only include tables you can use for native query builder

Merge remote-tracking branch 'origin/feature/reports' into document-sql
fix pivot query editing in documents
2025-08-12 23:09:01 -05:00 · 2025-08-12 19:48:05 -05:00 · 2025-08-12 20:56:35 -03:00 · 2025-08-13 02:48:09 +03:00 · 2025-08-12 16:06:07 -05:00 · 2025-08-12 17:02:25 -04:00
6832 changed files with 421153 additions and 698186 deletions
--- a/.clj-kondo/config.edn
+++ b/.clj-kondo/config.edn
@@ -1,7 +1,7 @@
 ;; -*- comment-column: 100; -*-
 {:config-paths ["macros" "src" "config"]
 :linters
- { ;;
+ {;;
  ;; enabled optional linters (these are disabled by default)
  ;;

@@ -25,7 +25,6 @@
  :reduce-without-init          {:level :warning}
  :redundant-call               {:level :warning}
  :redundant-fn-wrapper         {:level :warning}
-  :redundant-str-call           {:level :warning}
  :self-requiring-namespace     {:level :warning}
  :single-key-in                {:level :warning}
  :unsorted-imports             {:level :warning}
@@ -50,28 +49,26 @@
  ;; disabled linters
  ;;

-  :redundant-ignore {:level :off}    ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
+  :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
  :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?

  ;;
  ;; globally-enabled custom linters
  ;;
-  :metabase/check-defmulti-arglists                          {:level :warning}
-  :metabase/check-me-humanize                                {:level :warning}
-  :metabase/defsetting-must-specify-export                   {:level :warning}
-  :metabase/defsetting-namespace                             {:level :warning}
-  :metabase/discourage-millis-duration                       {:level :warning}
-  :metabase/mbql-query-first-arg                             {:level :warning}
-  :metabase/missing-test-expr-requires-in-cljs               {:level :warning}
-  :metabase/modules                                          {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
-  :metabase/namespace-name                                   {:level :warning}
-  :metabase/require-shape-checker                            {:level :warning}
-  :metabase/test-helpers-use-non-thread-safe-functions       {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
-  :metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
-  :metabase/validate-defendpoint-query-params-use-kebab-case {:level :warning}
-  :metabase/validate-logging                                 {:level :warning}
-  :metabase/validate-mb-driver-tests                         {:level :warning}
-  :metabase/validate-mb-once                                 {:level :warning}
+  :metabase/check-defmulti-arglists                    {:level :warning}
+  :metabase/check-me-humanize                          {:level :warning}
+  :metabase/defsetting-must-specify-export             {:level :warning}
+  :metabase/defsetting-namespace                       {:level :warning}
+  :metabase/mbql-query-first-arg                       {:level :warning}
+  :metabase/missing-test-expr-requires-in-cljs         {:level :warning}
+  :metabase/modules                                    {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
+  :metabase/namespace-name                             {:level :warning}
+  :metabase/require-shape-checker                      {:level :warning}
+  :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
+  :metabase/validate-logging                           {:level :warning}
+  :metabase/validate-mb-driver-tests                   {:level :warning}
+  :metabase/validate-mb-once                           {:level :warning}
+  :metabase/discourage-millis-duration                 {:level :warning}

  :metabase/validate-deftest
  {:level :warning
@@ -176,7 +173,7 @@
     metabase.driver.sql-jdbc.execute/execute-prepared-statement!
     metabase.notification.models/create-notification!
     metabase.pulse.send/send-pulse!
-     metabase-enterprise.transforms-python.python-runner-test/execute!
+     metabase.query-processor.store/store-database!
     ;; Safe in tests, where we typically use a private, temporary index per thread.
     metabase.search.core/reindex!
     metabase.util/run-count!
@@ -190,7 +187,7 @@
  :metabase/disallow-hardcoded-driver-names-in-tests
  ;; don't include `:h2` since that will probably lead to a mountain of tests where we are specifically testing
  ;; middleware or compilation behavior with just H2 since it's the default.
-  {:drivers #{ ;; core drivers
+  {:drivers #{;; core drivers
              #_:h2
              :postgres
              :mysql
@@ -218,7 +215,7 @@
  ;; misc config for built-in linters
  ;;

-  :invalid-arity       {:skip-args [metabase.lib.util.match/match]}                    ; TODO (cam): can we fix these?
+  :invalid-arity       {:skip-args [metabase.lib.util.match/match]} ; TODO (cam): can we fix these?
  :refer-all           {:level :warning, :exclude [clojure.test]}
  :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}

@@ -232,7 +229,7 @@
    (clojure.core.logic/fresh)
    (clojure.core.logic/matcha)
    (clojure.core.logic/run)
-    (clojure.test/is [=? malli= qv=])
+    (clojure.test/is [query= =? malli= qv=])
    (clojure.tools.macro/macrolet)
    instaparse.core/transform
    (metabase.server.streaming-response/streaming-response)
@@ -253,15 +250,16 @@
    (taoensso.nippy/extend-freeze)
    (taoensso.nippy/extend-thaw)]}

-  ;; TODO (Cam 8/22/25) -- what's the point of marking stuff deprecated if we don't have Kondo enforce it? We should
-  ;; remove all of these and add individual ignores as needed.
  :deprecated-var
  {:exclude
-   {metabase.driver.sql-jdbc.execute.old-impl/set-timezone-sql   {:namespaces ["metabase\\.driver.*"]}
-    metabase.driver.sql-jdbc.execute/set-time-zone-if-supported! {:namespaces ["metabase\\.driver.*"]}
-    metabase.driver/current-db-time                              {:namespaces ["metabase.*"]}
-    metabase.driver/supports?                                    {:namespaces ["metabase.*"]}
-    metabase.query-processor.util/normalize-token                {:namespaces ["metabase.*"]}}}
+   {metabase.cmd.core/dump                                                       {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
+    metabase.cmd.core/load                                                       {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
+    metabase.driver.sql-jdbc.execute.old-impl/set-timezone-sql                   {:namespaces ["metabase\\.driver.*"]}
+    metabase.driver.sql-jdbc.execute/set-time-zone-if-supported!                 {:namespaces ["metabase\\.driver.*"]}
+    metabase.driver/current-db-time                                              {:namespaces ["metabase.*"]}
+    metabase.driver/supports?                                                    {:namespaces ["metabase.*"]}
+    metabase.query-processor.middleware.resolve-joins/maybe-resolve-source-table {:namespaces ["metabase.*"]}
+    metabase.query-processor.util/normalize-token                                {:namespaces ["metabase.*"]}}}

  :discouraged-var
  {clojure.core/print                                 {:message "Use metabase.util.log instead of clojure.core/print"}
@@ -276,7 +274,6 @@
   clojure.java.jdbc/with-db-connection               {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/with-db-connection"}
   clojure.java.jdbc/with-db-metadata                 {:message "Use sql-jdbc.execute/do-with-connection-with-options + .getMetaData instead of jdbc/with-db-metadata"}
   clojure.pprint/pprint                              {:message "Use metabase.util.log instead of clojure.pprint/pprint"}
-   clojure.pprint/print-table                         {:message "Use metabase.util.log instead of printing directly to the console"}
   clojure.string/lower-case                          {:message "Use metabase.util/lower-case-en instead of clojure.string/lower-case"}
   clojure.string/upper-case                          {:message "Use metabase.util/upper-case-en instead of clojure.string/upper-case"}
   compojure.core/context                             {:message "Use metabase.api.util.handlers/route-map-handler instead of compojure.core/context, it is much faster and supports OpenAPI spec generation"}
@@ -295,8 +292,6 @@
   me.flowthing.pp/pprint                             {:message "Use metabase.util.log instead of me.flowthing.pp/pprint"}
   medley.core/random-uuid                            {:message "Use clojure.core/random-uuid instead of medley.core/random-uuid"}
   metabase.driver/database-supports?                 {:message "Use metabase.driver.util/supports? instead of metabase.driver/database-supports?"}
-   metabase.lib.convert/->legacy-MBQL                 {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
-   metabase.lib.core/->legacy-MBQL                    {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
   metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
   next.jdbc/active-tx?                               {:message "Use metabase.app-db.core/in-transaction? to see if we are in a transaction"}
   toucan2.core/debug                                 {:message "Don't commit code using t2/debug"}
@@ -305,7 +300,6 @@
  :discouraged-namespace
  {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
   cheshire.core          {:message "Use metabase.util.json instead of cheshire.core directly."}
-   clj-time.core          {:message "Use java-time.api or metabase.util.date-2 instead of clj-time"}
   clojure.tools.logging  {:message "Use metabase.util.log instead of clojure.tools.logging directly"}
   grouper.core           {:message "Use metabase.util.grouper instead of grouper.core"}
   honeysql.core          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
@@ -414,16 +408,11 @@
  clojure.test.check.clojure-test/defspec                                               clojure.test/deftest
  clojure.test.check.properties/for-all                                                 clojure.core/let
  clojurewerkz.quartzite.jobs/defjob                                                    clojure.core/defn
-  com.climate.claypoole/with-shutdown!                                                  clojure.core/let
  instaparse.core/defparser                                                             clojure.core/def
  metabase-enterprise.action-v2.test-util/with-test-tables!                             clojure.core/let
-  metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
  metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
  metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
-  metabase-enterprise.transforms.api-test/with-transform-tags                           clojure.core/let
-  metabase-enterprise.transforms.api-test/with-worker-runs                              clojure.core/let
-  metabase-enterprise.transforms.test-util/with-transform-cleanup!                      clojure.core/let
-  metabase-enterprise.transforms.execute/with-transform-lifecycle                       clojure.core/let
+  metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
  metabase.actions.test-util/with-actions                                               clojure.core/let
  metabase.api.common/let-404                                                           clojure.core/let
  metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
@@ -492,9 +481,8 @@
  metabase.util.malli/defn-                                                             schema.core/defn
  metabase.util.malli/fn                                                                schema.core/fn
  metabase.util.namespaces/import-fns                                                   potemkin/import-vars
-  metabase.util.performance/doseq                                                       clojure.core/doseq
-  metabase.util.performance/for                                                         clojure.core/for
  metabase.util/with-timer-ms                                                           clojure.core/fn
+  metabase.xrays.domain-entities.malli/defn                                             schema.core/defn
  metabuild-common.core/with-open-jar-file-system                                       clojure.core/let
  metabuild-common.files/with-open-jar-file-system                                      clojure.core/let
  monger.operators/defoperator                                                          clojure.core/def
@@ -524,10 +512,7 @@
   metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
   metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
   metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
-   metabase-enterprise.metabot-v3.tools.dependencies-test/with-dependent-transforms!                                         hooks.common/with-two-bindings
-   metabase-enterprise.semantic-search.db.connection/with-migrate-tx                                                         hooks.common/let-one-with-optional-value
   metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
-   metabase-enterprise.transforms-python.drivers-test/with-test-table                                                        hooks.common/with-two-bindings
   metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
   metabase.api.macros/defendpoint                                                                                           hooks.metabase.api.macros/defendpoint
   metabase.app-db.schema-migrations-test.impl/test-migrations                                                               hooks.metabase.app-db.schema-migrations-test.impl/test-migrations
@@ -553,8 +538,6 @@
   metabase.embedding.api.embed-test/with-temp-card                                                                          hooks.common/let-one-with-optional-value
   metabase.embedding.api.embed-test/with-temp-dashcard                                                                      hooks.common/let-one-with-optional-value
   metabase.legacy-mbql.schema.macros/defclause                                                                              hooks.metabase.legacy-mbql.schemas.macros/defclause
-   metabase.legacy-mbql.schema.macros/defclause*                                                                             hooks.metabase.legacy-mbql.schemas.macros/defclause*
-   metabase.legacy-mbql.schema.macros/one-of                                                                                 hooks.metabase.legacy-mbql.schemas.macros/one-of
   metabase.lib.schema.mbql-clause/define-catn-mbql-clause                                                                   hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
   metabase.lib.schema.mbql-clause/define-mbql-clause                                                                        hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
   metabase.lib.schema.mbql-clause/define-tuple-mbql-clause                                                                  hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
@@ -581,8 +564,8 @@
   metabase.pulse.models.pulse-test/with-pulse-in-collection!                                                                hooks.common/with-four-bindings
   metabase.pulse.test-util/checkins-query-card                                                                              hooks.metabase.test.data/$ids
   metabase.queries.api.card-test/with-card-param-values-fixtures                                                            hooks.common/let-one-with-optional-value
-   metabase.queries.api.card-test/with-temp-native-card                                                                      hooks.common/with-two-bindings
-   metabase.queries.api.card-test/with-temp-native-card-with-params                                                          hooks.common/with-two-bindings
+   metabase.queries.api.card-test/with-temp-native-card!                                                                     hooks.common/with-two-bindings
+   metabase.queries.api.card-test/with-temp-native-card-with-params!                                                         hooks.common/with-two-bindings
   metabase.query-processor-test.expressions-test/calculate-bird-scarcity                                                    hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
   metabase.query-processor-test.filter-test/count-with-filter-clause                                                        hooks.metabase.test.data/$ids
   metabase.query-processor.middleware.cache-test/with-mock-cache!                                                           hooks.common/with-two-bindings
@@ -632,11 +615,10 @@
   metabase.test/with-non-admin-groups-no-root-collection-perms                                                              hooks.common/do*
   metabase.test/with-persistence-enabled!                                                                                   hooks.metabase.model-persistence.test-util/with-persistence-enabled!
   metabase.test/with-prometheus-system!                                                                                     hooks.common/with-two-bindings
-   metabase.test/with-random-premium-token!                                                                                  hooks.common/with-one-binding
   metabase.test/with-temp                                                                                                   hooks.toucan2.tools.with-temp/with-temp
   metabase.test/with-temp-file                                                                                              hooks.metabase.test.util/with-temp-file
   metabase.test/with-temporary-setting-values                                                                               hooks.metabase.test.util/with-temporary-setting-values
-   metabase.users.api-test/with-temp-user-email!                                                                             hooks.common/with-one-binding
+   metabase.users.api-test/with-temp-user-email!                                                                              hooks.common/with-one-binding
   metabase.util.i18n/deferred-trs                                                                                           hooks.metabase.util.i18n/deferred-trs
   metabase.util.i18n/deferred-tru                                                                                           hooks.metabase.util.i18n/deferred-tru
   metabase.util.i18n/trs                                                                                                    hooks.metabase.util.i18n/trs
@@ -661,7 +643,6 @@

  :macroexpand
  {clojurewerkz.quartzite.jobs/build                                                       macros.quartz/build-job
-   clojurewerkz.quartzite.schedule.calendar-interval/build                                 macros.quartz/build-job
   clojurewerkz.quartzite.schedule.cron/schedule                                           macros.quartz/schedule
   clojurewerkz.quartzite.schedule.simple/schedule                                         macros.quartz/simple-schedule
   clojurewerkz.quartzite.triggers/build                                                   macros.quartz/build-trigger
@@ -696,6 +677,7 @@
   metabase.test/with-temporary-raw-setting-values                                         macros.metabase.test.util/with-temporary-raw-setting-values
   metabase.users.models.user-test/with-groups!                                            macros.metabase.users.models.user-test/with-groups!
   metabase.util.namespaces/import-fn                                                      macros.metabase.util.namespaces/import-fn
+   metabase.xrays.domain-entities.malli/define-getters-and-setters                         macros.metabase.xrays.domain-entities.malli/define-getters-and-setters
   metabase.xrays.related-test/with-world                                                  macros.metabase.xrays.related-test/with-world}}

 :config-in-comment
@@ -723,30 +705,18 @@
   :name    metabase-lib}
  {:pattern "^metabase\\.lib\\..*"
   :name    metabase-lib-excluding-legacy-mbql}
-  {:pattern "^metabase\\.legacy-mbql\\..*"
-   :name    legacy-mbql-namespaces}
  ;;
-  ;; QP and driver source namespaces: `metabase.query-processor.*`, `metabase-enterprise.sandbox.query-processor.*`,
-  ;; and `metabase.driver.*`, excluding `-test` namespaces.
+  ;; QP source namespaces: `metabase.query-processor.*`, `metabase-enterprise.sandbox.query-processor.*`, and
+  ;; `metabase.driver.*`, excluding `-test` namespaces.
  ;;
  {:pattern "metabase(?:(?:(?:-enterprise\\.sandbox)?\\.query-processor\\.)|(?:\\.driver\\.)).*(?<!-test)$"
   :name    qp-and-driver-source-namespaces}
  ;;
-  ;; QP source namespaces
+  ;; driver namespaces
  ;;
-  {:pattern "metabase(?:(?:-enterprise\\.sandbox)?\\.query-processor\\.).*(?<!-test)$"
-   :name    qp-source-namespaces}
-  ;;
-  ;; driver namespaces, including tests
-  ;;
-  {:pattern "metabase\\.driver(?:-api)?.*$"
+  {:pattern "metabase\\.driver.*$"
   :name    driver-namespaces}
  ;;
-  ;; Perf-sensitive namespaces are currently the union of metabase.lib.*, driver namespaces, and QP (without tests).
-  ;;
-  {:pattern "^(?!.*-test(?:\\..*)?$)(?!.*test-util)(?!^metabase\\.test.*)^metabase\\.(lib|driver|legacy-mbql|query-processor).*"
-   :name    performance-sensitive}
-  ;;
  ;; general QP tests are ones that run across multiple drivers. Anything `metabase.query-processor*-test`,
  ;; `metabase.driver.sql*-test` (excluding SQLServer and SQLite), or
  ;; `metabase-enterprise.sandbox.query-processor*-test`
@@ -760,13 +730,9 @@
   {:inline-def                              {:level :off}
    :missing-docstring                       {:level :off}
    :private-call                            {:level :off}
+    :discouraged-var                         {metabase.driver/database-supports? {:level :off}}
    :metabase/defsetting-must-specify-export {:level :off}
-    :metabase/defsetting-namespace           {:level :off}
-
-    :discouraged-var
-    {metabase.driver/database-supports? {:level :off}
-     metabase.lib.convert/->legacy-MBQL {:level :off}
-     metabase.lib.core/->legacy-MBQL    {:level :off}}}
+    :metabase/defsetting-namespace           {:level :off}}

   :hooks
   {:analyze-call
@@ -779,20 +745,9 @@
   {:metabase/validate-escaped-single-quotes-in-i18n {:level :warning}
    :metabase/validate-string-or-str-args-to-i18n {:level :warning}
    :metabase/discourage-millis-duration {:level :warning}
-
    :discouraged-var
    {clojure.core/with-redefs {:message "Don't use with-redefs outside of tests"}
-     clojure.core/eval        {:message "Don't use eval outside of tests"}}
-
-    :discouraged-namespace
-    {metabase.legacy-mbql.jvm-util       {:message "Avoid legacy MBQL utils, use Lib instead"}
-     metabase.legacy-mbql.normalize      {:message "Avoid legacy MBQL normalization, use MBQL 5 + lib/normalize instead"}
-     metabase.legacy-mbql.predicates     {:message "Avoid legacy MBQL utils, use Lib instead"}
-     metabase.legacy-mbql.schema         {:message "Avoid the legacy MBQL schema, use MBQL 5 + lib.schema instead"}
-     metabase.legacy-mbql.schema.helpers {:message "Avoid the legacy MBQL schema, use MBQL 5 + lib.schema instead"}
-     metabase.legacy-mbql.schema.macros  {:message "Avoid the legacy MBQL schema, use MBQL 5 + lib.schema instead"}
-     metabase.legacy-mbql.util           {:message "Avoid legacy MBQL utils, use Lib instead"}
-     metabase.query-processor.store      {:message "Please do not use the QP Store outside of legacy QP or driver code. Use MBQL 5/Lib or lib.metadata.jvm/applicaton-database-metadata-provider instead."}}}}
+     clojure.core/eval        {:message "Don't use eval outside of tests"}}}}

  printable-namespaces
  {:linters
@@ -804,7 +759,7 @@
                             clojure.string/lower-case {:level :off}
                             clojure.string/upper-case {:level :off}}}}

-  ;; enable all the extra linters we haven't enabled in the core app yet in Lib. It's all new code so we can adhere
+  ;; enable all the extra linters we haven't enabled in the core app yet in MLv2. It's all new code so we can adhere
  ;; to the new stricter rules from day 1
  metabase-lib
  {:linters
@@ -817,134 +772,50 @@
    ;; eventually we should do this for the whole codebase, but the args are in the opposite order so switching them
    ;; all at once isn't trivial, at least we can stop using it in new code.
    :discouraged-var
-    {medley.core/map-keys               {:message "Use metabase.util.performance/update-keys"}
-     medley.core/map-vals               {:message "Use clojure.core/update-vals"}
-     metabase.lib.convert/->legacy-MBQL {:level :off}
-     metabase.lib.core/->legacy-MBQL    {:level :off}
-     metabase.test/with-temp            {:message "Don't use application database inside Lib code"}}
+    {medley.core/map-keys    {:message "Use clojure.core/update-keys"}
+     medley.core/map-vals    {:message "Use clojure.core/update-vals"}
+     metabase.test/with-temp {:message "Don't use application database inside MLv2 code"}}

    :discouraged-namespace
-    {metabase.driver            {:message "Lib code should be independent of driver code/methods"}
-     metabase.test              {:message "Lib tests should only use Lib test helpers"}
-     metabase.test.data         {:message "Lib tests should only use Lib test helpers"}
-     metabase.util.malli.schema {:message "Prefer metabase.lib.schema schemas in Lib code"}
-     toucan.db                  {:message "Don't use application database inside Lib code"}
-     toucan.models              {:message "Don't use application database inside Lib code"}
-     toucan.util.test           {:message "Don't use application database inside Lib code"}
-     toucan2.core               {:message "Don't use application database inside Lib code"}}}}
+    {metabase.driver            {:message "MLv2 code should be independent of driver code/methods"}
+     metabase.test              {:message "MLv2 tests should only use MLv2 test helpers"}
+     metabase.test.data         {:message "MLv2 tests should only use MLv2 test helpers"}
+     metabase.util.malli.schema {:message "Prefer metabase.lib.schema schemas in MLv2 code"}
+     toucan.db                  {:message "Don't use application database inside MLv2 code"}
+     toucan.models              {:message "Don't use application database inside MLv2 code"}
+     toucan.util.test           {:message "Don't use application database inside MLv2 code"}
+     toucan2.core               {:message "Don't use application database inside MLv2 code"}}}}

  metabase-lib-excluding-legacy-mbql
-  {}
-
-  legacy-mbql-namespaces
  {:linters
-   {:discouraged-namespace
-    {metabase.legacy-mbql.jvm-util       {:level :off}
-     metabase.legacy-mbql.normalize      {:level :off}
-     metabase.legacy-mbql.predicates     {:level :off}
-     metabase.legacy-mbql.schema         {:level :off}
-     metabase.legacy-mbql.schema.helpers {:level :off}
-     metabase.legacy-mbql.schema.macros  {:level :off}
-     metabase.legacy-mbql.util           {:level :off}
-     metabase.query-processor.store      {:level :off}}
-
-    ;; the `metabase.legacy-mbql` stuff is all deprecated, so we don't need to warn inside the module about other stuff
-    ;; in the module being marked deprecated or discouraged.
-    :deprecated-namespace {:level :off}
-    :deprecated-var       {:level :off}}}
+   {:discouraged-var
+    {metabase.legacy-mbql.util/unique-name-generator {:message "Use metabase.lib.util/unique-name-generator or non-truncating-unique-name-generator"}}}}

  driver-namespaces
  {:linters
   {:discouraged-var
-    {metabase.driver/database-supports? {:level :off}}
-
-    ;; don't warn about the legacy MBQL namespaces being deprecated or discouraged in driver code now, we don't have a
-    ;; real alternative YET so it's not a helpful warning.
-    :discouraged-namespace
-    {metabase.legacy-mbql.jvm-util       {:level :off}
-     metabase.legacy-mbql.normalize      {:level :off}
-     metabase.legacy-mbql.predicates     {:level :off}
-     metabase.legacy-mbql.schema         {:level :off}
-     metabase.legacy-mbql.schema.helpers {:level :off}
-     metabase.legacy-mbql.schema.macros  {:level :off}
-     metabase.legacy-mbql.util           {:level :off}
-     metabase.query-processor.store      {:level :off}}
-
-    :deprecated-namespace
-    {:exclude
-     [metabase.driver.common.parameters
-      metabase.driver.common.parameters.dates
-      metabase.driver.common.parameters.operators
-      metabase.driver.common.parameters.parse
-      metabase.driver.common.parameters.values
-      metabase.legacy-mbql.jvm-util
-      metabase.legacy-mbql.normalize
-      metabase.legacy-mbql.predicates
-      metabase.legacy-mbql.schema
-      metabase.legacy-mbql.schema.helpers
-      metabase.legacy-mbql.schema.macros
-      metabase.legacy-mbql.util
-      metabase.query-processor.store]}
-
-    :deprecated-var
-    {:exclude
-     {metabase.legacy-mbql.schema.helpers/is-clause?   {:namespaces ["metabase\\.driver.*"]}
-      metabase.legacy-mbql.schema.helpers/mbql-clause? {:namespaces ["metabase\\.driver.*"]}
-      metabase.legacy-mbql.util/query->source-table-id {:namespaces ["metabase\\.driver.*"]}
-      metabase.legacy-mbql.util/aggregation-at-index   {:namespaces ["metabase\\.driver.*"]}
-      metabase.legacy-mbql.util/assoc-field-options    {:namespaces ["metabase\\.driver.*"]}
-      metabase.legacy-mbql.util/expression-with-name   {:namespaces ["metabase\\.driver.*"]}
-      metabase.legacy-mbql.util/field-options          {:namespaces ["metabase\\.driver.*"]}
-      metabase.legacy-mbql.util/negate-filter-clause   {:namespaces ["metabase\\.driver.*"]}
-      metabase.legacy-mbql.util/normalize-token        {:namespaces ["metabase\\.driver.*"]}
-      metabase.legacy-mbql.util/update-field-options   {:namespaces ["metabase\\.driver.*"]}}}}}
-
-  performance-sensitive
-  {:linters
-   {:discouraged-var
-    {clojure.core/empty?          {:message "Use metabase.util.performance/empty?"}
-     clojure.core/not-empty       {:message "Use metabase.util.performance/not-empty"}
-     clojure.core/every?          {:message "Use metabase.util.performance/every?"}
-     clojure.core/mapv            {:message "Use metabase.util.performance/mapv"}
-     clojure.core/run!            {:message "Use metabase.util.performance/run!"}
-     clojure.core/select-keys     {:message "Use metabase.util.performance/select-keys"}
-     clojure.core/some            {:message "Use metabase.util.performance/some"}
-     clojure.core/update-keys     {:message "Use metabase.util.performance/update-keys"}
-     clojure.walk/keywordize-keys {:message "Use metabase.util.performance/keywordize-keys"}
-     clojure.walk/postwalk        {:message "Use metabase.util.performance/postwalk"}
-     clojure.walk/prewalk         {:message "Use metabase.util.performance/prewalk"}
-     clojure.walk/walk            {:message "Use metabase.util.performance/walk"}
-     clojure.walk/for             {:message "Use metabase.util.performance/for"}
-     clojure.walk/doseq           {:message "Use metabase.util.performance/doseq"}}}}
+    {metabase.driver/database-supports? {:level :off}}}}

  qp-and-driver-source-namespaces
  {:linters
   {:discouraged-namespace
-    {metabase.query-processor.store {:level :off}
-     metabase.util.malli.schema     {:message "Prefer metabase.lib.schema or metabase.legacy-mbql.schema schemas in QP/driver code"}
-     toucan.db                      {:message "Don't use application database directly in QP code; use the MetadataProvider"}
-     toucan.models                  {:message "Don't use application database directly in QP code; use the MetadataProvider"}
-     toucan.util.test               {:message "Don't use application database directly in QP code; use the MetadataProvider"}
-     toucan2.core                   {:message "Don't use application database directly in QP code; use the MetadataProvider"}}
+    {metabase.util.malli.schema {:message "Prefer metabase.lib.schema or metabase.legacy-mbql.schema schemas in QP/driver code"}
+     toucan.db                  {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     toucan.models              {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     toucan.util.test           {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     toucan2.core               {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}

    :discouraged-var
-    {medley.core/map-keys                 {:message "Use metabase.util.performance/update-keys"}
+    {medley.core/map-keys                 {:message "Use clojure.core/update-keys"}
     medley.core/map-vals                 {:message "Use clojure.core/update-vals"}
-     metabase.app-db.core/query           {:message "Don't use application database directly in QP code; use the MetadataProvider"}
-     metabase.app-db.core/reducible-query {:message "Don't use application database directly in QP code; use the MetadataProvider"}
-     metabase.lib.convert/->legacy-MBQL   {:level :off}
-     metabase.lib.core/->legacy-MBQL      {:level :off}}}}
-
-  qp-source-namespaces
-  {}
+     metabase.app-db.core/query           {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     metabase.app-db.core/reducible-query {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}}}

  general-qp-and-driver-test-namespaces
  {:linters
   {:discouraged-var
-    {metabase.test/with-column-remappings      {:message "Use lib.tu/remap-metadata-provider instead of with-column-remappings in QP tests"}
-     metabase.test.util/with-column-remappings {:message "Use lib.tu/remap-metadata-provider instead of with-column-remappings in QP tests"}
-     metabase.test/with-temp                   {:message "Use lib.tu/mock-metadata-provider in QP tests. Exceptions: tests for code that doesn't use MPs or models not supported by MPs"}
-     toucan2.tools.with-temp/with-temp         {:message "Use lib.tu/mock-metadata-provider in QP tests. Exceptions: tests for code that doesn't use MPs or models not supported by MPs"}}
+    {metabase.test/with-column-remappings      {:message "Use metabase.lib.test-util/remap-metadata-provider instead of with-column-remappings in QP tests"}
+     metabase.test.util/with-column-remappings {:message "Use metabase.lib.test-util/remap-metadata-provider instead of with-column-remappings in QP tests"}}

    :metabase/disallow-hardcoded-driver-names-in-tests
    {:level :warning}}}}}
--- a/.clj-kondo/config/modules/config.edn
+++ b/.clj-kondo/config/modules/config.edn
--- a/.clj-kondo/config/test-helpers/config.edn
+++ b/.clj-kondo/config/test-helpers/config.edn
@@ -13,10 +13,7 @@
     toucan2.core/insert-returning-pk!
     toucan2.core/insert-returning-pks!
     clojure.core.async/<!!
-     clojure.core.async/<!
     clojure.core.async/>!!
-     clojure.core.async/>!
-     clojure.core.async/alts!
     clojure.core.async/alts!!
     clojure.core.async/close!
     clojure.core.async/poll!
--- a/.clj-kondo/macros/metabase/xrays/domain_entities/malli.clj
+++ b/.clj-kondo/macros/metabase/xrays/domain_entities/malli.clj
@@ -0,0 +1,16 @@
+(ns macros.metabase.xrays.domain-entities.malli)
+
+(defmacro define-getters-and-setters [schema & defs]
+  `(do
+     (comment ~schema) ;; Reference the schema
+     ~@(for [[sym _path] (partition 2 defs)]
+         `(do
+            (defn ~(vary-meta sym
+                              assoc :export true)
+              "docs" [_x#] nil)
+            (defn ~(vary-meta (symbol (str "with-" (name sym)))
+                              assoc :export true)
+              "docs" [x# _new#] x#)
+            (defn ~(vary-meta (symbol (str (name sym) "-js"))
+                              assoc :export true)
+              "docs" [x#] x#)))))
--- a/.clj-kondo/src/hooks/clojure/core/require.clj
+++ b/.clj-kondo/src/hooks/clojure/core/require.clj
@@ -52,13 +52,7 @@

