more docs

+ explore how to fix the issue with lib.util.match

.clj-kondo/config.edn

@@ -1,25 +1,63 @@
 ;; -*- comment-column: 100; -*-
 {:config-paths ["macros" "src"]
  :linters
- {:aliased-namespace-symbol     {:level :warning}
-  :invalid-arity                {:skip-args [metabase.lib.util.match/match]} ; TODO (cam): can we fix these?
+ {
+  ;;
+  ;; enabled optional linters (these are disabled by default)
+  ;;
+
+  :aliased-namespace-symbol     {:level :warning}
+  :case-symbol-test             {:level :warning}
+  :condition-always-true        {:level :warning}
+  :def-fn                       {:level :warning}
+  :dynamic-var-not-earmuffed    {:level :warning}
+  :equals-expected-position     {:level :warning, :only-in-test-assertion true}
   :keyword-binding              {:level :warning}
   :main-without-gen-class       {:level :warning}
+  :minus-one                    {:level :warning}
   :misplaced-docstring          {:level :warning}
   :missing-body-in-when         {:level :warning}
   :missing-docstring            {:level :warning}
   :missing-else-branch          {:level :warning}
   :namespace-name-mismatch      {:level :warning}
   :non-arg-vec-return-type-hint {:level :warning}
+  :plus-one                     {:level :warning}
   :reduce-without-init          {:level :warning}
+  :redundant-call               {:level :warning}
   :redundant-fn-wrapper         {:level :warning}
-  :refer-all                    {:level :warning, :exclude [clojure.test]}
+  :self-requiring-namespace     {:level :warning}
   :single-key-in                {:level :warning}
+  :unsorted-imports             {:level :warning}
   :unsorted-required-namespaces {:level :warning}
-  :unused-referred-var          {:exclude {compojure.core [GET DELETE POST PUT]}}
+  :unused-alias                 {:level :warning}
   :use                          {:level :warning}
   :warn-on-reflection           {:level :warning}
 
+  ;;
+  ;; other disabled-by-default linters it would be nice to enable soon
+  ;;
+
+  ;; TODO (cam): most of these either have a ton of things that need to be fixed or cause issues
+  ;; with [[metabase.lib.util.match/match]] and friends -- we need to write a custom hook for those macros so Kondo
+  ;; can understand them.
+
+  #_:docstring-leading-trailing-whitespace
+  #_:equals-false
+  #_:equals-true
+  #_:used-underscored-binding
+
+  ;;
+  ;; disabled linters
+  ;;
+
+  :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
+  :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
+
+  ;;
+  ;; globally-enabled custom linters
+  ;;
+  :metabase/check-defmulti-arglists                    {:level :warning}
+  :metabase/check-me-humanize                          {:level :warning}
   :metabase/defsetting-must-specify-export             {:level :warning}
   :metabase/mbql-query-first-arg                       {:level :warning}
   :metabase/missing-test-expr-requires-in-cljs         {:level :warning}
@@ -47,8 +85,8 @@
      metabase.actions.test-util/with-actions-test-data-and-actions-enabled
      metabase.actions.test-util/with-actions-test-data-tables
      metabase.analytics.snowplow-test/with-fake-snowplow-collector
-     metabase.email-test/with-expected-messages
-     metabase.email-test/with-fake-inbox
+     metabase.channel.email-test/with-expected-messages
+     metabase.channel.email-test/with-fake-inbox
      metabase.test.data.users/with-group
      metabase.test.data.users/with-group-for-user
      metabase.test.data/with-empty-h2-app-db
@@ -128,16 +166,18 @@
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
      metabase.channel.core/send!
-     metabase.models.notification/create-notification!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
+     metabase.models.notification/create-notification!
      metabase.pulse.send/send-pulse!
      metabase.query-processor.store/store-database!
+     ;; Safe in tests, where we typically use a private, temporary index per thread.
+     metabase.search.core/reindex!
      metabase.util/run-count!
      next.jdbc/execute!}}
 
   :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests
   {:level      :warning
-   :max-length 180}
+   :max-length 150}
 
   ;; this is not enabled here, it is enabled below only for specific namespaces.
   :metabase/disallow-hardcoded-driver-names-in-tests
@@ -166,21 +206,16 @@
               :vertica}}
 
   ;;
-  ;; disabled linters
+  ;; misc config for built-in linters
   ;;
 
-  :unexpected-recur         {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
-  :used-underscored-binding {:level :off} ; false positives: see https://github.com/clj-kondo/clj-kondo/issues/2152
-
-  ;;
-  ;; TODO (cam): here are some more linters we should experiment with enabling -- some might be useful.
-  ;;
-
-  ;; :docstring-leading-trailing-whitespace {:level :warning}
-  ;; :docstring-no-summary                  {:level :warning}
-  ;; :shadowed-var                          {:level :warning}
-  ;; :def-fn                                {:level :warning}
+  :invalid-arity       {:skip-args [metabase.lib.util.match/match]} ; TODO (cam): can we fix these?
+  :refer-all           {:level :warning, :exclude [clojure.test]}
+  :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
+  ;; TODO -- all of these entries are HACKS and we should fix them by writing real custom Kondo HOOKS for these
+  ;; macros. Please don't add anything new to this list! Talk to your best bud Cam if you don't know how to write a
+  ;; Kondo hook and he will pair with you on it. Thanks! -- Cam
   :unresolved-symbol
   {:exclude
    [(build.uberjar/with-duration-ms)
@@ -191,7 +226,7 @@
     (clojure.test/is [query= =? malli= qv=])
     (clojure.tools.macro/macrolet)
     instaparse.core/transform
-    (metabase.async.streaming-response/streaming-response)
+    (metabase.server.streaming-response/streaming-response)
     (metabase.driver.druid.query-processor-test/druid-query-returning-rows)
     (metabase.lib.util.match/match)
     (metabase.lib.util.match/match-one)
@@ -214,7 +249,7 @@
     metabase.driver.sql-jdbc.execute/set-time-zone-if-supported!                 {:namespaces ["metabase\\.driver.*"]}
     metabase.driver/current-db-time                                              {:namespaces ["metabase.*"]}
     metabase.driver/supports?                                                    {:namespaces ["metabase.*"]}
-    metabase.public-settings.premium-features/enable-enhancements?               {:namespaces ["metabase\\.models.*"]}
+    metabase.premium-features.premium-features/enable-enhancements?              {:namespaces ["metabase\\.models.*"]}
     metabase.query-processor.middleware.resolve-joins/maybe-resolve-source-table {:namespaces ["metabase.*"]}
     metabase.query-processor.util/normalize-token                                {:namespaces ["metabase.*"]}
     schema.core/both                                                             {:namespaces ["metabase.*"]}
@@ -228,6 +263,7 @@
    clojure.core/pr                                    {:message "Use metabase.util.log instead of clojure.core/pr"}
    clojure.core/tap>                                  {:message "Don't use tap> is source code"}
    clojure.core/time                                  {:message "Don't use time in source code"}
+   clojure.test.check/quick-check                     {:message "You probably meant to use clojure.test.check.clojure-test/defspec instead -- quick check will run the tests when it is evaluated rather than when we run the test suite."}
    clojure.java.jdbc/get-connection                   {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/get-connection"}
    clojure.java.jdbc/with-db-connection               {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/with-db-connection"}
    clojure.java.jdbc/with-db-metadata                 {:message "Use sql-jdbc.execute/do-with-connection-with-options + .getMetaData instead of jdbc/with-db-metadata"}
@@ -239,24 +275,27 @@
    honeysql.core/raw                                  {:message "Use hx/raw instead because it is Honey SQL 2 friendly"}
    java-time/with-clock                               {:message "Use mt/with-clock"}
    java.util.UUID/randomUUID                          {:message "Use clojure.core/random-uuid instead of java.util.UUID/randomUUID"}
-   malli.core/explainer                               {:message "Use metabase.util.malli.registry/explainer instead of malli.core/explainer"}
+   malli.core/explain                                 {:message "Use metabase.util.malli.registry/explain instead of malli.core/explain because it has built-in caching"}
+   malli.core/explainer                               {:message "Use metabase.util.malli.registry/explainer instead of malli.core/explainer because it has built-in caching"}
+   malli.core/validate                                {:message "Use metabase.util.malli.registry/validate instead of malli.core/validate because it has built-in caching"}
+   malli.core/validator                               {:message "Use metabase.util.malli.registry/validator instead of malli.core/validator because it has built-in caching"}
    me.flowthing.pp/pprint                             {:message "Use metabase.util.log instead of me.flowthing.pp/pprint"}
    medley.core/random-uuid                            {:message "Use clojure.core/random-uuid instead of medley.core/random-uuid"}
    metabase.driver/database-supports?                 {:message "Use metabase.driver.util/supports? instead of metabase.driver/database-supports?"}
    metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
    metabase.test/with-temp*                           {:message "Use mt/with-temp instead of mt/with-temp*"}
-   toucan2.tools.with-temp                            {:message "Use mt/with-temp instead of t2.with-temp/with-temp"}}
+   toucan2.tools.with-temp/with-temp                  {:message "Use mt/with-temp instead of toucan2.tools.with-temp/with-temp"}}
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
+   cheshire.core          {:message "Use metabase.util.json instead of cheshire.core directly."}
    clojure.tools.logging  {:message "Use metabase.util.log instead of clojure.tools.logging directly"}
    grouper.core           {:message "Use metabase.util.grouper instead of grouper.core"}
    honeysql.core          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
    honeysql.format        {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
    honeysql.helpers       {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
    honeysql.types         {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
-   honeysql.util          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
-   metabase.util.jvm      {:message "All of metabase.util.jvm is re-exported from metabase.util; prefer that"}}
+   honeysql.util          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}}
 
