the generate-llms-txt.js node script via sparse checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          ref: ${{ github.ref }}
+          sparse-checkout: |
+            .github/scripts
+          path: workflow-scripts
+
+      - name: Checkout target branch for docs
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          ref: ${{ needs.check-version.outputs.target_branch }}
+          path: metabase
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Generate llms.txt
+        id: generate
+        run: |
+          node workflow-scripts/.github/scripts/generate-llms-txt.js metabase/docs ${{ needs.check-version.outputs.target_branch }}
+
+      - name: Sanity check generated files
+        run: |
+          if [ ! -f "llms.txt" ]; then
+            echo "❌ Error: llms.txt was not generated"
+            exit 1
+          fi
+
+          if [ ! -f "llms-embedding-full.txt" ]; then
+            echo "❌ Error: llms-embedding-full.txt was not generated"
+            exit 1
+          fi
+
+          # Check that llms.txt contains URLs with the expected GitHub raw URL prefix
+          URL_COUNT=$(grep -o "https://raw.githubusercontent.com/metabase/metabase/refs/heads/${{ needs.check-version.outputs.target_branch }}/docs" llms.txt | wc -l)
+          if [ "$URL_COUNT" -lt 10 ]; then
+            echo "❌ Error: llms.txt appears to be malformed. Found only $URL_COUNT URLs (expected at least 10)"
+            exit 1
+          fi
+
+          echo "✅ Both llms.txt and llms-embedding-full.txt were generated successfully"
+          echo "✅ llms.txt contains $URL_COUNT documentation URLs"
+
+      - name: Set up git configuration
+        working-directory: metabase
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          BRANCH_NAME="llms-txt/auto-update-${{ needs.check-version.outputs.target_branch }}-$(date +%Y%m%d-%H%M%S)"
+          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
+          echo "Branch name will be: $BRANCH_NAME"
+
+      - name: Copy generated files to metabase repo
+        run: |
+          cp llms.txt metabase/
+          cp llms-embedding-full.txt metabase/
+
+      - name: Create Pull Request
+        id: create_pr
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          path: metabase
+          branch: ${{ env.BRANCH_NAME }}
+          base: ${{ needs.check-version.outputs.target_branch }}
+          commit-message: |
+            Update llms.txt and llms-full.txt (${{ needs.check-version.outputs.target_branch }})
+
+            Regenerated llms.txt to include all markdown files from the docs/ directory.
+            Also generated llms-full.txt files for the embedding section.
+
+            🤖 Generated automatically by llms-txt-generate workflow
+
+            Co-Authored-By: GitHub Actions <actions@github.com>
+          committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
+          author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
+          title: "[chore] Update llms.txt for ${{ needs.check-version.outputs.target_branch }}"
+          body: |
+            ## Summary
+            This PR contains automatically generated updates to `llms.txt` and `llms-embedding-full.txt` files, triggered by a minor or major release.
+
+            ## Changes
+            - The `llms.txt` file has been regenerated to include all markdown files from the `docs/` directory.
+            - The `llms-embedding-full.txt` file has been generated for the embedding section (concatenated documentation for RAG).
+
+            ## Generation
+            These files were generated using:
+            - Script: `.github/scripts/generate-llms-txt.js`
+            - Branch: `${{ needs.check-version.outputs.target_branch }}`
+            - Base URL: `https://raw.githubusercontent.com/metabase/metabase/refs/heads/${{ needs.check-version.outputs.target_branch }}`
+
+            Please review the changes and merge if they look correct.
+
+            🤖 Generated automatically by the `llms-txt-generate` workflow.
+
+            Co-Authored-By: GitHub Actions <actions@github.com>
+          labels: |
+            Type:Documentation
+            no-backport
+          add-paths: |
+            llms.txt
+            llms-embedding-full.txt
+
+      - name: Auto approve PR
+        if: steps.create_pr.outputs.pull-request-number != ''
+        working-directory: metabase
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr review "${{ steps.create_pr.outputs.pull-request-number }}" --approve --body "Auto-approved by llms-txt-generate workflow"
+
+      - name: Auto merge PR
+        if: steps.create_pr.outputs.pull-request-number != ''
+        working-directory: metabase
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: |
+          gh pr merge "${{ steps.create_pr.outputs.pull-request-number }}" --auto --squash