 (defn- lint-require* [node current-ns config]
  (let [[_require & args]   (:children node)
-        required-namespaces (->> (keep unwrap-require args)
-                                 ;; `require` runs through `cc/load-libs` which allows
-                                 ;; #{:as :reload :reload-all :require :use :verbose :refer :as-alias}
-                                 ;; as args. If you use a REPL tool that applies clj-kondo linting (e.g., Clojure MCP)
-                                 ;; you may wish to `:reload` or `:reload-all` a namespace. So we shouldn't assume all
-                                 ;; args are keywords:
-                                 (remove keyword?))]
+        required-namespaces (keep unwrap-require args)]
    (lint* node current-ns config required-namespaces)))

 (defn- lint-requiring-resolve* [node current-ns config]
--- a/.clj-kondo/src/hooks/metabase/api/macros.clj
+++ b/.clj-kondo/src/hooks/metabase/api/macros.clj
@@ -1,67 +1,7 @@
 (ns hooks.metabase.api.macros
  (:require
   [clj-kondo.hooks-api :as api]
-   [clojure.string :as str]))
-
-(defn- validate-route!
-  "Make sure the route uses kebab-case rather than snake_case."
-  [route]
-  (letfn [(validate-route-string! [route-string]
-            (when (and (api/string-node? route-string)
-                       (str/includes? (api/sexpr route-string) "_"))
-              (api/reg-finding! (assoc (meta route-string)
-                                       :message "REST API routes and query params should use kebab-case, not snake_case"
-                                       :type    :metabase/validate-defendpoint-route-uses-kebab-case))))]
-    (cond
-      (api/string-node? route)
-      (validate-route-string! route)
-      ;; otherwise route is a vector like ["/abc/:d/" :d <regex>]
-      (api/vector-node? route)
-      (validate-route-string! (first (:children route))))))
-
-(defn- validate-query-params!
-  "Make sure query params use kebab-case rather than snake_case.
-
-  This only works on inline schemas for now. If you define the schema elsewhere then we'd have to implement this
-  validation in Clojure-land since we can't resolve the schemas in Kondo. It should however still work on complicated
-  schemas like
-
-    [:merge <map-1> <map-2>]"
-  [query-param-schema-node]
-  (letfn [(map-schema? [node]
-            (and (api/vector-node? node)
-                 (when-let [first-child (first (:children node))]
-                   (and (api/keyword-node? first-child)
-                        (= (api/sexpr first-child) :map)))))
-          (map-schema-keys [{:keys [children], :as _node}]
-            (let [child-schemas (if (api/map-node? (second children))
-                                  (drop 2 children)
-                                  (drop 1 children))]
-              (keep (fn [child-schema]
-                      (when (api/vector-node? child-schema)
-                        (when-let [k (first (:children child-schema))]
-                          (when (api/keyword-node? k)
-                            k))))
-                    child-schemas)))
-          (validate-map-schema! [form]
-            ;; only warn once per endpoint -- just once on the first bad node
-            (when-let [bad-node (some (fn [key-node]
-                                        (when (str/includes? (str (api/sexpr key-node)) "_")
-                                          key-node))
-                                      (map-schema-keys form))]
-              (api/reg-finding! (assoc (meta bad-node)
-                                       :message "REST API routes and query params should use kebab-case, not snake_case"
-                                       :type    :metabase/validate-defendpoint-query-params-use-kebab-case))))
-          (validate! [node]
-            (cond
-              (and (api/vector-node? node)
-                   (map-schema? node))
-              (validate-map-schema! node)
-
-              (api/vector-node? node)
-              (doseq [child (:children node)]
-                (validate! child))))]
-    (validate! query-param-schema-node)))
+   [hooks.common]))

 (defn defendpoint
  [arg]
@@ -78,21 +18,16 @@
                                      (cons nil more))
                  [params & body] more
                  [bindings schemas] (when (api/vector-node? params)
-                                       (loop [bindings [], schemas [], [x y z & more] (:children params)]
+                                       (loop [bindings [], schemas [], [x y & more] (:children params)]
                                         (cond
                                           (not x)
                                           [bindings schemas]

-                                           (and (api/keyword-node? y)
-                                                (= (api/sexpr y) :-))
-                                           (recur (conj bindings x) (conj schemas z) more)
+                                           (= (api/sexpr x) :-)
+                                           (recur bindings (conj schemas y) more)

                                           :else
-                                           (recur (conj bindings x) (conj schemas nil) (list* y z more)))))]
-              (validate-route! route)
-              (let [[_route-param-schema query-param-schema _body-param-schema] schemas]
-                (when query-param-schema
-                  (validate-query-params! query-param-schema)))
+                                           (recur (conj bindings x) schemas (cons y more)))))]
              (-> (api/list-node
                   (list
                    (api/token-node 'do)
@@ -119,27 +54,3 @@
                      body))))
                  (with-meta (meta node)))))]
    (update arg :node update-defendpoint)))
-
-(comment
-  (defn -defendpoint [form]
-    (-> {:node (-> form pr-str api/parse-string)}
-        defendpoint
-        :node
-        api/sexpr))
-
-  (defn x []
-    (-defendpoint '(api.macros/defendpoint :get "/:id/syncable_schemas" ; snake_case route should trigger a warning
-                     "Returns a list of all syncable schemas found for the database `id`."
-                     [{:keys [id]} :- [:map
-                                       [:id ms/PositiveInt]]
-                      ;; snake_case query parameter, should trigger a warning
-                      {:keys [filter_by]} :- [:map
-                                              [:filter_by {:optional true} :string]]]
-                     (let [db (get-database id)]
-                       (api/check-403 (or (:is_attached_dwh db)
-                                          (and (mi/can-write? db)
-                                               (mi/can-read? db))))
-                       (->> db
-                            (driver/syncable-schemas (:engine db))
-                            (vec)
-                            (sort)))))))
--- a/.clj-kondo/src/hooks/metabase/legacy_mbql/schemas/macros.clj
+++ b/.clj-kondo/src/hooks/metabase/legacy_mbql/schemas/macros.clj
@@ -33,36 +33,18 @@
    (defclause [ag:var var] field-or-expression FieldOrExpressionDef)
    =>
    (def ag:var [FieldOrExpressionDef])"
-  [{:keys [node], :as x}]
-  (let [[_defclause clause-name & arg-specs] (:children node)]
-    (assoc x :node (-> (hooks/list-node
-                        (list
-                         (hooks/token-node 'do)
-                         (-> (hooks/keyword-node (keyword "metabase.legacy-mbql.schema" (name (hooks/sexpr clause-name))))
-                             (with-meta (meta clause-name))
-                             (hooks/reg-keyword! 'metabase.legacy-mbql.schemas.macros/defclause))
-                         (collect-defclause-body-schemas arg-specs)))
-                       (with-meta (meta node))))))
-
-(defn defclause*
-  "e.g.
-
-    (defclause [ag:var var] field-or-expression FieldOrExpressionDef)
-    =>
-    (def ag:var [FieldOrExpressionDef])"
-  [{:keys [node], :as x}]
-  (let [[_defclause clause-name schema] (:children node)]
-    (assoc x :node (-> (hooks/list-node
-                        (list
-                         (hooks/token-node 'do)
-                         (-> (hooks/keyword-node (keyword "metabase.legacy-mbql.schema" (name (hooks/sexpr clause-name))))
-                             (with-meta (meta clause-name))
-                             (hooks/reg-keyword! 'metabase.legacy-mbql.schemas.macros/defclause*))
-                         schema))
-                       (with-meta (meta node))))))
+  [{:keys [node]}]
+  (let [[_defclause clause-name-form & arg-specs] (:children node)]
+    {:node (-> (hooks/list-node
+                (list
+                 (hooks/token-node 'def)
+                 (unwrap-defclause-clause-name clause-name-form)
+                 (hooks/string-node "Docstring.")
+                 (collect-defclause-body-schemas arg-specs)))
+               (with-meta (meta node)))}))

 (comment
-  (defn- expand-defclause [form]
+  (defn- defclause* [form]
    (hooks/sexpr
     (:node
      (defclause
@@ -73,35 +55,15 @@
             form)))}))))

  (defn- x []
-    (expand-defclause '(defclause var
-                         field-or-expression FieldOrExpressionDef)))
+    (defclause* '(defclause [ag:var var]
+                   field-or-expression FieldOrExpressionDef)))
  ;; =>
-  (do :metabase.legacy-mbql.schema/var [FieldOrExpressionDef])
+  (def ag:var "Docstring." [FieldOrExpressionDef])

  (defn- y []
-    (expand-defclause '(defclause var
-                         x (some-list-schema)
-                         y (optional FieldOrExpressionDef)
-                         z (rest (some-other-schema)))))
+    (defclause* '(defclause var
+                   x (some-list-schema)
+                   y (optional FieldOrExpressionDef)
+                   z (rest (some-other-schema)))))
  ;; =>
-  (do :metabase.legacy-mbql.schema/var [(some-list-schema) FieldOrExpressionDef (some-other-schema)]))
-
-(defn one-of [{:keys [node], :as x}]
-  (let [[_one-of & schema-nodes] (:children node)
-        node' (-> (hooks/vector-node
-                   (mapv (fn [schema-node]
-                           (if (and (hooks/token-node? schema-node)
-                                    (simple-symbol? (hooks/sexpr schema-node)))
-                             (-> (hooks/keyword-node (keyword "mteabase.legacy-mbql.schema" (name (hooks/sexpr schema-node))))
-                                 (with-meta (meta schema-node)))
-                             schema-node))
-                         schema-nodes))
-                  (with-meta (meta node)))]
-    (assoc x :node node')))
-
-(comment
-  (defn- expand-one-of [form]
-    (hooks/sexpr (:node (one-of {:node (hooks/parse-string (with-out-str (clojure.pprint/pprint form)))}))))
-
-  (defn- z []
-    (expand-one-of '(one-of absolute-datetime relative-datetime time))))
+  (def var "Docstring." [(some-list-schema) FieldOrExpressionDef (some-other-schema)]))
--- a/.clj-kondo/src/hooks/metabase/test/util.clj
+++ b/.clj-kondo/src/hooks/metabase/test/util.clj
@@ -1,6 +1,6 @@
 (ns hooks.metabase.test.util
-  (:require
-   [clj-kondo.hooks-api :as hooks]))
+  (:require [clj-kondo.hooks-api :as hooks]
+            [hooks.common :as common]))

 (defn- namespaced-symbol-node? [node]
  (when (hooks/token-node? node)
--- a/.clj-kondo/test/hooks/metabase/api/macros_test.clj
+++ b/.clj-kondo/test/hooks/metabase/api/macros_test.clj
@@ -1,7 +1,6 @@
 (ns hooks.metabase.api.macros-test
  (:require
   [clj-kondo.hooks-api :as api]
-   [clj-kondo.impl.utils]
   [clojure.test :refer :all]
   [hooks.metabase.api.macros]))

@@ -70,41 +69,3 @@
             (respond :x)
             (catch Throwable e
               (raise e))))))))
-
-(defn- defendpoint [form]
-  (hooks.metabase.api.macros/defendpoint
-    {:node (-> form pr-str api/parse-string)}))
-
-(defn- defendpoint-warnings
-  [form]
-  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
-                                                               :metabase/validate-defendpoint-query-params-use-kebab-case {:level :warning}}}
-                                        :ignores    (atom nil)
-                                        :findings   (atom [])
-                                        :namespaces (atom {})}]
-    (defendpoint form)
-    @(:findings clj-kondo.impl.utils/*ctx*)))
-
-(deftest ^:parallel validate-route-kebab-case-test
-  (is (=? [{:message "REST API routes and query params should use kebab-case, not snake_case"
-            :type    :metabase/validate-defendpoint-route-uses-kebab-case
-            :row     pos-int?
-            :col     pos-int?}]
-          (defendpoint-warnings
-            '(api.macros/defendpoint :get "/:id/syncable_schemas" ; snake_case route should trigger a warning
-               "Returns a list of all syncable schemas found for the database `id`."
-               [{:keys [id]}]
-               id)))))
-
-(deftest ^:parallel validate-query-params-kebab-case-test
-  (is (=? [{:message "REST API routes and query params should use kebab-case, not snake_case",
-            :type    :metabase/validate-defendpoint-query-params-use-kebab-case
-            :row     pos-int?
-            :col     pos-int?}]
-          (defendpoint-warnings
-            '(api.macros/defendpoint :get "/:id/syncable-schemas"
-               "Returns a list of all syncable schemas found for the database `id`."
-               [{:keys [id]}
-                {:keys [filter_by]} :- [:map
-                                        [:filter_by {:optional true} :string]]]
-               id)))))
--- a/.cljfmt.edn
+++ b/.cljfmt.edn
@@ -163,8 +163,8 @@
  metabase.models.interface/define-batched-hydration-method                              [[:inner 0]]
  metabase.models.interface/define-simple-hydration-method                               [[:inner 0]]
  metabase.parameters.chain-filter-test/with-clean-field-values-for-field                [[:block 1]]
-  metabase.parameters.chain-filter-test/with-fk-field-to-field-remapping!                [[:block 0]]
-  metabase.parameters.chain-filter-test/with-human-readable-values-remapping!            [[:block 0]]
+  metabase.parameters.chain-filter-test/with-fk-field-to-field-remapping                 [[:block 0]]
+  metabase.parameters.chain-filter-test/with-human-readable-values-remapping             [[:block 0]]
  metabase.permissions.core/allow-changing-all-users-group-members                       [[:block 0]]
  metabase.permissions.core/disable-perms-cache                                          [[:block 0]]
  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing        [[:block 3]]
@@ -179,8 +179,8 @@
  metabase.queries.api.card-test/with-cards-in-readable-collection                       [[:block 1]]
  metabase.queries.api.card-test/with-cards-in-writeable-collection                      [[:block 1]]
  metabase.queries.api.card-test/with-ordered-items                                      [[:inner 0]]
-  metabase.queries.api.card-test/with-temp-native-card                                   [[:block 1]]
-  metabase.queries.api.card-test/with-temp-native-card-with-params                       [[:block 1]]
+  metabase.queries.api.card-test/with-temp-native-card!                                  [[:block 1]]
+  metabase.queries.api.card-test/with-temp-native-card-with-params!                      [[:block 1]]
  metabase.query-processor-test.pipeline-queries-test/pmbql-query                        [[:block 1]]
  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                    [[:block 1]]
  metabase.query-processor.debug/debug>                                                  [[:block 0]]
@@ -232,6 +232,7 @@
  metabase.test.data/$ids                                                                [[:inner 0]]
  metabase.test.data/dataset                                                             [[:inner 0]]
  metabase.test.data/mbql-query                                                          [[:inner 0]]
+  metabase.test.data/native-query                                                        [[:block 0]]
  metabase.test.data/query                                                               [[:block 1]]
  metabase.test.data/run-mbql-query                                                      [[:inner 0]]
  metabase.test.data/with-empty-h2-app-db!                                               [[:block 0]]
@@ -252,6 +253,7 @@
  metabase.test/format-rows-by                                                           [[:default]]
  metabase.test/let-url                                                                  [[:block 1]]
  metabase.test/mbql-query                                                               [[:inner 0]]
+  metabase.test/native-query                                                             [[:block 0]]
  metabase.test/query                                                                    [[:block 1]]
  metabase.test/run-mbql-query                                                           [[:inner 0]]
  metabase.test/test-driver                                                              [[:inner 0]]
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -4,6 +4,7 @@ FROM mcr.microsoft.com/vscode/devcontainers/java:21

 RUN ( curl -fsSL https://deb.nodesource.com/setup_22.x | bash ) \
  && export DEBIAN_FRONTEND=noninteractive \
+  && apt-key adv --refresh-keys --keyserver keyserver.ubuntu.com \
  && apt-get update && apt-get -y install --no-install-recommends nodejs yarn rlwrap fontconfig

 # install Clojure
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,4 +1,5 @@
 .babel_cache
+docs/*
 target/*
 .circleci
 .cpcache
--- a/.eslintignore
+++ b/.eslintignore
@@ -2,4 +2,3 @@ frontend/src/cljs
 frontend/src/cljs_release
 e2e/support/cypress_sample_database.js
 e2e/support/cypress_sample_instance_data.js
-e2e/embedding-sdk-host-apps
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -14,7 +14,6 @@ if (shouldLintCssModules) {
 }

 module.exports = {
-  ignorePatterns: ["!.storybook"],
  rules: {
    strict: [2, "never"],
    "no-undef": 2,
@@ -49,7 +48,6 @@ module.exports = {
    ],
    curly: [1, "all"],
    eqeqeq: [1, "smart"],
-    "import/no-duplicates": ["warn", { considerQueryString: true }],
    "import/no-default-export": 2,
    "import/no-named-as-default": 0,
    "import/no-commonjs": 1,
@@ -94,7 +92,10 @@ module.exports = {
    "react/jsx-no-target-blank": 2,
    "react/jsx-key": 2,
    "react/forbid-component-props": [2, { forbid: ["sx"] }],
-    "react-hooks/exhaustive-deps": ["warn"],
+    "react-hooks/exhaustive-deps": [
+      "warn",
+      { additionalHooks: "(useSafeAsyncFunction)" },
+    ],
    "prefer-const": [1, { destructuring: "all" }],
    "no-restricted-globals": ["error", "close"],
    "no-useless-escape": 0,
@@ -133,7 +134,7 @@ module.exports = {
  },
  env: {
    browser: true,
-    es2020: true,
+    es6: true,
    commonjs: true,
    jest: true,
    "jest/globals": true,
@@ -177,7 +178,6 @@ module.exports = {
    {
      files: ["*.js", "*.jsx", "*.ts", "*.tsx"],
      rules: {
-        "jtag-missing-key": "error",
        "no-unconditional-metabase-links-render": "error",
        "no-color-literals": "error",
        "no-literal-metabase-strings": "error",
@@ -200,17 +200,14 @@ module.exports = {
        "frontend/src/metabase/admin/**/*",
        "frontend/src/metabase/setup/**/*",
        "enterprise/frontend/src/metabase-enterprise/whitelabel/**/*",
-        "enterprise/frontend/src/metabase-enterprise/embedding/**/*",
        "frontend/lint/**/*",
        "*.stories.*",
-        "**/.storybook/*",
        "stories-data.*",
        "e2e/**/*",
        "**/tests/*",
        "release/**/*",
        "rspack.config.js",
        "rspack.main.config.js",
-        "rspack.embedding-sdk-package.config.js",
        "rspack.embedding-sdk-bundle.config.js",
      ],
      rules: {
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,9 +1,7 @@
 # Before changing this file, make sure you have read how we use it:
 # https://www.notion.so/metabase/Pull-Request-Code-Review-Guide-374f05df889748b69d67af753f9bc9b8?pvs=4#36550c04ceab40b5a8b8bee6264b090c

-enterprise/frontend/src/embedding-sdk-package @metabase/embedding
-enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
-enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
+enterprise/frontend/src/embedding-sdk @metabase/embedding
 frontend/src/metabase/embedding-sdk @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
@@ -22,8 +20,8 @@ docs/developers-guide # exclude from tech-writer ownership
 #

 # modules/drivers @metabase/drivers
-src/metabase/driver/sql_jdbc/actions.clj       @metabase/core-ux-east
-test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-ux-east
+src/metabase/driver/sql_jdbc/actions.clj       @metabase/core-workflows
+test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-workflows

 # enterprise/backend/src/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
 # enterprise/backend/test/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
@@ -55,8 +53,8 @@ test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-ux-east
 # enterprise/backend/src/metabase_enterprise/core @metabase/devexp
 # enterprise/backend/test/metabase_enterprise/core @metabase/devexp

-# enterprise/backend/src/metabase_enterprise/dashboard_subscription_filters @metabase/core-ux-east
-# enterprise/backend/test/metabase_enterprise/dashboard_subscription_filters @metabase/core-ux-east
+# enterprise/backend/src/metabase_enterprise/dashboard_subscription_filters @metabase/core-workflows
+# enterprise/backend/test/metabase_enterprise/dashboard_subscription_filters @metabase/core-workflows

 # enterprise/backend/src/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
 # enterprise/backend/test/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
@@ -73,11 +71,11 @@ test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-ux-east
 # enterprise/backend/src/metabase_enterprise/scim @metabase/core-backend-admin-webapp
 # enterprise/backend/test/metabase_enterprise/scim @metabase/core-backend-admin-webapp

-# enterprise/backend/src/metabase_enterprise/search ...
-# enterprise/backend/test/metabase_enterprise/search ...
+# enterprise/backend/src/metabase_enterprise/search @metabase/core-workflows
+# enterprise/backend/test/metabase_enterprise/search @metabase/core-workflows

-# enterprise/backend/src/metabase_enterprise/serialization @metabase/core-ux-east
-# enterprise/backend/test/metabase_enterprise/serialization @metabase/core-ux-east
+# enterprise/backend/src/metabase_enterprise/serialization @metabase/core-workflows
+# enterprise/backend/test/metabase_enterprise/serialization @metabase/core-workflows

 # enterprise/backend/src/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
 # enterprise/backend/test/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
@@ -97,8 +95,8 @@ test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-ux-east
 # enterprise/backend/src/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
 # enterprise/backend/test/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp

-src/metabase/actions @metabase/core-ux-east
-test/metabase/actions @metabase/core-ux-east
+src/metabase/actions @metabase/core-backend-ux-west
+test/metabase/actions @metabase/core-backend-ux-west

 # src/metabase/activity_feed @metabase/core-backend-admin-webapp
 # test/metabase/activity_feed @metabase/core-backend-admin-webapp
@@ -124,11 +122,11 @@ test/metabase/actions @metabase/core-ux-east
 # src/metabase/cmd @metabase/devexp
 # test/metabase/cmd @metabase/devexp

-# src/metabase/channel @metabase/core-ux-east
-# test/metabase/channel @metabase/core-ux-east
+# src/metabase/channel @metabase/core-workflows
+# test/metabase/channel @metabase/core-workflows

-# src/metabase/cloud_migration ...
-# test/metabase/cloud_migration ...
+# src/metabase/cloud_migration @metabase/core-workflows
+# test/metabase/cloud_migration @metabase/core-workflows

 # src/metabase/cmd @metabase/devexp
 # test/metabase/cmd @metabase/devexp
@@ -160,8 +158,8 @@ test/metabase/actions @metabase/core-ux-east
 # src/metabase/indexed_entities @metabase/core-backend-querying
 # test/metabase/indexed_entities @metabase/core-backend-querying

-# src/metabase/integrations ...
-# test/metabase/integrations ...
+# src/metabase/integrations @metabase/core-workflows
+# test/metabase/integrations @metabase/core-workflows

 # src/metabase/legacy_mbql @metabase/core-backend-querying
 # test/metabase/legacy_mbql @metabase/core-backend-querying
@@ -184,8 +182,8 @@ test/metabase/actions @metabase/core-ux-east
 # src/metabase/moderation @metabase/core-backend-admin-webapp
 # test/metabase/moderation @metabase/core-backend-admin-webapp

-# src/metabase/notification @metabase/core-ux-east
-# test/metabase/notification @metabase/core-ux-east
+# src/metabase/notification @metabase/core-workflows
+# test/metabase/notification @metabase/core-workflows

 # src/metabase/permissions @metabase/core-backend-admin-webapp
 # test/metabase/permissions @metabase/core-backend-admin-webapp
@@ -202,8 +200,8 @@ test/metabase/actions @metabase/core-ux-east
 # src/metabase/public_sharing @metabase/core-backend-admin-webapp
 # test/metabase/public_sharing @metabase/core-backend-admin-webapp

-# src/metabase/pulse @metabase/core-ux-east
-# test/metabase/pulse @metabase/core-ux-east
+# src/metabase/pulse @metabase/core-workflows
+# test/metabase/pulse @metabase/core-workflows

 # src/metabase/query_analysis @metabase/core-backend-querying
 # test/metabase/query_analysis @metabase/core-backend-querying
@@ -220,8 +218,8 @@ test/metabase/actions @metabase/core-ux-east
 # src/metabase/sample_data @metabase/core-backend-admin-webapp
 # test/metabase/sample_data @metabase/core-backend-admin-webapp

-# src/metabase/search ...
-# test/metabase/search ...
+# src/metabase/search @metabase/core-workflows
+# test/metabase/search @metabase/core-workflows

 # src/metabase/segments @metabase/core-backend-querying
 # test/metabase/segments @metabase/core-backend-querying
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -3,7 +3,7 @@

 > **Warning**
 >
-> If that is your first contribution to Metabase, please sign the [Contributor License Agreement](https://docs.google.com/a/metabase.com/forms/d/1oV38o7b9ONFSwuzwmERRMi9SYrhYeOrkbmNaq9pOJ_E/viewform). Also, if you're attempting to fix a translation issue, please submit your changes to our [Crowdin project](https://crowdin.com/project/metabase-i18n) instead of opening a PR.
+> If that is your first contribution to Metabase, please sign the [Contributor License Agreement](https://docs.google.com/a/metabase.com/forms/d/1oV38o7b9ONFSwuzwmERRMi9SYrhYeOrkbmNaq9pOJ_E/viewform) (unless it's a tiny documentation change). Also, if you're attempting to fix a translation issue, please submit your changes to our [Crowdin project](https://crowdin.com/project/metabase-i18n) instead of opening a PR.

 Closes https://github.com/metabase/metabase/issues/[issue_number]

--- a/.github/actions/cleanup-python-runner/action.yml
+++ b/.github/actions/cleanup-python-runner/action.yml
@@ -1,36 +0,0 @@
-name: Cleanup Python Runner
-description: Cleanup python-runner services and upload logs as artifacts
-
-inputs:
-  upload-logs:
-    description: 'Whether to upload logs (typically on failure)'
-    required: false
-    default: 'false'
-  logs-artifact-suffix:
-    description: 'The unique name of the .zip artifact containing the logs'
-    required: false
-    default: ''
-
-runs:
-  using: composite
-  steps:
-    - name: Cleanup python-runner services
-      if: always()
-      run: |
-        echo "Stopping python-runner services..."
-        if [ -d "python-runner" ]; then
-          cd python-runner
-          make stop || echo "WARNING: Failed to stop python runner"
-        fi
-      shell: bash
-
-    - name: Upload python-runner logs
-      if: ${{inputs.upload-logs == 'true' && inputs.logs-artifact-suffix != ''}}
-      uses: actions/upload-artifact@v4
-      with:
-        name: python-runner-logs-${{inputs.logs-artifact-suffix}}
-        path: |
-          python-runner.out.log
-          python-runner.err.log
-        retention-days: 1
-        if-no-files-found: warn
--- a/.github/actions/create-backport/action.yml
+++ b/.github/actions/create-backport/action.yml
@@ -74,7 +74,7 @@ runs:

        git push -u origin ${BACKPORT_BRANCH}

-        BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${{ github.event.pull_request.user.login }}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
+        BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
        BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}

        echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT
--- a/.github/actions/cross-branch-migration-test/action.yml
+++ b/.github/actions/cross-branch-migration-test/action.yml
@@ -17,6 +17,8 @@ runs:

    - name: Prepare backend environment
      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: cross-branch-migrations

    - name: Run backend on base branch
      run: |
--- a/.github/actions/fetch-artifact/action.yml
+++ b/.github/actions/fetch-artifact/action.yml
@@ -5,14 +5,6 @@ inputs:
  name:
    description: The name of the artifact to fetch
    required: true
-  output-name:
-    description: Optional custom name for the output jar file (defaults to metabase.jar)
-    required: false
-    default: "metabase.jar"
-  extract-path:
-    description: Directory path where the jar should be extracted (defaults to current directory)
-    required: false
-    default: "."

 runs:
  using: "composite"
@@ -33,7 +25,7 @@ runs:
          });

          if (!artifacts.data?.artifacts?.[0]?.id) {
-            throw new Error(`No artifacts found for ${{ inputs.name }}`);
+            throw new Error(`No artifacts found for ${{ inputs.commit }}`);
          }

          const artifact_id = artifacts.data.artifacts[0].id;
@@ -47,59 +39,25 @@ runs:

          fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));

-    - name: Extract and rename JAR
+    - name: unzip uberjar artifact
+      shell: bash
+      run: unzip mb.zip
+    - name: Move the Uberjar
      shell: bash
      run: | # bash
-        OUTPUT_NAME="${{ inputs.output-name }}"
-        EXTRACT_PATH="${{ inputs.extract-path }}"
-
-        # Create a temporary directory for extraction to avoid conflicts
-        TEMP_DIR=$(mktemp -d)
-
-        # Extract to temporary directory
-        unzip mb.zip -d "$TEMP_DIR"
-
-        # Create target directory
-        mkdir -p "$EXTRACT_PATH"
-
-        # Find the jar and move all files from its directory
-        if [ -e "$TEMP_DIR/metabase.jar" ]; then
-          # Move all files to extract path
-          mv "$TEMP_DIR"/* "$EXTRACT_PATH/" 2>/dev/null || true
-          # Rename the jar to custom name if different
-          if [ "$OUTPUT_NAME" != "metabase.jar" ]; then
-            mv "$EXTRACT_PATH/metabase.jar" "$EXTRACT_PATH/$OUTPUT_NAME"
-          fi
-        elif [ -e "$TEMP_DIR/target/uberjar/metabase.jar" ]; then
-          # Move all files from uberjar directory to extract path
-          mv "$TEMP_DIR/target/uberjar"/* "$EXTRACT_PATH/" 2>/dev/null || true
-          # Rename the jar to custom name if different
-          if [ "$OUTPUT_NAME" != "metabase.jar" ]; then
-            mv "$EXTRACT_PATH/metabase.jar" "$EXTRACT_PATH/$OUTPUT_NAME"
-          fi
+        if [ -e "metabase.jar" ]; then
+          echo "metabase.jar is already in the right place"
+        elif [ -e "target/uberjar/metabase.jar" ]; then
+            echo "moving metabase.jar to current directory"
+          mv target/uberjar/metabase.jar metabase.jar
        else
-          echo "Could not find metabase.jar in extracted files"
+          echo "Could not find the metabase.jar file"
          exit 1
        fi