   :unresolved-var
   {:exclude
@@ -276,8 +315,7 @@
    ;;    this set. Ideally this set should only have one namespace, but restricting it to a set of several is still
    ;;    better than `:any`.
    ;;
-   ;; 3. `nil` or not listed here -- we default to assuming there is one API namespace that matches the name of the
-   ;;    module itself, e.g. the module namespace for `metabase.setup` would be `metabase.setup`.
+   ;; 3. `nil` or not listed here -- we default to assuming there is one API namespace called `<module>.core`
    ;;
    ;; `nil` or an empty set  Otherwise this should be a set of namespace symbols.
    ;;
@@ -288,32 +326,43 @@
                                      metabase.analytics.snowplow
                                      metabase.analytics.stats
                                      metabase.analytics.sdk}                                        ; TODO -- consolidate these into a real API namespace.
-    metabase.analyze               #{metabase.analyze}
+    metabase.analyze               #{metabase.analyze.core}
     metabase.api                   #{metabase.api.common
+                                     ;; I don't really like making all these namespaces external but they have to be
+                                     ;; for now until we can shrink this mega-module down a little bit (by moving API
+                                     ;; namespaces out into different modules)... eventually `api` will just be a
+                                     ;; general low-level API utils/macros module and at that point it can probably
+                                     ;; get a single API namespace. Please try to avoid adding more stuff here if you
+                                     ;; can tho. -- Cam
+                                     metabase.api.common.validation
                                      metabase.api.dataset
+                                     metabase.api.macros
                                      metabase.api.permission-graph
                                      metabase.api.routes}                                           ; TODO -- consolidate these into a real API namespace. I think the `*current-user*` type stuff might need to be moved into a separate module.
-    metabase.async                 #{metabase.async.streaming-response
-                                     metabase.async.streaming-response.thread-pool
-                                     metabase.async.util}                                           ; TODO -- consolidate these into a real API namespace.
     metabase.audit                 #{metabase.audit}
-    metabase.bootstrap             #{metabase.bootstrap}
+    metabase.auth-provider         #{metabase.auth-provider}
     metabase.cmd                   #{}                                                              ; there are no namespaces here since you shouldn't be using this in any other module.
-    metabase.channel               #{metabase.channel.core
+    ;; TODO -- this has too many API namespaces, ideally it would only expose `metabase.channel.core`,
+    ;; `metabase.channel.init`, and `metabase.channel.api`.
+    metabase.channel               #{metabase.channel.api
+                                     metabase.channel.core
+                                     metabase.channel.email
+                                     metabase.channel.email.messages
+                                     metabase.channel.init
                                      metabase.channel.render.core
                                      metabase.channel.template.core}
     metabase.config                #{metabase.config}
+    ;; this is not even a real module, it's an external library but its starts with a `metabase.` namespace.
+    metabase.connection-pool       #{metabase.connection-pool}
     metabase.core                  #{metabase.core.initialization-status}                           ; TODO -- only namespace used outside of EE, this probably belongs in `metabase.server` anyway since that's the only place it's used.
     metabase.db                    #{metabase.db
                                      metabase.db.metadata-queries                                   ; TODO this should probably be separate from metabase.db
                                      metabase.db.query                                              ; TODO this is mostly util stuff like `metabase.db.query/query` that we don't even need anymore.
                                      metabase.db.setup}                                             ; TODO these are only calling `metabase.db.setup/setup-db!` and there's a slightly different version in `metabase.db`
     metabase.driver                :any                                                             ; TODO -- 19 namespaces!!!! CRY
-    metabase.email                 #{metabase.email
-                                     metabase.email.messages
-                                     metabase.email.result-attachment}                              ; TODO -- consolidate these into a real API namespace.
+    metabase.eid-translation       #{metabase.eid-translation}
     metabase.embed                 #{metabase.embed.settings}
-    metabase.events                #{metabase.events}
+    metabase.events                #{metabase.events metabase.events.init}
     metabase.formatter             #{metabase.formatter}
     metabase.integrations          #{metabase.integrations.common
                                      metabase.integrations.google
@@ -325,56 +374,69 @@
                                      metabase.legacy-mbql.schema.helpers
                                      metabase.legacy-mbql.util}                                     ; TODO -- consolidate these into a real API namespace.
     metabase.lib                   :any                                                             ; TODO -- :cry: 34 externally referenced namespaces, but maybe half of them are schema namespaces which technically don't need to be required.
-    metabase.logger                #{metabase.logger}
-    metabase.metabot               #{metabase.metabot}
+    metabase.logger                #{metabase.logger metabase.logger.init}
     metabase.models                :any                                                             ; TODO -- scream, 62 namespaces used elsewhere, but to be fair a lot of these don't *need* to be required.
     metabase.moderation            #{metabase.moderation}
     metabase.notification          #{metabase.notification.core
+                                     metabase.notification.init
                                      metabase.notification.payload.core}
     metabase.permissions           #{metabase.permissions.util}                                     ; TODO -- this is currently the only namespace in this module. Give it a real API namespace?
     metabase.plugins               #{metabase.plugins
                                      metabase.plugins.classloader}                                  ; TODO -- not 100% sure the classloader belongs here
-    metabase.public-settings       #{metabase.public-settings
-                                     metabase.public-settings.premium-features}
+    metabase.premium-features      #{metabase.premium-features.core}
+    metabase.public-settings       #{metabase.public-settings}
     metabase.pulse                 #{metabase.pulse.core}
     metabase.query-processor       :any                                                             ; TODO omg scream, 29 namespaces used outside of the module. WHAT THE HECC
-    metabase.query-analysis        #{metabase.query-analysis
-                                     metabase.query-analysis.failure-map}
-    metabase.related               #{metabase.related}
+    metabase.query-analysis        #{metabase.query-analysis.core
+                                     metabase.query-analysis.init}
+    metabase.request               #{metabase.request.core}
     metabase.sample-data           #{metabase.sample-data}
-    metabase.search                #{metabase.search
+    metabase.search                #{metabase.search.core
+                                     metabase.search.init
+                                     ;; this is used by `metabase.search.api`... once we move that into this module we
+                                     ;; can remove it as an API namespace
+                                     metabase.search.config
+                                     ;; Need to expose this submodule, to break circular dependencies with models.
                                      metabase.search.spec}
-    metabase.server                #{metabase.server
-                                     metabase.server.handler
-                                     metabase.server.middleware.auth
-                                     metabase.server.middleware.exceptions
+    metabase.server                #{metabase.server.core
+                                     ;;
+                                     ;; TODO FIXME -- this is loaded for side effects since it contains the JSON
+                                     ;; encoder logic for stuff like `java.time` classes. As a
+                                     ;; result, [[metabase.models.setting]] (and thus the `metabase.models` module)
+                                     ;; has to depend on the `metabase.server` module...we should create either a new
+                                     ;; `metabase.json` or `metabase.encoders` module for stuff like this to live. Or
+                                     ;; maybe it just belongs in a generic `metabase.config` module.
                                      metabase.server.middleware.json
-                                     metabase.server.middleware.misc
-                                     metabase.server.middleware.offset-paging
-                                     metabase.server.middleware.session
+                                     ;;
+                                     ;; TODO -- we can't make this part of [[metabase.server.core]] YET because it
+                                     ;; causes circular dependencies. Maybe in the future once we tease apart more of
+                                     ;; the modules tangle we can.
                                      metabase.server.protocols
-                                     metabase.server.request.util}                                  ; TODO -- consolidate these into a real API namespace.
-    metabase.setup                 #{metabase.setup}
-    metabase.sync                  #{metabase.sync
-                                     metabase.sync.analyze
-                                     metabase.sync.concurrent
-                                     metabase.sync.field-values
+                                     ;;
+                                     ;; TODO -- I really don't like having YET ANOTHER allowed external namespace for
+                                     ;; this module but some things need to import it so
+                                     ;; `metabase.server.streaming_response.StreamingReponse` comes into existence...
+                                     metabase.server.streaming-response}
+    metabase.setup                 #{metabase.setup.api
+                                     metabase.setup.core}
+    metabase.sync                  #{metabase.sync.api
+                                     metabase.sync.core
+                                     metabase.sync.init
+                                     ;; TODO -- see if we can expose the important parts in `metabase.sync.core`
                                      metabase.sync.schedules
-                                     metabase.sync.sync-metadata
-                                     metabase.sync.sync-metadata.fields
-                                     metabase.sync.sync-metadata.tables
-                                     metabase.sync.util}                                            ; TODO -- consolidate these into a real API namespace.
+                                     metabase.sync.util}
     metabase.task                  #{metabase.task
+                                     metabase.task.bootstrap
                                      metabase.task.index-values
+                                     metabase.task.init
                                      metabase.task.persist-refresh
                                      ;; We need to expose this to the metabase.search module.
                                      ;; Ideally, it would just live inside that module.
                                      metabase.task.search-index}                                    ; TODO -- consolidate these into a real API namespace.
-    metabase.troubleshooting       #{metabase.troubleshooting}
     metabase.types                 #{metabase.types}
     metabase.upload                #{metabase.upload}
     metabase.util                  :any                                                             ; I think util being `:any` is actually something I am ok with. But this has 32 namespaces.
-    metabase.xrays                 #{metabase.xrays}}
+    metabase.xrays                 #{metabase.xrays.core}}
 
    ;; Map of module => other modules you're allowed to use there. You have two options here:
    ;;
@@ -390,18 +452,15 @@
     metabase.analytics             :any
     metabase.analyze               :any
     metabase.api                   :any
-    metabase.async                 :any
     metabase.audit                 :any
-    metabase.auth-provider         #{metabase.util metabase.public-settings}
-    metabase.bootstrap             #{}
+    metabase.auth-provider         #{metabase.util
+                                     metabase.premium-features}
     metabase.cmd                   :any
-    metabase.compatibility         :any
     metabase.channel               :any
     metabase.config                #{metabase.plugins}
     metabase.core                  :any
     metabase.db                    :any
     metabase.driver                :any
-    metabase.email                 :any
     metabase.embed                 :any
     metabase.events                :any
     metabase.formatter             :any
@@ -410,12 +469,12 @@
     metabase.lib                   :any
     metabase.logger                #{metabase.config
                                      metabase.plugins}
-    metabase.metabot               :any
     metabase.models                :any
     metabase.moderation            :any
     metabase.notification          :any
     metabase.permissions           :any
     metabase.plugins               :any
+    metabase.premium-features      :any
     metabase.public-settings       :any
     metabase.pulse                 :any
     metabase.query-analysis        #{metabase.config
@@ -425,19 +484,22 @@
                                      metabase.models
                                      metabase.public-settings
                                      metabase.query-processor
+                                     metabase.task
                                      metabase.util}
     metabase.query-processor       :any
-    metabase.related               :any
+    metabase.request               #{metabase.config
+                                     metabase.models
+                                     metabase.public-settings
+                                     metabase.util}
     metabase.sample-data           :any
     metabase.search                :any
     metabase.server                :any
     metabase.setup                 :any
     metabase.sync                  :any
     metabase.task                  :any
-    metabase.troubleshooting       :any
     metabase.types                 #{metabase.util}
     metabase.upload                :any
-    metabase.util                  :any
+    metabase.util                  :any ; TODO -- this should probably be #{}
     metabase.xrays                 :any}
 
    ;; namespaces matching these patterns (with `re-find`) are excluded from the module linter. Since regex literals
@@ -449,6 +511,7 @@
    #{"-test$"                     ; anything ending in `-test`
      "test[-.]util"               ; anything that contains `test.util` or `test-util`
      "test\\.impl"                ; anything that contains `test.impl`
+     "test-setup"                 ; anything that contains `test-setup`
      "^metabase\\.test"           ; anything starting with `metabase.test`
      "^metabase\\.http-client$"}} ; `metabase.http-client` which is a test-only namespace despite its name.
 