.github/workflows/loki-stress-test-flake-fix.yml

@@ -0,0 +1,114 @@
+name: Loki Visual Stress Test Flake Fix
+
+on:
+  workflow_dispatch:
+    inputs:
+      stories_filter:
+        description: "Regex pattern to filter stories (e.g. 'DataGrid' or 'static-viz|viz')"
+        type: string
+        required: true
+      burn_in:
+        description: "Number of times to run the test (e.g. 50)"
+        type: string
+        required: true
+        default: "50"
+
+jobs:
+  workflow-summary:
+    name: Stress test inputs
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - name: Generate workflow summary
+        run: |
+          echo '**Inputs:**' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `stories_filter`: ${{ inputs.stories_filter }}' >> $GITHUB_STEP_SUMMARY
+          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
+
+  stress-test-loki:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    name: Stress test Loki visual tests
+    services:
+      docker:
+        image: docker:19.03.12
+        options: --privileged
+        ports:
+          - 2376:2376
+        env:
+          DOCKER_TLS_CERTDIR: /certs
+        volumes:
+          - /var/run/docker.sock:/var/run/docker.sock
+          - /tmp/docker-certs:/certs/client
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Prepare frontend environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+
+      - name: Compile CLJS
+        run: NODE_ENV=development yarn build-pure:cljs
+
+      - name: Build Storybook (once)
+        run: yarn build-storybook
+
+      - name: Stress-test Loki "${{ inputs.stories_filter }}" ${{ inputs.burn_in }} times
+        run: |
+          BURN_IN=${{ inputs.burn_in }}
+          STORIES_FILTER='${{ inputs.stories_filter }}'
+
+          echo "Running Loki visual tests $BURN_IN times for stories matching: $STORIES_FILTER"
+          echo ""
+
+          FAILED=0
+          for i in $(seq 1 $BURN_IN); do
+            echo "=========================================="
+            echo "Run $i of $BURN_IN"
+            echo "=========================================="
+
+            if yarn test-visual:loki \
+              --reactUri file:./storybook-static \
+              --verboseRenderer \
+              --storiesFilter "$STORIES_FILTER"; then
+              echo "✅ Run $i passed"
+            else
+              echo "❌ Run $i FAILED"
+              FAILED=$((FAILED + 1))
+
+              mkdir -p .loki/failures/run-$i
+              cp -r .loki/difference/* .loki/failures/run-$i/ 2>/dev/null || true
+            fi
+            echo ""
+          done
+
+          echo "=========================================="
+          echo "Summary: $((BURN_IN - FAILED))/$BURN_IN passed, $FAILED failed"
+          echo "=========================================="
+
+          if [ $FAILED -gt 0 ]; then
+            echo "::error::$FAILED out of $BURN_IN runs failed"
+            exit 1
+          fi
+
+      - name: Generate Visual Report on Failure
+        if: failure()
+        run: yarn test-visual:loki-report
+
+      - name: Upload Artifact
+        id: artifact-upload-step
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: loki-stress-test-report
+          include-hidden-files: true
+          path: .loki/
+          if-no-files-found: ignore

.github/workflows/mage.yml

@@ -2,7 +2,9 @@ name: Mage Tests
 
 on:
   pull_request:
-    paths: ["mage/**"]
+    paths:
+      - "mage/**"
+      - "bb.edn"
 
 jobs:
   # run mage tests even if the rest of be isnt needed
@@ -13,13 +15,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-      - name: Setup Babashka
-        uses: turtlequeue/setup-babashka@v1.7.0
-        with:
-          babashka-version: 1.12.197
-      - name: Check bb runs
-        run: bb --version
-      - name: bb task list
-        run: bb tasks
+      - name: Check mage runs
+        run: ./bin/mage -h
       - name: Run mage tests
-        run: bb ./mage/test/mage/runtests.clj
+        run: ./bin/mage -test