-        # Clean up temporary directory
-        rm -rf "$TEMP_DIR"
-
-        # Set the JAR_PATH environment variable
-        if [ "$EXTRACT_PATH" == "." ]; then
-          echo "JAR_PATH=$OUTPUT_NAME" >> $GITHUB_ENV
-        else
-          echo "JAR_PATH=$EXTRACT_PATH/$OUTPUT_NAME" >> $GITHUB_ENV
-        fi
-
    - name: Verify that this is a valid JAR file
      shell: bash
-      run: |
-        echo "Verifying JAR at: $JAR_PATH"
-        file --mime-type "$JAR_PATH"
-
+      run: file --mime-type ./metabase.jar
    - name: Reveal its version.properties
      shell: bash
-      run: |
-        echo "Extracting version.properties from: $JAR_PATH"
-        jar xf "$JAR_PATH" version.properties && cat version.properties
+      run: jar xf metabase.jar version.properties && cat version.properties
--- a/.github/actions/get-cache-keys/action.yml
+++ b/.github/actions/get-cache-keys/action.yml
@@ -1,32 +0,0 @@
-name: Get cache keys
-description: |
-  Get deterministic cache keys for Maven and Node.js caches based on the centrally controlled cache prefix,
-  and the suffix based on the runner OS and the current week of the year.
-
-outputs:
-  m2-cache-key:
-    description: "The cache key for the Maven cache."
-    value: ${{ steps.keys-factory.outputs.m2-cache-key }}
-  node-cache-key:
-    description: "The cache key for the Node.js cache."
-    value: ${{ steps.keys-factory.outputs.node-cache-key }}
-  eslint-cache-key:
-    description: "The cache key for Eslint cache"
-    value: ${{ steps.keys-factory.outputs.eslint-cache-key }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Generate and output cache keys
-      id: keys-factory
-      run: |
-        M2_CACHE_PREFIX='M2'
-        NODE_CACHE_PREFIX='node-modules'
-        ESLINT_CACHE_PREFIX='eslint'
-        WEEK_OF_YEAR=$(/bin/date "+%G-%V")
-        CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
-
-        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
-        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
-        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
-      shell: bash
--- a/.github/actions/get-docker-info/action.yml
+++ b/.github/actions/get-docker-info/action.yml
@@ -1,74 +0,0 @@
-name: Get Docker Info
-description: Determines Docker repository and tag based on branch and edition
-
-inputs:
-  branch:
-    description: Branch name (defaults to current branch)
-    required: false
-    default: ${{ github.head_ref || github.ref_name }}
-  edition:
-    description: Edition (ee or oss)
-    required: false
-    default: ee
-  owner:
-    description: Repository owner (defaults to current repo owner)
-    required: false
-    default: ${{ github.repository_owner }}
-
-outputs:
-  repo:
-    description: Docker repository name
-    value: ${{ steps.docker-info.outputs.repo }}
-  tag:
-    description: Docker tag
-    value: ${{ steps.docker-info.outputs.tag }}
-  full_image:
-    description: Full Docker image name (repo:tag)
-    value: ${{ steps.docker-info.outputs.full_image }}
-  editions:
-    description: JSON array of editions to build
-    value: ${{ steps.docker-info.outputs.editions }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Determine Docker info
-      id: docker-info
-      uses: actions/github-script@v7
-      with:
-        script: | # js
-          const branch = '${{ inputs.branch }}';
-          const edition = '${{ inputs.edition }}';
-          const owner = '${{ inputs.owner }}';
-
-          console.log(`Determining Docker info for branch: ${branch}, edition: ${edition}`);
-
-          let repo, tag, editions;
-
-          if (branch === 'master') {
-            // Master builds both editions with specific repos
-            editions = ['ee', 'oss'];
-            tag = 'latest';
-
-            if (edition === 'ee') {
-              repo = `${owner}/metabase-enterprise-head`;
-            } else {
-              repo = `${owner}/metabase-head`;
-            }
-          } else {
-            // All other branches only build EE to metabase-dev
-            editions = ['ee'];
-            tag = branch.replaceAll('/', '-'); // slashes make docker sad
-            repo = `${owner}/metabase-dev`;
-          }
-
-          const fullImage = `${repo}:${tag}`;
-
-          // Set outputs
-          core.setOutput('repo', repo);
-          core.setOutput('tag', tag);
-          core.setOutput('full_image', fullImage);
-          core.setOutput('editions', JSON.stringify(editions));
-
-          console.log(`Docker image: ${fullImage}`);
-          console.log(`Editions: ${JSON.stringify(editions)}`);
--- a/.github/actions/prepare-backend/action.yml
+++ b/.github/actions/prepare-backend/action.yml
@@ -1,7 +1,4 @@
 name: Prepare back-end environment
-description: |
-  Prepare the backend. Installs jdk, Clojure, and fetches the cache for m2.
-  The CI config fetches `ci-test-config.json` from master and lets us ignore tests at the var level if they are flaking.
 inputs:
  java-version:
    required: true
@@ -9,6 +6,10 @@ inputs:
  clojure-version:
    required: true
    default: '1.12.0.1488'
+  m2-cache-key:
+    description: 'Key to cache M2 packages from Maven Central'
+    required: true
+    default: 'm2'

 runs:
  using: "composite"
@@ -20,24 +21,20 @@ runs:
        distribution: 'temurin'
    - name: Install Clojure CLI
      shell: bash
-      continue-on-error: true
      run: |
        curl -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh &&
        sudo bash ./linux-install-${{ inputs.clojure-version }}.sh
-
-    - name: Fetch CI config
+    - name: Check to see if dependencies should be cached
+      if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
+      run: echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
      shell: bash
-      run: |
-        curl -o ci-test-config.json https://raw.githubusercontent.com/metabase/metabase/refs/heads/master/ci-test-config.json
-
-    - name: Get M2 cache key
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
-
-    - name: Restore M2 cache
-      uses: actions/cache/restore@v4
+    - name: Get M2 cache
+      uses: actions/cache@v4
+      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
      with:
        path: |
          ~/.m2
          ~/.gitlibs
-        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+        key: ${{ runner.os }}-${{ inputs.m2-cache-key }}-${{ hashFiles('**/deps.edn') }}
+        restore-keys: |
+          ${{ runner.os }}-${{ inputs.m2-cache-key }}-
--- a/.github/actions/prepare-cypress/action.yml
+++ b/.github/actions/prepare-cypress/action.yml
@@ -22,16 +22,16 @@ runs:
        chrome-version: 1097615
      id: setup-chrome

-    - name: Get current week of year
-      id: get-date
-      run: |
-        echo "week-of-year=$(/bin/date "+%G-%V")" >> $GITHUB_OUTPUT
+    - name: Check to see if dependencies should be cached
+      if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
+      run: echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
      shell: bash
    - name: Get Cypress cache
      uses: actions/cache@v4
+      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
      with:
        path: ~/.cache/Cypress
-        key: ${{ runner.os }}-Cypress-${{ steps.get-date.outputs.week-of-year }}
+        key: ${{ runner.os }}-Cypress-${{ hashFiles('**/yarn.lock') }}
    - name: Ensure that Cypress executable is ready
      run: |
        yarn cypress install
--- a/.github/actions/prepare-frontend/action.yml
+++ b/.github/actions/prepare-frontend/action.yml
@@ -3,10 +3,6 @@ inputs:
  node-version:
    description: "The version of Node.js to use, overriding .nvmrc"
    required: false
-  apply-patches:
-    description: "Whether to patch frontend dependencies with patch-package."
-    required: true
-    default: 'true'
 runs:
  using: "composite"
  steps:
@@ -16,32 +12,26 @@ runs:
        node-version: ${{ inputs.node-version }} # this overrides, if present
        node-version-file: ".nvmrc"

-    - name: Get cache keys
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
-
-    - name: Restore M2 cache
-      uses: actions/cache/restore@v4
+    - name: Check to see if dependencies should be cached
+      if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
+      run: |
+        echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
+        yarn cache clean
+      shell: bash
+    - name: Get M2 cache
+      uses: actions/cache@v4
+      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
      with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+        path: ~/.m2
+        key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}

-    - name: Restore node_modules cache
-      uses: actions/cache/restore@v4
+    - name: Get node_modules cache
+      uses: actions/cache@v4
      id: node-modules-cache
+      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
      with:
        path: node_modules
-        key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
+        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock', '**/patches/*.patch') }}

-    # postinstall lifecycle hook can be dangerous in CI so we only run it locally (see package.json)
-    # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
-    # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
-    - name: Clean install
-      run: yarn install --frozen-lockfile --prefer-offline
-      shell: bash
-    - name: Patch frontend dependencies
-      if: inputs.apply-patches == 'true'
-      run: yarn patch-package
+    - run: yarn install --frozen-lockfile --prefer-offline
      shell: bash
--- a/.github/actions/run-embedding-sdk-storybook/action.yml
+++ b/.github/actions/run-embedding-sdk-storybook/action.yml
@@ -0,0 +1,33 @@
+name: Run Embedding SDK Storybook
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare frontend environment
+      uses: ./.github/actions/prepare-frontend
+
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: "cljs"
+
+    - name: Compile CLJS
+      run: yarn build-pure:cljs
+      shell: bash
+
+    - name: Build Storybook
+      run: yarn build-storybook-embedding-sdk
+      shell: bash
+
+    - name: Serve Storybook
+      run: yarn http-server storybook-static -p 6006 &
+      shell: bash
+
+    - name: Wait for Storybook to become available
+      run: |
+        echo "Waiting for Storybook to be served..."
+        while ! curl --silent --fail http://localhost:6006; do
+          sleep 5
+          echo "Retrying..."
+        done
+        echo "Storybook is being served!"
+      shell: bash
--- a/.github/actions/setup-python-runner/action.yml
+++ b/.github/actions/setup-python-runner/action.yml
@@ -1,14 +0,0 @@
-name: Setup Python Runner
-description: Setup python-runner for tests
-inputs:
-  metabase-automation-token:
-    description: Token for accessing the python-runner repository
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Setup python-runner
-      run: ./.github/scripts/setup-python-runner.sh
-      shell: bash
-      env:
-        METABASE_AUTOMATION_USER_TOKEN: ${{ inputs.metabase-automation-token }}
--- a/.github/actions/test-driver/action.yml
+++ b/.github/actions/test-driver/action.yml
@@ -15,6 +15,8 @@ runs:
  steps:
    - name: Prepare back-end environment
      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: driver
    - name: Prepare front-end environment
      uses: ./.github/actions/prepare-frontend
      if: ${{ inputs.build-static-viz == 'true' }}
@@ -27,17 +29,9 @@ runs:
    - name: Test database driver
      run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
      shell: bash
-      id: run-test
-      # Trunk Quarantine controls the final state of the run in the CI!
-      # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-      # whether to fail or to pass the whole job, based on the quarantine list.
-      continue-on-error: true
    - name: Publish Test Report (JUnit)
      uses: dorny/test-reporter@v1
-      # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
-      # test.outcome gives us access to the result before `continue-on-error` overrides it and sets it to 'success'.
-      # We want test reports even if the test step gets cancelled (e.g. times out), hence we match anything that is not a 'success'.
-      if: steps.run-test.outcome != 'success'
+      if: failure()
      with:
        path: "target/junit/**/*_test.xml"
        name: JUnit Test Report ${{ inputs.junit-name }}
@@ -46,11 +40,9 @@ runs:
        list-tests: failed
        fail-on-error: false
    - name: Upload Logs on Failure
-      if: always() && steps.run-test.outcome != 'success'
+      if: failure()
      uses: actions/upload-artifact@v4
      with:
        name: test-logs-${{ github.job }}
        path: logs/test-log.json
        retention-days: 1
-      # Failing to upload the artifact should never affect the outcome of the whole test run.
-      continue-on-error: true
--- a/.github/actions/update-cache/action.yml
+++ b/.github/actions/update-cache/action.yml
@@ -1,41 +0,0 @@
-name: Update cache
-description: |
-  Update a GitHub Actions cache based on a provided path and key.
-  If a cache entry already exists for the given key, it is first removed.
-  This ensures immutability of cache entries, and prevents runtime errors.
-
-inputs:
-  path:
-    description: "The path(s) to cache, separated by newlines."
-    required: true
-  key:
-    description: "The cache key to use."
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-    - name: Check if the cache entry exists
-      id: cache-lookup
-      uses: actions/cache/restore@v4
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}
-        lookup-only: true # Important bit: the action will not fetch anything, just check for the cache existence.
-    - name: Delete the cache entry if it exists
-      if: ${{ steps.cache-lookup.outputs.cache-hit == 'true' }}
-      run: |
-        echo "Cache entry found for key '${{ inputs.key }}'. Deleting it to ensure immutability."
-        gh api \
-          --method DELETE \
-          -H "Accept: application/vnd.github+json" \
-          -H "X-GitHub-Api-Version: 2022-11-28" \
-          /repos/${{ github.repository }}/actions/caches?key=${{ inputs.key }}
-      env:
-        GH_TOKEN: ${{ github.token }}
-      shell: bash
-    - name: Save the new cache entry
-      uses: actions/cache/save@v4
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}
--- a/.github/actions/upload-test-results/action.yml
+++ b/.github/actions/upload-test-results/action.yml
@@ -48,11 +48,11 @@ runs:
        aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/

    - name: Upload results to Trunk
-      if: always() # Important! This step must always run because it controls job's exit code.
+      if: ${{ always() && !(github.event_name == 'pull_request' && github.event.pull_request.draft == true) }}
      uses: trunk-io/analytics-uploader@main
      with:
        junit-paths: ${{ inputs.input-path }}
        variant: ${{ inputs.variant || inputs.output-name }}
        org-slug: metabase
-        dry-run: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == true }} # quarantine, but do not upload results
        token: ${{ inputs.trunk-api-token }}
+      continue-on-error: true
--- a/.github/codeql/codeql-config.yml
+++ b/.github/codeql/codeql-config.yml
@@ -1,5 +1,3 @@
-version: 1
-
 name: "Metabase CodeQL config"

 paths-ignore:
--- a/.github/file-paths.yaml
+++ b/.github/file-paths.yaml
@@ -30,7 +30,6 @@ frontend_configs: &frontend_configs
  - "postcss.config.js"
  - "rspack.config.js"
  - "rspack.main.config.js"
-  - "rspack.embedding-sdk-package.config.js"
  - "rspack.embedding-sdk-bundle.config.js"
  - "rspack.static-viz.config.js"
  - ".nvmrc"
@@ -41,17 +40,10 @@ frontend_sources: &frontend_sources
  - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
  - "frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"

-frontend_embedding_sources:
-  - "enterprise/frontend/src/{embedding,embedding-*}/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
-  - "enterprise/frontend/src/metabase-enterprise/{embedding,embedding-*}**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
-
 frontend_embedding_sdk_sources:
  - *frontend_configs
  - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"

-frontend_embedding_sdk_package_sources:
-  - "enterprise/frontend/src/embedding-sdk-package/**/!(*.spec).{js,jsx,ts,tsx,css}"
-
 frontend_specs: &frontend_specs
  - *shared_specs
  - "frontend/test/**"
@@ -127,6 +119,10 @@ e2e_ci: &e2e_ci
 e2e_specs: &e2e_specs
  - e2e/!(test-host-app)**/*.cy.*.{js,ts}

+e2e_cross_version: &e2e_cross_version
+  - ".github/workflows/e2e-cross-version.yml"
+  - "e2e/test/scenarios/cross-version/**"
+
 e2e_embedding_sdk:
  - *frontend_embedding_sdk_ci
  - *sources
@@ -141,17 +137,16 @@ e2e_embedding_sdk_compatibility:
  - "e2e/runner/embedding-sdk/**"
  - "e2e/test-host-app/**/*.cy.*.{js,ts}"

-snowplow: &snowplow
-  - ".github/workflows/snowplow.yml"
-  - "snowplow/**"
-
 e2e_all:
  - *default
  - *e2e_ci
  - *sources
  - *e2e_specs
  - "e2e/**"
-  - *snowplow
+
+snowplow:
+  - ".github/workflows/snowplow.yml"
+  - "snowplow/**"

 documentation:
  - "docs/**"
@@ -166,7 +161,6 @@ yaml:
  - "**/*.yaml"

 codeql:
-  - ".github/workflows/codeql.yml"
  - "frontend/src/**"
  - "enterprise/frontend/src/**"

--- a/.github/scripts/average-e2e-timings.js
+++ b/.github/scripts/average-e2e-timings.js
@@ -1,171 +0,0 @@
-const fs = require("fs");
-const path = require("path");
-const { execSync } = require("child_process");
-
-const collectAndAverageTimings = async ({
-  github,
-  context,
-  daysBack = 7,
-  existingTimingsPath = "e2e/support/timings.json",
-}) => {
-  try {
-    const artifacts = await findMergedTimingArtifacts({
-      github,
-      context,
-      daysBack,
-    });
-
-    if (artifacts.length === 0) {
-      throw new Error("No timing artifacts found in the specified time range");
-    }
-
-    const timingData = await downloadAndExtractArtifacts(
-      artifacts,
-      github,
-      context,
-    );
-
-    if (timingData.length === 0) {
-      throw new Error("No valid timing data extracted from artifacts");
-    }
-
-    const averagedTimings = averageTimings(timingData);
-    averagedTimings.durations.sort((a, b) => a.spec.localeCompare(b.spec));
-
-    fs.writeFileSync(
-      existingTimingsPath,
-      JSON.stringify(averagedTimings, null, 2),
-    );
-    console.log(`✅ Updated ${existingTimingsPath} with new timing data`);
-
-    return { artifactCount: timingData.length };
-  } catch (error) {
-    console.error("❌ Error in collectAndAverageTimings:", error.message);
-    throw error;
-  }
-};
-
-const findMergedTimingArtifacts = async ({ github, context, daysBack }) => {
-  const cutoffDate = new Date();
-  cutoffDate.setDate(cutoffDate.getDate() - daysBack);
-
-  console.log(
-    `Searching for merged timing artifacts created after ${cutoffDate.toISOString()}`,
-  );
-
-  const artifacts = [];
-  let page = 1;
-
-  while (true) {
-    try {
-      const { data } = await github.rest.actions.listArtifactsForRepo({
-        owner: context.repo.owner,
-        repo: context.repo.repo,
-        name: "merged-e2e-timings",
-        per_page: 100,
-        page,
-      });
-
-      const validArtifacts = data.artifacts
-        .filter((a) => new Date(a.created_at) > cutoffDate && !a.expired)
-        .map(({ name, created_at, id }) => ({ name, created_at, id }));
-      artifacts.push(...validArtifacts);
-
-      if (
-        data.artifacts.some((a) => new Date(a.created_at) <= cutoffDate) ||
-        data.artifacts.length < 100
-      ) {
-        break;
-      }
-      page++;
-    } catch (error) {
-      console.log(
-        `Error fetching artifacts page ${page - 1}: ${error.message}`,
-      );
-      break;
-    }
-  }
-
-  console.log(`Found ${artifacts.length} merged timing artifacts total`);
-  return artifacts;
-};
-
-const downloadAndExtractArtifacts = async (artifacts, github, context) => {
-  const tempDir = "timing-artifacts-temp";
-  fs.mkdirSync(tempDir, { recursive: true });
-
-  const timingData = [];
-
-  for (const artifact of artifacts) {
-    try {
-      console.log(`Downloading artifact: ${artifact.name}`);
-
-      const zipPath = path.join(tempDir, `${artifact.name}.zip`);
-      const extractPath = path.join(tempDir, artifact.name);
-
-      const { data } = await github.rest.actions.downloadArtifact({
-        owner: context.repo.owner,
-        repo: context.repo.repo,
-        artifact_id: artifact.id,
-        archive_format: "zip",
-      });
-
-      fs.writeFileSync(zipPath, Buffer.from(data));
-      fs.mkdirSync(extractPath, { recursive: true });
-      execSync(`unzip -q "${zipPath}" -d "${extractPath}"`);
-
-      const timingFilePath = path.join(extractPath, "runTimings.json");
-
-      if (fs.existsSync(timingFilePath)) {
-        const content = JSON.parse(fs.readFileSync(timingFilePath, "utf8"));
-
-        if (content.durations?.length) {
-          timingData.push(content);
-          console.log(
-            `✅ Extracted timing data from ${artifact.name} (${content.durations.length} specs)`,
-          );
-        } else {
-          console.log(`⚠ Invalid timing data structure in ${artifact.name}`);
-        }
-      } else {
-        console.log(`⚠ No timing data found in ${artifact.name}`);
-      }
-
-      fs.rmSync(extractPath, { recursive: true });
-    } catch (error) {
-      console.log(`❌ Error processing ${artifact.name}: ${error.message}`);
-    }
-  }
-
-  fs.rmSync(tempDir, { recursive: true });
-
-  console.log(
-    `Successfully extracted timing data from ${timingData.length}/${artifacts.length} artifacts`,
-  );
-  return timingData;
-};
-
-const averageTimings = (timingDataArray) => {
-  if (!timingDataArray.length) {
-    throw new Error("No timing data to process");
-  }
-
-  const specTimings = timingDataArray
-    .flatMap((data) => data.durations)
-    .filter((item) => item.spec && typeof item.duration === "number")
-    .reduce((acc, { spec, duration }) => {
-      (acc[spec] = acc[spec] || []).push(duration);
-      return acc;
-    }, {});
-
-  const durations = Object.entries(specTimings).map(([spec, durations]) => ({
-    spec,
-    duration: Math.round(
-      durations.reduce((sum, d) => sum + d, 0) / durations.length,
-    ),
-  }));
-
-  return { durations };
-};
-
-module.exports = { collectAndAverageTimings, averageTimings };
--- a/.github/scripts/average-e2e-timings.unit.spec.js
+++ b/.github/scripts/average-e2e-timings.unit.spec.js
@@ -1,132 +0,0 @@
-const { averageTimings } = require("./average-e2e-timings");
-
-describe("averageTimings", () => {
-  it("should throw error when given empty array", () => {
-    expect(() => averageTimings([])).toThrow("No timing data to process");
-  });
-
-  it("should work for n=1", () => {
-    const input = [
-      {
-        durations: [
-          { spec: "test1.cy.js", duration: 1000 },
-          { spec: "test2.cy.js", duration: 2000 },
-        ],
-      },
-    ];
-
-    const result = averageTimings(input);
-
-    expect(result.durations).toHaveLength(2);
-    expect(result.durations).toContainEqual({
-      spec: "test1.cy.js",
-      duration: 1000,
-    });
-    expect(result.durations).toContainEqual({
-      spec: "test2.cy.js",
-      duration: 2000,
-    });
-  });
-
-  it("should calculate average for multiple specs", () => {
-    const input = [
-      {
-        durations: [
-          { spec: "test1.cy.js", duration: 1000 },
-          { spec: "test2.cy.js", duration: 2000 },
-        ],
-      },
-      {
-        durations: [
-          { spec: "test1.cy.js", duration: 2000 },
-          { spec: "test2.cy.js", duration: 4000 },
-        ],
-      },
-    ];
-
-    const result = averageTimings(input);
-
-    expect(result.durations).toHaveLength(2);
-    expect(result.durations).toContainEqual({
-      spec: "test1.cy.js",
-      duration: 1500,
-    });
-    expect(result.durations).toContainEqual({
-      spec: "test2.cy.js",
-      duration: 3000,
-    });
-  });
-
-  it("should round averages to nearest integer", () => {
-    const input = [
-      {
-        durations: [{ spec: "test1.cy.js", duration: 1001 }],
-      },
-      {
-        durations: [{ spec: "test1.cy.js", duration: 1002 }],
-      },
-    ];
-
-    const result = averageTimings(input);
-
-    expect(result.durations[0].duration).toBe(1002);
-  });
-
-  it("should ignore invalid entries", () => {
-    const input = [
-      {
-        durations: [
-          { spec: "test1.cy.js", duration: 1000 },
-          { spec: "test2.cy.js", duration: "invalid" },
-          { duration: 2000 }, // missing spec
-          { spec: "test3.cy.js", duration: 3000 },
-        ],
-      },
-    ];
-
-    const result = averageTimings(input);
-
-    expect(result.durations).toHaveLength(2);
-    expect(result.durations).toContainEqual({
-      spec: "test1.cy.js",
-      duration: 1000,
-    });
-    expect(result.durations).toContainEqual({
-      spec: "test3.cy.js",
-      duration: 3000,
-    });
-  });
-
-  it("should handle merging different specs", () => {
-    const input = [
-      {
-        durations: [
-          { spec: "test1.cy.js", duration: 1000 },
-          { spec: "test2.cy.js", duration: 2000 },
-        ],
-      },
-      {
-        durations: [
-          { spec: "test1.cy.js", duration: 3000 },
-          { spec: "test3.cy.js", duration: 1000 },
-        ],
-      },
-    ];
-
-    const result = averageTimings(input);
-
-    expect(result.durations).toHaveLength(3);
-    expect(result.durations).toContainEqual({
-      spec: "test1.cy.js",
-      duration: 2000,
-    });
-    expect(result.durations).toContainEqual({
-      spec: "test2.cy.js",
-      duration: 2000,
-    });
-    expect(result.durations).toContainEqual({
-      spec: "test3.cy.js",
-      duration: 1000,
-    });
-  });
-});
--- a/.github/scripts/build-e2e-matrix.js
+++ b/.github/scripts/build-e2e-matrix.js
@@ -3,8 +3,14 @@
 // grouping some specific tests together, other tests are split into chunks

 const DEFAULT_SPEC_PATTERN = "./e2e/test/scenarios/**/*.cy.spec.*";
+const EMBEDDING_SDK_SPEC_PATTERN =
+  "./e2e/test/scenarios/embedding-sdk/**.cy.spec.*";

 const specialTestConfigs = [
+  {
+    name: "embedding-sdk",
+    specs: EMBEDDING_SDK_SPEC_PATTERN,
+  },
  {
    name: "oss-subset",
    edition: "oss",
@@ -12,7 +18,6 @@ const specialTestConfigs = [
    specs: DEFAULT_SPEC_PATTERN,
  },
  { name: "mongo", tags: "@mongo", specs: DEFAULT_SPEC_PATTERN },
-  { name: "python", tags: "@python", specs: DEFAULT_SPEC_PATTERN },
 ];

 /**
--- a/.github/scripts/build-e2e-matrix.unit.spec.js
+++ b/.github/scripts/build-e2e-matrix.unit.spec.js
@@ -21,10 +21,10 @@ describe("buildMatrix", () => {
  });

  it("should apply default specs path when empty entry is provided", () => {
-    const result = testBuildMatrix("", 6);
+    const result = testBuildMatrix("", 5);

-    expect(result.regularChunks).toBe(3);
-    expect(result.config.length).toBe(6);
+    expect(result.regularChunks).toBe(2);
+    expect(result.config.length).toBe(5);
  });

  it("should name regular test groups sequentially", () => {
@@ -43,9 +43,9 @@ describe("buildMatrix", () => {

    expect(result.regularChunks).toBe(0);
    expect(result.config.length).toBe(3);
-    expect(result.config[0].name).toBe("oss-subset");
-    expect(result.config[1].name).toBe("mongo");
-    expect(result.config[2].name).toBe("python");
+    expect(result.config[0].name).toBe("embedding-sdk");
+    expect(result.config[1].name).toBe("oss-subset");
+    expect(result.config[2].name).toBe("mongo");
  });

  it("should correctly calculate regularChunks for non-default spec pattern", () => {
@@ -83,9 +83,9 @@ describe("buildMatrix", () => {
  it("should return special test configs when default spec pattern is provided", () => {
    const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 50);

-    expect(result.config[47].name).toBe("oss-subset");
-    expect(result.config[48].name).toBe("mongo");
-    expect(result.config[49].name).toBe("python");
+    expect(result.config[47].name).toBe("embedding-sdk");
+    expect(result.config[48].name).toBe("oss-subset");
+    expect(result.config[49].name).toBe("mongo");
  });

  it("should not return special test configs when non-default spec pattern is provided", () => {
--- a/.github/scripts/conventional-commit-pr-title-reminder/utils.js
+++ b/.github/scripts/conventional-commit-pr-title-reminder/utils.js
@@ -1,66 +1,24 @@
-const TYPES = new Set([
-  "feat",
-  "fix",
-  "perf",
-  "docs",
-  "style",
-  "refactor",
-  "test",
-  "build",
-  "ci",
-]);
-
-/**
- * @param title {string}
- */
-function isConventionalTitle(title) {
-  const match = /^(?<type>\w+)\((?<rawScopes>[^)]+)\):/.exec(title);
-
-  if (!match) {
-    return false;
-  }
-
-  const [, type, rawScopes] = match;
-  const scopes = rawScopes
-    .split(",")
-    .map((scope) => scope.trim())
-    .filter(Boolean);
-
-  return TYPES.has(type) && scopes.length > 0;
-}
+exports.updateComment = updateComment;

 /** @param {import('@types/github-script').AsyncFunctionArguments} AsyncFunctionArguments */
-async function updateCommentForEmbedding({ github, context }) {
+async function updateComment({ github, context }) {
  const githubUsername = context.payload.sender.login;
-
-  const comment = `${CONVENTIONAL_COMMENT_IDENTIFIER}
-@${githubUsername} You have modified embedding code. Please make sure the PR title follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) style.
-Here are all the supported types:
+  const comment = `${CONVENTIONAL_COMMIT_REMINDER_COMMENT_IDENTIFIER}
+@${githubUsername} You have modified embedding SDK code. Please make sure the PR title follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) style.
+Here are all the supported types that will be shown in the changelog:
 - \`feat\`
 - \`fix\`
 - \`perf\`
- \`docs\`
- \`style\`
- \`refactor\`
- \`test\`
- \`build\`
- \`ci\`

-Please also make sure to include a scope.
+These types \`docs\`, \`style\`, \`refactor\`, \`test\`, \`build\`, and \`ci\` are also encouraged for non-changelog related tasks.
+
+Please also make sure to include \`sdk\` scope, otherwise, the changelog will not include this task.