@@ -475,7 +538,6 @@
     clojure.tools.namespace.parse                                 ns.parse
     colorize.core                                                 colorize
     environ.core                                                  env
-    hf.depstar.api                                                depstar
     hiccup.core                                                   hiccup
     hiccup.util                                                   hiccup.util
     honey.sql                                                     sql
@@ -526,7 +588,6 @@
     metabase.api.logic-history                                    api.login-history
     metabase.api.metric                                           api.metric
     metabase.api.native-query-snippet                             api.native-query-snippet
-    metabase.api.notify                                           api.notify
     metabase.api.permission-graph                                 api.permission-graph
     metabase.api.permissions                                      api.permissions
     metabase.api.permissions-test-util                            perm-test-util
@@ -549,7 +610,6 @@
     metabase.api.timeline-event                                   api.timeline-event
     metabase.api.user                                             api.user
     metabase.api.util                                             api.util
-    metabase.async.streaming-response.thread-pool                 thread-pool
     metabase.channel.core                                         channel
     metabase.channel.render.core                                  channel.render
     metabase.cmd.copy.h2                                          copy.h2
@@ -592,8 +652,6 @@
     metabase.driver.sql.parameters.substitute                     sql.params.substitute
     metabase.driver.sql.parameters.substitution                   sql.params.substitution
     metabase.eid-translation                                      eid-translation
-    metabase.email-test                                           et
-    metabase.email.messages                                       messages
     metabase.formatter                                            formatter
     metabase.http-client                                          client
     metabase.legacy-mbql.normalize                                mbql.normalize
@@ -607,7 +665,6 @@
     metabase.models.collection                                    collection
     metabase.models.collection.graph                              graph
     metabase.models.collection-permission-graph-revision          c-perm-revision
-    metabase.models.channel                                       models.channel
     metabase.models.dashboard-card                                dashboard-card
     metabase.models.database                                      database
     metabase.models.dependency                                    dependency
@@ -633,7 +690,7 @@
     metabase.notification.test-util                               notification.tu
     metabase.plugins.initialize                                   plugins.init
     metabase.public-settings                                      public-settings
-    metabase.public-settings.premium-features                     premium-features
+    metabase.premium-features.core                                premium-features
     metabase.pulse.core                                           pulse
     metabase.pulse.render                                         render
     metabase.pulse.render.body                                    body
@@ -664,32 +721,21 @@
     metabase.query-processor.streaming.xlsx                       qp.xlsx
     metabase.query-processor.timezone                             qp.timezone
     metabase.query-processor.util                                 qp.util
-    metabase.related                                              related
+    metabase.request.core                                         request
     metabase.search.config                                        search.config
     metabase.search.filter                                        search.filter
     metabase.search.in-place.filter                               search.in-place.filter
-    metabase.search.util                                          search.util
+    metabase.search.in-place.util                                 search.util
     metabase.search.in-place.scoring                              scoring
-    metabase.server.middleware.auth                               mw.auth
-    metabase.server.middleware.browser-cookie                     mw.browser-cookie
-    metabase.server.middleware.exceptions                         mw.exceptions
-    metabase.server.middleware.json                               mw.json
-    metabase.server.middleware.log                                mw.log
-    metabase.server.middleware.misc                               mw.misc
-    metabase.server.middleware.offset-paging                      mw.offset-paging
-    metabase.server.middleware.security                           mw.security
-    metabase.server.middleware.session                            mw.session
-    metabase.server.middleware.ssl                                mw.ssl
-    metabase.server.request.util                                  req.util
+    metabase.server.core                                          server
     metabase.server.protocols                                     server.protocols
     metabase.sync.analyze.fingerprint                             sync.fingerprint
-    metabase.sync.field-values                                    field-values
+    metabase.sync.field-values                                    sync.field-values
     metabase.sync.interface                                       i
     metabase.sync.schedules                                       sync.schedules
     metabase.sync.sync-metadata.fields.our-metadata               fields.our-metadata
     metabase.sync.util                                            sync-util
     metabase.sync.util-test                                       sync.util-test
-    metabase.task.sync-databases                                  task.sync-databases
     metabase.test                                                 mt
     metabase.test.data.dataset-definitions                        defs
     metabase.test.data.env.impl                                   tx.env.impl
@@ -725,7 +771,7 @@
     metabase.util.schema                                          su
     metabase.util.ui-logic                                        ui-logic
     metabase.util.urls                                            urls
-    metabase.xrays                                                xrays
+    metabase.xrays.core                                           xrays
     metabuild-common.core                                         u
     metabuild-common.output                                       out
     metabuild-common.shell                                        shell
@@ -743,6 +789,7 @@
   clojure.core.cache/defcache                                                           clojure.core/deftype
   clojure.core.logic/defne                                                              clj-kondo.lint-as/def-catch-all
   clojure.test.check.clojure-test/defspec                                               clojure.test/deftest
+  clojure.test.check.properties/for-all                                                 clojure.core/let
   clojurewerkz.quartzite.jobs/defjob                                                    clojure.core/defn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
@@ -750,10 +797,9 @@
   metabase.api.common/defroutes                                                         clojure.core/def
   metabase.api.common/let-404                                                           clojure.core/let
   metabase.api.search-test/do-test-users                                                clojure.core/let
-  metabase.async.api-response-test/with-response                                        clojure.core/let
   metabase.dashboard-subscription-test/with-dashboard-sub-for-card                      clojure.core/let
-  metabase.channel.http-test/with-captured-http-requests                                clojure.core/fn
-  metabase.channel.http-test/with-server                                                clojure.core/let
+  metabase.channel.impl.http-test/with-captured-http-requests                           clojure.core/fn
+  metabase.channel.impl.http-test/with-server                                           clojure.core/let
   metabase.db.custom-migrations/define-migration                                        clj-kondo.lint-as/def-catch-all
   metabase.db.custom-migrations/define-reversible-migration                             clj-kondo.lint-as/def-catch-all
   metabase.db.data-migrations/defmigration                                              clojure.core/def
@@ -770,8 +816,9 @@
   metabase.models.json-migration/def-json-migration                                     clj-kondo.lint-as/def-catch-all
   metabase.models.setting.multi-setting/define-multi-setting                            clojure.core/def
   metabase.models.setting/defsetting                                                    clj-kondo.lint-as/def-catch-all
-  metabase.public-settings.premium-features/defenterprise-schema                        clj-kondo.lint-as/def-catch-all
-  metabase.public-settings.premium-features/define-premium-feature                      clojure.core/def
+  metabase.premium-features.core/defenterprise-schema                                   clj-kondo.lint-as/def-catch-all
+  metabase.premium-features.defenterprise/defenterprise-schema                          clj-kondo.lint-as/def-catch-all
+  metabase.premium-features.core/define-premium-feature                                 clojure.core/def
   metabase.pulse.send-test/with-pulse-for-card                                          clojure.core/let
   metabase.query-processor-test.pipeline-queries-test/pmbql-query                       clojure.core/->
   metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                   clojure.core/->
@@ -805,6 +852,8 @@
   metabase.util.namespaces/import-fns                                                   potemkin/import-vars
   metabase.util.ssh/with-ssh-tunnel                                                     clojure.core/let
   metabase.xrays.domain-entities.malli/defn                                             schema.core/defn
+  metabuild-common.core/with-open-jar-file-system                                       clojure.core/let
+  metabuild-common.files/with-open-jar-file-system                                      clojure.core/let
   monger.operators/defoperator                                                          clojure.core/def
   potemkin.types/defprotocol+                                                           clojure.core/defprotocol
   potemkin.types/defrecord+                                                             clojure.core/defrecord
@@ -820,10 +869,12 @@
   {cljs.test/deftest                                                                                                         hooks.clojure.test/deftest
    cljs.test/is                                                                                                              hooks.clojure.test/is
    cljs.test/use-fixtures                                                                                                    hooks.clojure.test/use-fixtures
+   clojure.core/defmulti                                                                                                     hooks.clojure.core/lint-defmulti
    clojure.core/ns                                                                                                           hooks.clojure.core/lint-ns
    clojure.test/deftest                                                                                                      hooks.clojure.test/deftest
    clojure.test/is                                                                                                           hooks.clojure.test/is
    clojure.test/use-fixtures                                                                                                 hooks.clojure.test/use-fixtures
+   malli.error/humanize                                                                                                      hooks.malli.error/humanize
    metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
    metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
@@ -846,6 +897,7 @@
    metabase.api.embed-test/with-chain-filter-fixtures!                                                                       hooks.common/let-one-with-optional-value
    metabase.api.embed-test/with-temp-card                                                                                    hooks.common/let-one-with-optional-value
    metabase.api.embed-test/with-temp-dashcard                                                                                hooks.common/let-one-with-optional-value
+   metabase.api.macros/defendpoint                                                                                           hooks.metabase.api.macros/defendpoint
    metabase.api.persist-test/with-setup!                                                                                     hooks.common/with-one-top-level-binding
    metabase.api.public-test/with-required-param-card!                                                                        hooks.common/with-one-binding
    metabase.api.public-test/with-temp-public-card                                                                            hooks.common/let-one-with-optional-value
@@ -853,9 +905,9 @@
    metabase.api.public-test/with-temp-public-dashboard-and-card                                                              hooks.common/with-three-bindings
    metabase.api.search-test/with-search-items-in-collection                                                                  hooks.metabase.api.search-test/with-search-items-in-collection
    metabase.api.search-test/with-search-items-in-root-collection                                                             hooks.common/do*
-   metabase.api.user-test/with-temp-user-email                                                                               hooks.common/with-one-binding
-   metabase.async.streaming-response-test/with-start-execution-chan                                                          hooks.common/with-one-binding
-   metabase.channel.template.handlebars-test/with-temp-template                                                              hooks.common/with-vec-first-binding
+   metabase.api.user-test/with-temp-user-email!                                                                              hooks.common/with-one-binding
+   metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
+   metabase.channel.template.handlebars-helper/defhelper                                                                     hooks.metabase.channel.template.handlebars-helper/defhelper
    metabase.dashboard-subscription-test/with-link-card-fixture-for-dashboard                                                 hooks.common/let-second
    metabase.db.schema-migrations-test.impl/test-migrations                                                                   hooks.metabase.db.schema-migrations-test.impl/test-migrations
    metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
@@ -878,12 +930,17 @@
    metabase.models.pulse-test/with-pulse-in-collection!                                                                      hooks.common/with-four-bindings
    metabase.models.setting.multi-setting/define-multi-setting                                                                hooks.metabase.models.setting/define-multi-setting
    metabase.models.setting/defsetting                                                                                        hooks.metabase.models.setting/defsetting
-   metabase.public-settings.premium-features/defenterprise                                                                   hooks.metabase.public-settings.premium-features/defenterprise
+   metabase.premium-features.core/defenterprise                                                                              hooks.metabase.premium-features.defenterprise/defenterprise
+   metabase.premium-features.defenterprise/defenterprise                                                                     hooks.metabase.premium-features.defenterprise/defenterprise
    metabase.pulse.test-util/checkins-query-card                                                                              hooks.metabase.test.data/$ids
    metabase.query-processor-test.expressions-test/calculate-bird-scarcity                                                    hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
    metabase.query-processor-test.filter-test/count-with-filter-clause                                                        hooks.metabase.test.data/$ids
    metabase.query-processor.middleware.cache-test/with-mock-cache!                                                           hooks.common/with-two-bindings
+   metabase.request.core/with-current-request                                                                                hooks.common/with-used-first-arg
+   metabase.request.core/with-current-user                                                                                   hooks.common/with-used-first-arg
+   metabase.request.core/with-limit-and-offset                                                                               hooks.common/with-used-first-two-args
    metabase.sample-data-test/with-temp-sample-database-db                                                                    hooks.common/with-one-binding
+   metabase.server.streaming-response-test/with-start-execution-chan                                                         hooks.common/with-one-binding
    metabase.stale-test/with-stale-items                                                                                      hooks.toucan2.tools.with-temp/with-temp
    metabase.test.data.datasets/test-driver                                                                                   hooks.metabase.test.data.datasets/test-driver
    metabase.test.data.datasets/test-drivers                                                                                  hooks.metabase.test.data.datasets/test-drivers
@@ -929,6 +986,7 @@
    metabase.util.log/warn                                                                                                    hooks.metabase.util.log/info
    metabase.util.log/warnf                                                                                                   hooks.metabase.util.log/infof
    metabase.util.malli.registry/def                                                                                          hooks.metabase.util.malli.registry/def
+   metabase.util/case-enum                                                                                                   hooks.metabase.util/case-enum
    metabase.util/format-color                                                                                                hooks.metabase.util/format-color}
 