.github/workflows/openapi-check.yml

@@ -0,0 +1,44 @@
+name: OpenAPI Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  check-openapi-specs:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: contains(github.event.pull_request.labels.*.name, 'openapi-self-healing')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # we're intentionally using METABASE_AUTOMATION_USER_TOKEN to trigger the whole CI pipeline again
+          #  after the self-healing commit is created
+          #  if we used GITHUB_TOKEN, the self-healing commit would not trigger the CI pipeline again
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          # fetch full git history to allow fetching the latest base branch commit and comparing changes
+          fetch-depth: 0
+      - name: Setup Node.js 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Generate version.properties
+        run: ./bin/build.sh :steps [:version]
+      - name: Get latest base branch commit
+        run: |
+          git fetch origin ${{ github.event.pull_request.base.ref }}
+          echo "LATEST_BASE_SHA=$(git rev-parse origin/${{ github.event.pull_request.base.ref }})" >> $GITHUB_ENV
+      - name: Check OpenAPI specs are up to date
+        env:
+          AUTO_COMMIT: "true"
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
+          BASE_SHA: ${{ env.LATEST_BASE_SHA }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: ./bin/openapi-check.sh

.github/workflows/pr-env-close-unlabel.yml

@@ -10,7 +10,7 @@ concurrency:
 
 jobs:
   pr-env:
-    if: ${{ (github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'PR-Env') && !contains(github.event.pull_request.labels.*.name, 'PR-Env-self-hosting')) || github.event.label.name == 'PR-Env' }}
+    if: ${{ (github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'PR-Env') && !contains(github.event.pull_request.labels.*.name, 'PR-Env-self-hosting') && !contains(github.event.pull_request.labels.*.name, 'PR-Env-analytics-dev')) || github.event.label.name == 'PR-Env' }}
     uses: ./.github/workflows/pr-env-destroy.yml
     secrets: inherit
     with:
@@ -22,3 +22,10 @@ jobs:
     secrets: inherit
     with:
       self_hosting: true
+
+  pr-env-analytics-dev:
+    if: ${{ (github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'PR-Env-analytics-dev')) || github.event.label.name == 'PR-Env-analytics-dev' }}
+    uses: ./.github/workflows/pr-env-destroy.yml
+    secrets: inherit
+    with:
+      self_hosting: false

.github/workflows/pr-env-labeled.yml

@@ -10,7 +10,7 @@ concurrency:
 
 jobs:
   uberjar:
-    if: ${{ github.event.label.name == 'PR-Env' || github.event.label.name == 'PR-Env-self-hosting' }}
+    if: ${{ github.event.label.name == 'PR-Env' || github.event.label.name == 'PR-Env-self-hosting' || github.event.label.name == 'PR-Env-analytics-dev' }}
     uses: ./.github/workflows/uberjar.yml
     secrets: inherit
 
@@ -21,6 +21,7 @@ jobs:
     secrets: inherit
     with:
       self_hosting: false
+      analytics_dev_mode: false
 
   pr-env-self-hosting:
     needs: [uberjar]
@@ -29,3 +30,13 @@ jobs:
     secrets: inherit
     with:
       self_hosting: true
+      analytics_dev_mode: false
+
+  pr-env-analytics-dev:
+    needs: [uberjar]
+    if: ${{ github.event.label.name == 'PR-Env-analytics-dev' }}
+    uses: ./.github/workflows/pr-env.yml
+    secrets: inherit
+    with:
+      self_hosting: false
+      analytics_dev_mode: true

.github/workflows/pr-env.yml

@@ -9,6 +9,11 @@ on:
         required: false
         type: boolean
         default: false
+      analytics_dev_mode:
+        description: 'Enable analytics development mode'
+        required: false
+        type: boolean
+        default: false
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -132,6 +137,7 @@ jobs:
           PR_NUMBER: ${{ github.event.number }}
           MB_PREMIUM_EMBEDDING_TOKEN: ${{ secrets.PR_ENV_MB_PREMIUM_EMBEDDING_TOKEN }}
           SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          MB_ANALYTICS_DEV_MODE: ${{ inputs.analytics_dev_mode && 'true' || 'false' }}
       - name: Deploy PR Review ENV
         if: ${{ !inputs.self_hosting }}
         run: |
@@ -157,6 +163,7 @@ jobs:
           DB_USERNAME: ${{ secrets.PR_ENV_DB_USER }}
           DB_PASSWORD: ${{ secrets.PR_ENV_DB_PASSWORD }}
           CONFIG: ${{ secrets.PR_ENV_CONFIG }}
+          MB_ANALYTICS_DEV_MODE: ${{ inputs.analytics_dev_mode && 'true' || 'false' }}
 