 For example, these are valid PR titles:
- \`feat(sdk-bundle): Add interactive dashboard component\`
- \`fix(sdk-package): Fixed MetabaseProviderPropsStore logic\`
- \`fix(sdk-package, embed-js): Fix API\``;
+- \`feat(sdk): Add interactive dashboard component\`
+- \`feat(sdk): Support theming pie chart\`
+- \`fix(sdk): Fix static dashboard crash\``;

-  return updateComment(comment, { github, context });
-}
-
-/**
- * @param comment {string}
- * @param {import('@types/github-script').AsyncFunctionArguments} AsyncFunctionArguments
- */
-async function updateComment(comment, { github, context }) {
  const owner = context.repo.owner;
  const repo = context.repo.repo;
  const pullRequestNumber = context.issue.number;
@@ -91,19 +49,20 @@ async function updateComment(comment, { github, context }) {
  }
 }

-const CONVENTIONAL_COMMENT_IDENTIFIER =
-  "<!---conventional comment identifier-->";
-
+const CONVENTIONAL_COMMIT_REMINDER_COMMENT_IDENTIFIER =
+  "<!---conventional commit reminder comment ID-->";
 /**
- * @param comments {{body: string}[]}
+ * @typedef Comment
+ * @property {string} body
+ *
+ * @param {Comment[]} comments
 */
 function getExistingConventionalCommitReminderComment(comments) {
  for (const comment of comments) {
-    if (comment.body.startsWith(CONVENTIONAL_COMMENT_IDENTIFIER)) {
+    if (
+      comment.body.startsWith(CONVENTIONAL_COMMIT_REMINDER_COMMENT_IDENTIFIER)
+    ) {
      return comment;
    }
  }
 }
-
-exports.isConventionalTitle = isConventionalTitle;
-exports.updateCommentForEmbedding = updateCommentForEmbedding;
--- a/.github/scripts/conventional-commit-pr-title-reminder/utils.unit.spec.js
+++ b/.github/scripts/conventional-commit-pr-title-reminder/utils.unit.spec.js
@@ -1,45 +0,0 @@
-const { isConventionalTitle } = require("./utils");
-
-describe("isConventionalTitle", () => {
-  it("returns true for a simple conventional commit", () => {
-    expect(isConventionalTitle("feat: add new feature")).toBe(false);
-  });
-
-  it("returns true for a commit with a scope", () => {
-    expect(isConventionalTitle("fix(api): correct API bug")).toBe(true);
-  });
-
-  it("returns true for a commit with multiple scopes, comma separated", () => {
-    expect(isConventionalTitle("feat(build,deps): update dependencies")).toBe(
-      true,
-    );
-  });
-
-  it("returns true for a commit with multiple scopes, comma separated with space", () => {
-    expect(isConventionalTitle("feat(build, deps): update dependencies")).toBe(
-      true,
-    );
-  });
-
-  it("returns false for a commit with round brackets in a message", () => {
-    expect(isConventionalTitle("feat: (something) update dependencies")).toBe(
-      false,
-    );
-  });
-
-  it("returns false for missing colon", () => {
-    expect(isConventionalTitle("feat add feature")).toBe(false);
-  });
-
-  it("returns false for invalid type", () => {
-    expect(isConventionalTitle("invalidType: some message")).toBe(false);
-  });
-
-  it("returns false for empty message", () => {
-    expect(isConventionalTitle("feat:")).toBe(false);
-  });
-
-  it("returns false for empty input", () => {
-    expect(isConventionalTitle("")).toBe(false);
-  });
-});
--- a/.github/scripts/extract-changed-timings.js
+++ b/.github/scripts/extract-changed-timings.js
@@ -1,39 +0,0 @@
-const extractChangedTimings = ({ oldTimings, newTimings }) => {
-  const oldTimingMap =
-    oldTimings.durations?.reduce((map, item) => {
-      if (item.spec) {
-        map[item.spec] = item.duration;
-      }
-      return map;
-    }, {}) || {};
-
-  const changedDurations = newTimings.durations
-    .filter((item) => {
-      if (!item || !item.spec || typeof item.duration !== "number") {
-        return false;
-      }
-      const newSpec = convertPathFormat(item.spec);
-      const oldDuration = oldTimingMap[newSpec] || oldTimingMap[item.spec];
-      // Include if it's a new spec or the duration has changed
-      return oldDuration === undefined || oldDuration !== item.duration;
-    })
-    .map((item) => ({
-      spec: convertPathFormat(item.spec),
-      duration: item.duration,
-    }));
-
-  return {
-    changedTimings: { durations: changedDurations },
-    hasChanges: changedDurations.length > 0,
-  };
-};
-
-// Convert cypress-split path format to timings.json path format
-// from "e2e/test/scenarios/..." to "../test/scenarios/..."
-function convertPathFormat(specPath) {
-  return specPath.startsWith("e2e/test/")
-    ? specPath.replace("e2e/test/", "../test/")
-    : specPath;
-}
-
-module.exports = { extractChangedTimings };
--- a/.github/scripts/extract-changed-timings.unit.spec.js
+++ b/.github/scripts/extract-changed-timings.unit.spec.js
@@ -1,195 +0,0 @@
-const { extractChangedTimings } = require("./extract-changed-timings");
-
-describe("extractChangedTimings", () => {
-  it("should return empty durations when no changes", () => {
-    const oldTimings = {
-      durations: [
-        { spec: "test1.cy.js", duration: 1000 },
-        { spec: "test2.cy.js", duration: 2000 },
-      ],
-    };
-
-    const newTimings = {
-      durations: [
-        { spec: "test1.cy.js", duration: 1000 },
-        { spec: "test2.cy.js", duration: 2000 },
-      ],
-    };
-
-    const result = extractChangedTimings({ oldTimings, newTimings });
-
-    expect(result.changedTimings.durations).toHaveLength(0);
-    expect(result.hasChanges).toBe(false);
-  });
-
-  it("should detect new specs", () => {
-    const oldTimings = {
-      durations: [{ spec: "test1.cy.js", duration: 1000 }],
-    };
-
-    const newTimings = {
-      durations: [
-        { spec: "test1.cy.js", duration: 1000 },
-        { spec: "test2.cy.js", duration: 2000 },
-      ],
-    };
-
-    const result = extractChangedTimings({ oldTimings, newTimings });
-
-    expect(result.changedTimings.durations).toHaveLength(1);
-    expect(result.changedTimings.durations[0]).toEqual({
-      spec: "test2.cy.js",
-      duration: 2000,
-    });
-    expect(result.hasChanges).toBe(true);
-  });
-
-  it("should detect duration changes", () => {
-    const oldTimings = {
-      durations: [
-        { spec: "test1.cy.js", duration: 1000 },
-        { spec: "test2.cy.js", duration: 2000 },
-      ],
-    };
-
-    const newTimings = {
-      durations: [
-        { spec: "test1.cy.js", duration: 1000 },
-        { spec: "test2.cy.js", duration: 2200 },
-      ],
-    };
-
-    const result = extractChangedTimings({ oldTimings, newTimings });
-
-    expect(result.changedTimings.durations).toHaveLength(1);
-    expect(result.changedTimings.durations[0]).toEqual({
-      spec: "test2.cy.js",
-      duration: 2200,
-    });
-    expect(result.hasChanges).toBe(true);
-  });
-
-  it("should handle missing old timings", () => {
-    const oldTimings = { durations: [] };
-
-    const newTimings = {
-      durations: [
-        { spec: "test1.cy.js", duration: 1000 },
-        { spec: "test2.cy.js", duration: 2000 },
-      ],
-    };
-
-    const result = extractChangedTimings({ oldTimings, newTimings });
-
-    // All timings should be considered "changed" since old timings is empty
-    expect(result.changedTimings.durations).toHaveLength(2);
-    expect(result.changedTimings.durations).toContainEqual({
-      spec: "test1.cy.js",
-      duration: 1000,
-    });
-    expect(result.changedTimings.durations).toContainEqual({
-      spec: "test2.cy.js",
-      duration: 2000,
-    });
-    expect(result.hasChanges).toBe(true);
-  });
-
-  it("should handle invalid timing entries", () => {
-    const oldTimings = {
-      durations: [{ spec: "test1.cy.js", duration: 1000 }],
-    };
-
-    const newTimings = {
-      durations: [
-        { spec: "test1.cy.js", duration: 1000 },
-        { spec: "test2.cy.js", duration: "invalid" },
-        { duration: 2000 }, // missing spec
-        { spec: "test3.cy.js", duration: 3000 },
-      ],
-    };
-
-    const result = extractChangedTimings({ oldTimings, newTimings });
-
-    // Only test3.cy.js should be included (new spec with valid data)
-    expect(result.changedTimings.durations).toHaveLength(1);
-    expect(result.changedTimings.durations[0]).toEqual({
-      spec: "test3.cy.js",
-      duration: 3000,
-    });
-    expect(result.hasChanges).toBe(true);
-  });
-
-  it("should handle timing data with different specs", () => {
-    const oldTimings = {
-      durations: [
-        { spec: "test1.cy.js", duration: 1000 },
-        { spec: "test2.cy.js", duration: 2000 },
-      ],
-    };
-
-    const newTimings = {
-      durations: [
-        { spec: "test1.cy.js", duration: 3000 },
-        { spec: "test3.cy.js", duration: 1000 },
-      ],
-    };
-
-    const result = extractChangedTimings({ oldTimings, newTimings });
-
-    expect(result.changedTimings.durations).toHaveLength(2);
-    expect(result.changedTimings.durations).toContainEqual({
-      spec: "test1.cy.js",
-      duration: 3000,
-    });
-    expect(result.changedTimings.durations).toContainEqual({
-      spec: "test3.cy.js",
-      duration: 1000,
-    });
-    expect(result.hasChanges).toBe(true);
-  });
-
-  it("should convert cypress-split paths to relative paths", () => {
-    const oldTimings = {
-      durations: [
-        {
-          spec: "../test/scenarios/dashboard/dashboard.cy.spec.js",
-          duration: 1000,
-        },
-        {
-          spec: "../test/scenarios/admin/databases.cy.spec.js",
-          duration: 2000,
-        },
-      ],
-    };
-
-    const newTimings = {
-      durations: [
-        {
-          spec: "e2e/test/scenarios/dashboard/dashboard.cy.spec.js",
-          duration: 1200,
-        },
-        {
-          spec: "e2e/test/scenarios/admin/databases.cy.spec.js",
-          duration: 2000,
-        },
-        {
-          spec: "e2e/test/scenarios/collections/collections.cy.spec.js",
-          duration: 1500,
-        },
-      ],
-    };
-
-    const result = extractChangedTimings({ oldTimings, newTimings });
-
-    expect(result.changedTimings.durations).toHaveLength(2);
-    expect(result.changedTimings.durations).toContainEqual({
-      spec: "../test/scenarios/dashboard/dashboard.cy.spec.js",
-      duration: 1200,
-    });
-    expect(result.changedTimings.durations).toContainEqual({
-      spec: "../test/scenarios/collections/collections.cy.spec.js",
-      duration: 1500,
-    });
-    expect(result.hasChanges).toBe(true);
-  });
-});
--- a/.github/scripts/get-issue-data.js
+++ b/.github/scripts/get-issue-data.js
@@ -1,84 +0,0 @@
-const githubSlackMap = require("../../release/github-slack-map.json");
-
-async function getIssueData({ context, github, manualIssueNumber }) {
-  let issueNumber;
-  let issueData;
-  let prReviews = [];
-  const triggerType = context.eventName;
-
-  if (context.eventName === "issues") {
-    issueNumber = context.payload.issue.number;
-    issueData = context.payload.issue;
-  } else if (context.eventName === "workflow_dispatch") {
-    issueNumber = parseInt(manualIssueNumber);
-    const { data } = await github.rest.issues.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      issue_number: issueNumber,
-    });
-    issueData = data;
-  } else if (context.eventName === "pull_request_review") {
-    const prNumber = context.payload.pull_request.number;
-    const { data: prData } = await github.rest.pulls.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      pull_number: prNumber,
-    });
-
-    // Extract issue number from branch name (e.g., "claude-fix/issue-12345-some-title")
-    const branchMatch = prData.head.ref.match(/claude-fix\/issue-(\d+)/);
-    if (!branchMatch) {
-      throw new Error(
-        `Could not extract issue number from branch name: ${prData.head.ref}`,
-      );
-    }
-
-    issueNumber = parseInt(branchMatch[1]);
-
-    const { data } = await github.rest.issues.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      issue_number: issueNumber,
-    });
-    issueData = data;
-
-    const { data: reviews } = await github.rest.pulls.listReviews({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      pull_number: prNumber,
-    });
-
-    prReviews = reviews.filter(
-      (review) =>
-        review.state === "CHANGES_REQUESTED" &&
-        isMetabaseMember(review.user.login),
-    );
-  }
-
-  const { data: comments } = await github.rest.issues.listComments({
-    owner: context.repo.owner,
-    repo: context.repo.repo,
-    issue_number: issueNumber,
-  });
-
-  const employeeComments = comments.filter((comment) =>
-    isMetabaseMember(comment.user.login),
-  );
-
-  return {
-    issueNumber,
-    issueData,
-    employeeComments,
-    prReviews,
-    triggerType,
-    isIssueAuthorEmployee: isMetabaseMember(issueData.user.login),
-  };
-}
-
-function isMetabaseMember(username) {
-  return username in githubSlackMap;
-}
-
-module.exports = {
-  getIssueData,
-};
--- a/.github/scripts/setup-python-runner.sh
+++ b/.github/scripts/setup-python-runner.sh
@@ -1,30 +0,0 @@
-#!/bin/bash
-set -e
-
-# Parse command line arguments
-SKIP_START=false
-
-while [[ $# -gt 0 ]]; do
-  case $1 in
-    --skip-start)
-      SKIP_START=true
-      shift
-      ;;
-    *)
-      echo "Unknown option: $1"
-      echo "Usage: $0 [--skip-start]"
-      exit 1
-      ;;
-  esac
-done
-
-echo "Cloning python-runner repository..."
-git clone --depth 1 https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git python-runner
-
-if [ "$SKIP_START" = false ]; then
-  echo "Starting python-runner..."
-  cd python-runner
-  make run-ci 1> ../python-runner.out.log 2> ../python-runner.err.log
-  make logs 1>> ../python-runner.out.log 2>> ../python-runner.err.log &
-  cd ..
-fi
--- a/.github/team.json
+++ b/.github/team.json
@@ -32,6 +32,20 @@
        "lorem--ipsum"
      ]
    },
+    {
+      "name": "Workflows",
+      "label": ".Team/Workflows",
+      "members": [
+        "qnkhuat",
+        "piranha",
+        "crisptrutski",
+        "spalt08",
+        "stasgavrylov",
+        "uladzimirdev",
+        "kulyk",
+        "kamilmielnik"
+      ]
+    },
    {
      "name": "Admin Webapp",
      "label": ".Team/AdminWebapp",
@@ -44,10 +58,7 @@
      "label": ".Team/DevEx",
      "members": [
        "camsaul",
-        "dpsutton",
-        "escherize",
-        "fraserdrops",
-        "nemanjaglumac"
+        "escherize"
      ]
    },
     {
@@ -59,10 +70,19 @@
        "retro",
        "sloansparger",
        "somtom",
+        "wotbrew",
        "tsplude",
        "lbrdnk",
-        "piranha",
-        "crisptrutski"
+        "bronsa"
+      ]
+    },
+    {
+      "name": "Product Growth",
+      "label": ".Team/ProductGrowth",
+      "members": [
+        "nemanjaglumac",
+        "chodorowicz",
+        "andsalves"
      ]
    },
    {
@@ -91,22 +111,7 @@
        "edpaget",
        "deniskaber",
        "alxnddr",
-        "bpander",
-        "andsalves"
-      ]
-    },
-    {
-      "name": "Gadget",
-      "label": ".Team/Gadget",
-      "members": [
-        "nmezzopera",
-        "bronsa",
-        "wotbrew",
-        "qnkhuat",
-        "chodorowicz",
-        "kamilmielnik",
-        "stasgavrylov",
-        "uladzimirdev"
+        "bpander"
      ]
    }
  ]
--- a/.github/workflows/app-db.yml
+++ b/.github/workflows/app-db.yml
@@ -35,21 +35,21 @@ jobs:
            build-static-viz: false
            test-args: >-
              :only '"enterprise/backend/test"'
-            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
+            exclude-tag: ':mb/driver-tests'
          - name: EE App DB Tests (Part 1)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :partition/total 2
              :partition/index 0
-            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
+            exclude-tag: ':mb/driver-tests'
          - name: EE App DB Tests (Part 2)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :partition/total 2
              :partition/index 1
-            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
+            exclude-tag: ':mb/driver-tests'

    services:
      mysql:
@@ -137,33 +137,31 @@ jobs:
            image: cimg/mysql:8.0
            env:
              enable-ssl-tests: 'false'
-              enable-aws-iam-tests: 'false'
          - name: MySQL Latest
            junit-name: be-tests-mysql-latest-ee
            image: mysql:latest
            env:
              enable-ssl-tests: 'true'
-              enable-aws-iam-tests: 'true'
        job:
          - name: Enterprise Tests
            build-static-viz: false
            test-args: >-
              :only '"enterprise/backend/test"'
-            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
+            exclude-tag: ':mb/driver-tests'
          - name: EE App DB Tests (Part 1)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :partition/total 2
              :partition/index 0
-            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
+            exclude-tag: ':mb/driver-tests'
          - name: EE App DB Tests (Part 2)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :partition/total 2
              :partition/index 1
-            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
+            exclude-tag: ':mb/driver-tests'

    services:
      mysql:
@@ -213,14 +211,6 @@ jobs:
      MB_MYSQL_SSL_TEST_SSL_CERT: ${{ secrets.MB_MYSQL_SSL_TEST_SSL_CERT }}
      MB_MYSQL_SSL_TEST_USER: metabase
      MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
-      MB_MYSQL_AWS_IAM_TEST: ${{ matrix.version.env.enable-aws-iam-tests }}
-      MB_MYSQL_AWS_IAM_TEST_HOST: ${{ secrets.MYSQL_AURORA_IAM_INSTANCE_HOST }}
-      MB_MYSQL_AWS_IAM_TEST_PORT: 3306
-      MB_MYSQL_AWS_IAM_TEST_USER: my_iam_user
-      MB_MYSQL_AWS_IAM_TEST_DBNAME: test_db
-      MB_MYSQL_AWS_IAM_TEST_SSL_CERT: trust
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_AURORA_IAM_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
    # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
    # "be-tests-mariadb-10-2-ee (0)"
    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
@@ -259,19 +249,21 @@ jobs:
            docker-image: postgres:12-alpine
            env:
              enable-ssl-tests: 'false'
-              enable-aws-iam-tests: 'false'
          - name: Postgres Latest
            junit-name: postgres-latest-ee
            docker-image: postgres:latest
            env:
              enable-ssl-tests: 'true'
-              enable-aws-iam-tests: 'true'
        job:
+          - name: Driver Tests
+            build-static-viz: false
+            test-args: >-
+              :only-tags [:mb/driver-tests]
          - name: Enterprise Tests
            build-static-viz: false
            test-args: >-
              :only '"enterprise/backend/test"'
-            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
+            exclude-tag: ':mb/driver-tests'
          - name: EE App DB Tests (Part 1)
            build-static-viz: true
            test-args: >-
@@ -279,14 +271,14 @@ jobs:
              :exclude-tags [:mb/driver-tests]
              :partition/total 2
              :partition/index 0
-            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
+            exclude-tag: ':mb/driver-tests'
          - name: EE App DB Tests (Part 2)
            build-static-viz: true
            test-args: >-
              :only '"test"'
              :partition/total 2
              :partition/index 1
-            exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
+            exclude-tag: ':mb/driver-tests'
    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
    env:
      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
@@ -317,13 +309,6 @@ jobs:
      MB_POSTGRES_SSL_TEST_SSL: ${{ matrix.version.env.enable-ssl-tests }}
      MB_POSTGRES_SSL_TEST_SSL_MODE: verify-full
      MB_POSTGRES_SSL_TEST_SSL_ROOT_CERT_PATH: 'test-resources/certificates/us-east-2-bundle.pem'
-      MB_POSTGRES_AWS_IAM_TEST: ${{ matrix.version.env.enable-aws-iam-tests }}
-      MB_POSTGRES_AWS_IAM_TEST_HOST: ${{ secrets.POSTGRES_AURORA_IAM_INSTANCE_HOST }}
-      MB_POSTGRES_AWS_IAM_TEST_PORT: 5432
-      MB_POSTGRES_AWS_IAM_TEST_USER: my_iam_user
-      MB_POSTGRES_AWS_IAM_TEST_DBNAME: test_db
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_AURORA_IAM_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
    services:
      postgres:
        image: ${{ matrix.version.docker-image }}
--- a/.github/workflows/auto-assign.yml
+++ b/.github/workflows/auto-assign.yml
@@ -23,7 +23,7 @@ jobs:
        uses: actions/github-script@v7
        with:
          github-token: ${{ steps.generate-token.outputs.token }}
-          script: | #js
+          script: |
            const fs = require('fs');
            const teamConfig = JSON.parse(fs.readFileSync('.github/team.json', 'utf-8'));
            const prAuthor = context.payload.pull_request.user.login;
@@ -65,3 +65,10 @@ jobs:
              issue_number: prNumber,
              labels: [team.label]
            });
+
+            return team.projectUrl || null;
+      - uses: actions/add-to-project@v0.5.0
+        if: ${{ steps.auto-assign.outputs.result != 'null' }}
+        with:
+          project-url: ${{ steps.auto-assign.outputs.result }}
+          github-token: ${{ steps.generate-token.outputs.token }}
--- a/.github/workflows/auto-backport.yml
+++ b/.github/workflows/auto-backport.yml
@@ -6,19 +6,11 @@ on:

 jobs:
  create-backport:
-    if:
-      | # the PR must have a backport label when it's merged, or be labeled with a backport label after merge
+    if: | # the PR must be merged and have a backport label
      github.event.pull_request.merged == true && (
-        github.event.action == 'closed' && (
-          contains(github.event.pull_request.labels.*.name, 'backport') ||
-          contains(github.event.pull_request.labels.*.name, 'double-backport') ||
-          contains(github.event.pull_request.labels.*.name, 'triple-backport')
-        ) ||
-        github.event.action == 'labeled' && (
-          github.event.label.name == 'backport' ||
-          github.event.label.name == 'double-backport' ||
-          github.event.label.name == 'triple-backport'
-        )
+        contains(github.event.pull_request.labels.*.name, 'backport') ||
+        contains(github.event.pull_request.labels.*.name, 'double-backport') ||
+        contains(github.event.pull_request.labels.*.name, 'triple-backport')
      )
    runs-on: ubuntu-latest
    steps:
--- a/.github/workflows/backend-cloverage.yml
+++ b/.github/workflows/backend-cloverage.yml
@@ -10,202 +10,21 @@ jobs:
    # don't run this workflow on a cron for forks
    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        modules:
-          - actions
-          - activity-feed
-          - analytics
-          - analyze
-          - api
-          - api-keys
-          - api-routes
-          - app-db
-          - appearance
-          - audit-app
-          - auth-provider
-          - batch-processing
-          - bookmarks
-          - bug-reporting
-          - cache
-          - channel
-          - classloader
-          - cloud-migration
-          - cmd
-          - collections
-          - config
-          - connection-pool
-          - content-translation
-          - content-verification
-          - core
-          - dashboards
-          - database-routing
-          - driver
-          - driver-api
-          - eid-translation
-          - embedding
-          - events
-          - formatter
-          - geojson
-          - glossary
-          - graph
-          - indexed-entities
-          - internal-stats
-          - legacy-mbql
-          - lib
-          - lib-be
-          - logger
-          - login-history
-          - model-persistence
-          - models
-          - native-query-snippets
-          - notification
-          - parameters
-          - permissions
-          - pivot
-          - plugins
-          - premium-features
-          - product-feedback
-          - public-sharing
-          - pulse
-          - queries
-          - query-permissions
-          - query-processor
-          - remote-sync
-          - request
-          - revisions
-          - sample-data
-          - search
-          - secrets
-          - segments
-          - server
-          - session
-          - settings
-          - setup
-          - sso
-          - startup
-          - store-api
-          - sync
-          - system
-          - task
-          - task-history
-          - testing-api
-          - tiles
-          - timeline
-          - types
-          - upload
-          - user-key-value
-          - users
-          - util
-          - version
-          - view-log
-          - warehouse-schema
-          - warehouses
-          - xrays
+    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
-
+        with:
+          m2-cache-key: "cloverage"
      - name: Build static viz frontend
        run: yarn build-static-viz
        env:
          MB_EDITION: ee
      - name: Collect the test coverage
-        run: |
-          clojure -X:dev:ci:ee:ee-dev:test:cloverage \
-            :ns-regex     '["^metabase\\.${{ matrix.modules }}\\..*"]' \
-            :test-ns-path '["test/metabase/${{ matrix.modules }}"]'
-        continue-on-error: true
-
+        run: clojure -X:dev:ci:ee:ee-dev:test:cloverage
      - name: Upload coverage to codecov.io
-        if: always()
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./target/coverage/codecov.json
-          flags: back-end
-
-  be-linter-cloverage-enterprise:
-    # don't run this workflow on a cron for forks
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        modules:
-          - action-v2
-          - advanced-config
-          - advanced-permissions
-          - ai-entity-analysis
-          - ai-sql-fixer
-          - ai-sql-generation
-          - analytics
-          - api
-          - audit-app
-          - auth-provider
-          - billing
-          - bookmarks
-          - cache
-          - cloud-add-ons
-          - comments
-          - content-translation
-          - content-verification
-          - core
-          - dashboard-subscription-filters
-          - database-replication
-          - database-routing
-          - dependencies
-          - documents
-          - email
-          - embedding-hub
-          - gsheets
-          - harbormaster
-          - impersonation
-          - internal-stats
-          - llm
-          - metabot-v3
-          - permission-debug
-          - premium-features
-          - public-sharing
-          - remote-sync
-          - sandbox
-          - scim
-          - search
-          - semantic-search
-          - serialization
-          - snippet-collections
-          - sso
-          - stale
-          - transforms
-          - transforms-python
-          - upload-management
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-
-      - name: Build static viz frontend
-        run: yarn build-static-viz
-        env:
-          MB_EDITION: ee
-      - name: Collect the test coverage
-        run: |
-          clojure -X:dev:ci:ee:ee-dev:test:cloverage \
-            :ns-regex     '["^metabase-enterprise\\.${{ matrix.modules }}\\..*"]' \
-            :test-ns-path '["enterprise/backend/test/metabase/${{ matrix.modules }}"]'
-        continue-on-error: true
-
-      - name: Upload coverage to codecov.io
-        if: always()
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./target/coverage/codecov.json
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -21,6 +21,8 @@ jobs:
      - uses: actions/checkout@v4
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: 'kondo'
      - name: Run clj-kondo
        run: ./bin/mage kondo

@@ -33,6 +35,8 @@ jobs:
      - uses: actions/checkout@v4
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "eastwood"
      - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
        name: Run Eastwood linter

@@ -47,13 +51,11 @@ jobs:
        job:
          - name: Enterprise Tests
            edition: ee
-            test-group-name: ee
            build-static-viz: 'false'
            test-args: >-
              :only '"enterprise/backend/test"'
          - name: EE App DB Tests (Part 1)
            edition: ee
-            test-group-name: ee-app-db-1
            build-static-viz: 'true'
            test-args: >-
              :only '["test" ".clj-kondo/test"]'
@@ -61,7 +63,6 @@ jobs:
              :partition/index 0
          - name: EE App DB Tests (Part 2)
            edition: ee
-            test-group-name: ee-app-db-2
            build-static-viz: 'true'
            test-args: >-
              :only '["test" ".clj-kondo/test"]'
@@ -69,7 +70,6 @@ jobs:
              :partition/index 1
          - name: OSS App DB Tests (Part 1)
            edition: oss
-            test-group-name: oss-app-db-1
            build-static-viz: 'true'
            test-args: >-
              :only '["test" ".clj-kondo/test"]'
@@ -77,7 +77,6 @@ jobs:
              :partition/index 0
          - name: OSS App DB Tests (Part 2)
            edition: oss
-            test-group-name: oss-app-db-2
            build-static-viz: 'true'
            test-args: >-
              :only '["test" ".clj-kondo/test"]'
@@ -108,6 +107,7 @@ jobs:
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
        with:
+          m2-cache-key: be-tests
          java-version: "${{ matrix.java-version }}"
      # Depending on which files changed, we might either have to build static-viz
      # from scratch or download the previously built artifact
@@ -129,10 +129,6 @@ jobs:
          clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev
          :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
          ${{ matrix.job.test-args }}
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
-        continue-on-error: true

      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
@@ -158,10 +154,10 @@ jobs:
          fail-on-error: false

      - name: Upload Logs on Failure
-        if: always() && !success()
+        if: failure()
        uses: actions/upload-artifact@v4
        with:
-          name: test-logs-${{ matrix.java-version }}-${{ matrix.job.edition }}-${{ github.job }}-${{ matrix.job.test-group-name }}
+          name: test-logs-${{ matrix.java-version }}-${{ matrix.job.edition }}-${{ github.job }}
          path: logs/test-log.json
          retention-days: 1

@@ -179,6 +175,8 @@ jobs:
      - uses: actions/checkout@v4
      - name: Prepare backend
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: be-check
      # TODO -- we should probably also check WITHOUT ee -- do a check with only OSS namespaces on the classpath
      - name: Check namespaces
        run: clojure -M:ee:drivers:check
@@ -192,6 +190,8 @@ jobs:
      - uses: actions/checkout@v4
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: 'cljfmt'
      - name: Run cljfmt
        run: ./bin/mage cljfmt-all --force-check

--- a/.github/workflows/block-master-source-branch-prs.yml
+++ b/.github/workflows/block-master-source-branch-prs.yml
@@ -1,14 +0,0 @@
-name: Block Master Branch PRs
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-jobs:
-  check-source-branch:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Block master branch PRs
-        if: github.head_ref == 'master'
-        run: |
-          echo "PRs from `master` branches are not allowed, please use a new branch name for your PR."
-          exit 1
--- a/.github/workflows/bugs-triage-slack-notification.yml
+++ b/.github/workflows/bugs-triage-slack-notification.yml
@@ -0,0 +1,52 @@
+name: Bugs Slack Notification
+
+on:
+  issues:
+    types:
+      - labeled
+jobs:
+  on-issue-labeled:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: |
+      github.event.label.name == '.Needs Triage' && contains(github.event.issue.labels.*.name, 'Type:Bug')
+    steps:
+      - name: Setting title
+        uses: actions/github-script@v7
+        id: vars
+        with:
+          script: |
+            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
+      - name: Check for labels containing team name
+        id: check_labels
+        run: |
+          labels_json=$(sed 's/&/\$/g' <<< '${{ toJson(github.event.issue.labels) }}')
+          echo "has_team_label=false" >> "$GITHUB_OUTPUT"
+          for label in "$labels_json"
+          do
+            if [[ $label == *".Team"* ]]; then
+              echo "Label contains the team name."
+              echo "has_team_label=true" >> "$GITHUB_OUTPUT"
+              break
+            fi
+          done
+      - name: Send the issue ${{ github.event.issue.number }} to Slack
+        id: slack
+        if: steps.check_labels.outputs.has_team_label == 'false'
+        uses: slackapi/slack-github-action@v1.26.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_BUG_TRIAGE_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
--- a/.github/workflows/build-scripts.yml
+++ b/.github/workflows/build-scripts.yml
@@ -16,6 +16,8 @@ jobs:
    - name: Prepare back-end environment
      timeout-minutes: 5
      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: 'build-scripts'