   :macroexpand
@@ -936,13 +994,13 @@
    clojurewerkz.quartzite.schedule.cron/schedule                                 macros.quartz/schedule
    clojurewerkz.quartzite.schedule.simple/schedule                               macros.quartz/simple-schedule
    clojurewerkz.quartzite.triggers/build                                         macros.quartz/build-trigger
+   metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!   macros.metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!
+   metabase-enterprise.query-reference-validation.api-test/with-test-setup!      macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
    metabase-enterprise.sandbox.test-util/with-gtaps!                             macros.metabase-enterprise.sandbox.test-util/with-gtaps!
    metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                    macros.metabase-enterprise.sandbox.test-util/with-gtaps!
    metabase-enterprise.serialization.test-util/with-world                        macros.metabase-enterprise.serialization.test-util/with-world
    metabase-enterprise.test/with-gtaps!                                          macros.metabase-enterprise.sandbox.test-util/with-gtaps!
    metabase-enterprise.test/with-gtaps-for-user!                                 macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!   macros.metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!
-   metabase-enterprise.query-reference-validation.api-test/with-test-setup!      macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
    metabase.api.card-test/with-ordered-items                                     macros.metabase.api.card-test/with-ordered-items
    metabase.api.collection-test/with-collection-hierarchy!                       macros.metabase.api.collection-test/with-collection-hierarchy!
    metabase.api.collection-test/with-some-children-of-collection!                macros.metabase.api.collection-test/with-some-children-of-collection!
@@ -951,15 +1009,14 @@
    metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing! macros.metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
    metabase.api.public-test/with-sharing-enabled-and-temp-card-referencing!      macros.metabase.api.public-test/with-sharing-enabled-and-temp-card-referencing!
    metabase.api.public-test/with-sharing-enabled-and-temp-dashcard-referencing!  macros.metabase.api.public-test/with-sharing-enabled-and-temp-dashcard-referencing!
-   metabase.lib.filter/deffilter                                                 macros.metabase.lib.filter/deffilter
    metabase.lib.common/defop                                                     macros.metabase.lib.common/defop
+   metabase.lib.filter/deffilter                                                 macros.metabase.lib.filter/deffilter
    metabase.models.params.chain-filter-test/chain-filter                         macros.metabase.models.params.chain-filter-test/chain-filter
    metabase.models.params.chain-filter-test/chain-filter-search                  macros.metabase.models.params.chain-filter-test/chain-filter
    metabase.models.query-analysis-test/with-test-setup                           macros.metabase.models.query-analysis-test/with-test-setup
    metabase.models.user-test/with-groups                                         macros.metabase.models.user-test/with-groups
+   metabase.query-analysis.task.test-setup/with-test-setup!                      macros.metabase.query-analysis.task.test-setup/with-test-setup!
    metabase.query-processor.streaming/streaming-response                         macros.metabase.query-processor.streaming/streaming-response
-   metabase.related-test/with-world                                              macros.metabase.related-test/with-world
-   metabase.task.setup.query-analysis-setup/with-test-setup!                     macros.metabase.task.setup.query-analysis-setup/with-test-setup!
    metabase.test.data.users/with-group-for-user                                  macros.metabase.test.data.users/with-group-for-user
    metabase.test.util/with-temp-env-var-value!                                   macros.metabase.test.util/with-temp-env-var-value!
    metabase.test.util/with-temporary-raw-setting-values                          macros.metabase.test.util/with-temporary-raw-setting-values
@@ -968,7 +1025,8 @@
    metabase.test/with-temp-env-var-value!                                        macros.metabase.test.util/with-temp-env-var-value!
    metabase.test/with-temporary-raw-setting-values                               macros.metabase.test.util/with-temporary-raw-setting-values
    metabase.util.namespaces/import-fn                                            macros.metabase.util.namespaces/import-fn
-   metabase.xrays.domain-entities.malli/define-getters-and-setters               macros.metabase.xrays.domain-entities.malli/define-getters-and-setters}}
+   metabase.xrays.domain-entities.malli/define-getters-and-setters               macros.metabase.xrays.domain-entities.malli/define-getters-and-setters
+   metabase.xrays.related-test/with-world                                        macros.metabase.xrays.related-test/with-world}}
 
  :config-in-comment
  {:linters {:unresolved-symbol {:level :off}}}

.clj-kondo/macros/metabase/query_analysis/task/test_setup.clj

@@ -1,4 +1,4 @@
-(ns macros.metabase.task.setup.query-analysis-setup
+(ns macros.metabase.query-analysis.task.test-setup
   (:require [macros.common]))
 
 (defmacro with-test-setup!