       - name: Setup Helm
         if: ${{ inputs.self_hosting }}
@@ -191,4 +198,4 @@ jobs:
             ✅ Preview:
                 https://pr${{ github.event.number }}.coredev.metabase.com
             🗒️ [login instructions](https://www.notion.so/metabase/Ephemeral-PR-Environments-c74a3710c87a460dbf4fc0007a001458)
-            📦 Deployment type: ${{ inputs.self_hosting && 'PR-Env-self-hosting' || 'PR-Env' }}
+            📦 Deployment type: ${{ inputs.self_hosting && 'PR-Env-self-hosting' || (inputs.analytics_dev_mode && 'PR-Env-analytics-dev' || 'PR-Env') }}

.github/workflows/pre-release.yml

@@ -166,11 +166,8 @@ jobs:
           snowplow: true
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-      - name: Prepare JDK 21
-        uses: actions/setup-java@v4
-        with:
-          java-version: 21
-          distribution: "temurin"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
@@ -189,8 +186,14 @@ jobs:
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
+      # For now we only need the default snapshots for pre-release checks.
+      # If we decide to include tests that rely on the external QA databases, we should:
+      #   1. remove the --spec ... line
+      #   2. add postgres, mysql, and mongo to the prepare-containers step
       - name: Make app db snapshot
-        run: node e2e/runner/run_cypress_ci.js snapshot
+        run: |
+          node e2e/runner/run_cypress_ci.js snapshot \
+            --spec "e2e/snapshot-creators/default.cy.snap.js"
 
       - name: Run a few important OSS Cypress tests as sanity check
         if: ${{ matrix.edition == 'oss' }}

.github/workflows/querying-team-pagerduty.yml

@@ -0,0 +1,44 @@
+name: Querying On-call PagerDuty Alert
+
+on:
+  issues:
+    types:
+      - labeled
+
+jobs:
+  notify-querying-on-call:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: |
+      (github.event.label.name == 'Priority:P0' || github.event.label.name == 'Priority:P1' || github.event.label.name == '.Escalation') &&
+      contains(github.event.issue.labels.*.name, '.Team/Querying')
+    steps:
+      - name: Setting title
+        uses: actions/github-script@v7
+        id: vars
+        with:
+          script: |
+            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
+      - name: Trigger PagerDuty Incident
+        run: |
+          curl -X POST https://events.pagerduty.com/v2/enqueue \
+            -H 'Content-Type: application/json' \
+            -d '{
+              "routing_key": "${{ secrets.QUERYING_PAGERDUTY_INTEGRATION_KEY }}",
+              "event_action": "trigger",
+              "dedup_key": "github-issue-${{ github.event.issue.number }}",
+              "payload": {
+                "summary": "[${{ github.event.label.name }}] ${{ steps.vars.outputs.issue_title }}",
+                "source": "GitHub Issues - ${{ github.repository }}",
+                "severity": "critical",
+                "custom_details": {
+                  "Labels": "${{ join(github.event.issue.labels.*.name, ', ') }}"
+                }
+              },
+              "links": [
+                {
+                  "href": "${{ github.event.issue.html_url }}",
+                  "text": "View GitHub Issue"
+                }
+              ]
+            }'

.github/workflows/release-embedding-sdk.yml

@@ -383,28 +383,16 @@ jobs:
         run: |
           echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
 
-          TAG=$(jq -r --null-input \
-            --arg branch "${{ inputs.branch }}" \
-            --arg masterTag "${{ steps.compute-tag.outputs.masterTag }}" '
-            {
-              "master": $masterTag,
-              "release-x.51.x": "51-stable",
-              "release-x.52.x": "52-stable",
-              "release-x.53.x": "53-stable",
-              "release-x.54.x": "54-stable",
-              "release-x.55.x": "55-stable",
-              "release-x.56.x": "56-stable"
-            }[$branch]'
-          )
-
+          TAG="${{ steps.compute-tag.outputs.masterTag }}"
           echo "Resolved npm tag: $TAG"
           npm publish --tag "$TAG"
 