    - name: Run build and release script tests
      run: clojure -X:dev:drivers:build:build-dev:build-test:ci
--- a/.github/workflows/cache-generator.yml
+++ b/.github/workflows/cache-generator.yml
@@ -1,107 +0,0 @@
-# This workflow is the single source of truth for generating and updating various caches used by our CI pipeline.
-# It sets the fresh cache each Monday but provides a manual trigger to update it on-demand.
-#
-# All other jobs only restore from this cache; *they never update it*!
-# They should always use `actions/cache/restore@v4` because `actions/cache@v4` would attempt to save the cache.
-#
-# Our agreed-upon strategy is to use a deterministic cache key based on the week of the year.
-# Jobs can utilize the prior week's cache if the current week's cache is not found.
-#
-#
-# PRINCIPLES:
-#   - The cache is never wrong!
-#   - Caches are immutable once created.
-#   - Caches are for speeding up builds, not for correctness.
-#   - It is faster to download a large cache than to re-resolve missing dependencies.
-#
-#
-# DESIGN:
-#
-# 1. Prepare
-#     - A job first prepares the local environment (e.g., installs JDK, Clojure, Node.js, etc.)
-#     - This fetches the dependencies from the cache (if it exists) and warms up the local cache for this workflow.
-# 2. Resolve
-#     - The next step pre-resolves all dependencies, ensuring that the local cache is fully populated and up-to-date.
-# 3. Update
-#     - The final step saves the local cache back to GitHub Actions cache with a deterministic key.
-#     - If a cache entry already exists for that key, it is deleted first to ensure immutability.
-#
-name: Cache Generator
-
-on:
-  schedule:
-    - cron: '0 3 * * 1'   # Mondays at 03:00 UTC
-  workflow_dispatch:      # manually update the cache
-
-concurrency:
-  group: cache-generator
-  cancel-in-progress: true
-
-jobs:
-  get-cache-keys:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-      - name: Get cache keys
-        uses: ./.github/actions/get-cache-keys
-        id: get-cache-keys
-    outputs:
-      m2-cache-key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
-      node-cache-key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
-      eslint-cache-key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
-
-  generate-m2-cache:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    needs: get-cache-keys
-    env:
-      M2_CACHE_KEY: ${{ needs.get-cache-keys.outputs.m2-cache-key }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare backend
-        uses: ./.github/actions/prepare-backend
-
-      # Add or remove aliases to affect the cache size and its contents.
-      # Adjust to taste, then redeploy this workflow.
-      - name: Pre-resolve dependencies
-        run: clojure -A:build:dev:ee:ee-dev:drivers:drivers-dev:cljs -P
-
-      - name: Update M2 cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: |
-            ~/.m2
-            ~/.gitlibs
-          key: ${{ env.M2_CACHE_KEY }}
-
-  generate-frontend-caches:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    needs: get-cache-keys
-    env:
-      NODE_CACHE_KEY: ${{ needs.get-cache-keys.outputs.node-cache-key }}
-      ESLINT_CACHE_KEY: ${{ needs.get-cache-keys.outputs.eslint-cache-key }}
-    steps:
-      - uses: actions/checkout@v4
-      # `prepare-frontend` action (1) prepares Node.js and (2) fetches the node_modules cache if it exists.
-      # It then (3) runs `yarn install --frozen-lockfile --prefer-offline` which ensures the local cache is fully populated.
-      # IMPORTANT: Caching node_modules after patches are already applied will break any PR that attempts to either:
-      #   - upgrade a patched library
-      #   - change a patch
-      # Hence why we explicitly exclude patches from the cache (controlled by the `apply-patches` action input).
-      - name: Install front-end dependencies
-        uses: ./.github/actions/prepare-frontend
-        with:
-          apply-patches: 'false'
-
-      - name: Update node_modules cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: node_modules
-          key: ${{ env.NODE_CACHE_KEY }}
-
-      - name: Update eslint cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: .eslintcache
-          key: ${{ env.ESLINT_CACHE_KEY }}
--- a/.github/workflows/chromatic.yml
+++ b/.github/workflows/chromatic.yml
@@ -40,6 +40,8 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
      - name: Compile CLJS
        run: NODE_ENV=development yarn build-pure:cljs
      - name: Publish to Chromatic
--- a/.github/workflows/claude-code-bug-fix.yml
+++ b/.github/workflows/claude-code-bug-fix.yml
@@ -1,326 +0,0 @@
-name: "Claude Code Bug Fix"
-
-on:
-  issues:
-    types:
-      - labeled
-  pull_request_review:
-    types:
-      - submitted
-  workflow_dispatch:
-    inputs:
-      issue_number:
-        description: "Issue number to fix"
-        required: true
-        type: string
-      override_employee_check:
-        description: "Override employee check for issue creator"
-        required: false
-        default: false
-        type: boolean
-
-jobs:
-  auto-fix-bug:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-      id-token: write
-    if: |
-      (github.event_name == 'issues' && github.event.label.name == 'Claude Bug Fix' && github.event.issue.state == 'open') ||
-      (github.event_name == 'workflow_dispatch') ||
-      (github.event_name == 'pull_request_review' && github.event.review.state == 'changes_requested' && startsWith(github.event.pull_request.head.ref, 'claude-fix/'))
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Get issue data and check employee status
-        id: get_issue
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { getIssueData } = require('${{ github.workspace }}/.github/scripts/get-issue-data.js');
-
-            try {
-              const result = await getIssueData({
-                context,
-                github,
-                manualIssueNumber: '${{ github.event.inputs.issue_number }}'
-              });
-
-              const { issueNumber, issueData, employeeComments, prReviews, triggerType, isIssueAuthorEmployee } = result;
-
-              // Check employee status and fail if not authorized
-              if (!result.isIssueAuthorEmployee && '${{ github.event.inputs.override_employee_check }}' !== 'true') {
-                  core.setFailed(`User ${result.issueData.user.login} is not a Metabase employee. Skipping bug fix automation.`);
-              }
-
-              core.setOutput('issue_number', issueNumber);
-              core.setOutput('issue_data', JSON.stringify(issueData));
-              core.setOutput('issue_comments', JSON.stringify(employeeComments));
-              core.setOutput('pr_reviews', JSON.stringify(prReviews));
-              core.setOutput('trigger_type', triggerType);
-            } catch (error) {
-              core.setFailed(error.message);
-            }
-
-      - name: Set up git configuration
-        run: |
-          git config --global user.name "Claude Code[bot]"
-          git config --global user.email "noreply@anthropic.com"
-
-      - name: Prepare issue context and bug fix prompt
-        id: prepare_prompt
-        uses: actions/github-script@v7
-        env:
-          ISSUE_DATA: ${{ steps.get_issue.outputs.issue_data }}
-          ISSUE_COMMENTS: ${{ steps.get_issue.outputs.issue_comments }}
-          PR_REVIEWS: ${{ steps.get_issue.outputs.pr_reviews }}
-          TRIGGER_TYPE: ${{ steps.get_issue.outputs.trigger_type }}
-        with:
-          script: |
-            const issueData = JSON.parse(process.env.ISSUE_DATA);
-            const issueComments = JSON.parse(process.env.ISSUE_COMMENTS);
-            const prReviews = JSON.parse(process.env.PR_REVIEWS);
-            const triggerType = process.env.TRIGGER_TYPE;
-            const issueNumber = '${{ steps.get_issue.outputs.issue_number }}';
-
-            // Convert issue title to kebab case and create branch name
-            const issueTitle = issueData.title || 'untitled';
-            const kebabTitle = issueTitle
-              .toLowerCase()
-              .replace(/[^a-z0-9]+/g, '-')
-              .replace(/^-+|-+$/g, '')
-              .replace(/-+/g, '-')
-              .substring(0, 50);
-            const branchName = `claude-fix/issue-${issueNumber}-${kebabTitle}`;
-
-            // Format data for bash environment
-            const formattedComments = issueComments.length > 0
-              ? issueComments.map(comment =>
-                  `**Comment by @${comment.user.login} on ${comment.created_at}:**\n${comment.body}`
-                ).join('\n\n---\n\n')
-              : '';
-            const formattedReviews = prReviews.length > 0
-              ? prReviews.map(review =>
-                  `**Review by @${review.user.login} on ${review.submitted_at} (Changes Requested):**\n${review.body || 'No review comment provided'}`
-                ).join('\n\n---\n\n')
-              : '';
-
-            core.exportVariable('BRANCH_NAME', branchName);
-            core.exportVariable('ISSUE_NUMBER', issueNumber);
-            core.exportVariable('ISSUE_TITLE', issueData.title);
-            core.exportVariable('ISSUE_AUTHOR', issueData.user.login);
-            core.exportVariable('ISSUE_CREATED', issueData.created_at);
-            core.exportVariable('ISSUE_BODY', issueData.body || 'No description provided');
-            core.exportVariable('ISSUE_COMMENTS_FORMATTED', formattedComments);
-            core.exportVariable('PR_REVIEWS_FORMATTED', formattedReviews);
-            core.exportVariable('TRIGGER_TYPE', triggerType);
-
-      - name: Generate bug fix prompt
-        run: |
-          cat << 'EOF' >> $GITHUB_ENV
-          BUG_FIX_PROMPT<<PROMPT_END
-          You are helping to fix a bug reported in GitHub issue #${{ env.ISSUE_NUMBER }}.
-
-          ## Bug Report Details
-          **Title:** ${{ env.ISSUE_TITLE }}
-          **Reporter:** ${{ env.ISSUE_AUTHOR }}
-          **Created:** ${{ env.ISSUE_CREATED }}
-
-          **Description:**
-          ${{ env.ISSUE_BODY }}
-
-          **Comments:**
-          ${{ env.ISSUE_COMMENTS_FORMATTED }}
-          EOF
-
-          # Add review feedback section only if this is a review trigger
-          if [ "${{ env.TRIGGER_TYPE }}" = "pull_request_review" ]; then
-            cat << 'EOF' >> $GITHUB_ENV
-
-          ## Previous Fix Attempt - Review Feedback (MUST ADDRESS)
-          Your previous automated fix attempt received the following feedback that needs to be addressed:
-
-          ${{ env.PR_REVIEWS_FORMATTED }}
-          EOF
-          fi
-
-          # Add the rest of the prompt (always the same)
-          cat << 'EOF' >> $GITHUB_ENV
-
-          ## Instructions
-          1. **Analyze the issue description and comments** - Understand what the issue is describing
-             a. Pay particular attention to reproduction steps and if there's an agreed upon fix.
-          2. **Search the codebase** - Use Grep and Glob tools to find relevant files
-          3. **Implement a fix** - Follow existing code patterns and conventions
-          4. **Test the fix** - Run appropriate tests using the commands in CLAUDE.md:
-             - JavaScript/TypeScript: `yarn test-unit path/to/file.unit.spec.js`
-             - Clojure: `clojure -X:dev:test :only namespace/test-name`
-             - Lint: `yarn lint-eslint-pure` for JS/TS, `./bin/mage kondo <file>` for Clojure
-          5. **Verify the fix** - Ensure tests pass and code follows conventions
-
-          ## Important Guidelines
-          - Follow the development patterns in CLAUDE.md
-          - Write failing tests first, then fix them
-          - Work in small, testable increments
-          - Don't commit changes - leave that for the workflow
-          - IMPORTANT: Focus only on fixing the reported bug, don't make unrelated changes
-
-          ## Scratchpad Directory
-          A `.claude-scratchpad/` directory has been created for your temporary files:
-          - Use this directory for ALL temporary verification files. However, prefer using production test files rather than adhoc ones.
-          - Only modify actual production code in the main repository directories
-          - The scratchpad will be cleaned up automatically - nothing from it will be committed
-
-          Start by understanding the bug and then systematically work toward a solution.
-          PROMPT_END
-          EOF
-
-      - name: Determine branch strategy
-        run: |
-          BRANCH_NAME="${{ env.BRANCH_NAME }}"
-          if git branch -r --list "origin/${BRANCH_NAME}" | grep -q .; then
-            echo "Branch already exists: $BRANCH_NAME"
-            echo "Will push to existing branch and skip PR creation"
-            echo "BRANCH_EXISTS=true" >> $GITHUB_ENV
-          else
-            echo "Creating new branch: $BRANCH_NAME"
-            echo "Will create new PR"
-            echo "BRANCH_EXISTS=false" >> $GITHUB_ENV
-          fi
-
-          # Export the branch name
-          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
-
-      - name: Create scratchpad directory for Claude
-        run: |
-          # Create a scratchpad directory for Claude to use for temporary files
-          mkdir -p .claude-scratchpad
-          echo "Scratchpad directory created for Claude's temporary verification files"
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-
-      - name: Generate Bug Fix with Claude Code
-        uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          prompt: ${{ env.BUG_FIX_PROMPT }}
-          claude_args: |
-            --allowedTools "Bash(yarn test-unit*),Bash(yarn lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
-            --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"
-
-      - name: Clean up scratchpad directory
-        run: |
-          # Remove the scratchpad directory so its contents don't get committed
-          rm -rf .claude-scratchpad/
-          # Remove output file generated by Claude Code action
-          rm -f output.txt
-          echo "Scratchpad directory and action output files cleaned up"
-
-      - name: Check for changes and analysis
-        id: check_changes
-        run: |
-          # Now check for actual code changes (excluding analysis file)
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-            echo "Changes detected:"
-            git status --short
-          else
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-            echo "No changes made by Claude."
-          fi
-
-      - name: Get issue team labels and prepare reviewers
-        if: steps.check_changes.outputs.has_changes == 'true'
-        id: prepare_reviewers
-        uses: actions/github-script@v7
-        env:
-          ISSUE_DATA: ${{ steps.get_issue.outputs.issue_data }}
-        with:
-          script: |
-            const issueData = JSON.parse(process.env.ISSUE_DATA);
-            const issueLabels = issueData.labels.map(label => label.name);
-            const teamLabels = issueLabels.filter(label => label.startsWith('.Team/'));
-            const issueCreator = issueData.user.login;
-            core.setOutput('team_labels', teamLabels.join(','));
-            core.setOutput('reviewers', issueCreator);
-
-      - name: Create Pull Request
-        if: steps.check_changes.outputs.has_changes == 'true'
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: ${{ env.BRANCH_NAME }}
-          base: master
-          commit-message: |
-            Fix: ${{ env.ISSUE_TITLE }}
-
-            Fixes #${{ env.ISSUE_NUMBER }}
-
-            🤖 Generated with [Claude Code](https://claude.ai/code)
-
-            Co-Authored-By: Claude <noreply@anthropic.com>
-          committer: "Claude Code[bot] <noreply@anthropic.com>"
-          author: "Claude Code[bot] <noreply@anthropic.com>"
-          title: "Fix: ${{ env.ISSUE_TITLE }}"
-          body: |
-            This PR automatically fixes the bug reported in #${{ env.ISSUE_NUMBER }}.
-
-            ## Bug Report
-            **Original Issue:** #${{ env.ISSUE_NUMBER }}
-            **Reporter:** @${{ env.ISSUE_AUTHOR }}
-            **Issue Title:** ${{ env.ISSUE_TITLE }}
-
-            ## Automated Fix
-            🤖 This fix was generated automatically by Claude Code based on the issue description.
-
-            **Please review carefully:**
-            - [ ] The fix addresses the reported issue
-            - [ ] Tests pass and code follows conventions
-            - [ ] No unrelated changes were introduced
-            - [ ] The solution is appropriate and maintainable
-
-            ## Next Steps
-            - Review the changes and test thoroughly
-            - If the fix looks good, approve and merge
-            - If issues are found, either fix them or close this PR
-
-            ---
-            Closes #${{ env.ISSUE_NUMBER }}
-
-            🤖 Generated with [Claude Code](https://claude.ai/code)
-
-            Co-Authored-By: Claude <noreply@anthropic.com>
-          labels: |
-            ${{ steps.prepare_reviewers.outputs.team_labels }}
-            automated-fix
-            ci skip
-          reviewers: ${{ steps.prepare_reviewers.outputs.reviewers }}
-
-      - name: Log existing branch update
-        if: steps.check_changes.outputs.has_changes == 'true' && env.BRANCH_EXISTS == 'true'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            console.log('🔄 Updated existing branch: ${{ env.BRANCH_NAME }}');
-            console.log('The changes have been pushed to the existing PR for this issue.');
-
-      - name: Log analysis for no changes
-        if: steps.check_changes.outputs.has_changes == 'false'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            console.log('🤖 No code changes were made by Claude.');
--- a/.github/workflows/claude-code-review.yaml
+++ b/.github/workflows/claude-code-review.yaml
@@ -1,101 +0,0 @@
-name: "Claude Code Review"
-
-on:
-  pull_request:
-    types:
-      - closed
-      - synchronize
-      - labeled
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-code-review
-  cancel-in-progress: true
-
-jobs:
-  review:
-    if: |
-      (
-        github.event.action == 'closed' &&
-        github.event.pull_request.merged == true
-      ) ||
-      contains(github.event.pull_request.labels.*.name, 'Claude Code Review')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
-          persist-credentials: false
-
-      # Apparently comments on specific lines and top-level comments about the PR as a whole are TWO TOTALLY DIFFERENT
-      # TYPES OF THINGS. So we have to fetch and delete separately.
-      - name: Delete old Claude PR review comments
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        shell: bash
-        run: |
-          # Get old comment IDs from the bot
-          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          echo "Deleting line comments: $old_line_comment_ids"
-          # Delete each comment
-          for id in $old_line_comment_ids; do
-            gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
-            echo "Deleted line comment $id"
-          done
-          # Get old top-level comment IDs (technically "issue" comments on the PR?)
-          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          echo "Deleting top-level comments: $old_top_level_comment_ids"
-          # Delete each comment
-          for id in $old_top_level_comment_ids; do
-            gh api -X DELETE "/repos/$REPO/issues/comments/$id"
-            echo "Deleted top-level comment $id"
-          done
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-          permission-contents: read       # Required for reading repository files and PR diffs
-          permission-pull-requests: write # Required for creating inline comments and PR comments
-
-      - name: Fetch Community Clojure Style Guide
-        run: >-
-          curl https://raw.githubusercontent.com/bbatsov/clojure-style-guide/refs/heads/master/README.adoc -o CLOJURE_STYLE_GUIDE.adoc
-
-      - uses: anthropics/claude-code-action@v1
-        timeout-minutes: 10
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Review this pull request with a focus on:
-
-            - Compliance with project coding standards and conventions
-            - Code quality and best practices
-            - Clear and correct docstrings
-            - Clear and correct comments explaining what the code is doing
-
-            DO NOT post any comments confirming that something is correct or congratulating someone for following our
-            guidelines -- only post comments for style violations or concerns.
-
-            Follow additional guidelines in the "Code Review Guidelines" section of CLAUDE.md .
-
-            Note: The PR branch is already checked out in the current working directory.
-
-            Use `gh pr comment` for top-level feedback.
-            Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
-            Only post GitHub comments - don't submit review text as messages.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),ReadFile(CLOJURE_STYLE_GUIDE.adoc)"
--- a/.github/workflows/cljs.yml
+++ b/.github/workflows/cljs.yml
@@ -38,5 +38,7 @@ jobs:
      uses: ./.github/actions/prepare-frontend
    - name: Prepare back-end environment
      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: 'cljs'
    - name: Run Cljs tests
      run: yarn run test-cljs
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,10 +30,9 @@ jobs:
    - name: Checkout repository
      uses: actions/checkout@v4
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@v2
      with:
        languages: javascript
        config-file: ./.github/codeql/codeql-config.yml
-        trap-caching: false
    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@v2
--- a/.github/workflows/containerize-uberjar.yml
+++ b/.github/workflows/containerize-uberjar.yml
@@ -1,126 +0,0 @@
-name: Containerize Uberjar
-
-on:
-  workflow_call:
-  workflow_dispatch:
-
-jobs:
-  get-container-info:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    name: Get container info
-    outputs:
-      editions: ${{ steps.ee-info.outputs.editions }}
-      ee: ${{ toJson(fromJson(steps.build-matrix.outputs.result).ee) }}
-      oss: ${{ toJson(fromJson(steps.build-matrix.outputs.result).oss) }}
-    steps:
-      - name: Check out the code
-        uses: actions/checkout@v4
-      - name: Get EE Docker info
-        id: ee-info
-        uses: ./.github/actions/get-docker-info
-        with:
-          edition: ee
-      - name: Get OSS Docker info
-        id: oss-info
-        uses: ./.github/actions/get-docker-info
-        with:
-          edition: oss
-      - name: Build matrix info
-        id: build-matrix
-        uses: actions/github-script@v7
-        with:
-          script: | # js
-            const editions = JSON.parse('${{ steps.ee-info.outputs.editions }}');
-            const result = {
-              editions: editions,
-              ee: {
-                repo: '${{ steps.ee-info.outputs.repo }}',
-                tag: '${{ steps.ee-info.outputs.tag }}'
-              },
-              oss: {
-                repo: '${{ steps.oss-info.outputs.repo }}',
-                tag: '${{ steps.oss-info.outputs.tag }}'
-              }
-            };
-            console.log('Build matrix:', result);
-            return result;
-
-  containerize:
-    needs: [get-container-info]
-    if: needs.get-container-info.result == 'success'
-    strategy:
-      matrix:
-        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
-    uses: ./.github/workflows/containerize-jar.yml
-    secrets: inherit
-    with:
-      artifact-name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
-      commit: ${{ github.event.inputs.commit || github.sha }}
-      repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
-      tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
-      release: "false"
-      build-args: |
-        GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.sha }}
-
-  run-trivy:
-    needs: [get-container-info, containerize]
-    strategy:
-      matrix:
-        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
-    runs-on: ubuntu-22.04
-    name: Run Trivy vulnerability scanner
-    steps:
-      - name: Check out the code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit || github.sha }}
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.29.0
-        env:
-          TRIVY_OFFLINE_SCAN: true
-          repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
-          tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
-        with:
-          image-ref: docker.io/${{ env.repo }}:${{ env.tag }}
-          format: sarif
-          output: trivy-results.sarif
-          version: "v0.57.1"
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: "trivy-results.sarif"
-
-  post-comment:
-    needs: [get-container-info, containerize]
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-22.04
-    name: Post PR comment
-    steps:
-      - name: Check out the code
-        uses: actions/checkout@v4
-      - name: Get Docker info for comment
-        id: docker-info
-        uses: ./.github/actions/get-docker-info
-        with:
-          branch: ${{ github.head_ref || github.ref_name }}
-          edition: ee
-
-      - name: Post PR comment
-        uses: marocchino/sticky-pull-request-comment@v2
-        with:
-          header: docker-build-status
-          message: |
-            ✅ Docker build completed for commit ${{ github.event.pull_request.head.sha || github.sha }}
-
-            The uberjar has been built and containerized successfully.
-
-            **Branch:** `${{ github.head_ref || github.ref_name }}`
-            **Docker Image:** `${{ steps.docker-info.outputs.full_image }}`
-            **Docker Hub:** [View on Docker Hub](https://hub.docker.com/r/${{ steps.docker-info.outputs.repo }}/tags?name=${{ steps.docker-info.outputs.tag }})
-            **Triggered by:** @${{ github.actor }}
-
-            Pull the image:
-            ```bash
-            docker pull ${{ steps.docker-info.outputs.full_image }}
-            ```
--- a/.github/workflows/conventional-commit-pr-title-reminder.yml
+++ b/.github/workflows/conventional-commit-pr-title-reminder.yml
@@ -4,53 +4,39 @@ on:
  pull_request:
    branches:
      - master
+    paths:
+      - enterprise/frontend/src/embedding-sdk/**

 jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      frontend_embedding_sources: ${{ steps.changes.outputs.frontend_embedding_sources }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
  pr-title-reminder:
    runs-on: ubuntu-22.04
    timeout-minutes: 5
    permissions:
      pull-requests: write
-    needs: [ files-changed ]
-    if: |
-      !cancelled() &&
-      needs.files-changed.outputs.frontend_embedding_sources == 'true'
    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
-
      - name: Check if the PR title is already following Conventional Commits style
        uses: actions/github-script@v7
        id: is-conventional-commit
        with:
          result-encoding: string
          script: | # js
-            const { isConventionalTitle } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
            const pullRequestTitle = context.payload.pull_request.title
+            const conventionalCommitRegex = /^(?<type>\w+)\((?<scope>\w+)\):/
+            const match = pullRequestTitle.match(conventionalCommitRegex)
+            if (match) {
+              const { type, scope } = match.groups
+              return ['feat', 'fix', 'perf', 'docs', 'style', 'refactor', 'test', 'build', 'ci'].includes(type) && scope === 'sdk'
+            }

-            return isConventionalTitle(pullRequestTitle)
+      - name: Checkout repository so `gh` CLI works
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}

      - name: Remind PR authors to use conventional commit in the title
        if: ${{ steps.is-conventional-commit.outputs.result != 'true' }}
        uses: actions/github-script@v7
        with:
-          script: | #js
-            const { updateCommentForEmbedding } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
-
-            await updateCommentForEmbedding({github, context})
+          script: |
+            const { updateComment } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
+            await updateComment({github, context})
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -1,28 +1,25 @@
-name: Frontend Test Coverage
+name: Test coverage

 on:
-  workflow_dispatch:
  schedule:
    - cron: '40 1 * * *' # every day at 1:40

 jobs:
  fe-test-coverage:
    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - name: Prepare front-end environment
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
      - name: Run frontend unit tests
-        run: |
-          yarn run test-unit \
-            --silent \
-            --coverage \
-            --testTimeout=60000
+        run: yarn run test-unit --silent --coverage
      - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
        with:
          files: ./coverage/lcov.info
          flags: front-end
--- a/.github/workflows/docs-generate-base.yml
+++ b/.github/workflows/docs-generate-base.yml
@@ -1,184 +0,0 @@
-# .github/workflows/reusable-doc-update.yml
-name: Reusable - Update Documentation
-
-# This workflow is designed to be called by other workflows.
-on:
-  workflow_call:
-    inputs:
-      target_branch:
-        description: "The branch to check out and create a PR against"
-        required: true
-        type: string
-    secrets:
-      automation_token:
-        description: "A token with permissions to create branches and PRs"
-        required: true
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  update-docs:
-    name: Update documentation for ${{ inputs.target_branch }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.automation_token }}
-          ref: ${{ inputs.target_branch }}
-
-      - name: Prepare backend environment
-        uses: ./.github/actions/prepare-backend
-
-      - name: Generate environment variables documentation
-        id: generate_env_docs
-        run: |
-          set -e  # Exit on any error
-          # Ensure we're on the target branch for documentation generation
-          git checkout ${{ inputs.target_branch }}
-          echo "Generating environment variables documentation from branch: ${{ inputs.target_branch }}"
-          clojure -M:ee:doc environment-variables-documentation
-        continue-on-error: false
-
-      - name: Generate config template documentation
-        id: generate_config_docs
-        run: |
-          set -e  # Exit on any error
-          echo "Generating config template documentation..."
-          clojure -M:ee:doc config-template
-        continue-on-error: false
-
-      - name: Generate API documentation
-        id: generate_api_docs
-        run: |
-          set -e  # Exit on any error
-          echo "Generating API documentation..."
-          clojure -M:ee:doc api-documentation
-        continue-on-error: false
-
-      - name: Generate command documentation
-        id: generate_command_docs
-        run: |
-          set -e  # Exit on any error
-          echo "Generating API documentation..."
-          clojure -M:ee:doc command-documentation
-        continue-on-error: false
-
-      - name: Check for changes
-        id: check_changes
-        run: |
-          if git diff --quiet docs/; then
-            echo "changes=false" >> $GITHUB_OUTPUT
-            echo "No changes detected in docs directory"
-          else
-            echo "changes=true" >> $GITHUB_OUTPUT
-            echo "Changes detected in docs directory"
-          fi
-
-      - name: Create branch and commit changes
-        id: commit_and_push
-        if: steps.check_changes.outputs.changes == 'true'
-        run: |
-          git config user.name github-actions
-          git config user.email github-actions@github.com
-
-          BRANCH_NAME="docs/auto-update-${{ inputs.target_branch }}-$(date +%Y-%m-%d-%H%M%S)"
-          echo "Creating branch: $BRANCH_NAME"
-
-          # Create and switch to new branch from current target branch
-          git checkout -b "$BRANCH_NAME"
-
-          # Stage and commit changes
-          git add docs/
-          if git diff --cached --quiet; then
-            echo "No changes to commit"
-            exit 1
-          fi
-
-          git commit -m "Update generated docs (${{ inputs.target_branch }})" --no-verify
-          git push -u origin "$BRANCH_NAME"
-
-          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
-          echo "Successfully created and pushed branch"
-
-      - name: Create pull request
-        id: create_pr
-        if: steps.check_changes.outputs.changes == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.automation_token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          CHANGES_SUMMARY=$(git diff --name-only HEAD~1 docs/ 2>/dev/null | head -10 | sed 's/^/- /' || echo "- No specific files detected")
-          TOTAL_CHANGES=$(git diff --name-only HEAD~1 docs/ 2>/dev/null | wc -l || echo "0")
-          BRANCH_NAME="${{ steps.commit_and_push.outputs.branch_name }}"
-
-          echo "Creating PR with branch: $BRANCH_NAME"
-          echo "Changes detected: $TOTAL_CHANGES files"
-
-          for i in {1..3}; do
-            echo "Attempt $i of 3..."
-            if gh pr create \
-              --base "${{ inputs.target_branch }}" \
-              --head "$BRANCH_NAME" \
-              --title "Auto-update documentation for ${{ inputs.target_branch }}" \
-              --body "This PR contains automatically generated documentation updates.
-
-          ## Changes detected
-          The following documentation files were updated:
-          $CHANGES_SUMMARY
-          $([ "$TOTAL_CHANGES" -gt 10 ] && echo "- ... and $((TOTAL_CHANGES - 10)) more files")
-
-          ## Generation commands
-          Documentation was generated using:
-          - \`clojure -M:ee:doc environment-variables-documentation\`
-          - \`clojure -M:ee:doc config-template\`
-          - \`clojure -M:ee:doc api-documentation\`
-
-          Please review the changes and merge if they look correct." \
-              --label "Type:Documentation" \
-              --label "no-backport" \
-              --reviewer "metabase/tech-writers"; then
-              echo "PR created successfully on attempt $i"
-              break
-            else
-              echo "PR creation failed on attempt $i"
-              if [ $i -eq 3 ]; then
-                echo "All attempts failed. Exiting with error."
-                exit 1
-              fi
-              echo "Waiting 10 seconds before retry..."
-              sleep 10
-            fi
-          done
-
-      - name: Skip PR creation
-        if: steps.check_changes.outputs.changes == 'false'
-        run: |
-          echo "No documentation changes detected, skipping PR creation"
-
-      - name: Workflow summary
-        if: always()
-        run: |
-          if [ "${{ steps.check_changes.outputs.changes }}" == "true" ]; then
-            if [ "${{ steps.commit_and_push.outcome }}" == "success" ]; then
-              if [ "${{ steps.create_pr.outcome }}" == "success" ]; then
-                echo "## ✅ Documentation Updated Successfully" >> $GITHUB_STEP_SUMMARY
-                echo "- Branch: \`${{ steps.commit_and_push.outputs.branch_name }}\`" >> $GITHUB_STEP_SUMMARY
-                echo "- PR created targeting **${{ inputs.target_branch }}**" >> $GITHUB_STEP_SUMMARY
-              else
-                echo "## ⚠️ Branch Created but PR Failed" >> $GITHUB_STEP_SUMMARY
-                echo "- Branch: \`${{ steps.commit_and_push.outputs.branch_name }}\`" >> $GITHUB_STEP_SUMMARY
-                echo "- Manual PR creation required" >> $GITHUB_STEP_SUMMARY
-              fi
-            else
-              echo "## ❌ Failed to Create Branch" >> $GITHUB_STEP_SUMMARY
-              echo "- Check workflow logs for details" >> $GITHUB_STEP_SUMMARY
-            fi
-          else
-            echo "## ℹ️ No Changes Detected" >> $GITHUB_STEP_SUMMARY
-            echo "- Documentation is up to date on **${{ inputs.target_branch }}**" >> $GITHUB_STEP_SUMMARY
-          fi
--- a/.github/workflows/docs-links.yml
+++ b/.github/workflows/docs-links.yml
@@ -1,36 +0,0 @@
-name: Check doc links
-
-on:
-  pull_request:
-    paths:
-      - "docs/**"
-  workflow_dispatch:
-
-jobs:
-  link-checker:
-    name: Check documentation links
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          sparse-checkout: |
-            docs
-            .lychee
-
-      - name: Cache lychee
-        uses: actions/cache@v3
-        with:
-          path: ~/.cache/lychee
-          key: lychee-${{ runner.os }}-${{ hashFiles('.lychee/config.toml') }}
-
-      - name: Run link checker
-        id: link-check
-        uses: lycheeverse/lychee-action@v2
-        with:
-          fail: true
-          args: docs --config ./.lychee/config.toml --offline
-          format: markdown
--- a/.github/workflows/docs-master-generate.yml
+++ b/.github/workflows/docs-master-generate.yml
@@ -1,15 +0,0 @@
-name: Auto-update documentation (master)
-
-on:
-  schedule:
-    - cron: "0 1 * * 1-5" # Every Monday through Friday at 1 AM UTC
-  workflow_dispatch:
-
-jobs:
-  update-master-docs:
-    name: Call documentation update for master
-    uses: ./.github/workflows/docs-generate-base.yml
-    with:
-      target_branch: "master"
-    secrets:
-      automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
--- a/.github/workflows/docs-release-generate.yml
+++ b/.github/workflows/docs-release-generate.yml
@@ -1,21 +0,0 @@
-name: Auto-update documentation (release)
-
-on:
-  schedule:
-    - cron: "0 2 * * 1-5" # Every Monday through Friday at 2 AM UTC
-  workflow_dispatch:
-    inputs:
-      target_branch:
-        description: "Target branch for documentation update"
-        required: false
-        default: "release-x.56.x"
-        type: string
-
-jobs:
-  update-release-docs:
-    name: Call documentation update for release branch
-    uses: ./.github/workflows/docs-generate-base.yml
-    with:
-      target_branch: ${{ inputs.target_branch || 'release-x.56.x' }}
-    secrets:
-      automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
--- a/.github/workflows/docs_bump_detected.yml
+++ b/.github/workflows/docs_bump_detected.yml
@@ -0,0 +1,44 @@
+name: Docs Bump Detected
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
+    branches:
+      - 'master'
+      - 'release-x.[0-9]+.x'
+    paths:
+      - 'docs/**'
+
+jobs:
+  push_workflow_to_docs_metabase_github_io_job:
+    runs-on: ubuntu-latest
+    env:
+      SOURCE_BRANCH: ${{ github.head_ref || github.ref  }}
+      TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    steps:
+      - name: Report changed docs files exist
+        run: |
+          echo "A PR with changes in the docs directory was detected."
+          echo "Sending workflow trigger to create/update the corresponding PR in docs repo."
+          echo "source branch: $SOURCE_BRANCH"
+          echo "target branch: $TARGET_BRANCH"
+          echo "pr number: $PR_NUMBER"
+
+      - name: Trigger repo dispatch
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | #js
+              github.rest.repos.createDispatchEvent({
+                owner: "${{ github.repository_owner }}",
+                repo: "docs.metabase.github.io",
+                event_type: "docs_update",
+                client_payload: {
+                  dispatch_type: "docs_update",
+                  source_branch: process.env.SOURCE_BRANCH,
+                  target_branch: process.env.TARGET_BRANCH,
+                  pr_number: process.env.PR_NUMBER}});
--- a/.github/workflows/docs_close_detected.yml
+++ b/.github/workflows/docs_close_detected.yml
@@ -0,0 +1,43 @@
+name: Docs Close Detected
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - 'master'
+      - 'release-x.[0-9]+.x'
+    paths:
+      - 'docs/**'
+
+jobs:
+  push_and_merge_workflow_to_docs_metabase_github_io_job:
+    if: github.event.pull_request.merged == false
+    runs-on: ubuntu-latest
+    env:
+      SOURCE_BRANCH: ${{ github.head_ref || github.ref  }}
+      TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    steps:
+      - name: Report changed docs files exist
+        run: |
+          echo "A PR with changes to the docs directory was closed."
+          echo "Sending workflow trigger to close corresponding PR in docs repo."
+          echo "source branch: $SOURCE_BRANCH"
+          echo "target branch: $TARGET_BRANCH"
+          echo "pr number: $PR_NUMBER"
+
+      - name: Trigger repo dispatch
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | #js
+            github.rest.repos.createDispatchEvent({
+                owner: "${{ github.repository_owner }}",
+                repo: "docs.metabase.github.io",
+                event_type: "docs_close",
+                client_payload: {
+                  dispatch_type: "docs_close",
+                  source_branch: process.env.SOURCE_BRANCH,
+                  target_branch: process.env.TARGET_BRANCH,
+                  pr_number: process.env.PR_NUMBER}});
--- a/.github/workflows/docs_merge_detected.yml
+++ b/.github/workflows/docs_merge_detected.yml
@@ -0,0 +1,43 @@
+name: Docs Merge Detected
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - 'master'
+      - 'release-x.[0-9]+.x'
+    paths:
+      - 'docs/**'
+
+jobs:
+  push_and_merge_workflow_to_docs_metabase_github_io_job:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    env:
+      SOURCE_BRANCH: ${{ github.head_ref || github.ref  }}
+      TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    steps:
+      - name: Report changed docs files exist
+        run: |
+          echo "A PR with changes to the docs directory was merged."
+          echo "Sending workflow trigger to merge corresponding PR in docs repo."
+          echo "source branch: $SOURCE_BRANCH"
+          echo "target branch: $TARGET_BRANCH"
+          echo "pr number: $PR_NUMBER"
+
+      - name: Trigger repo dispatch
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | #js
+            github.rest.repos.createDispatchEvent({
+                owner: "${{ github.repository_owner }}",
+                repo: "docs.metabase.github.io",
+                event_type: "docs_merge",
+                client_payload: {
+                  dispatch_type: "docs_merge",
+                  source_branch: process.env.SOURCE_BRANCH,
+                  target_branch: process.env.TARGET_BRANCH,
+                  pr_number: process.env.PR_NUMBER}});
--- a/.github/workflows/drivers-stress-test.yml
+++ b/.github/workflows/drivers-stress-test.yml
@@ -689,51 +689,18 @@ jobs:
        junit-name: 'be-tests-starburst-ee'
        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"