.clj-kondo/macros/metabase/xrays/related_test.clj

@@ -1,4 +1,4 @@
-(ns macros.metabase.related-test
+(ns macros.metabase.xrays.related-test
   (:require [macros.common]))
 
 (defmacro with-world [& body]

.clj-kondo/src/hooks/clojure/core.clj

@@ -49,13 +49,15 @@
      metabase-enterprise.advanced-permissions.models.permissions/update-db-download-permissions!
      metabase-enterprise.internal-user/install-internal-user!
      metabase-enterprise.sso.integrations.saml-test/call-with-login-attributes-cleared!
-     metabase.actions/perform-action!
+     metabase.actions.actions/perform-action!
      metabase.analytics.snowplow-test/fake-track-event-impl!
      metabase.analytics.snowplow/track-event-impl!
      metabase.api.public-test/add-card-to-dashboard!
+     metabase.channel.email-test/reset-inbox!
+     metabase.channel.email/send-email!
      metabase.cmd.dump-to-h2/dump-to-h2!
      metabase.cmd.load-from-h2/load-from-h2!
-     metabase.core/ensure-audit-db-installed!
+     metabase.core.core/ensure-audit-db-installed!
      metabase.db.schema-migrations-test.impl/run-migrations-in-range!
      metabase.db.setup/migrate!
      metabase.db.setup/setup-db!
@@ -65,8 +67,6 @@
      metabase.driver.postgres-test/create-enums-db!
      metabase.driver.postgres-test/drop-if-exists-and-create-db!
      metabase.driver.sql-jdbc.execute/execute-statement!
-     metabase.email-test/reset-inbox!
-     metabase.email/send-email!
      metabase.models.action/insert!
      metabase.models.collection.graph-test/clear-graph-revisions!
      metabase.models.collection.graph-test/do-with-n-temp-users-with-personal-collections!
@@ -97,12 +97,12 @@
      metabase.query-processor.streaming.interface/finish!
      metabase.query-processor.streaming.interface/write-row!
      metabase.sample-data/try-to-extract-sample-database!
-     metabase.setup/create-token!
+     metabase.setup.core/create-token!
+     metabase.sync.core/sync-database!
      metabase.sync.sync-metadata.fields.sync-metadata/update-field-metadata-if-needed!
      metabase.sync.sync-metadata/sync-db-metadata!
      metabase.sync.util-test/sync-database!
      metabase.sync.util/store-sync-summary!
-     metabase.sync/sync-database!
      metabase.task.index-values/job-init!
      metabase.task.persist-refresh/job-init!
      metabase.task.persist-refresh/refresh-tables!
@@ -238,11 +238,12 @@
                   (cond
                     (hooks/vector-node? node)
                     ;; propagate the metadata attached to this vector in case there's a `:clj-kondo/ignore` form.
-                    (vary-meta (first (:children node)) (partial merge (meta require-node) (meta node)))
+                    (let [symbol-node (first (:children node))]
+                      (hooks.common/merge-ignored-linters symbol-node require-node node))
 
                     ;; this should also be dead code since we require requires to be vectors
                     (hooks/token-node? node)
-                    (vary-meta node (partial merge (meta require-node)))
+                    (hooks.common/merge-ignored-linters node require-node)
 
                     :else
                     (printf "Don't know how to figure out what namespace is being required in %s\n" (pr-str node)))))
@@ -271,8 +272,7 @@
 
 (defn- module-api-namespaces
   "Set API namespaces for a given module. `:any` means you can use anything, there are no API namespaces for this
-  module (yet). If unspecified, the default is just the namespace with the same name as the module e.g.
-  `metabase.db`."
+  module (yet). If unspecified, the default is just the `<module>.core` namespace."
   [module config]
   (let [module-config (get-in config [:api-namespaces module])]
     (cond
@@ -283,7 +283,7 @@
       module-config
 
       :else
-      #{module})))
+      #{(symbol (str module ".core"))})))
 
 (defn- lint-modules [ns-form-node config]
   (let [ns-symb (ns-form-node->ns-symb ns-form-node)]
@@ -294,8 +294,7 @@
                                                 ns-form-node->require-node
                                                 require-node->namespace-symb-nodes)]
           (doseq [node  required-namespace-symb-nodes
-                  :let  [clj-kondo-ignore (some-> (meta node) :clj-kondo/ignore hooks/sexpr set)]
-                  :when (not (contains? clj-kondo-ignore :metabase/ns-module-checker))
+                  :when (not (contains? (hooks.common/ignored-linters node) :metabase/ns-module-checker))
                   :let  [required-namespace (hooks/sexpr node)
                          required-module    (module required-namespace)]
                   ;; ignore stuff not in a module i.e. non-Metabase stuff.
@@ -327,3 +326,50 @@
   (lint-require-shapes (:node x))
   (lint-modules (:node x) (get-in x [:config :linters :metabase/ns-module-checker]))
   x)
+
+(defn- check-arglists [report-node arglists]
+  (letfn [(reg-bad-arglists! []
+            (hooks/reg-finding!
+             (assoc (meta report-node)
+                    :message ":arglists should be a quoted list of vectors [:metabase/check-defmulti-arglists]"
+                    :type :metabase/check-defmulti-arglists)))
+          (reg-bad-arg! []
+            (hooks/reg-finding!
+             (assoc (meta report-node)
+                    :message ":arglists should contain actual arg names, not underscore (unused) symbols [:metabase/check-defmulti-arglists]"
+                    :type    :metabase/check-defmulti-arglists)))
+          (underscore-arg? [arg]
+            (and (symbol? arg)
+                 (str/starts-with? arg "_")))
+          (check-arglist [arglist]
+            (cond
+              (not (vector? arglist))        (reg-bad-arglists!)
+              (some underscore-arg? arglist) (reg-bad-arg!)))]
+    (if-not (and (seq? arglists)
+                 (= (first arglists) 'quote)
+                 (seq (second arglists)))
+      (reg-bad-arglists!)
+      (let [[_quote arglists] arglists]
+        (doseq [arglist arglists]
+          (check-arglist arglist))))))
+
+(defn- defmulti-check-for-arglists-metadata
+  "Make sure a [[defmulti]] has an attribute map with `:arglists` metadata."
+  [node]
+  (let [[_defmulti _symb & args] (:children node)
+        [_docstring & args]      (if (hooks/string-node? (first args))
+                                   args
+                                   (cons nil args))
+        attr-map                 (when (hooks/map-node? (first args))
+                                   (first args))
+        arglists                 (some-> attr-map hooks/sexpr :arglists seq)]
+    (if (not (seq? arglists))
+      (hooks/reg-finding!
+       (assoc (meta node)
+              :message "All defmultis should have an attribute map with :arglists metadata. [:metabase/check-defmulti-arglists]"
+              :type    :metabase/check-defmulti-arglists))
+      (check-arglists attr-map arglists))))
+
+(defn lint-defmulti [x]
+  (defmulti-check-for-arglists-metadata (:node x))
+  x)

.clj-kondo/src/hooks/clojure/test.clj

@@ -71,11 +71,7 @@
                                      :type :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests)))))))
 
 (defn- ignore? [node error-type]
-  (when-let [ignores (some-> node meta :clj-kondo/ignore hooks/sexpr)]
-    (when-let [ignores (cond
-                         (coll? ignores)    (set ignores)
-                         (keyword? ignores) #{ignores})]
-      (contains? ignores error-type))))
+  (contains? (hooks.common/ignored-linters node) error-type))
 
 (defn deftest-check-no-driver-keywords [node {:keys [drivers], :as _config}]
   ;; fail fast after we see the first error, where we see one hardcoded driver name there are likely several more and we

.clj-kondo/src/hooks/common.clj

@@ -1,7 +1,8 @@
 (ns hooks.common
   (:require
    [clj-kondo.hooks-api :as hooks]
-   [clojure.pprint]))
+   [clojure.pprint]
+   [clojure.set :as set]))
 
 (defn with-macro-meta
   "When introducing internal nodes (let, defn, etc) it is important to provide a meta of an existing token
@@ -9,6 +10,78 @@
   [new-node hook-node]
   (with-meta new-node (meta (first (:children hook-node)))))
 
+;;; Kondo stores information about ignored linters as rewrite-clj forms matching how they are specified in the code, so
+;;; either
+;;;
+;;;    <vector-node [<token-node :discouraged-namespace>]>
+;;;
+;;; or
+;;;
+;;;    <token-node :discouraged-namespace>
+;;;
+;;; these are stored in
+;;;
+;;;     (-> node meta :clj-kondo/ignore :linters).
+;;;
+;;; These are not a convenient shape(s) to work with, so the next few functions abstract that shape out and work with a
+;;; set of keywords like
+;;;
+;;;    #{:discouraged-namespace}
+;;;
+;;; instead.
+
+(defn- unwrap-ignored-linters [linters]
+  (cond
+    (or (hooks/vector-node? linters)
+        (hooks/list-node? linters))
+    (into #{}
+          (map hooks/sexpr)
+          (:children linters))
+
+    (hooks/keyword-node? linters)
+    #{(hooks/sexpr linters)}
+
+    (and (set? linters)
+         (every? keyword? linters))
+    linters
+
+    (and (sequential? linters)
+         (every? keyword? linters))
+    (into #{} linters)
+
+    (keyword? linters)
+    #{linters}))
+
+(defn- wrap-ignored-linters [linters]
+  (hooks/vector-node (mapv hooks/keyword-node linters)))
+
+(defn ignored-linters
+  "Return a set of keywords all ignored linters associated with a node by looking at its metadata."
+  [node]
+  (or (some-> node meta :clj-kondo/ignore :linters unwrap-ignored-linters)
+      ;; deal with the old pre-2024.09 shape mentioned in https://github.com/clj-kondo/clj-kondo/issues/2414
+      (some-> node :meta first hooks/sexpr :clj-kondo/ignore unwrap-ignored-linters)))
+
+(defn update-ignored-linters
+  "Update the `:clj-kondo/ignore` linters in `node`'s metadata. `linters` should be a set of keywords."
+  [node f & args]
+  (letfn [(apply-f [linters]
+            (apply f linters args))
+          (update-linters [linters]
+            (-> (or (unwrap-ignored-linters linters)
+                    #{})
+                apply-f
+                wrap-ignored-linters))]
+    (vary-meta node update-in [:clj-kondo/ignore :linters] update-linters)))
+
+(defn merge-ignored-linters
+  "Merge the ignored linters from `source-nodes` into `node`. You can use this to propagate
+  ignored linters from parent nodes to child nodes."
+  [node & source-nodes]
+  (if-let [linters (not-empty (transduce (map ignored-linters) set/union #{} source-nodes))]
+    (update-ignored-linters node set/union linters)
+    node))
+
 ;;; This stuff is to help debug hooks. Trace a function and it will pretty-print the before & after sexprs.
 ;;;
 ;;;    (hooks.common/trace #'calculate-bird-scarcity)
@@ -48,9 +121,9 @@
   [{{[_ & args] :children, :as node} :node}]
   (let [node* (-> (hooks/list-node
                    (list*
-                    (with-meta (hooks/token-node 'do) {:clj-kondo/ignore [:redundant-do]})
+                    (update-ignored-linters (hooks/token-node 'do) conj :redundant-do)
                     (for [arg args]
-                      (vary-meta arg update :clj-kondo/ignore #(conj (vec %) :unused-value)))))
+                      (update-ignored-linters arg conj :unused-value))))
                   (with-meta (meta node)))]
     {:node node*}))
 