-      - name: Add `latest` tag to the latest release branch (`release-x.55.x`) deployment
-        if: ${{ inputs.branch == 'release-x.56.x' }}
-        working-directory: sdk
-        run: |
-          npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest
+      # ⚠️ This step should only be executed on the latest stable (gold) release branch.
+      # Only uncomment this when the new release branch becomes stable (gold).
+      # - name: Add `latest` tag to the latest release branch (`release-x.55.x`) deployment
+      #   working-directory: sdk
+      #   run: |
+      #     npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest
 
   git-tag:
     needs: [publish-npm, determine-sdk-version]

.github/workflows/release.yml

@@ -326,10 +326,11 @@ jobs:
             const { getExtraTagsForVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
 
             const version = '${{ inputs.version }}';
+            const latestMajorVersion = '${{ vars.LATEST_MAJOR_VERSION }}';
 
-            const extra_tags = getExtraTagsForVersion({ version });
+            const extra_tags = getExtraTagsForVersion({ version, latestMajorVersion });
 
-            console.log({ extra_tags });
+            console.log({ extra_tags, latestMajorVersion });
             core.setOutput('extra_tags', JSON.stringify(extra_tags));
 
   add-extra-tags:
@@ -347,9 +348,11 @@ jobs:
     with:
       version: ${{ inputs.version }}
       tag_name: ${{ matrix.tag }}
-      tag_ee: ${{ contains(matrix.tag, 'v1') }}
-      tag_oss: ${{ contains(matrix.tag, 'v0') }}
-      dot-x-tag: true
+      # For version tags (v0.x, v1.x), apply to matching edition only
+      # For non-version tags like "latest", apply to both editions
+      tag_ee: ${{ contains(matrix.tag, 'v1') || !startsWith(matrix.tag, 'v') }}
+      tag_oss: ${{ contains(matrix.tag, 'v0') || !startsWith(matrix.tag, 'v') }}
+      dot-x-tag: ${{ startsWith(matrix.tag, 'v') }}
 
   trigger-cloud-issues:
     if: ${{ !inputs.auto }}
@@ -424,6 +427,19 @@ jobs:
               }
             });
 
+  # updates the llms.txt asynchronously.
+  # release does not need to wait for this PR to be merged,
+  # because the llms.txt is in the main git repo.
+  trigger-update-llms-txt:
+    # do not trigger llms.txt update on automatic patch releases
+    if: ${{ !inputs.auto }}
+    needs: add-extra-tags
+    uses: ./.github/workflows/llms-txt-generate.yml
+    secrets: inherit
+    with:
+      version: ${{ inputs.version }}
+      branch: ${{ github.ref_name }}
+
   draft-release-notes:
     if: ${{ !inputs.auto }}
     needs: add-extra-tags

.github/workflows/run-tests.yml

@@ -25,6 +25,10 @@ jobs:
       frontend_all: ${{ steps.changes.outputs.frontend_all }}
       frontend_sources: ${{ steps.changes.outputs.frontend_sources }}
       documentation: ${{ steps.changes.outputs.documentation }}
+      embedding_documentation: ${{ steps.changes.outputs.embedding_documentation }}
+      embedding_sdk_components: ${{ steps.changes.outputs.embedding_sdk_components }}
+      embedding_sdk_host_sample_apps: ${{ steps.changes.outputs.embedding_sdk_host_sample_apps }}
+      embedding_sdk_ci: ${{ steps.changes.outputs.embedding_sdk_ci }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
@@ -92,21 +96,42 @@ jobs:
       # list of changed specs files, then only specs are changed and we can run only those specs
       specs: ${{ needs.files-changed.outputs.e2e_all_files == needs.files-changed.outputs.e2e_specs_files && needs.files-changed.outputs.e2e_specs_files || '' }}
 
+  embedding-sdk-package:
+    needs: [files-changed]
+    if: |
+      !cancelled() &&
+      (needs.files-changed.outputs.embedding_sdk_components == 'true' ||
+      needs.files-changed.outputs.frontend_sources == 'true' ||
+      needs.files-changed.outputs.embedding_documentation == 'true' ||
+      needs.files-changed.outputs.embedding_sdk_ci == 'true')
+    uses: ./.github/workflows/embedding-sdk-package-build.yml
+    secrets: inherit
+
   sdk-tests:
-    needs: [uberjar]
+    needs: [uberjar, embedding-sdk-package, files-changed]
+    if: always()
     uses: ./.github/workflows/embedding-sdk.yml
     secrets: inherit
+    with:
+      cli-snippets-type-check: ${{ needs.files-changed.outputs.frontend_sources == 'true' }}
+      docs-snippets-type-check: ${{ needs.files-changed.outputs.embedding_documentation == 'true' }}
+      documentation-validation: ${{ needs.files-changed.outputs.frontend_sources == 'true' }}
+      component-tests: ${{ needs.files-changed.outputs.embedding_sdk_components == 'true' }}
+      host-sample-apps-tests: ${{ needs.files-changed.outputs.embedding_sdk_host_sample_apps == 'true' }}
+      skip: ${{ needs.embedding-sdk-package.result != 'success' || needs.uberjar.result != 'success' }}
 