-  login-to-ecr:
-    if: inputs.driver == 'Vertica'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    permissions:
-      id-token: write
-      contents: read
-    steps:
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v4
-      with:
-        role-to-assume: ${{ secrets.CI_IAM_ROLE }}
-        role-session-name: GitHub_to_AWS_via_FederatedOIDC
-        aws-region: us-east-1
-    - name: Get ECR password
-      id: login-ecr
-      run: |
-        PASSWORD=$(aws ecr get-login-password --region us-east-1)
-
-        REGISTRY="$(aws sts get-caller-identity --query Account --output text).dkr.ecr.us-east-1.amazonaws.com"
-
-        echo "docker_username=AWS" >> $GITHUB_OUTPUT
-        echo "docker_password=$PASSWORD" >> $GITHUB_OUTPUT
-        echo "registry=$REGISTRY" >> $GITHUB_OUTPUT
-    outputs:
-      registry: ${{ steps.login-ecr.outputs.registry }}
-      docker_username: ${{ steps.login-ecr.outputs.docker_username }}
-      docker_password: ${{ steps.login-ecr.outputs.docker_password }}
-
  be-tests-vertica-ee:
    if: inputs.driver == 'Vertica'
    runs-on: ubuntu-22.04
-    needs: login-to-ecr
    timeout-minutes: 90
    env:
      CI: 'true'
      DRIVERS: vertica
    services:
      vertica:
-        image: ${{ needs.login-to-ecr.outputs.registry }}/vertica-ce:25.3.0-0
+        image: vertica/vertica-ce:12.0.2-0
        ports:
          - "5433:5433"
-        credentials:
-          username: ${{ needs.login-to-ecr.outputs.docker_username }}
-          password: ${{ needs.login-to-ecr.outputs.docker_password }}
    steps:
    - uses: actions/checkout@v4
    - name: Make plugins directory
--- a/.github/workflows/drivers.yml
+++ b/.github/workflows/drivers.yml
@@ -44,11 +44,11 @@ jobs:
            echo "A relevant team label is present. Tier 3 driver tests will run."
          else
            echo "Checking for changes in relevant folders..."
-            CHANGED_FILES=$(git diff --name-only $(git merge-base ${{ github.event.pull_request.base.sha }} ${{ github.sha }}) ${{ github.sha }})
+            CHANGED_FILES=$(git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }})

            # Initialize an empty array to store folders with changes
            CHANGED_FOLDERS=()
-            for folder in "src/metabase/lib" "src/metabase/query_processor" "modules/drivers" "src/metabase/driver"; do
+            for folder in "src/metabase/lib" "src/metabase/query_processor" "modules/drivers"; do
              if echo "$CHANGED_FILES" | grep -q "$folder"; then
                CHANGED_FOLDERS+=("$folder")
              fi
@@ -90,7 +90,6 @@ jobs:
        junit-name: 'be-tests-athena-ee'
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -107,19 +106,6 @@ jobs:
    if: ${{ !inputs.skip }}
    runs-on: ubuntu-22.04
    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          - name: Driver Tests
-            test-args: >-
-              :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
-# DS 2025-09-26 temporarily disabled while we diagnose flakes
-#          - name: Transforms Python Tests
-#            test-args: >-
-#              :only-tags [:mb/transforms-python-test]
-#            needs-python-runner: true
    env:
      CI: 'true'
      DRIVERS: bigquery-cloud-sdk
@@ -130,20 +116,15 @@ jobs:
      MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
-    name: BigQuery ${{ matrix.job.name }}
+    name: BigQuery
    steps:
    - uses: actions/checkout@v4
-    - name: Setup python-runner
-      if: ${{ matrix.job.needs-python-runner == true }}
-      uses: ./.github/actions/setup-python-runner
-      with:
-        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
    - name: Test BigQuery Cloud SDK driver
-      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-bigquery-cloud-sdk-ee'
-        test-args: ${{ matrix.job.test-args }}
+        test-args: >-
+          :only-tags [:mb/driver-tests]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -155,29 +136,11 @@ jobs:
        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
        aws-region: ${{ vars.AWS_REGION }}
        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-    - name: Cleanup python-runner
-      if: ${{ always() && matrix.job.needs-python-runner == true }}
-      uses: ./.github/actions/cleanup-python-runner
-      with:
-        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}

  be-tests-clickhouse-ee:
    if: ${{ !inputs.skip }}
    runs-on: ubuntu-22.04
    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          - name: Driver Tests
-            test-args: >-
-              :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
-          - name: Transforms Python Tests
-            test-args: >-
-              :only-tags [:mb/transforms-python-test]
-            needs-python-runner: true
    env:
      CI: 'true'
      DRIVERS: clickhouse
@@ -185,14 +148,9 @@ jobs:
      MB_CLICKHOUSE_TEST_PORT: 8123
      MB_CLICKHOUSE_TEST_OLD_PORT: 8124
      MB_CLICKHOUSE_TEST_NGINX_PORT: 8127
-    name: Clickhouse ${{ matrix.job.name }}
+    name: Clickhouse
    steps:
    - uses: actions/checkout@v4
-    - name: Setup python-runner
-      if: ${{ matrix.job.needs-python-runner == true }}
-      uses: ./.github/actions/setup-python-runner
-      with:
-        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
    - name: Add ClickHouse TLS instance to /etc/hosts
      run: |
        sudo echo "127.0.0.1 server.clickhouseconnect.test" | sudo tee -a /etc/hosts
@@ -209,11 +167,11 @@ jobs:
          clickhouse_cluster_node2
          nginx
    - name: Test Clickhouse driver
-      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-clickhouse-ee'
-        test-args: ${{ matrix.job.test-args }}
+        test-args: >-
+          :only-tags [:mb/driver-tests]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -225,12 +183,6 @@ jobs:
        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
        aws-region: ${{ vars.AWS_REGION }}
        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-    - name: Cleanup python-runner
-      if: ${{ always() && matrix.job.needs-python-runner == true }}
-      uses: ./.github/actions/cleanup-python-runner
-      with:
-        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}

  be-tests-druid-ee:
    needs: determine-driver-skips
@@ -256,7 +208,6 @@ jobs:
        junit-name: 'be-tests-druid-ee'
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -293,7 +244,6 @@ jobs:
        junit-name: 'be-tests-druid-jdbc-ee'
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -330,7 +280,6 @@ jobs:
        junit-name: 'be-tests-databricks-ee'
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -368,7 +317,6 @@ jobs:
        junit-name: 'be-tests-databricks-multi-catalog-ee'
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -391,13 +339,11 @@ jobs:
    steps:
    - uses: actions/checkout@v4
    - name: Test H2 driver
-      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: 'be-tests-h2'
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -423,34 +369,25 @@ jobs:
            image: circleci/mariadb:10.2.23
            env:
              enable-ssl-tests: 'false'
-              enable-aws-iam-tests: 'false'
          - name: MariaDB Latest
            junit-name: be-tests-mariadb-latest-ee
            image: circleci/mariadb:latest
            env:
              enable-ssl-tests: 'false'
-              enable-aws-iam-tests: 'false'
          - name: MySQL 8.0
            junit-name: be-tests-mysql-8-0-ee
            image: mysql:8.0
            env:
              enable-ssl-tests: 'false'
-              enable-aws-iam-tests: 'false'
          - name: MySQL Latest
            junit-name: be-tests-mysql-latest-ee
            image: mysql:latest
            env:
              enable-ssl-tests: 'true'
-              enable-aws-iam-tests: 'true'
        job:
          - name: Driver Tests
            test-args: >-
              :only-tags [:mb/driver-tests]
-            exclude-tag: ':mb/transforms-python-test'
-          - name: Transforms Python Tests
-            test-args: >-
-              :only-tags [:mb/transforms-python-test]
-            needs-python-runner: true

    services:
      mysql:
@@ -500,26 +437,12 @@ jobs:
      MB_MYSQL_SSL_TEST_SSL_CERT: ${{ secrets.MB_MYSQL_SSL_TEST_SSL_CERT }}
      MB_MYSQL_SSL_TEST_USER: metabase
      MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
-      MB_MYSQL_AWS_IAM_TEST: ${{ matrix.version.env.enable-aws-iam-tests }}
-      MB_MYSQL_AWS_IAM_TEST_HOST: ${{ secrets.MYSQL_AURORA_IAM_INSTANCE_HOST }}
-      MB_MYSQL_AWS_IAM_TEST_PORT: 3306
-      MB_MYSQL_AWS_IAM_TEST_USER: my_iam_user
-      MB_MYSQL_AWS_IAM_TEST_DBNAME: test_db
-      MB_MYSQL_AWS_IAM_TEST_SSL_CERT: trust
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_AURORA_IAM_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
    # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
    # "be-tests-mariadb-10-2-ee (0)"
    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
    steps:
      - uses: actions/checkout@v4
-      - name: Setup python-runner
-        if: ${{ matrix.job.needs-python-runner == true }}
-        uses: ./.github/actions/setup-python-runner
-        with:
-          metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
      - name: Test ${{ matrix.version.name }}
-        id: test-driver
        uses: ./.github/actions/test-driver
        with:
          junit-name: ${{ matrix.version.junit-name }}
@@ -537,12 +460,6 @@ jobs:
          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
          aws-region: ${{ vars.AWS_REGION }}
          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-      - name: Cleanup python-runner
-        if: always()
-        uses: ./.github/actions/cleanup-python-runner
-        with:
-          upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-          logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}

  be-tests-mongo:
    needs: determine-driver-skips
@@ -559,15 +476,6 @@ jobs:
          - name: MongoDB Latest
            junit-name: be-tests-mongo-latest-ee
            image: mongo:latest
-        job:
-          - name: Driver Tests
-            test-args: >-
-              :exclude-tags '[:mongo-sharded-cluster-tests :mb/transforms-python-test]'
-              :only-tags [:mb/driver-tests]
-          - name: Transforms Python Tests
-            test-args: >-
-              :only-tags [:mb/transforms-python-test]
-            needs-python-runner: true
    env:
      CI: 'true'
      DRIVERS: mongo
@@ -581,20 +489,16 @@ jobs:
        env:
          MONGO_INITDB_ROOT_USERNAME: metabase
          MONGO_INITDB_ROOT_PASSWORD: metasample123
-    name: ${{ matrix.version.name }} ${{ matrix.job.name }}
+    name: ${{ matrix.version.name }}
    steps:
    - uses: actions/checkout@v4
-    - name: Setup python-runner
-      if: ${{ matrix.job.needs-python-runner == true }}
-      uses: ./.github/actions/setup-python-runner
-      with:
-        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
    - name: Test ${{ matrix.version.name }}
-      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: ${{ matrix.version.junit-name }}
-        test-args: ${{ matrix.job.test-args }}
+        test-args: >-
+          :exclude-tags [:mongo-sharded-cluster-tests]
+          :only-tags [:mb/driver-tests]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -606,12 +510,6 @@ jobs:
        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
        aws-region: ${{ vars.AWS_REGION }}
        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-    - name: Cleanup python-runner
-      if: ${{ always() && matrix.job.needs-python-runner == true }}
-      uses: ./.github/actions/cleanup-python-runner
-      with:
-        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}

  be-tests-mongo-ssl:
    needs: determine-driver-skips
@@ -664,7 +562,7 @@ jobs:
        with:
          junit-name: ${{ matrix.version.junit-name }}
          test-args: >-
-            :exclude-tags '[:mongo-sharded-cluster-tests :mb/transforms-python-test]'
+            :exclude-tags [:mongo-sharded-cluster-tests]
            :only-tags [:mb/driver-tests]
      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
@@ -772,7 +670,6 @@ jobs:
        junit-name: ${{ matrix.version.junit-name }}
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -798,22 +695,15 @@ jobs:
            docker-image: postgres:12-alpine
            env:
              enable-ssl-tests: 'false'
-              enable-aws-iam-tests: 'false'
          - name: Postgres Latest
            junit-name: postgres-latest-ee
            docker-image: postgres:latest
            env:
              enable-ssl-tests: 'true'
-              enable-aws-iam-tests: 'true'
        job:
          - name: Driver Tests
            test-args: >-
              :only-tags [:mb/driver-tests]
-            exclude-tag: ':mb/transforms-python-test'
-          - name: Transforms Python Tests
-            test-args: >-
-              :only-tags [:mb/transforms-python-test]
-            needs-python-runner: true
    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
    env:
      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
@@ -844,13 +734,6 @@ jobs:
      MB_POSTGRES_SSL_TEST_SSL: ${{ matrix.version.env.enable-ssl-tests }}
      MB_POSTGRES_SSL_TEST_SSL_MODE: verify-full
      MB_POSTGRES_SSL_TEST_SSL_ROOT_CERT_PATH: 'test-resources/certificates/us-east-2-bundle.pem'
-      MB_POSTGRES_AWS_IAM_TEST: ${{ matrix.version.env.enable-aws-iam-tests }}
-      MB_POSTGRES_AWS_IAM_TEST_HOST: ${{ secrets.POSTGRES_AURORA_IAM_INSTANCE_HOST }}
-      MB_POSTGRES_AWS_IAM_TEST_PORT: 5432
-      MB_POSTGRES_AWS_IAM_TEST_USER: my_iam_user
-      MB_POSTGRES_AWS_IAM_TEST_DBNAME: test_db
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_AURORA_IAM_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
    services:
      postgres:
        image: ${{ matrix.version.docker-image }}
@@ -862,13 +745,7 @@ jobs:
          POSTGRES_HOST_AUTH_METHOD: trust
    steps:
      - uses: actions/checkout@v4
-      - name: Setup python-runner
-        if: ${{ matrix.job.needs-python-runner == true }}
-        uses: ./.github/actions/setup-python-runner
-        with:
-          metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
      - name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
-        id: test-driver
        uses: ./.github/actions/test-driver
        with:
          junit-name: 'be-tests-${{ matrix.version.junit-name }}'
@@ -886,12 +763,6 @@ jobs:
          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
          aws-region: ${{ vars.AWS_REGION }}
          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-      - name: Cleanup python-runner
-        if: always()
-        uses: ./.github/actions/cleanup-python-runner
-        with:
-          upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-          logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}

  be-tests-presto-jdbc-ee:
    needs: determine-driver-skips
@@ -950,7 +821,6 @@ jobs:
        junit-name: 'be-tests-presto-jdbc-ee'
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -980,14 +850,8 @@ jobs:
            skip: false
            test-args: >-
              :only-tags [:mb/driver-tests]
-              :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
+              :exclude-tags [:mb/upload-tests]
              :fail-fast? true
-          - name: Redshift Transforms Python Tests
-            skip: false
-            test-args: >-
-              :only-tags [:mb/transforms-python-test]
-              :fail-fast? true
-            needs-python-runner: true

    env:
      CI: 'true'
@@ -1000,13 +864,7 @@ jobs:
    name: ${{ matrix.job.name }}
    steps:
    - uses: actions/checkout@v4
-    - name: Setup python-runner
-      if: ${{ matrix.job.needs-python-runner == true }}
-      uses: ./.github/actions/setup-python-runner
-      with:
-        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
    - name: Test ${{ matrix.job.name }}
-      id: test-driver
      if: ${{ !matrix.job.skip }}
      uses: ./.github/actions/test-driver
      with:
@@ -1024,82 +882,49 @@ jobs:
        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
        aws-region: ${{ vars.AWS_REGION }}
        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-    - name: Cleanup python-runner
-      if: ${{ always() && matrix.job.needs-python-runner == true }}
-      uses: ./.github/actions/cleanup-python-runner
+
+  be-tests-snowflake-ee:
+    if: ${{ !inputs.skip }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: snowflake
+      MB_SNOWFLAKE_TEST_USER: METABASE CI
+      MB_SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.MB_SNOWFLAKE_TEST_ACCOUNT }}
+      MB_SNOWFLAKE_TEST_PASSWORD: ${{ secrets.MB_SNOWFLAKE_TEST_PASSWORD }}
+      MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
+      MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
+      MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
+      MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2 }}
+      MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY }}
+      MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2 }}
+
+      # RSA Role testing:
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DEFAULT_USER: RSA_ROLE_TEST_DEFAULT_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_CUSTOM_USER: RSA_ROLE_TEST_CUSTOM_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_ROLE: RSA_ROLE_TEST_ROLE
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
+    name: Snowflake
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Snowflake driver
+      uses: ./.github/actions/test-driver
      with:
-        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
-
-  # dan sutton 2025-10-23: disable snowflake because of account
-  # issues. https://linear.app/metabase/issue/DEV-997/reenable-snowflake-in-ci. Note that the transforms tests were
-  # disabled previously
-  # be-tests-snowflake-ee:
-  #   if: ${{ !inputs.skip }}
-  #   runs-on: ubuntu-22.04
-  #   timeout-minutes: 60
-  #   strategy:
-  #     fail-fast: false
-  #     matrix:
-  #       job:
-  #         - name: Driver Tests
-  #           test-args: >-
-  #             :only-tags [:mb/driver-tests]
-  #             :exclude-tags [:mb/transforms-python-test]
-# DS 2025-09-26 temporarily disabled while we diagnose flakes
-#          - name: Transforms Python Tests
-#            test-args: >-
-#              :only-tags [:mb/transforms-python-test]
-#            needs-python-runner: true
-    # env:
-    #   CI: 'true'
-    #   DRIVERS: snowflake
-    #   MB_SNOWFLAKE_TEST_USER: METABASE CI
-    #   MB_SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.MB_SNOWFLAKE_TEST_ACCOUNT }}
-    #   MB_SNOWFLAKE_TEST_PASSWORD: ${{ secrets.MB_SNOWFLAKE_TEST_PASSWORD }}
-    #   MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
-    #   MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
-    #   MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
-    #   MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2 }}
-    #   MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY }}
-    #   MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2 }}
-
-    #   # RSA Role testing:
-    #   MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DEFAULT_USER: RSA_ROLE_TEST_DEFAULT_USER
-    #   MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_CUSTOM_USER: RSA_ROLE_TEST_CUSTOM_USER
-    #   MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_ROLE: RSA_ROLE_TEST_ROLE
-    #   MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
-    # name: Snowflake ${{ matrix.job.name }}
-    # steps:
-    # - uses: actions/checkout@v4
-    # - name: Setup python-runner
-    #   if: ${{ matrix.job.needs-python-runner == true }}
-    #   uses: ./.github/actions/setup-python-runner
-    #   with:
-    #     metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-    # - name: Test Snowflake driver
-    #   id: test-driver
-    #   uses: ./.github/actions/test-driver
-    #   with:
-    #     junit-name: 'be-tests-snowflake-ee'
-    #     test-args: ${{ matrix.job.test-args }}
-    # - name: Upload Test Results
-    #   uses: ./.github/actions/upload-test-results
-    #   if: always()
-    #   with:
-    #     input-path: ./target/junit/
-    #     output-name: ${{ github.job }}
-    #     bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-    #     aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-    #     aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-    #     aws-region: ${{ vars.AWS_REGION }}
-    #     trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-    # - name: Cleanup python-runner
-    #   if: ${{ always() && matrix.job.needs-python-runner == true }}
-    #   uses: ./.github/actions/cleanup-python-runner
-    #   with:
-    #     upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-    #     logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
+        junit-name: 'be-tests-snowflake-ee'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}

  be-tests-sparksql-ee:
    needs: determine-driver-skips
@@ -1123,7 +948,6 @@ jobs:
        junit-name: 'be-tests-sparksql-ee'
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -1153,7 +977,6 @@ jobs:
        junit-name: 'be-tests-sqlite-ee'
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -1181,15 +1004,6 @@ jobs:
          - name: SQL Server 2022
            junit-name: be-tests-sqlserver-2022-ee
            image: mcr.microsoft.com/mssql/server:2022-latest
-        job:
-          - name: Driver Tests
-            test-args: >-
-              :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
-          - name: Transforms Python Tests
-            test-args: >-
-              :only-tags [:mb/transforms-python-test]
-            needs-python-runner: true
    env:
      CI: 'true'
      DRIVERS: sqlserver
@@ -1205,20 +1019,15 @@ jobs:
          ACCEPT_EULA: Y
          SA_PASSWORD: 'P@ssw0rd'
          MSSQL_MEMORY_LIMIT_MB: 1024
-    name: ${{ matrix.version.name }} ${{ matrix.job.name }}
+    name: ${{ matrix.version.name }}
    steps:
    - uses: actions/checkout@v4
-    - name: Setup python-runner
-      if: ${{ matrix.job.needs-python-runner == true }}
-      uses: ./.github/actions/setup-python-runner
-      with:
-        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
    - name: Test ${{ matrix.version.name }}
-      id: test-driver
      uses: ./.github/actions/test-driver
      with:
        junit-name: ${{ matrix.version.junit-name }}
-        test-args: ${{ matrix.job.test-args }}
+        test-args: >-
+          :only-tags [:mb/driver-tests]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -1230,84 +1039,47 @@ jobs:
        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
        aws-region: ${{ vars.AWS_REGION }}
        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-    - name: Cleanup python-runner
-      if: ${{ always() && matrix.job.needs-python-runner == true }}
-      uses: ./.github/actions/cleanup-python-runner
-      with:
-        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}

-  # TODO(dpsutton, 2025-08-20): Re-enable starburst when we figure out why it randomly dies in CI
-  # be-tests-starburst-ee:
-  #   needs: determine-driver-skips
-  #   if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
-  #   runs-on: ubuntu-22.04
-  #   timeout-minutes: 60
-  #   env:
-  #     CI: 'true'
-  #     DRIVERS: starburst
-  #   services:
-  #     starburst:
-  #       image: trinodb/trino:latest
-  #       env:
-  #         CATALOG_MANAGEMENT: dynamic
-  #       ports:
-  #         - "8080:8080"
-  #   name: Starburst
-  #   steps:
-  #   - uses: actions/checkout@v4
-  #   - name: Make plugins directory
-  #     run: mkdir plugins
-  #   - name: Test Starburst driver
-  #     uses: ./.github/actions/test-driver
-  #     with:
-  #       junit-name: 'be-tests-starburst-ee'
-  #       test-args: >-
-  #         :only-tags [:mb/driver-tests]
-  #   - name: Upload Test Results
-  #     uses: ./.github/actions/upload-test-results
-  #     if: always()
-  #     with:
-  #       input-path: ./target/junit/
-  #       output-name: ${{ github.job }}
-  #       bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-  #       aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-  #       aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-  #       aws-region: ${{ vars.AWS_REGION }}
-  #       trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
-  login-to-ecr:
+  be-tests-starburst-ee:
    needs: determine-driver-skips
    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    permissions:
-      id-token: write
-      contents: read
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: starburst
+    services:
+      starburst:
+        image: trinodb/trino:latest
+        env:
+          CATALOG_MANAGEMENT: dynamic
+        ports:
+          - "8080:8080"
+    name: Starburst
    steps:
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v4
+    - uses: actions/checkout@v4
+    - name: Make plugins directory
+      run: mkdir plugins
+    - name: Test Starburst driver
+      uses: ./.github/actions/test-driver
      with:
-        role-to-assume: ${{ secrets.CI_IAM_ROLE }}
-        role-session-name: GitHub_to_AWS_via_FederatedOIDC
-        aws-region: us-east-1
-    - name: Get ECR password
-      id: login-ecr
-      run: |
-        PASSWORD=$(aws ecr get-login-password --region us-east-1)
-
-        REGISTRY="$(aws sts get-caller-identity --query Account --output text).dkr.ecr.us-east-1.amazonaws.com"
-
-        echo "docker_username=AWS" >> $GITHUB_OUTPUT
-        echo "docker_password=$PASSWORD" >> $GITHUB_OUTPUT
-        echo "registry=$REGISTRY" >> $GITHUB_OUTPUT
-    outputs:
-      registry: ${{ steps.login-ecr.outputs.registry }}
-      docker_username: ${{ steps.login-ecr.outputs.docker_username }}
-      docker_password: ${{ steps.login-ecr.outputs.docker_password }}
+        junit-name: 'be-tests-starburst-ee'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}

  be-tests-vertica-ee:
-    needs: [determine-driver-skips, login-to-ecr]
+    needs: determine-driver-skips
    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
    runs-on: ubuntu-22.04
    timeout-minutes: 60
@@ -1316,12 +1088,9 @@ jobs:
      DRIVERS: vertica
    services:
      vertica:
-        image: ${{ needs.login-to-ecr.outputs.registry }}/vertica-ce:25.3.0-0
+        image: vertica/vertica-ce:12.0.2-0
        ports:
          - "5433:5433"
-        credentials:
-          username: ${{ needs.login-to-ecr.outputs.docker_username }}
-          password: ${{ needs.login-to-ecr.outputs.docker_password }}
    name: Vertica
    steps:
    - uses: actions/checkout@v4
@@ -1333,7 +1102,6 @@ jobs:
        junit-name: 'be-tests-vertica-ee'
        test-args: >-
          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
    - name: Upload Test Results
      uses: ./.github/actions/upload-test-results
      if: always()
@@ -1363,14 +1131,12 @@ jobs:
      - be-tests-postgres
      - be-tests-presto-jdbc-ee
      - be-tests-redshift-ee
-      # dan: disabled for account reasons. https://linear.app/metabase/issue/DEV-997/reenable-snowflake-in-ci
-      # - be-tests-snowflake-ee
+      - be-tests-snowflake-ee
      - be-tests-sparksql-ee
      - be-tests-sqlite-ee
      - be-tests-sqlserver
-      # - be-tests-starburst-ee
-      # TODO(rileythomp, 2025-08-20): Re-enable vertica tests once the docker image is updated
-      # - be-tests-vertica-ee
+      - be-tests-starburst-ee
+      - be-tests-vertica-ee
      - be-tests-clickhouse-ee
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -1392,7 +1158,7 @@ jobs:
              }));