@@ -373,6 +446,28 @@
                 body))]
     {:node node*}))
 
+(defn with-used-first-two-args
+  "For macros like
+
+    (with-limit-and-offset limit offset
+      ...)
+
+    =>
+
+    (let [_123 limit
+         [_456 offset]
+      ...)
+
+  where the first arg should be linted and appear to be used."
+  [{{[_ x y & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node [(hooks/token-node (gensym "_")) x
+                                    (hooks/token-node (gensym "_")) y])
+                body))]
+    {:node node*}))
+
 (defn with-vec-first-binding
   "For macros like
 
@@ -439,9 +534,4 @@
 
   metadata to a node to suppress LSP warnings."
   [node]
-  (letfn [(update-ignores [existing-ignores]
-            (hooks/vector-node
-             (cons
-              (hooks/keyword-node :clojure-lsp/unused-public-var)
-              (:children existing-ignores))))]
-    (vary-meta node update :clj-kondo/ignore update-ignores)))
+  (update-ignored-linters node conj :clojure-lsp/unused-public-var))

.clj-kondo/src/hooks/malli/error.clj

@@ -0,0 +1,26 @@
+(ns hooks.malli.error
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common]))
+
+(defn humanize [x]
+  (letfn [(check-node [node]
+            (when (hooks/list-node? node)
+              (let [[_ child] (:children node)]
+                (when (hooks/list-node? child)
+                  (let [[symb] (:children child)]
+                    (when-let [qualified-symb (hooks.common/node->qualified-symbol symb)]
+                      (when ('#{malli.core/validate metabase.util.malli.registry/validate}
+                             qualified-symb)
+                        (hooks/reg-finding! (assoc (meta symb)
+                                                   :message "Use malli.error/humanize with explain, NOT with validate. [:metabase/check-me-humanize]"
+                                                   :type :metabase/check-me-humanize)))))))))]
+    (check-node (:node x))
+    x))
+
+(comment
+  (humanize {:node (hooks/parse-string
+                    (pr-str '(malli.error/humanize
+                              (malli.core/validate
+                               metabase.sync.sync-metadata.dbms-version/DBMSVersion
+                               metabase.driver.druid.sync-test/dbms-version))))}))

.clj-kondo/src/hooks/metabase/api/macros.clj

@@ -0,0 +1,49 @@
+(ns hooks.metabase.api.macros
+  (:require
+   [clj-kondo.hooks-api :as api]))
+
+(defn defendpoint
+  [arg]
+  (letfn [(update-defendpoint [node]
+            (let [[defendpoint method route & more] (:children node)
+                  [result-schema & more] (if (= (api/sexpr (first more)) :-)
+                                           (drop 1 more)
+                                           (cons nil more))
+                  [_docstring & more] (if (api/string-node? (first more))
+                                        more
+                                        (cons nil more))
+                  [metadata & more] (if (api/map-node? (first more))
+                                      more
+                                      (cons nil more))
+                  [params & body] more
+                  [bindings schemas] (when (api/vector-node? params)
+                                       (loop [bindings [], schemas [], [x y & more] (:children params)]
+                                         (cond
+                                           (not x)
+                                           [bindings schemas]
+
+                                           (= (api/sexpr x) :-)
+                                           (recur bindings (conj schemas y) more)
+
+                                           :else
+                                           (recur (conj bindings x) schemas (cons y more)))))]
+              (-> (api/list-node
+                   (list
+                    (api/token-node 'do)
+                    defendpoint
+                    method
+                    route
+                    (api/list-node
+                     (list*
+                      (api/token-node 'do)
+                      (filter some? (list* metadata result-schema schemas))))
+                    (api/list-node
+                     (list*
+                      (api/token-node `let)
+                      (api/vector-node (into []
+                                             (mapcat (fn [a-binding]
+                                                       [a-binding (api/token-node nil)]))
+                                             bindings))
+                      body))))
+                  (with-meta (meta node)))))]
+    (update arg :node update-defendpoint)))

.clj-kondo/src/hooks/metabase/channel/template/handlebars_helper.clj

@@ -0,0 +1,25 @@
+(ns hooks.metabase.channel.template.handlebars-helper
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common]))
+
+(defn defhelper
+  "defhelper hook"
+  [{:keys [node]}]
+  (let [[_ helper-name description argvec & body] (:children node)
+        helper-fn-name (symbol (str (hooks/sexpr helper-name) "*"))]
+    {:node (-> (hooks/list-node
+                (list (hooks/token-node 'do)
+                      (hooks/list-node
+                       (list (hooks/token-node 'defn)
+                             (hooks/token-node helper-fn-name)
+                             description
+                             argvec
+                             (hooks/list-node body)))
+                      (hooks/list-node
+                       (list (hooks/token-node 'defn)
+                             helper-name
+                             description
+                             argvec
+                             (hooks/list-node body)))))
+               (with-meta (meta node)))}))

.clj-kondo/src/hooks/metabase/models/setting.clj

@@ -21,6 +21,7 @@
      database-enable-actions
      deprecation-notice-version
      dismissed-custom-dashboard-toast
+     dismissed-onboarding-sidebar-link
      email-configured?
      email-from-address
      email-from-name
@@ -161,6 +162,7 @@
      token-features
      token-status
      toucan-name
+     trial-banner-dismissal-timestamp
      uncached-setting
      user-visibility
      version

.clj-kondo/src/hooks/metabase/premium_features/defenterprise.clj

@@ -1,4 +1,4 @@
-(ns hooks.metabase.public-settings.premium-features
+(ns hooks.metabase.premium-features.defenterprise
   (:require
    [clj-kondo.hooks-api :as hooks]
    [hooks.common]))

.clj-kondo/src/hooks/metabase/test/data/datasets.clj

@@ -1,11 +1,13 @@
 (ns hooks.metabase.test.data.datasets
-  (:require [clj-kondo.hooks-api :as hooks]
-            [clojure.set :as set]))
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.set :as set]
+   [hooks.common]))
 
 (defn- only-core-drivers?
   "Whether we're for sure only testing against the 'core' drivers that are also app DB types: `:postgres`, `:mysql`, or
-  `:h2`. Tests like these are ok to mark `:mb/once` or `:mb/driver-tests` since we always run the full test suite
-  against app DB drivers anyway."
+  `:h2`. Tests like these are ok to mark `:mb/driver-tests` since we always run the full test suite against app DB
+  drivers anyway."
   [node]
   (let [drivers (hooks/sexpr (second (:children node)))
         drivers (cond
@@ -15,14 +17,6 @@
     (when drivers
       (empty? (set/difference drivers #{:h2 :mysql :postgres})))))
 
-(defn- validate-mb-once [x]
-  (when (:mb/once (meta (:ns x)))
-    (hooks/reg-finding!
-     (assoc (meta (:ns x))
-            :message (str "You should not use test-driver or test-drivers in a namespace marked ^:mb/once"
-                          " [:metabase/validate-mb-once]")
-            :type :metabase/validate-mb-once))))
-
 (defn- validate-mb-driver-tests [x]
   (when-not (:mb/driver-tests (meta (:ns x)))
     (hooks/reg-finding!
@@ -33,7 +27,6 @@
 
 (defn- validate-ns-tags [x]
   (when-not (only-core-drivers? (:node x))
-    (validate-mb-once x)
     (validate-mb-driver-tests x)))
 
 (defn test-drivers [x]
@@ -45,7 +38,7 @@
                     (hooks/token-node 'do)
                     test-drivers
                     (-> drivers-expr
-                        (vary-meta update :clj-kondo/ignore #(conj (vec %) :unused-value)))
+                        (hooks.common/update-ignored-linters conj :unused-value))
                     body))
                   (with-meta (meta node)))))]
     (update x :node update-node)))

.clj-kondo/src/hooks/metabase/util.clj

@@ -15,3 +15,17 @@
                                                     actual-arg-count)
                                    :type :format))))))
   x)
+
+(defn case-enum
+  "Lint `(case-enum ...)` like `(condp = ...)`."
+  [x]
+  (letfn [(update-node [node]
+            (let [[_case-enum x & more] (:children node)]
+              (-> (api/list-node
+                   (list*
+                    (api/token-node 'clojure.core/condp)
+                    (api/token-node 'clojure.core/=)
+                    x
+                    more))
+                  (with-meta (meta node)))))]
+    (update x :node update-node)))