   pr-env:
     needs: [uberjar]
     if: |
       !cancelled() &&
       contains(github.event.pull_request.labels.*.name, 'PR-Env') &&
-      !contains(github.event.pull_request.labels.*.name, 'PR-Env-self-hosting')
+      !contains(github.event.pull_request.labels.*.name, 'PR-Env-self-hosting') &&
+      !contains(github.event.pull_request.labels.*.name, 'PR-Env-analytics-dev')
     uses: ./.github/workflows/pr-env.yml
     secrets: inherit
     with:
       self_hosting: false
+      analytics_dev_mode: false
 
   pr-env-self-hosting:
     needs: [uberjar]
@@ -117,6 +142,18 @@ jobs:
     secrets: inherit
     with:
       self_hosting: true
+      analytics_dev_mode: false
+
+  pr-env-analytics-dev:
+    needs: [uberjar]
+    if: |
+      !cancelled() &&
+      contains(github.event.pull_request.labels.*.name, 'PR-Env-analytics-dev')
+    uses: ./.github/workflows/pr-env.yml
+    secrets: inherit
+    with:
+      self_hosting: false
+      analytics_dev_mode: true
 
   containerize:
     needs: [uberjar]

.github/workflows/semantic-search.yml

@@ -27,7 +27,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '"enterprise/backend/test/metabase_enterprise/semantic_search"'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -85,7 +85,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '"enterprise/backend/test/metabase_enterprise/semantic_search"'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -157,7 +157,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '"enterprise/backend/test/metabase_enterprise/semantic_search"'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -229,7 +229,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '"enterprise/backend/test/metabase_enterprise/semantic_search"'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:

.github/workflows/snyk.yml

@@ -3,15 +3,15 @@ name: "Snyk"
 on:
   push:
     branches:
-      - 'master'
-      - 'release-**'
+      - "master"
+      - "release-**"
     paths:
-      - '**/deps.edn'
-      - '**/package.json'
-      - '.github/workflows/snyk.yml'
-      - '.github/scripts/write-poms.sh'
+      - "**/deps.edn"
+      - "**/package.json"
+      - ".github/workflows/snyk.yml"
+      - ".github/scripts/write-poms.sh"
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
 
 jobs:
   # Generate pom.xml files for all Maven projects
@@ -45,26 +45,6 @@ jobs:
             file: yarn.lock
             package-manager: yarn
             category: main-frontend-yarn
-          - name: Embedding SDK Template
-            file: bin/embedding-sdk/templates/yarn.lock
-            package-manager: yarn
-            category: embedding-sdk-template
-          - name: E2E Angular 20 Host App
-            file: e2e/embedding-sdk-host-apps/angular-20-host-app/package-lock.json
-            package-manager: npm
-            category: e2e-angular-host
-          - name: E2E Next 15 App Router
-            file: e2e/embedding-sdk-host-apps/next-15-app-router-host-app/package-lock.json
-            package-manager: npm
-            category: e2e-next-app-router
-          - name: E2E Next 15 Pages Router
-            file: e2e/embedding-sdk-host-apps/next-15-pages-router-host-app/package-lock.json
-            package-manager: npm
-            category: e2e-next-pages-router
-          - name: E2E Vite 6 Host App
-            file: e2e/embedding-sdk-host-apps/vite-6-host-app/package-lock.json
-            package-manager: npm
-            category: e2e-vite-host
           - name: Release Helper
             file: release/yarn.lock
             package-manager: yarn