            // are all jobs skipped or successful?
-            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success' || job.name == 'be-tests-starburst-ee'))) {
+            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
                console.log("");
                console.log("        _------.        ");
                console.log("       /  ,     \_      ");
--- a/.github/workflows/e2e-component-tests-embedding-sdk-backward-compatibility.yml
+++ b/.github/workflows/e2e-component-tests-embedding-sdk-backward-compatibility.yml
@@ -1,185 +0,0 @@
-# This workflow does the backward compatibility tests
-# between the Embedding SDK package of version N and Embedding SDK Bundle of version N - 1
-# N - 1 is a target of a PR
-name: Embedding SDK backward-compatibility E2E Component Tests
-
-on:
-  workflow_call:
-    inputs:
-      cached-embedding-sdk-dist-artifact-name:
-        required: true
-        type: string
-
-jobs:
-  files-changed:
-    name: "SDK backward-compatibility E2E > Check which files changed"
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      e2e_embedding_sdk: ${{ steps.changes.outputs.e2e_embedding_sdk }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  decide-target-ref:
-    runs-on: ubuntu-latest
-    outputs:
-      target-ref: ${{ steps.get-target-ref.outputs.value }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Decide ref to checkout
-        id: get-target-ref
-        run: |
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo "value=${{ github.base_ref }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "value=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
-          fi
-
-  # if this is a test on a release branch, we need to check the build requirements
-  get-build-requirements:
-    name: "SDK backward-compatibility E2E > [Backport only] Get build requirements"
-    needs: [decide-target-ref]
-    if: |
-      !cancelled() &&
-      contains(github.base_ref || github.ref, 'release-x')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.decide-target-ref.outputs.target-ref }}
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      - name: Get build dependencies
-        uses: actions/github-script@v7
-        id: dependencies
-        with:
-          script: | # js
-            const {
-              getBuildRequirements,
-              getVersionFromReleaseBranch,
-            } = require('${{ github.workspace }}/release/dist/index.cjs');
-            const targetBranchName = '${{ github.base_ref || github.ref }}';
-
-            const version = getVersionFromReleaseBranch(targetBranchName);
-            const requirements = getBuildRequirements(version);
-
-            return {
-              java_version: requirements.java,
-              node_version: requirements.node,
-            };
-
-  e2e-tests:
-    name: "SDK backward-compatibility E2E > Run e2e tests"
-    needs: [files-changed, decide-target-ref, get-build-requirements]
-    if: |
-      !cancelled() &&
-      needs.files-changed.outputs.e2e_embedding_sdk == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-    env:
-      MB_EDITION: ee
-      DISPLAY: ""
-      MB_RUN_MODE: "e2e"
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.decide-target-ref.outputs.target-ref }}
-
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-        with:
-          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
-
-      - name: Build uberjar with ./bin/build.sh
-        run: ./bin/build.sh
-
-      - name: Retrieve Embedding SDK dist artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: ${{ inputs.cached-embedding-sdk-dist-artifact-name }}
-          path: ${{ github.workspace }}/resources/embedding-sdk
-
-      - name: Prepare Cypress environment
-        id: cypress-prep
-        uses: ./.github/actions/prepare-cypress
-
-      - name: Run Metabase
-        run: node e2e/runner/run_cypress_ci.js start
-
-      - name: Make app db snapshot
-        run: node e2e/runner/run_cypress_ci.js snapshot --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run component tests for Embedding SDK
-        run: |
-          node e2e/runner/run_cypress_ci.js component \
-            --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
-            --env grepTags="-@skip-backward-compatibility",grepOmitFiltered=true
-
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-embedding-sdk
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
-      - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: cypress-recording-embedding-sdk-cross-version
-          path: |
-            ./cypress
-            ./logs/test.log
-          if-no-files-found: ignore
-
-      - name: Publish Summary
-        if: failure()
-        uses: actions/github-script@v7
-        with:
-          script: | #js
-            const {
-               generateReport,
-               parseReport,
-               formatSummary
-             } = require("./.github/scripts/handle-mochawesome-report.js");
-
-             const report = await generateReport();
-             const results = parseReport(report);
-             const summary = formatSummary(results);
-
-             await core.summary.addRaw(summary).write();
--- a/.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml
+++ b/.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml
@@ -0,0 +1,230 @@
+name: E2E Cross-version Component Tests for Embedding SDK
+
+on:
+  workflow_call:
+
+jobs:
+  files-changed:
+    name: "SDK cross-version E2E > Check which files changed"
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      e2e_all: ${{ steps.changes.outputs.e2e_all }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  # if this is a test on a release branch, we need to check the build requirements
+  get-build-requirements:
+    name: "SDK cross-version E2E > [Backport only] Get build requirements"
+    if: |
+      !cancelled()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get build dependencies
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const {
+              getBuildRequirements,
+              getVersionFromReleaseBranch,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const targetBranchName = '${{ github.base_ref || github.ref }}';
+
+            const version = getVersionFromReleaseBranch(targetBranchName);
+            const requirements = getBuildRequirements(version);
+
+            return {
+              java_version: requirements.java,
+              node_version: requirements.node,
+            };
+
+  build:
+    name: "SDK cross-version E2E > Build uberjar"
+    needs: [files-changed, get-build-requirements]
+    if: |
+      !cancelled()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    env:
+      MB_EDITION: ee
+      INTERACTIVE: false
+      # make sure that builds on release branches get licenses, because we use them for releases
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: uberjar
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 11 }}"
+
+      - name: Build uberjar with ./bin/build.sh
+        run: ./bin/build.sh
+
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-cross-version
+
+  resolve-sdk-version:
+    name: "SDK cross-version E2E > Resolve SDK version"
+    if: |
+      !cancelled()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      sdk_version: ${{ fromJson(steps.dependencies.outputs.result).sdk_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get latest SDK release for this branch
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const { getSdkVersionFromReleaseBranchName } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const branchName = '${{ github.base_ref || github.ref }}';
+
+            const sdk_version = await getSdkVersionFromReleaseBranchName({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              branchName,
+            });
+
+            return {
+              sdk_version,
+            };
+
+  e2e-tests:
+    name: "SDK cross-version E2E > Run e2e tests"
+    needs: [get-build-requirements, build, resolve-sdk-version]
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # Needed to omit newly added tests for functionality that is not yet released
+      - name: Sparse checkout tests from SDK release commit
+        uses: actions/checkout@v4
+        with:
+          ref: embedding-sdk-${{ needs.resolve-sdk-version.outputs.sdk_version }}
+          path: sdk-release-e2e
+          sparse-checkout: e2e
+
+      - name: Move tests from the release commit into the repo
+        run: |
+          rm -rf ./e2e/support/*
+          mv ./sdk-release-e2e/e2e/support/* ./e2e/support
+
+          rm -rf ./e2e/test-component/*
+          mv ./sdk-release-e2e/e2e/test-component/* ./e2e/test-component
+        shell: bash
+
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-cross-version
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Install Embedding SDK package v${{ needs.resolve-sdk-version.outputs.sdk_version }}
+        run: yarn add @metabase/embedding-sdk-react@${{ needs.resolve-sdk-version.outputs.sdk_version }}
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Make app db snapshot
+        run: node e2e/runner/run_cypress_ci.js snapshot --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Run component tests for Embedding SDK
+        run: node e2e/runner/run_cypress_ci.js component --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-cross-version
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();
--- a/.github/workflows/e2e-component-tests-embedding-sdk.yml
+++ b/.github/workflows/e2e-component-tests-embedding-sdk.yml
@@ -83,6 +83,7 @@ jobs:
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
        with:
+          m2-cache-key: uberjar
          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"

      - name: Build uberjar with ./bin/build.sh
@@ -108,14 +109,13 @@ jobs:
    env:
      MB_EDITION: ee
      DISPLAY: ""
-      MB_RUN_MODE: "e2e"
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
      CYPRESS_IS_EMBEDDING_SDK: "true"
      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
      TZ: US/Pacific # to make node match the instance tz
@@ -144,6 +144,8 @@ jobs:

      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"

      - name: Retrieve Embedding SDK dist artifact
        uses: actions/download-artifact@v4
--- a/.github/workflows/e2e-cross-version-for-breaking-changes.yml
+++ b/.github/workflows/e2e-cross-version-for-breaking-changes.yml
@@ -0,0 +1,162 @@
+name: E2E cross-version for breaking changes
+
+# See `bin/backward-compatibility-test.js` for the documentation of this workflow.
+
+on:
+  workflow_dispatch:
+    inputs:
+      fe-ref:
+        description: "Frontend git ref to use"
+        type: string
+        required: true
+        default: "master"
+      be-ref:
+        description: "Backend git ref to use"
+        type: string
+        required: true
+        default: "master"
+      total-shards:
+        description: "Total number of parallel test shards"
+        type: number
+        required: false
+        default: 4
+  workflow_call:
+    inputs:
+      fe-ref:
+        description: "Frontend git ref to use"
+        type: string
+        required: true
+      be-ref:
+        description: "Backend git ref to use"
+        type: string
+        required: true
+      total-shards:
+        description: "Total number of parallel test shards"
+        type: number
+        required: false
+        default: 4
+
+jobs:
+  generate-matrix:
+    name: "Breaking changes E2E > Generate matrix"
+    runs-on: ubuntu-latest
+    outputs:
+      matrix_json: ${{ steps.set_matrix.outputs.matrix_json }}
+      shards_total: ${{ steps.set_matrix.outputs.shards_total }}
+    steps:
+      - name: Set up shard matrix
+        id: set_matrix
+        uses: actions/github-script@v7
+        with:
+          # generate an output like `{"matrixJson": "{\"shard\": [1, 2, 3, 4]}", "shardsTotal": 4}` to be used in the other jobs
+          script: |
+            const totalShards = parseInt(process.env.TOTAL_SHARDS_INPUT, 10);
+
+            const matrix = { shard: Array.from({ length: totalShards }, (_, i) => i + 1) };
+
+            console.log("Generated matrix JSON", matrix);
+            console.log(`Total shards: ${totalShards}`);
+
+            core.setOutput('matrix_json', JSON.stringify(matrix));
+            core.setOutput('shards_total', totalShards);
+        env:
+          TOTAL_SHARDS_INPUT: ${{ inputs.total-shards }}
+
+  build-jar:
+    name: "Breaking changes E2E > Build jar"
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Prepare Node.js
+        # We're not using `actions/prepare-frontend` because we don't want to install deps from the root repo
+        # nor we want to touch the cache as we'll be potentially be installing different versions of packages
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: cross-version-uberjar
+
+      - name: Build jar with different frontend and backend version
+        env:
+          MB_EDITION: ee
+          CYPRESS_CI: true
+        run: |
+          node bin/backward-compatibility-test.js \
+            ${{ inputs.fe-ref }} ${{ inputs.be-ref }} \
+            build
+
+      - name: Upload Uberjar
+        uses: actions/upload-artifact@v4
+        with:
+          name: metabase-jar-cross-version
+          path: .tmp/metabase-be/target/uberjar/metabase.jar
+          if-no-files-found: error
+
+  run-breaking-changes-tests:
+    name: "Breaking changes E2E > Run breaking changes tests"
+    needs: [build-jar, generate-matrix]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    env:
+      TOTAL_SHARDS: ${{ needs.generate-matrix.outputs.shards_total }}
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix_json) }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Prepare Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: cross-version-uberjar
+
+      - name: Download Uberjar
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-jar-cross-version
+          path: .tmp/metabase-be/target/uberjar/
+
+      - name: Download FE repo
+        run: |
+          git clone --depth 1 -b ${{ inputs.fe-ref }} https://github.com/metabase/metabase.git .tmp/metabase-fe
+
+      - name: Install FE dependencies
+        working-directory: .tmp/metabase-fe
+        run: |
+          yarn install
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+        with:
+          working-directory: .tmp/metabase-fe
+
+      - name: Run the tests
+        env:
+          MB_EDITION: ee
+          CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+          CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+          CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+          CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
+          CYPRESS_CI: true
+        run: |
+          node bin/backward-compatibility-test.js \
+            ${{ inputs.fe-ref }} ${{ inputs.be-ref }} \
+            start > /dev/null & \
+            node bin/backward-compatibility-test.js \
+            ${{ inputs.fe-ref }} ${{ inputs.be-ref }} \
+            test ${{ matrix.shard}}/${{ env.TOTAL_SHARDS }}
--- a/.github/workflows/e2e-cross-version.yml
+++ b/.github/workflows/e2e-cross-version.yml
@@ -0,0 +1,171 @@
+name: E2E Cross-version Tests
+
+on:
+  schedule:
+    - cron: '0 9 * * 1-5'
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    # don't run this workflow on a cron for forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      e2e_cross_version: ${{ steps.changes.outputs.e2e_cross_version }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  cross-version-testing:
+    needs: files-changed
+    if: ${{ needs.files-changed.outputs.e2e_cross_version == 'true' || github.event_name == 'schedule'}}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    strategy:
+      matrix:
+        version: [
+          # Major OSS upgrade
+          { source: v0.42.2, target: v0.48.7 },
+          # OSS upgrade
+          { source: v0.41.3.1, target: v0.42.2 },
+          # EE upgrade
+          { source: v1.43.4, target: v1.44.0 },
+          # EE downgrade
+          { source: v1.42.0, target: v1.41.3.1 },
+          # Cross-edition upgrade
+          { source: v0.41.3.1, target: v1.42.2 }
+        ]
+      fail-fast: false
+    env:
+      CROSS_VERSION_SOURCE: ${{ matrix.version.source }}
+      CROSS_VERSION_TARGET: ${{ matrix.version.target }}
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Set source Docker image to OSS
+      run: |
+        echo "DOCKER_SOURCE_IMAGE=metabase/metabase:${{ matrix.version.source }}" >> $GITHUB_ENV
+      if: startsWith(matrix.version.source, 'v0')
+    - name: Set source Docker image to EE
+      run: |
+        echo "DOCKER_SOURCE_IMAGE=metabase/metabase-enterprise:${{ matrix.version.source }}" >> $GITHUB_ENV
+      if: startsWith(matrix.version.source, 'v1')
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+    - name: Start Metabase ${{ matrix.version.source }}
+      run: |
+        docker run -d \
+        -v $PWD/my-metabase:/metabase.db \
+        -p 3000:3000 \
+        -e CYPRESS_MB_ALL_FEATURES_TOKEN=${{ secrets.MB_ALL_FEATURES_TOKEN }} \
+        -e CYPRESS_MB_STARTER_CLOUD_TOKEN=${{ secrets.MB_STARTER_CLOUD_TOKEN }} \
+        -e CYPRESS_MB_PRO_CLOUD_TOKEN=${{ secrets.MB_PRO_CLOUD_TOKEN }} \
+        -e CYPRESS_MB_PRO_SELF_HOSTED_TOKEN=${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }} \
+        --name metabase-${{ matrix.version.source }} \
+        ${{ env.DOCKER_SOURCE_IMAGE }}
+    - name: Wait for Metabase to start on port 3000
+      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+    - name: Prepare Cypress environment
+      id: cypress-prep
+      uses: ./.github/actions/prepare-cypress
+    - name: Run Cypress on the source
+      run: |
+        yarn cypress run \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
+          --config-file e2e/test/scenarios/cross-version/source/shared/cross-version-source.config.js \
+          --spec e2e/test/scenarios/cross-version/source/**/*.cy.spec.js
+    - name: Stop Metabase ${{ matrix.version.source }}
+      run: docker stop metabase-${{ matrix.version.source }}
+
+    - name: Set target Docker image to OSS
+      run: |
+        echo "DOCKER_TARGET_IMAGE=metabase/metabase:${{ matrix.version.source }}" >> $GITHUB_ENV
+      if: startsWith(matrix.version.source, 'v0')
+    - name: Set target Docker image to EE
+      run: |
+        echo "DOCKER_TARGET_IMAGE=metabase/metabase-enterprise:${{ matrix.version.source }}" >> $GITHUB_ENV
+      if: startsWith(matrix.version.source, 'v1')
+    - name: Start Metabase ${{ matrix.version.target }}
+      run: |
+        docker run -d \
+          -v $PWD/my-metabase:/metabase.db \
+          -p 3001:3000 \
+          -e CYPRESS_MB_ALL_FEATURES_TOKEN=${{ secrets.MB_ALL_FEATURES_TOKEN }} \
+          -e CYPRESS_MB_STARTER_CLOUD_TOKEN=${{ secrets.MB_STARTER_CLOUD_TOKEN }} \
+          -e CYPRESS_MB_PRO_CLOUD_TOKEN=${{ secrets.MB_PRO_CLOUD_TOKEN }} \
+          -e CYPRESS_MB_PRO_SELF_HOSTED_TOKEN=${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }} \
+          --name metabase-${{ matrix.version.target }} \
+          ${{ env.DOCKER_TARGET_IMAGE }}
+    - name: Wait for Metabase to start on port 3001
+      run: while ! curl -s 'http://localhost:3001/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+    - name: Run Cypress on the target
+      run: |
+        yarn cypress run \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
+          --config-file e2e/test/scenarios/cross-version/target/shared/cross-version-target.config.js \
+          --spec e2e/test/scenarios/cross-version/target/**/*.cy.spec.js
+    - name: Upload Cypress Artifacts upon failure
+      uses: actions/upload-artifact@v4
+      if: failure()
+      with:
+        name: cypress-artifacts-${{ matrix.version.source}}-to-${{ matrix.version.target }}
+        path: |
+          ./cypress
+        if-no-files-found: ignore
+  notify-on-failure:
+    needs: cross-version-testing
+    if: ${{ always() && contains(needs.*.result, 'failure') && github.event_name == 'schedule' }}
+    name: Cross-version test failure
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/Jod # 22.x.x
+      - run: npm install @slack/web-api
+      - name: notify slack of failure
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            const FAILED_RUN_URL = "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}";
+            const REF_NAME = "${{ github.ref_name }}";
+
+            // notify slack of failure
+            const { WebClient } = require('@slack/web-api');
+            const slack = new WebClient('${{ secrets.SLACK_BOT_TOKEN }}');
+
+            await slack.chat.postMessage({
+              channel: 'engineering-ci',
+              text: 'Cross-version Tests Have Failed',
+              blocks: [
+                {
+                  "type": "header",
+                  "text": {
+                    "type": "plain_text",
+                    "text": `:broken_heart:   Cross-version tests are failing on ${REF_NAME}`,
+                    "emoji": true,
+                  }
+                },
+              ],
+              attachments: [{
+                color: "#BF40BF",
+                blocks: [
+                  {
+                    "type": "section",
+                    "text": {
+                      "type": "mrkdwn",
+                      "text": `See <${FAILED_RUN_URL}|failing run details>.`
+                    }
+                  },
+                ]
+              }]
+            });
--- a/.github/workflows/e2e-embedding-sdk-compatibility-tests.yml
+++ b/.github/workflows/e2e-embedding-sdk-compatibility-tests.yml
@@ -167,6 +167,7 @@ jobs:
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
        with:
+          m2-cache-key: uberjar
          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"

      - name: Build uberjar with ./bin/build.sh
@@ -177,12 +178,12 @@ jobs:
        with:
          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar

+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+        shell: bash
+
      - name: Build Embedding SDK package
-        run: |
-          # Remove the matchers to not report false positives on every PR
-          # unrelated to embedding (EMB-765)
-          echo "::remove-matcher owner=tsc::"
-          yarn build-embedding-sdk-package
+        run: yarn build-embedding-sdk

      - name: Prepare Embedding SDK artifact
        uses: actions/upload-artifact@v4
@@ -195,7 +196,7 @@ jobs:
  # - starts it
  # - runs its Cypress tests against the local metabase.jar and local @metabase/embedding-sdk-react package.
  # The job is not required, though if it's failing better to be sure that it's not caused by a breaking change.
-  # For more details see `Sample Apps compatibility with Embedding SDK tests` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
+  # For more details see `Sample Apps compatibility with Embedding SDK tests` in `enterprise/frontend/src/embedding-sdk/dev.md`
  e2e-sample-apps-tests:
    needs: [get-build-requirements, get-sample-apps-data, build]
    strategy:
@@ -213,9 +214,7 @@ jobs:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-      MB_RUN_MODE: e2e
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
      CYPRESS_IS_EMBEDDING_SDK: "true"
      TZ: US/Pacific # to make node match the instance tz
      CYPRESS_CI: true
@@ -321,7 +320,7 @@ jobs:
  # - starts an app
  # - runs its Cypress tests against the e2e test metabase instance and local @metabase/embedding-sdk-react package.
  # The job is not required, though if it's failing better to be sure that it's not caused by a breaking change.
-  # For more details see `Embedding SDK integration tests with Host Apps` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
+  # For more details see `Embedding SDK integration tests with Host Apps` in `enterprise/frontend/src/embedding-sdk/dev.md`
  e2e-host-apps-tests:
    needs: [get-build-requirements, build]
    strategy:
@@ -345,9 +344,7 @@ jobs:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-      MB_RUN_MODE: e2e
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
      CYPRESS_IS_EMBEDDING_SDK: "true"
      TZ: US/Pacific # to make node match the instance tz
      CYPRESS_CI: true
--- a/.github/workflows/e2e-stress-test-flake-fix.yml
+++ b/.github/workflows/e2e-stress-test-flake-fix.yml
@@ -37,26 +37,8 @@ on:
        default: true

 jobs:
-  determine-suite:
-    name: Determine test suite
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    outputs:
-      suite: ${{ steps.detect.outputs.suite }}
-    steps:
-      - name: Detect suite from spec path
-        id: detect
-        run: |
-          SPEC='${{ inputs.spec }}'
-          if [[ "$SPEC" == e2e/test-component/scenarios/embedding-sdk/* ]]; then
-            echo "suite=component" >> $GITHUB_OUTPUT
-          else
-            echo "suite=e2e" >> $GITHUB_OUTPUT
-          fi
-
  workflow-summary:
    name: Stress test inputs
-    needs: [determine-suite]
    runs-on: ubuntu-22.04
    timeout-minutes: 5
    steps:
@@ -66,7 +48,6 @@ jobs:
          echo '' >> $GITHUB_STEP_SUMMARY
          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
          echo '- `spec`: ${{ inputs.spec }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `test_suite` (inferred): ${{ needs.determine-suite.outputs.suite }}' >> $GITHUB_STEP_SUMMARY
          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
          echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
          echo '- `qa_db`: "${{ inputs.qa_db }}"' >> $GITHUB_STEP_SUMMARY
@@ -75,7 +56,6 @@ jobs:
          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY

  stress-test-flake-fix:
-    needs: [determine-suite]
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    name: Stress test E2E flake fix
@@ -83,12 +63,10 @@ jobs:
      DISPLAY: ""
      QA_DB_ENABLED: ${{ contains(fromJSON('["sql", "mongo"]'), inputs.qa_db) }}
      CYPRESS_QA_DB_MONGO: ${{ inputs.qa_db == 'mongo' }}
-      MB_RUN_MODE: e2e
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
      MB_SNOWPLOW_AVAILABLE: true
      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
      MB_EDITION: ${{ inputs.mb_edition }}
@@ -120,16 +98,6 @@ jobs:

      - name: Prepare front-end environment
        uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare back-end environment
-        if: ${{ needs.determine-suite.outputs.suite == 'component' }}
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cljs"
-      - name: Build Embedding SDK package
-        if: ${{ needs.determine-suite.outputs.suite == 'component' }}
-        run: yarn build-embedding-sdk-package
-
      - name: Prepare JDK 21
        uses: actions/setup-java@v4
        with:
@@ -148,9 +116,8 @@ jobs:
      - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
        env:
          GREP: ${{ github.event.inputs.grep }}
-          CYPRESS_IS_EMBEDDING_SDK: ${{ needs.determine-suite.outputs.suite == 'component' }}
        run: |
-          node e2e/runner/run_cypress_ci.js ${{ needs.determine-suite.outputs.suite }} \
+          node e2e/runner/run_cypress_ci.js e2e \
          --spec '${{ github.event.inputs.spec }}' \
          --env burn=${{ github.event.inputs.burn_in }} \
          --config-file e2e/support/cypress-stress-test.config.js \
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -42,14 +42,12 @@ jobs:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
      JOB_NAME: ${{ inputs.name }}
-      MB_RUN_MODE: "e2e"
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
      MB_EXPERIMENTAL_SEARCH_BLOCK_ON_QUEUE: true
@@ -59,17 +57,9 @@ jobs:
      TZ: US/Pacific # to make node match the instance tz
      CYPRESS_CI: true
      CYPRESS_QA_DB_MONGO: ${{ inputs.name == 'mongo' }}
+      CYPRESS_IS_EMBEDDING_SDK: "${{ inputs.name == 'embedding-sdk' }}"
    steps:
      - uses: actions/checkout@v4
-        with:
-          submodules: true
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-
-      - name: Setup python-runner
-        if: ${{ inputs.name == 'python' }}
-        env:
-          METABASE_AUTOMATION_USER_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-        run: ./.github/scripts/setup-python-runner.sh

      - name: Prepare Docker containers
        uses: ./.github/actions/e2e-prepare-containers
@@ -84,12 +74,14 @@ jobs:
          mysql: ${{ inputs.name != 'mongo' }}
          mongo: ${{ inputs.name == 'mongo' }}

+      - name: Run Embedding SDK Storybook
+        if: inputs.name == 'embedding-sdk'
+        uses: ./.github/actions/run-embedding-sdk-storybook
+
      - name: Retrieve uberjar artifact for ${{ inputs.edition }}
-        uses: ./.github/actions/fetch-artifact
+        uses: actions/download-artifact@v4
        with:
          name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-          extract-path: "target/uberjar"
-          output-name: "metabase.jar"

      - name: Prepare front-end environment
        uses: ./.github/actions/prepare-frontend
@@ -129,7 +121,7 @@ jobs:
          SPLIT_INDEX: ${{ inputs.split_index }}
          SPLIT_FILE: "./e2e/support/timings.json"
          SPLIT_OUTPUT_FILE: "newTimes.json"
-          SPLIT_TIME_THRESHOLD: 0.01 # 1% threshold for changes
+          SPLIT_TIME_THRESHOLD: 5.0
          # do not write cypress-split summary to github
          SPLIT_SUMMARY: false
          SPEC_PATH: ${{ env.specs || inputs.specs }}
@@ -137,13 +129,9 @@ jobs:
        run: |
          echo "Running tests with specs: $SPEC_PATH"
          node e2e/runner/run_cypress_ci.js e2e \
-            --env grepTags="-@mongo+-@python+-@OSS+-@skip",grepOmitFiltered=true \
+            --env grepTags="-@mongo+-@flaky+-@OSS --@quarantine",grepOmitFiltered=true \
            --spec "$SPEC_PATH" \
            --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
-        continue-on-error: true

      - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
        if: ${{ inputs.specs }}
@@ -153,27 +141,21 @@ jobs:
        run: |
          echo "Running tests with specs: $SPEC_PATH"
          node e2e/runner/run_cypress_ci.js e2e \
-          --env grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@skip'}}",grepOmitFiltered=true \
+          --env grepTags="${{inputs.tags}} --@quarantine",grepOmitFiltered=true \
          --spec "$SPEC_PATH" \
          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
-        continue-on-error: true

      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
        if: always()
        with:
          input-path: ./target/junit
-          # Related to our custom upload to S3
          output-name: e2e-${{ inputs.name }}
+          variant: e2e-tests
          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
          aws-region: ${{ vars.AWS_REGION }}
-          # Related to Trunk uploader
-          variant: e2e-tests
          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}

      - name: Upload Cypress Artifacts upon failure
@@ -193,51 +175,6 @@ jobs:
          name: failed-tests-${{ inputs.name }}-${{ inputs.edition }}
          path: ./cypress/test-results

-      - name: Extract chunk-specific changed timings
-        id: extract-timings
-        if: inputs.split_index >= 0 && github.ref == 'refs/heads/master'
-        continue-on-error: true
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const fs = require('fs');
-            const oldTimingsPath = "./e2e/support/timings.json";
-            const newTimingsPath = "./e2e/support/newTimes.json";
-
-            if (!fs.existsSync(newTimingsPath)) {
-              throw new Error(`newTimes.json not found - cypress-split may not have generated it`);
-            }
-
-            if (!fs.existsSync(oldTimingsPath)) {
-              throw new Error(`Original timings file ${oldTimingsPath} not found`);
-            }
-
-            const oldTimings = fs.existsSync(oldTimingsPath)
-              ? JSON.parse(fs.readFileSync(oldTimingsPath, "utf8"))
-              : { durations: [] };
-
-            const newTimings = fs.existsSync(newTimingsPath)
-              ? JSON.parse(fs.readFileSync(newTimingsPath, "utf8"))
-              : { durations: [] };
-
-            const { extractChangedTimings } = require('${{ github.workspace }}/.github/scripts/extract-changed-timings.js');
-
-            const result = extractChangedTimings({ oldTimings, newTimings });
-
-            if (result.hasChanges) {
-              core.setOutput('has-changes', 'true');
-              fs.writeFileSync('chunkTimings.json', JSON.stringify(result.changedTimings, null, 2));
-              console.log(`Extracted ${Object.keys(result.changedTimings).length} changed timings for chunk index ${{ inputs.split_index }}`);
-            }
-
-      - name: Upload Timing Data
-        uses: actions/upload-artifact@v4
-        if: steps.extract-timings.outcome == 'success' && steps.extract-timings.outputs.has-changes == 'true'
-        with:
-          name: timing-data-${{ inputs.name }}-${{ inputs.split_index }}
-          path: chunkTimings.json
-          retention-days: 1 # gets merged immediately by parent workflow
-
      - name: Publish Summary
        if: failure()
        uses: actions/github-script@v7
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -73,77 +73,31 @@ jobs:
      tags: ${{ matrix.tags }}
      runner: ${{ matrix.runner }}

-  collect-timings:
-    name: Collect E2E Timings
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    needs: e2e-tests
-    if: always() && !cancelled() && github.ref == 'refs/heads/master'
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: |
-            .github
-            e2e/support
-          sparse-checkout-cone-mode: false
-
-      - name: Download all timing artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: timing-data-*
-          path: timing-files
-          merge-multiple: false
-        continue-on-error: true
-
-      - name: Merge split timings
-        id: merge
-        continue-on-error: true
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-
-            const globber = await glob.create('timing-files/*/chunkTimings.json');
-            const chunkFiles = await globber.glob();
-
-            const specs = new Map();
-            chunkFiles.forEach(file => {
-              const { durations = [] } = JSON.parse(fs.readFileSync(file, 'utf8'));
-              durations.forEach(({ spec, duration }) => specs.set(spec, duration));
-            });
-
-            if (specs.size === 0) {
-              throw new Error('No timing data found - no specs had timing changes');
-            }
-
-            const outputPath = 'e2e/support/runTimings.json';
-            fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-
-            const runTimings = {
-              durations: [...specs].map(([spec, duration]) => ({ spec, duration }))
-            };
-
-            fs.writeFileSync(outputPath, JSON.stringify(runTimings, null, 2));
-            console.log(`Merged timing data for ${specs.size} specs`);
-
-      - name: Upload merged timing files
-        if: steps.merge.outcome == 'success'
-        uses: actions/upload-artifact@v4
-        with:
-          name: merged-e2e-timings
-          path: e2e/support/runTimings.json
-          retention-days: 7
+  # run this separately to make it non-blocking
+  flaky-e2e-tests:
+    name: Flaky e2e Tests
+    uses: ./.github/workflows/e2e-test.yml
+    needs:
+      - e2e-matrix-builder
+    # skip flaky test run if only e2e specs changed as an optimization
+    if: |
+      !cancelled() && !inputs.skip && needs.e2e-matrix-builder.outputs.isDefaultSpecPattern == 'true'
+    secrets: inherit
+    with:
+      name: Flaky
+      tags: "@flaky"

  e2e-tests-result:
    needs:
      - e2e-tests
+      - flaky-e2e-tests
    runs-on: ubuntu-latest
    timeout-minutes: 5
    name: e2e-tests-result
    if: always() && !cancelled()
    env:
      E2E_TESTS_RESULT: ${{ needs.e2e-tests.result }}
+      FLAKY_E2E_TESTS_RESULT: ${{ needs.flaky-e2e-tests.result }}
    steps:
      - name: Stub
        if: ${{ needs.e2e-tests.result == 'skipped' }}
@@ -153,6 +107,7 @@ jobs:
        if: ${{ needs.e2e-tests.result != 'skipped' }}
        run: | # sh
          echo "E2E Tests: ${{ needs.e2e-tests.result }}"
+          echo "Flaky E2E Tests: ${{ needs.flaky-e2e-tests.result }}"

          if [ "${{ needs.e2e-tests.result }}" != "success" ]; then
            echo "E2E Tests failed"
--- a/.github/workflows/embedding-sdk-labels-reminder.yml
+++ b/.github/workflows/embedding-sdk-labels-reminder.yml
@@ -1,49 +0,0 @@
-name: Embedding SDK Labels Reminder
-
-on:
-  pull_request:
-    types: [auto_merge_enabled, review_requested, labeled, unlabeled, synchronize]
-    branches:
-      - "master"
-  merge_group:
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      frontend_embedding_sdk_package_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_package_sources }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  embedding-sdk-package-no-release-notes-reminder:
-    needs: [ files-changed ]
-    if: |
-      !cancelled() &&
-      (needs.files-changed.outputs.frontend_embedding_sdk_package_sources == 'true')
-    name: Embedding SDK package release-notes/no-release-notes label reminder
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v4
-      - uses: jesusvasquez333/verify-pr-label-action@v1.4.0
-        id: verify-release-notes-labels
-        with:
-          github-token: '${{ secrets.GITHUB_TOKEN }}'
-          valid-labels: 'release-notes, no-release-notes'
-          disable-reviews: true
-      - name: Comment on PR if label should be added
-        if: ${{ always() }}
-        uses: ./.github/actions/notify-pull-request
-        with:
-          remove-previous-comment: true
-          add-new-comment: ${{ steps.verify-release-notes-labels.outcome == 'failure' }}
-          message: "⚠️ Changes were made to the <b>Embedding SDK Package</b>. Review this PR and apply one of the following labels.<br><br>- <code>release-notes</code> — select if this PR must be included in the main Metabase changelog release notes.<br>- <code>no-release-notes</code> — select if this PR should not be included in the main Metabase changelog release notes."
-          include-log: true
--- a/.github/workflows/embedding-sdk.yml
+++ b/.github/workflows/embedding-sdk.yml
@@ -40,12 +40,10 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
      - name: Build Embedding SDK package
-        run: |
-          # Remove the matchers to not report false positives on every PR
-          # unrelated to embedding (EMB-765)
-          echo "::remove-matcher owner=tsc::"
-          yarn build-embedding-sdk-package
+        run: yarn build-embedding-sdk
      - name: Prepare Embedding SDK artifact
        uses: actions/upload-artifact@v4
        with:
@@ -139,7 +137,7 @@ jobs:
        if: ${{ steps.docs-generation.outcome == 'failure' }}
        run: exit 1