.clj-kondo/test/hooks/clojure/core_test.clj

@@ -0,0 +1,111 @@
+(ns hooks.clojure.core-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.test :refer :all]
+   [hooks.clojure.core]))
+
+(deftest module-checker-allowed-modules-test
+  (let [findings (atom [])]
+    (with-redefs [hooks/reg-finding! (fn [node]
+                                       (swap! findings conj node))]
+      (hooks.clojure.core/lint-ns
+       {:node     (hooks/parse-string "
+(ns metabase.api.search
+  (:require
+   [metabase.request.core :as request]
+   [metabase.task :as task]))")
+        :config '{:linters {:metabase/ns-module-checker {:allowed-modules {metabase.api #{metabase.request}}
+                                                         :api-namespaces  {metabase.request #{metabase.request.core}}}}}})
+      (is (=? [{:message (str "Module metabase.task should not be used in the metabase.api module."
+                              " [:metabase/ns-module-checker :allowed-modules metabase.api]")
+                :type :metabase/ns-module-checker}]
+              @findings)))))
+
+(deftest module-checker-api-namespaces-test
+  (let [findings (atom [])]
+    (with-redefs [hooks/reg-finding! (fn [node]
+                                       (swap! findings conj node))]
+      (hooks.clojure.core/lint-ns
+       {:node     (hooks/parse-string "
+(ns metabase.api.search
+  (:require
+   [metabase.search.config :as search.config]
+   [metabase.search.core :as search]))")
+        :config '{:linters {:metabase/ns-module-checker {:allowed-modules {metabase.api #{metabase.search}}
+                                                         :api-namespaces  {metabase.search #{metabase.search.core}}}}}})
+      (is (=? [{:message (str "Namespace metabase.search.config is not an allowed external API namespace for the"
+                              " metabase.search module. [:metabase/ns-module-checker :api-namespaces metabase.search]")
+                :type :metabase/ns-module-checker}]
+              @findings)))))
+
+(deftest module-checker-api-namespaces-ignore-test
+  (let [findings (atom [])]
+    (with-redefs [hooks/reg-finding! (fn [node]
+                                       (swap! findings conj node))]
+      (hooks.clojure.core/lint-ns
+       {:node     (hooks/parse-string "
+(ns metabase.api.search
+  (:require
+   ^{:clj-kondo/ignore [:metabase/ns-module-checker]}
+   [metabase.search.config :as search.config]
+   [metabase.search.core :as search]))")
+        :config '{:linters {:metabase/ns-module-checker {:allowed-modules {metabase.api #{metabase.search}}
+                                                         :api-namespaces  {metabase.search #{metabase.search.core}}}}}})
+      (is (empty? @findings)))))
+
+(defn- lint-defmulti! [form]
+  (let [findings (atom [])
+        node     (hooks/parse-string (pr-str form))]
+    (with-redefs [hooks/reg-finding! (fn [node]
+                                       (swap! findings conj node))]
+      (hooks.clojure.core/lint-defmulti {:node node})
+      @findings)))
+
+(deftest defmulti-missing-arglists-test
+  (testing "missing arglists"
+    (is (=? [{:message "All defmultis should have an attribute map with :arglists metadata. [:metabase/check-defmulti-arglists]"}]
+            (lint-defmulti! '(defmulti expand-visualization
+                               (fn [card _ _]
+                                 (-> card :visualization first))))))))
+
+(deftest defmulti-invalid-arglists-test
+  (testing "invalid arglists"
+    (are [form] (=? [{:message ":arglists should be a quoted list of vectors [:metabase/check-defmulti-arglists]"}]
+                    (lint-defmulti! form))
+      '(defmulti expand-visualization
+         {:arglists '()}
+         (fn [card _ _]
+           (-> card :visualization first)))
+      '(defmulti expand-visualization
+         {:arglists ([a])}              ; unquoted
+         (fn [card _ _]
+           (-> card :visualization first)))
+      '(defmulti expand-visualization
+         {:arglists '[(a)]}
+         (fn [card _ _]
+           (-> card :visualization first)))
+      '(defmulti expand-visualization
+         {:arglists '((a))}
+         (fn [card _ _]
+           (-> card :visualization first))))))
+
+(deftest defmulti-arglists-with-underscore-args-test
+  (testing "arglists, but some symbols are _"
+    (are [form] (=? [{:message ":arglists should contain actual arg names, not underscore (unused) symbols [:metabase/check-defmulti-arglists]"}]
+                    (lint-defmulti! form))
+      '(defmulti expand-visualization
+         {:arglists '([card _ _])}
+         (fn [card _ _]
+           (-> card :visualization first)))
+      '(defmulti expand-visualization
+         {:arglists '([card _bad _arg])}
+         (fn [card _ _]
+           (-> card :visualization first))))))
+
+(deftest defmulti-arglists-ok-test
+  (testing "good"
+    (is (= []
+           (lint-defmulti! '(defmulti expand-visualization
+                              {:arglists '([card x y])}
+                              (fn [card _ _]
+                                (-> card :visualization first))))))))

.clj-kondo/test/hooks/common_test.clj

@@ -1,10 +1,39 @@
-(ns ^:mb/once hooks.common-test
+(ns hooks.common-test
   (:require
    [clj-kondo.hooks-api :as api]
    [clj-kondo.impl.utils]
    [clojure.test :refer :all]
    [hooks.common]))
 
+(deftest ^:parallel ignored-linters-test
+  (doseq [ignored [":metabase/ns-module-checker"
+                   "[:metabase/ns-module-checker]"
+                   "(:metabase/ns-module-checker)"]
+          prefix ["#_"
+                  "^"]
+          :let [s (format "%s{:clj-kondo/ignore %s} [metabase.search.config :as search.config]"
+                          prefix
+                          ignored)]]
+    (testing (pr-str s)
+      (is (= #{:metabase/ns-module-checker}
+             (hooks.common/ignored-linters (api/parse-string s)))))))
+
+(deftest ^:parallel merge-ignored-linters-test
+  (let [node-1  (api/parse-string "#_{:clj-kondo/ignore [:a]} [:a]")
+        node-2  (api/parse-string "#_{:clj-kondo/ignore [:b]} [:b]")
+        node-3  (api/parse-string "#_{:clj-kondo/ignore [:c]} [:c]")
+        node-1' (hooks.common/merge-ignored-linters node-1 node-2 node-3)]
+    (is (= #{:a :b :c}
+           (hooks.common/ignored-linters node-1')))
+    (testing "Updated metadata should match the shape Kondo expects"
+      (is (=? {:clj-kondo/ignore {:linters api/vector-node?}}
+              (meta node-1')))
+      (let [children (-> node-1' meta :clj-kondo/ignore :linters :children)]
+        (is (= (count children) 3))
+        (is (every? api/keyword-node? children))
+        (is (= [:a :b :c]
+               (sort (map api/sexpr children))))))))
+
 (deftest ^:parallel node->qualified-symbol-test
   (binding [clj-kondo.impl.utils/*ctx* {:namespaces (atom nil)}]
     (is (= 'metabase.util.i18n/tru

.clj-kondo/test/hooks/metabase/api/macros_test.clj

@@ -0,0 +1,35 @@
+(ns hooks.metabase.api.macros-test
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clojure.test :refer :all]
+   [hooks.metabase.api.macros]))
+
+(deftest ^:parallel defendpoint-test
+  (let [form '(api.macros/defendpoint :post "/" :- [:map [:collection_id :int]]
+                "Create a new [[Timeline]]."
+                [_route-params
+                 _query-params
+                 {:keys [icon], collection-id :collection_id, :as body} :- [:map
+                                                                            [:name    ms/NonBlankString]
+                                                                            [:default {:optional true} [:maybe :boolean]]]]
+                (body icon)
+                (body collection-id))
+        node (-> form pr-str api/parse-string)]
+    (is (= '(do
+              api.macros/defendpoint
+              :post
+              "/"
+              (do
+                [:map [:collection_id :int]]
+                [:map
+                 [:name    ms/NonBlankString]
+                 [:default {:optional true} [:maybe :boolean]]])
+              (clojure.core/let [_route-params nil
+                                 _query-params nil
+                                 {:keys [icon], collection-id :collection_id, :as body} nil]
+                (body icon)
+                (body collection-id)))
+           (-> {:node node}
+               hooks.metabase.api.macros/defendpoint
+               :node
+               api/sexpr)))))

.clj-kondo/test/hooks/metabase/util/log_test.clj

@@ -1,4 +1,4 @@
-(ns ^:mb/once hooks.metabase.util.log-test
+(ns hooks.metabase.util.log-test
   (:require
    [clj-kondo.hooks-api :as api]
    [clj-kondo.impl.utils]

.cljfmt.edn

@@ -13,6 +13,8 @@
   "test"
   "enterprise/backend"
   "bin/build"
+  "bin/lint-migrations-file"
+  "bin/release-list"
   "modules/drivers"
   ".clj-kondo/src"
   ".clj-kondo/test"
@@ -91,7 +93,7 @@
   metabase-enterprise.test/with-gtaps!                                                 [[:inner 0]]
   metabase-enterprise.test/with-gtaps-for-user!                                        [[:inner 0]]
   metabase-enterprise.test/with-user-attributes                                        [[:block 2]]
-  metabase.actions-test/with-actions-test-data-and-actions-permissively-enabled        [[:block 0]]
+  metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled [[:block 0]]
   metabase.actions.test-util/with-actions                                              [[:block 1]]
   metabase.actions.test-util/with-actions-disabled                                     [[:block 0]]
   metabase.actions.test-util/with-actions-enabled                                      [[:block 0]]
@@ -131,10 +133,6 @@
   metabase.api.public-test/with-temp-public-dashboard-and-card                         [[:block 1]]
   metabase.api.search-test/do-test-users                                               [[:block 1]]
   metabase.api.session/http-401-on-error                                               [[:block 0]]
-  metabase.async.streaming-response/streaming-response                                 [[:block 2]]
-  metabase.async.streaming-response-test/with-streaming-response-thread-pool           [[:block 0]]
-  metabase.async.streaming-response-test/with-test-driver-db!                          [[:block 0]]
-  metabase.async.util/cancelable-thread                                                [[:block 0]]
   metabase.cmd.copy/step                                                               [[:block 1]]
   metabase.cmd.copy/with-connection-rollback-only                                      [[:block 1]]
   metabase.cmd.copy/with-disabled-db-constraints                                       [[:block 2]]
@@ -192,9 +190,18 @@
   metabase.query-processor.store/with-metadata-provider                                [[:inner 0]]
   metabase.query-processor.streaming/streaming-response                                [[:block 1]]
   metabase.query-processor.test-util/format-rows-by                                    [[:default]]
+  metabase.request.core/as-admin                                                       [[:block 0]]
+  metabase.request.core/with-current-request                                           [[:inner 0]]
+  metabase.request.core/with-current-user                                              [[:inner 0]]
+  metabase.request.core/with-limit-and-offset                                          [[:inner 0]]
+  metabase.request.session/as-admin                                                    [[:block 0]]
+  metabase.request.session/with-current-user                                           [[:inner 0]]
   metabase.sample-data-test/with-temp-sample-database-db                               [[:block 1]]
   metabase.server.middleware.session/as-admin                                          [[:block 0]]
   metabase.server.middleware.session/with-current-user                                 [[:inner 0]]
+  metabase.server.streaming-response/streaming-response                                [[:block 2]]
+  metabase.server.streaming-response-test/with-streaming-response-thread-pool          [[:block 0]]
+  metabase.server.streaming-response-test/with-test-driver-db!                         [[:block 0]]
   metabase.sync.fetch-metadata/log-if-error                                            [[:block 1]]
   metabase.sync.sync-metadata.fields-test/with-test-db                                 [[:block 0]]
   metabase.sync.util/do-with-start-and-finish-debug-logging                            [[:default]]
@@ -269,12 +276,14 @@
   metabase.upload.types/with-currency                                                  [[:default]]
   metabase.upload.types/with-parens                                                    [[:default]]
   metabase.util/auto-retry                                                             [[:block 1]]
+  metabase.util/case-enum                                                              [[:block 1]]
   metabase.util/ignore-exceptions                                                      [[:block 0]]
   metabase.util/or-with                                                                [[:block 1]]
   metabase.util/profile                                                                [[:block 1]]
   metabase.util/prog1                                                                  [[:inner 0]]
   metabase.util/varargs                                                                [[:inner 0]]
   metabase.util/with-us-locale                                                         [[:block 0]]
+  metabase.util.async/cancelable-thread                                                [[:block 0]]
   metabase.util.date-2/with-time-zone-same-instant                                     [[:default]]
   metabase.util.encryption-test/with-secret-key                                        [[:block 1]]
   metabase.util.honey-sql-2/with-database-type-info                                    [[:default]]