.github/workflows/translation-update.yml

@@ -15,8 +15,8 @@ jobs:
       BRANCH_NAME: update-translations-${{ github.run_id }}
       CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
       CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
-      GITHUB_TOKEN: ${{ github.token }}
-      GH_TOKEN: ${{ github.token }}
+      GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+      GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -107,7 +107,7 @@ jobs:
       - name: Auto approve PR
         uses: juliangruber/approve-pull-request-action@v1
         with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          github-token: ${{ github.token }}
           number: ${{ steps.create_pr.outputs.pr_number }}
 
       - name: Enable Pull Request Automerge

.github/workflows/uberjar.yml

@@ -146,7 +146,13 @@ jobs:
     runs-on: ubuntu-22.04
     name: Is ${{ matrix.edition }} (java ${{ matrix.java-version }}) healthy?
     needs: [build, check-existing-artifacts]
-    if: always() && !cancelled() && (needs.build.result == 'success' || (needs.check-existing-artifacts.outputs.should_build == 'false' && needs.check-existing-artifacts.outputs.ee_exists == 'true' && needs.check-existing-artifacts.outputs.oss_exists == 'true'))
+    # We only care about the explicit JAR health check on push to `master` and the `release-` branches.
+    # JARs created in random branches on PRs are 99% of the time treated as ephemeral, and used only in e2e tests.
+    # E2E tests already have a step where they wait for the instance health check.
+    if: |
+      always() && !cancelled() &&
+      (github.ref_name == 'master' || startsWith(github.ref_name, 'release-')) &&
+      (needs.build.result == 'success' || (needs.check-existing-artifacts.outputs.should_build == 'false' && needs.check-existing-artifacts.outputs.ee_exists == 'true' && needs.check-existing-artifacts.outputs.oss_exists == 'true'))
     timeout-minutes: 10
     strategy:
       matrix:

.github/workflows/update-e2e-timings.yml

@@ -23,9 +23,16 @@ jobs:
     env:
       DAYS_BACK: ${{ inputs.days_back || 7 }}
     steps:
+      - name: Generate GitHub App Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
+          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@v4
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -41,7 +48,7 @@ jobs:
             const result = await collectAndAverageTimings({
               github,
               context,
-              token: '${{ secrets.GITHUB_TOKEN }}',
+              token: '${{ steps.app-token.outputs.token }}',
               daysBack: ${{ env.DAYS_BACK }},
               existingTimingsPath: 'e2e/support/timings.json'
             });
@@ -59,7 +66,7 @@ jobs:
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v6
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           branch: ${{ env.BRANCH_NAME }}
           base: master
           commit-message: |
@@ -89,4 +96,7 @@ jobs:
             Co-Authored-By: GitHub Actions <actions@github.com>
           labels: |
             .CI & Tests
+            no-backport
           add-paths: e2e/support/timings.json
+          team-reviewers: |
+            devexp

.github/workflows/whitespace.yml

@@ -16,5 +16,5 @@ jobs:
     - uses: actions/checkout@v4
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
-    - run: clojure -T:whitespace-linter lint
+    - run: clojure -T:whitespace-linter lint :whitespace-linter/progress-bar false
       name: Run Whitespace Linter

.gitignore

@@ -21,7 +21,8 @@
 /*.mv.db
 /*.trace.db
 /.babel_cache
-/.env
+/.env*
+!/.env.example
 /.envrc
 /.lein-env
 /.lein-failures
@@ -104,6 +105,7 @@ dev/serialization_deltas/
 *.tsbuildinfo
 /trace-output/
 /temp-types/
+/frontend/src/metabase-types/openapi
 
 **/cypress_sample_database.json
 **/cypress_sample_instance_data.json
@@ -111,6 +113,7 @@ dev/serialization_deltas/
 /frontend/src/cljs_release
 .shadow-cljs
 .clerk
+mise.local.toml
 
 # lsp: ignore all but the config file
 .lsp/*
@@ -163,3 +166,4 @@ CLAUDE.local.md
 
 /logs
 /.clojure-mcp
+

.husky/pre-commit

@@ -1,6 +1,3 @@
-#!/bin/sh
-. "$(dirname "$0")/_/husky.sh"
-
 yarn precommit
 
 # Run the formatter
@@ -9,4 +6,4 @@ yarn precommit
 # ATM, you can manually run ./bin/cljfmt_staged.sh if you want to format locally staged files and inspect after.
 # ./bin/cljfmt_staged.sh
 
-./hooks/pre-commit.nocommit
+./hooks/pre-commit.nocommit