-  # See `Component e2e tests` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
+  # See `Component e2e tests` in `enterprise/frontend/src/embedding-sdk/dev.md`
  sdk-e2e-tests:
    name: "SDK e2e tests"
    uses: ./.github/workflows/e2e-component-tests-embedding-sdk.yml
@@ -148,13 +146,24 @@ jobs:
    with:
      cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}

-  e2e-component-tests-embedding-sdk-backward-compatibility:
-    name: "SDK e2e backward compatibility tests"
-    uses: ./.github/workflows/e2e-component-tests-embedding-sdk-backward-compatibility.yml
-    needs: [build]
+  e2e-component-tests-embedding-sdk-cross-version:
+    name: "[Backport only] SDK e2e cross version tests"
+    # run on: every push on release branches, and every pr that targets a release branch
+    if: ${{ startsWith(github.ref, 'refs/heads/release-x.') || (github.event_name == 'pull_request' && startsWith(github.base_ref, 'release-x.')) }}
+    uses: ./.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml
    secrets: inherit
-    with:
-      cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+
+  # Temporarily skipped because the cypress runner crashes
+  # See `bin/backward-compatibility-test.js` for the documentation of this workflow.
+  # cross-version-for-breaking-changes:
+  # name: "[NOT REQUIRED - Experimental - Backport only] detect breaking changes with cross versions tests"
+  #   # run on: every pr that targets a release branch, it does NOT run for pr targeting master
+  #   if: ${{ github.event_name == 'pull_request' && startsWith(github.base_ref, 'release-x.') }}
+  #   uses: ./.github/workflows/e2e-cross-version-for-breaking-changes.yml
+  #   secrets: inherit
+  #   with:
+  #     fe-ref: ${{ github.base_ref }}
+  #     be-ref: ${{ github.head_ref }}

  embedding-sdk-tests-result:
    needs:
@@ -162,7 +171,7 @@ jobs:
      - embedding-sdk-docs-snippets-type-check
      - embedding-sdk-api-documentation-generation-validation
      - sdk-e2e-tests
-      - e2e-component-tests-embedding-sdk-backward-compatibility
+      - e2e-component-tests-embedding-sdk-cross-version
    if: always() && !cancelled()
    runs-on: ubuntu-latest
    timeout-minutes: 5
--- a/.github/workflows/frontend-unit-test-stress-test-flake-fix.yml
+++ b/.github/workflows/frontend-unit-test-stress-test-flake-fix.yml
@@ -43,6 +43,8 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
      - name: Build cljs
        run: yarn build:cljs
      - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -35,16 +35,15 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
-
-      - name: Get Eslint cache key
-        uses: ./.github/actions/get-cache-keys
-        id: get-cache-keys
+        with:
+          m2-cache-key: "cljs"
      - name: Restore ESLint cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache@v4
        with:
          path: .eslintcache
-          key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
-
+          key: eslintcache-${{ hashFiles('yarn.lock', '.eslintrc.js') }}
+          restore-keys: |
+            eslintcache-
      - name: Compile CLJS
        run: yarn build-pure:cljs
      - name: Find CSS variables that are used but never defined
@@ -53,8 +52,6 @@ jobs:
        run: yarn run lint-prettier-pure
      - name: Run ESLint linter
        run: yarn run lint-eslint-pure
-      - name: Run CSS linter
-        run: yarn run lint-css

  fe-type-check:
    if: ${{ !inputs.skip }}
@@ -66,6 +63,8 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
      - run: yarn build-pure:cljs
        name: Compile CLJS
      - run: yarn type-check-pure
@@ -89,12 +88,10 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
      - name: Run frontend unit tests
        run: yarn run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
-        continue-on-error: true
      - name: Upload Test Results
        uses: ./.github/actions/upload-test-results
        if: always() && github.event_name != 'workflow_dispatch'
@@ -117,6 +114,8 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
      - name: Run frontend timezones tests
        run: yarn run test-timezones

--- a/.github/workflows/fuzzing.yml
+++ b/.github/workflows/fuzzing.yml
@@ -22,6 +22,8 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
      - run: yarn test-unit frontend/src/metabase/querying/expressions/pratt/fuzz.lexifier.unit.spec.ts
        env:
          MB_FUZZ: 1
@@ -36,6 +38,8 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.compiler.unit.spec.ts
        env:
          MB_FUZZ: 1
@@ -50,6 +54,8 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.string.unit.spec.ts
        env:
          MB_FUZZ: 1
--- a/.github/workflows/generative-query-test.yml
+++ b/.github/workflows/generative-query-test.yml
@@ -40,6 +40,8 @@ jobs:
          ref: ${{ inputs.ref }}
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: generative-query-test
      - name: Prepare front-end environment
        uses: ./.github/actions/prepare-frontend

--- a/.github/workflows/i18n.yml
+++ b/.github/workflows/i18n.yml
@@ -38,6 +38,8 @@ jobs:
      uses: ./.github/actions/prepare-frontend
    - name: Prepare back-end environment
      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: 'i18n'
    - name: Install xgettext if necessary
      run: |
        if ! command -v xgettext > /dev/null; then
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -0,0 +1,32 @@
+name: Links
+
+on:
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * 0"
+
+jobs:
+  linkChecker:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write # required for peter-evans/create-issue-from-file
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Link Checker
+        id: lychee
+        uses: lycheeverse/lychee-action@v2
+        with:
+          fail: false
+          args: docs --include-fragments --config ./.lychee/config.toml --verbose --no-progress
+          format: markdown
+
+      - name: Create Issue From File
+        if: steps.lychee.outputs.exit_code != 0
+        uses: peter-evans/create-issue-from-file@v5
+        with:
+          title: Link Checker Report
+          content-filepath: ./.lychee/out.md
+          labels: "Type:Documentation"
+          assignees: jeff-bruemmer
--- a/.github/workflows/loki-update.yml
+++ b/.github/workflows/loki-update.yml
@@ -20,12 +20,32 @@ jobs:

      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"

      - name: Compile CLJS
        run: yarn build-pure:cljs

+      - name: Build Storybook
+        # We won't be able to use Storybook play's `userEvent` with production build
+        # see https://github.com/storybookjs/storybook/issues/19758
+        run: NODE_ENV=development yarn build-storybook
+
+      - name: Serve Storybook
+        run: yarn http-server storybook-static -p 6006 &
+        shell: bash
+
+      - name: Wait for Storybook to become available
+        run: |
+          echo "Waiting for Storybook to be served..."
+          while ! curl --silent --fail http://localhost:6006; do
+            sleep 5
+            echo "Retrying..."
+          done
+          echo "Storybook is being served!"
+
      - name: Update Loki Snapshots
-        run: yarn test-visual:loki:ci || yarn test-visual:loki-approve-diff && yarn test-visual:loki-prune
+        run: yarn test-visual:loki || yarn test-visual:loki-approve-diff && yarn test-visual:loki-prune

      - name: Check for changes
        id: check-changes
--- a/.github/workflows/loki.yml
+++ b/.github/workflows/loki.yml
@@ -47,12 +47,20 @@ jobs:

      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"

      - name: Compile CLJS
        run: NODE_ENV=development yarn build-pure:cljs

+      - name: Build Storybook
+        # We won't be able to use Storybook play's `userEvent` with production build
+        # see https://github.com/storybookjs/storybook/issues/19758
+        run: NODE_ENV=development yarn build-storybook
+
      - name: Run Loki Visual Tests
-        run: yarn test-visual:loki:ci
+        run: |
+          yarn loki --requireReference --reactUri file:./storybook-static --chromeFlags='--headless --disable-gpu' --verboseRenderer

      - name: Generate Visual Report on Failure
        if: failure()
--- a/.github/workflows/mage.yml
+++ b/.github/workflows/mage.yml
@@ -2,7 +2,7 @@ name: Mage Tests

 on:
  pull_request:
-    paths: ["mage/**"]
+    paths: ["mage/**", "test/mage/**"]

 jobs:
  # run mage tests even if the rest of be isnt needed
@@ -13,6 +13,8 @@ jobs:
      - uses: actions/checkout@v4
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: 'kondo'
      - name: Setup Babashka
        uses: turtlequeue/setup-babashka@v1.7.0
        with:
@@ -22,4 +24,4 @@ jobs:
      - name: bb task list
        run: bb tasks
      - name: Run mage tests
-        run: bb ./mage/test/mage/runtests.clj
+        run: bb ./test/mage/runtests.clj
--- a/.github/workflows/migrations.yml
+++ b/.github/workflows/migrations.yml
@@ -16,5 +16,7 @@ jobs:
      - uses: actions/checkout@v4
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: lint-migrations
      - name: Verify Liquibase Migrations
        run: ./bin/mage lint-migrations
--- a/.github/workflows/perf-test-labeled.yml
+++ b/.github/workflows/perf-test-labeled.yml
@@ -9,13 +9,9 @@ concurrency:
  cancel-in-progress: true

 jobs:
-  uberjar:
-    if: ${{ github.event.label.name == 'Run-perf' }}
-    uses: ./.github/workflows/uberjar.yml
-    secrets: inherit
-
  run-perf-test:
-    needs: [uberjar]
    if: ${{ github.event.label.name == 'Run-perf' }}
    uses: ./.github/workflows/perf-test.yml
+    with:
+      wait_for_uberjar: true
    secrets: inherit
--- a/.github/workflows/perf-test.yml
+++ b/.github/workflows/perf-test.yml
@@ -3,6 +3,11 @@ run-name: Run perf test for ${{ github.ref_name }} by @${{ github.actor }}

 on:
  workflow_call:
+    inputs:
+      wait_for_uberjar:
+        description: "Wait for uberjar build"
+        required: false
+        type: boolean
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -26,12 +31,69 @@ jobs:
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registries: "${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}"
+      - name: Wait for uberjar
+        id: wait_for_uberjar
+        if: ${{ inputs.wait_for_uberjar == true }}
+        run: |
+          ## Get workflow run id for uberjar build
+          curl -Ls --output e2e-tests.json \
+          -H "Accept: application/vnd.github+json" \
+          -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          https://api.github.com/repos/${{ github.repository }}/actions/workflows/run-tests.yml/runs?head_sha=${{ github.event.pull_request.head.sha || github.sha }}
+          ID=$(jq -r '.workflow_runs[0].id' e2e-tests.json)
+          echo "Run ID: ${ID}"
+
+          ## Get workflow run id for uberjar build
+          while [ -z "$JOB_ID" ]; do
+            NEXT_URL="https://api.github.com/repos/${{ github.repository }}/actions/runs/${ID}/jobs?filter=latest"
+
+            # Search for build job
+            echo "Searching for build job..."
+            while [ -z "$JOB_ID" ] && [ -n "$NEXT_URL" ]; do
+              # Get one page of jobs
+              RESPONSE=$(curl -s -i \
+                -H "Accept: application/vnd.github+json" \
+                -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+                -H "X-GitHub-Api-Version: 2022-11-28" \
+                "$NEXT_URL")
+
+              # Extract headers and body
+              HEADERS=$(echo "$RESPONSE" | sed -n '1,/^\r$/p')
+              BODY=$(echo "$RESPONSE" | sed '1,/^\r$/d')
+              LINK_HEADER=$(echo "$HEADERS" | grep -i '^link:' | sed 's/^link: //')
+
+              # Check for next page in Link header
+              if echo "$LINK_HEADER" | grep -q 'rel="next"'; then
+                NEXT_URL=$(echo "$LINK_HEADER" | sed -E 's/.*<([^>]+)>; rel="next".*/\1/')
+              else
+                NEXT_URL=""
+              fi
+
+              # Check for build job
+              JOB_ID=$(echo "$BODY" | jq -r '.jobs[] | select(.name | contains("build (ee)")) | .id')
+            done
+          done
+          echo "Job ID: ${JOB_ID}"
+
+          ## Wait for uberjar build to complete
+          while [ true ]; do
+            curl -Ls --output uberjar.json \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${{ github.repository }}/actions/jobs/${JOB_ID}
+            jq -r '.steps[] | select(.name == "Prepare uberjar artifact") | .status' uberjar.json | grep -q "completed" && break
+            echo "Waiting for uberjar build..."
+            sleep 10
+          done
+          echo "run_id=$(jq -r '.workflow_runs[0].id' e2e-tests.json)" >> $GITHUB_OUTPUT
      - name: Retrieve uberjar artifact for ee
-        uses: ./.github/actions/fetch-artifact
+        uses: actions/download-artifact@v4
        with:
          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-          extract-path: "target/uberjar"
-          output-name: "metabase.jar"
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ inputs.wait_for_uberjar && steps.wait_for_uberjar.outputs.run_id || github.run_id }}
      - name: Move uberjar to bin/docker
        run: |
          jar xf target/uberjar/metabase.jar
--- a/.github/workflows/pr-env.yml
+++ b/.github/workflows/pr-env.yml
@@ -27,11 +27,9 @@ jobs:
        with:
          registries: "${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}"
      - name: Retrieve uberjar artifact for ee
-        uses: ./.github/actions/fetch-artifact
+        uses: actions/download-artifact@v4
        with:
          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-          extract-path: "target/uberjar"
-          output-name: "metabase.jar"
      - name: Move uberjar to bin/docker
        run: |
          jar xf target/uberjar/metabase.jar
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -24,39 +24,6 @@ on:
        required: true

 jobs:
-  test-mode-config:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    outputs:
-      run_mode: ${{ fromJson(steps.config.outputs.result).runMode }}
-      dev_server: ${{ fromJson(steps.config.outputs.result).metastoreDevServer }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      # note: this block can be removed after we stop needing to be able to test versions before v55
-      - name: Get test mode config
-        id: config
-        uses: actions/github-script@v7
-        with:
-          script: | # js
-            const { getMajorVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-            // Versions before v55 used a single token for testing
-            // with v55 and later we use enterprise tokens that mirror actual Metabase plans
-            const MULTIPLE_TEST_TOKEN_THRESHOLD = 55;
-
-            const version = '${{ inputs.version }}';
-            const majorVersion = Number(getMajorVersion(version));
-            const oldTestToken = majorVersion < MULTIPLE_TEST_TOKEN_THRESHOLD;
-
-            return ({
-              runMode: oldTestToken ? 'prod' : 'e2e',
-              metastoreDevServer: oldTestToken ? '' : '${{ vars.METASTORE_DEV_SERVER_URL }}'
-            });
-
  release-artifact:
    runs-on: ubuntu-22.04
    timeout-minutes: 10
@@ -129,19 +96,17 @@ jobs:
  run-sanity-check:
    runs-on: ubuntu-22.04
    timeout-minutes: 30
-    needs: [test-mode-config, release-artifact]
+    needs: [release-artifact]
    strategy:
      matrix:
        edition: [oss, ee]
    env:
      MB_EDITION: ${{ matrix.edition }}
      DISPLAY: ""
-      MB_RUN_MODE: ${{ needs.test-mode-config.outputs.run_mode }}
-      METASTORE_DEV_SERVER_URL: ${{ needs.test-mode-config.outputs.dev_server }}
-      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
-      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
      # these are needed for backwards compatibility with release branches earlier than v55, since
      # this workflow always runs from master, but we run tests from the release branch
      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
--- a/.github/workflows/release-embedding-sdk.yml
+++ b/.github/workflows/release-embedding-sdk.yml
@@ -5,12 +5,19 @@ on:
  workflow_dispatch:
    inputs:
      branch:
-        description: "Branch we want to release the SDK from (to release from other branches use the workflow from those branches)"
+        description: "Branch we want to release the SDK from"
        type: choice
        required: true
        default: "master"
        options:
          - master
+          - release-x.51.x
+          - release-x.52.x
+          - release-x.53.x
+          - release-x.54.x
+          - release-x.55.x
+          - release-x.56.x
+          - esbuild-main

 concurrency:
  # We want to ensure only one job is running at a time per branch because
@@ -171,39 +178,41 @@ jobs:
    outputs:
      sdk_version: ${{ fromJson(steps.new-sdk-version.outputs.result).version }}
      major_version: ${{ fromJson(steps.new-sdk-version.outputs.result).majorVersion }}
-      pre_release_label: ${{ fromJson(steps.new-sdk-version.outputs.result).preReleaseLabel }}
    steps:
      - name: Check out the code using the provided branch
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.branch }}

-      - name: Prepare build scripts
-        run: yarn --cwd release --frozen-lockfile && yarn --cwd release build
-
      - name: Get current SDK version
        id: current-sdk-version
        run: |
-          VERSION=$(jq -r .version ./enterprise/frontend/src/embedding-sdk-package/package.template.json)
+          VERSION=$(jq -r .version ./enterprise/frontend/src/embedding-sdk/package.template.json)
          echo "sdk_current_version=$VERSION" >> $GITHUB_OUTPUT

-      - name: Get next SDK patch or pre-release version
+      - name: Get next SDK patch version
        id: new-sdk-version
        uses: actions/github-script@v7
        with:
-          script: | #js
-            const { getNextSdkVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-            const branch = "${{ inputs.branch }}";
+          script: |
            const currentVersion = "${{ steps.current-sdk-version.outputs.sdk_current_version }}";
+            const [currentVersionWithoutSuffix, suffix] = currentVersion.split("-");
+            const versionParts = currentVersionWithoutSuffix.split(".");
+            versionParts[versionParts.length - 1] = parseInt(versionParts.at(-1)) + 1;
+            const newVersion = versionParts.join(".");
+            const [_, majorVersion] = versionParts

-            const result = getNextSdkVersion(branch, currentVersion);
+            if (!suffix) {
+              return {
+                version: newVersion,
+                majorVersion
+              };
+            }

            return {
-              version: result.version,
-              preReleaseLabel: result.preReleaseLabel,
-              majorVersion: result.majorVersion
-            };
+              version: `${newVersion}-${suffix}`,
+              majorVersion
+            }

      - name: Append workflow summary
        run: |
@@ -254,6 +263,8 @@ jobs:

      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "release-sdk"

      - name: Run unit tests
        run: yarn embedding-sdk:test-unit
@@ -275,14 +286,20 @@ jobs:

      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "release-sdk"

      - name: Bump published npm package version
        # NOTE: this should happen before "Build SDK bundle" as we inject SDK version into the code during build step
        run: |
          ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ needs.determine-sdk-version.outputs.sdk_version }}

-      - name: Build SDK package
-        run: yarn run build-embedding-sdk-package
+      - name: Update changelog
+        run: |
+          yarn embedding-sdk:generate-changelog -o changelog-diff
+
+      - name: Build SDK bundle
+        run: yarn run build-embedding-sdk

      - name: Generate SDK package.json in the build directory
        run: yarn run embedding-sdk:generate-package
@@ -293,6 +310,12 @@ jobs:
          name: metabase-sdk
          path: ./resources/embedding-sdk

+      - name: Upload changelog diff
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdk-changelog-diff
+          path: ./changelog-diff
+
  publish-npm:
    needs: [build-sdk, determine-sdk-version]
    runs-on: ubuntu-22.04
@@ -313,7 +336,6 @@ jobs:
          git config --global user.name "Metabase Automation"

      - name: Update readme
-        if: inputs.branch != 'master'
        run: |
          bash ./bin/embedding-sdk/release_utils.bash update_readme ${{ env.sdk_version }}

@@ -321,33 +343,31 @@ jobs:
        run: |
          bash ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ env.sdk_version }}

-      - name: Create a PR updating readme + published version (using GitHub Metabase Automation account)
+      - name: Retrieve SDK changelog diff
+        uses: actions/download-artifact@v4
+        with:
+          name: sdk-changelog-diff
+
+      - name: Update changelog
+        run: |
+          cat changelog-diff enterprise/frontend/src/embedding-sdk/CHANGELOG.md > new-changelog
+          mv new-changelog enterprise/frontend/src/embedding-sdk/CHANGELOG.md
+
+      - name: Create a PR updating readme + published version, and changelog (using GitHub Metabase Automation account)
        run: |
          git checkout -b update-sdk-version-${{ env.sdk_version }}
-
-          if [ "${{ inputs.branch }}" = "master" ]; then
-            COMMIT_MSG="chore(sdk): Update published npm version to ${{ env.sdk_version }}"
-            PR_TITLE="chore(sdk): Update SDK version to ${{ env.sdk_version }}"
-            PR_BODY="Update published npm package version to ${{ env.sdk_version }}"
-          else
-            COMMIT_MSG="docs(sdk): Update Readme version references and published npm version to ${{ env.sdk_version }}"
-            PR_TITLE="docs(sdk): Update SDK version to ${{ env.sdk_version }}"
-            PR_BODY="Update Readme version references and published npm package version to ${{ env.sdk_version }}"
-          fi
-
-          git commit -a -m "$COMMIT_MSG"
+          git commit -a -m 'Update Readme version references and published npm version to ${{ env.sdk_version }}'
          git push origin HEAD
-          gh pr create --base "${{ inputs.branch }}" \
-                       --assignee "${GITHUB_ACTOR}" \
-                       --title "$PR_TITLE" \
-                       --body "$PR_BODY"
+          gh pr create --base ${{ inputs.branch }}\
+                       --assignee "${GITHUB_ACTOR}"\
+                       --title "docs(sdk): Update SDK version to ${{ env.sdk_version }}"\
+                       --body "Update Readme version references and published npm package version to ${{ env.sdk_version }}"
        env:
          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

      - name: Edit PR adding useful information (using Metabase bot app)
-        # metabase/embedding team is added automatically as code owner of updated `package.template.json` file
        run: |
-          gh pr edit --add-reviewer albertoperdomo --add-label no-backport
+          gh pr edit --add-reviewer @metabase/embedding,albertoperdomo --add-label no-backport
        env:
          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

@@ -369,36 +389,21 @@ jobs:
          name: metabase-sdk
          path: sdk

-      - name: Compute master tag
-        id: compute-tag
-        run: |
-          if [ -n "${{ needs.determine-sdk-version.outputs.pre_release_label }}" ]; then
-            echo "masterTag=${{ needs.determine-sdk-version.outputs.pre_release_label }}" >> $GITHUB_OUTPUT
-          else
-            echo "masterTag=nightly" >> $GITHUB_OUTPUT
-          fi
-
      - name: Publish to NPM
        working-directory: sdk
        run: |
          echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
-
-          TAG=$(jq -r --null-input \
-            --arg branch "${{ inputs.branch }}" \
-            --arg masterTag "${{ steps.compute-tag.outputs.masterTag }}" '
-            {
-              "master": $masterTag,
-              "release-x.51.x": "51-stable",
-              "release-x.52.x": "52-stable",
-              "release-x.53.x": "53-stable",
-              "release-x.54.x": "54-stable",
-              "release-x.55.x": "55-stable",
-              "release-x.56.x": "56-stable"
-            }[$branch]'
-          )
-
-          echo "Resolved npm tag: $TAG"
-          npm publish --tag "$TAG"
+          # Please keep the value in sync with `inputs.branch`'s release branch
+          npm publish --tag ${{fromJson('{
+           "master": "nightly",
+           "release-x.51.x": "51-stable",
+           "release-x.52.x": "52-stable",
+           "release-x.53.x": "53-stable",
+           "release-x.54.x": "54-stable",
+           "release-x.55.x": "55-stable",
+           "release-x.56.x": "56-stable",
+           "esbuild-main": "56-esbuild"
+           }')[inputs.branch]}}

      - name: Add `latest` tag to the latest release branch (`release-x.55.x`) deployment
        if: ${{ inputs.branch == 'release-x.56.x' }}
--- a/.github/workflows/release-log.yml
+++ b/.github/workflows/release-log.yml
@@ -47,7 +47,7 @@ jobs:
        with:
          script: | # js
            const {
-              getMajorVersionFromRef,
+              getVersionFromReleaseBranch,
              getMajorVersion,
            } = require('${{ github.workspace }}/release/dist/index.cjs');

@@ -60,15 +60,14 @@ jobs:
            }

            // otherwise, get the version from the release branch name
-            const ref = context.payload.ref;
-            const majorVersion = getMajorVersionFromRef(ref);
+            const branch = context.payload.ref;
+            const version = getVersionFromReleaseBranch(branch);
+            const majorVersion = getMajorVersion(version);

-            console.log({ ref, majorVersion });
+            console.log({ branch, version, majorVersion });
            core.exportVariable('VERSION', majorVersion);

      - name: generate release Log
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: cd release && tsx ./src/release-log-run.ts $VERSION > v$VERSION.html
      - name: generate release channel log
        run: cd release && tsx ./src/release-channel-log.ts > channels.html
--- a/.github/workflows/release-patch.yml
+++ b/.github/workflows/release-patch.yml
@@ -8,11 +8,6 @@ on:
        description: 'Major Metabase version (e.g. 45, 52, 68)'
        type: number
        required: true
-      override_sha:
-        description: DANGEROUSLY allow releasing from this commit sha, regardless of the state of CI (can be empty)
-        type: string
-        required: false
-        default: ''
  schedule:
    - cron: '0 21 * * 1-5' # every weekday at 4 pm EST/5 pm EDT

@@ -42,7 +37,7 @@ jobs:
            const lastRelease = currentRelease - 1;
            const AUTO_RELEASE_VERSIONS = [lastRelease, currentRelease];

-            async function releasePatchFor(majorVersion, overrideSha) {
+            async function releasePatchFor(majorVersion) {
              const nextPatch = await getNextPatchVersion({
                github,
                owner: context.repo.owner,
@@ -50,7 +45,7 @@ jobs:
                majorVersion,
              });

-              const releaseCommit = overrideSha || await getLatestGreenCommit({
+              const goodCommit = await getLatestGreenCommit({
                github,
                owner: context.repo.owner,
                repo: context.repo.repo,
@@ -61,27 +56,26 @@ jobs:
                github,
                owner: context.repo.owner,
                repo: context.repo.repo,
-                ref: releaseCommit,
+                ref: goodCommit,
                majorVersion: Number(majorVersion),
              });

-              console.log(
-                { nextPatch, releaseCommit, hasBeenReleased }
-              );
-
-              if (nextPatch && releaseCommit && !hasBeenReleased) {
+              if (nextPatch && goodCommit && !hasBeenReleased) {
                await github.rest.actions.createWorkflowDispatch({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  workflow_id: 'tag-for-release.yml',
                  ref: 'refs/heads/master',
                  inputs: {
-                    commit: releaseCommit,
+                    commit: goodCommit,
                    version: nextPatch,
                    auto: true,
                  }
-                }).catch(console.error);
+                });
              } else {
+                console.log(
+                  { nextPatch, goodCommit, hasBeenReleased }
+                );
                console.error(`No new patch version or no green commit found for v${majorVersion}`);
              }
            }
@@ -94,15 +88,7 @@ jobs:
                throw new Error(`Invalid version number: ${inputVersion}`);
              }

-              // only allow overriding the commit SHA for workflow_dispatch events with a provided sha
-              const overrideSha = String(context.payload?.inputs?.override_sha ?? '').trim();
-              const isValidOverride = overrideSha.length === 40;
-
-              if (!isValidOverride && overrideSha.length > 0) {
-                throw new Error(`Invalid override SHA provided: ${overrideSha}`);
-              }
-
-              await releasePatchFor(inputVersion, isValidOverride ? overrideSha : undefined);
+              await releasePatchFor(inputVersion);
            } else { // scheduled release of AUTO_RELEASE_VERSIONS
-              await Promise.all(AUTO_RELEASE_VERSIONS.map(version => releasePatchFor(version)));
+              await Promise.all(AUTO_RELEASE_VERSIONS.map(releasePatchFor));
            }
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -189,16 +189,14 @@ jobs:
    - name: Upload to s3 ${{ inputs.tag_name }} path
      run: | # sh
        aws s3 cp \
-          s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.source_path.outputs.result }}/ \
-          s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.upload_path.outputs.result }}/ \
-          --recursive \
-          --include "*"
+          s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.source_path.outputs.result }}/metabase.jar \
+          s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.upload_path.outputs.result }}/metabase.jar

    - name: Create cloudfront invalidation
      run: |
        aws cloudfront create-invalidation \
        --distribution-id ${{ vars.AWS_CLOUDFRONT_DOWNLOADS_ID }} \
-        --paths "/${{ steps.upload_path.outputs.result }}/*"
+        --paths /${{ steps.upload_path.outputs.result }}/metabase.jar

    - name: Download the jars
      run: | # sh
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -211,15 +211,13 @@ jobs:
          return version_path;

    - name: Upload to S3
-      run: |
-        aws s3 cp ./metabase.jar s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.version_path.outputs.result }}/metabase.jar
-        aws s3 cp ./SHA256.sum s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.version_path.outputs.result }}/metabase.sha256
+      run: aws s3 cp ./metabase.jar s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.version_path.outputs.result }}/metabase.jar

    - name: Create cloudfront invalidation
      run: |
        aws cloudfront create-invalidation \
        --distribution-id ${{ vars.AWS_CLOUDFRONT_DOWNLOADS_ID }} \
-        --paths "/${{ steps.version_path.outputs.result }}/*"
+        --paths /${{ steps.version_path.outputs.result }}/metabase.jar

  verify-s3-download:
    runs-on: ubuntu-22.04
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -8,7 +8,6 @@ on:
  pull_request:
    types: [opened, synchronize, reopened]
  merge_group:
-  workflow_dispatch:

 jobs:
  files-changed:
@@ -49,6 +48,8 @@ jobs:
        uses: ./.github/actions/prepare-frontend
      - name: Prepare back-end environment
        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "files-changed"
      - name: Build static-viz frontend
        run: yarn build-static-viz
        env:
@@ -71,22 +72,17 @@ jobs:
    if: ${{ !cancelled() && !(needs.files-changed.outputs.documentation == 'true' && needs.files-changed.outputs.backend_all == 'false' && needs.files-changed.outputs.frontend_all == 'false' && needs.files-changed.outputs.e2e_all == 'false') }}
    uses: ./.github/workflows/uberjar.yml
    secrets: inherit
+    with:
+      source_changed: ${{ needs.files-changed.outputs.backend_all == 'true' || needs.files-changed.outputs.frontend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true' }}

  backend-tests:
-    if: ${{ !cancelled() && needs.files-changed.result == 'success' }}
+    if: ${{ !cancelled() }}
    needs: [files-changed, static-viz-files-changed]
    uses: ./.github/workflows/backend.yml
    secrets: inherit
    with:
      skip: ${{ needs.files-changed.outputs.backend_all != 'true' && needs.static-viz-files-changed.outputs.static_viz != 'true' }}

-  semantic-search-tests:
-    needs: files-changed
-    uses: ./.github/workflows/semantic-search.yml
-    secrets: inherit
-    with:
-      skip: ${{ needs.files-changed.outputs.backend_all != 'true' }}
-
  app-db-tests:
    needs: files-changed
    uses: ./.github/workflows/app-db.yml
@@ -111,7 +107,7 @@ jobs:

  e2e-tests:
    needs: [files-changed, uberjar]
-    if: always() && !cancelled() && needs.files-changed.result == 'success'
+    if: always() && !cancelled()
    uses: ./.github/workflows/e2e-tests.yml
    secrets: inherit
    with:
@@ -134,15 +130,3 @@ jobs:
      contains(github.event.pull_request.labels.*.name, 'PR-Env')
    uses: ./.github/workflows/pr-env.yml
    secrets: inherit
-
-  containerize:
-    needs: [uberjar]
-    if: |
-      !cancelled() &&
-      needs.uberjar.result == 'success' &&
-      (
-        (github.event_name == 'push' && contains(fromJson('["master", "metabot-v3-main", "internal-tools"]'), github.ref_name)) ||
-        (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'build-docker-uberjar'))
-      )
-    uses: ./.github/workflows/containerize-uberjar.yml
-    secrets: inherit
--- a/Show More
+++ b/Show More