.dir-locals.el

@@ -26,6 +26,7 @@
   (eval . (put 'define-premium-feature             'clojure-doc-string-elt 2))
   (eval . (put 'api/defendpoint-schema             'clojure-doc-string-elt 3))
   (eval . (put 'api/defendpoint                    'clojure-doc-string-elt 3))
+  (eval . (put 'api.macros/defendpoint             'clojure-doc-string-elt 3))
   (eval . (put 'api/defendpoint-async              'clojure-doc-string-elt 3))
   (eval . (put 'defsetting                         'clojure-doc-string-elt 2))
   (eval . (put 'setting/defsetting                 'clojure-doc-string-elt 2))

.eslintrc.js

@@ -257,12 +257,31 @@ module.exports = {
       files: ["frontend/src/**/*"],
       rules: {
         "no-restricted-syntax": [
-        "error",
-        {
-          selector: "Literal[value=/mb-base-color-/]",
-          message: "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
-        }
-      ],
+          "error",
+          {
+            selector: "Literal[value=/mb-base-color-/]",
+            message:
+              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
+          },
+        ],
+      },
+    },
+    {
+      files: ["frontend/src/metabase/**/*"],
+      rules: {
+        "no-restricted-syntax": [
+          "error",
+          {
+            selector: "Literal[value=/mb-base-color-/]",
+            message:
+              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
+          },
+          {
+            selector:
+              "CallExpression[callee.property.name='legacyQuery'] > ObjectExpression > Property[key.name='useStructuredQuery'][value.value=true]",
+            message: "StructuredQuery usage is forbidden. Use MLv2",
+          },
+        ],
       },
     },
   ],

.github/CODEOWNERS

@@ -1,16 +1,34 @@
 # Before changing this file, make sure you have read how we use it:
 # https://www.notion.so/metabase/Pull-Request-Code-Review-Guide-374f05df889748b69d67af753f9bc9b8?pvs=4#36550c04ceab40b5a8b8bee6264b090c
-# TL;DR: if @camsaul hasn't been involved you're probably doing it wrong
 
-src/metabase @camsaul
-modules @camsaul
-enterprise/backend @camsaul
 enterprise/backend/src/metabase_enterprise/advanced_permissions @noahmoss
 enterprise/backend/src/metabase_enterprise/audit_app @noahmoss
 enterprise/backend/src/metabase_enterprise/sso @noahmoss
 enterprise/backend/src/metabase_enterprise/task/truncate_audit_table.clj @noahmoss
 enterprise/backend/src/metabase_enterprise/internal_user.clj @noahmoss
+enterprise/frontend/src/embedding-sdk @metabase/embedding
+frontend/src/metabase/embedding-sdk @metabase/embedding
 frontend/src/metabase/ui @metabase/core-frontend-admin-webapp
 src/metabase/**/*permissions* @noahmoss
 src/metabase/integrations @noahmoss
 snowplow/* @metabase/data
+e2e/* @filiphric
+
+#
+# Backend modules <=> teams that own them
+#
+
+src/metabase/actions @metabase/core-backend-admin-webapp
+test/metabase/actions @metabase/core-backend-admin-webapp
+
+src/metabase/channel @metabase/core-workflows
+test/metabase/channel @metabase/core-workflows
+
+src/metabase/query_analysis @metabase/core-backend-querying
+test/metabase/query_analysis @metabase/core-backend-querying
+
+src/metabase/setup @metabase/core-backend-admin-webapp
+test/metabase/setup @metabase/core-backend-admin-webapp
+
+src/metabase/sync @metabase/drivers
+test/metabase/sync @metabase/drivers

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -66,12 +66,13 @@ body:
         Copy and paste the JSON from `Admin -> Troubleshooting`.
         _This will be automatically formatted into code, so no need for backticks._
       placeholder: |
-        - Your browser and the version: (e.g., Chrome 52.1, Firefox 48.0, Safari 11.1, …)
-        - Your operating system: (e.g., OS X 10.10, Windows 10.1809, Ubuntu 16.04, …)
-        - Your databases: (e.g, MySQL, Postgres, MongoDB, …)
-        - Metabase version: (e.g., 0.19.3)
-        - Metabase hosting environment: (e.g., Elastic Beanstalk, Docker, Heroku, Jar-file on Ubuntu, …)
-        - Metabase internal database: (e.g., H2 (default), Postgres or MySQL)
+        {"browser-info": {
+           "language": "en-US",
+           "platform": "MacIntel",
+           "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+           "vendor": "Google Inc."},
+         "metabase-info": {
+           "databases": [ "postgres",...
       render: JSON
     validations:
       required: true

.github/ISSUE_TEMPLATE/epic.md

@@ -5,20 +5,19 @@ about: This issue is used to track a feature/project that may span several days
   and manage work.
 title: "[Epic] Title"
 labels: ".Epic"
-
 ---
 
-**Links**
-- product doc: _link to product doc_
-- eng doc: _link to technical design doc, if any_
-- feature branch: `branch-name` _this should be the feature branch where this work will be done in. PRs will be delivered against this branch_
-- issue links: _related issues if any_
+### Links
 
-**Implementation Plan**
+- [product doc](LINK_TO_PRODUCT_DOC)
+- [technical design doc](LINK_TO_TECHNICAL_DESIGN_DOC)
+- [testing plan](LINK_TO_TESTING_PLAN)
+- feature branch: `BRANCH_NAME`
+- issue links: _related issues, if any_
 
+### Implementation Plan
 
-***Milestone 1***
-_insert tasklist here_
-
-***Milestone 2***
-
+```[tasklist]
+#### Milestone 1
+- [ ] _Add tasks here_
+```

.github/actions/build-e2e-matrix/action.yml

@@ -1,70 +0,0 @@
-name: Build E2E Matrix
-description: Build and output a custom matrix for E2E tests.
-
-outputs:
-  matrix:
-    description: Parameterized matrix in JSON format
-    value: ${{ steps.matrix.outputs.result }}
-
-runs:
-  using: "composite"
-  steps:
-    - uses: actions/github-script@v7
-      id: matrix
-      with:
-        script: | # js
-          const java = 21;
-
-          const defaultRunner = "ubuntu-22.04";
-
-          const defaultOptions = {
-            "java-version": java,
-            runner: defaultRunner,
-            edition: "ee",
-            context: "folder"
-          };
-
-          const testSets = [
-            ["actions", {} ],
-            ["admin", {} ],
-            ["admin-2", {} ],
-            ["binning", {} ],
-            ["collections", {} ],
-            ["custom-column", {} ],
-            ["dashboard", {} ],
-            ["dashboard-cards", {} ],
-            ["dashboard-filters", {} ],
-            ["embedding", {} ],
-            ["embedding-sdk", { context: "embedding-sdk" } ],
-            ["filters", {} ],
-            ["filters-reproductions", {}],
-            ["joins", {} ],
-            ["metrics", {} ],
-            ["models", {} ],
-            ["native", {} ],
-            ["native-filters", {} ],
-            ["onboarding", {} ],
-            ["organization", {} ],
-            ["permissions", {} ],
-            ["question", {} ],
-            ["question-reproductions", {} ],
-            ["search", {}],
-            ["sharing", {} ],
-            ["visualizations-charts", {} ],
-            ["visualizations-tabular", {} ],
-            ["oss-subset", { edition: 'oss', context: "special" } ],
-            ["slow", { context: "special" } ],
-            ["flaky", { context: "special" } ],
-            ["mongo", { context: "qa-database" } ],
-          ];
-
-          const config = testSets.map(([name, specialOptions]) => {
-            return {
-              ...defaultOptions,
-              ...specialOptions,
-              name,
-            }
-          });
-
-          const matrix = { include: config };
-          return matrix;

.github/actions/build-ee-extra/action.yml

@@ -4,7 +4,9 @@ description: Build Metabase Enterprise Edition with extra features
 inputs:
   java-version:
     required: true
-    default: '11'
+    # build with Java 11 since that's still officially what we target as a minimum and we don't want Java >11 bytecode
+    # sneaking in.
+    default: 11
   iam-role:
     description: "The IAM role to assume"
     required: true
@@ -110,7 +112,7 @@ runs:
       shell: bash
     - name: Launch uberjar
       run: >-
-        java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./target/uberjar/metabase.jar &
+        java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./bin/docker/metabase.jar &
       shell: bash
     - name: Wait for Metabase to start
       run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done

.github/actions/e2e-download-uberjar/action.yml

@@ -68,10 +68,3 @@ runs:
     - name: Unzip Metabase artifact containing an uberjar
       run: unzip mb.zip
       shell: bash
-
-    - name: Get the version info
-      run: |
-        jar xf target/uberjar/metabase.jar version.properties
-        cat version.properties
-        mv version.properties resources/
-      shell: bash

.github/actions/e2e-prepare-containers/action.yml

@@ -90,7 +90,7 @@ runs:
 
         if ${{ inputs.webhook }}; then
           echo -e "${Y}Starting webhook test container..." &&
-          docker run -d -p 9080:8080/tcp tarampampam/webhook-tester serve --create-session 00000000-0000-0000-0000-000000000000 &&
+          docker run -d -p 9080:8080/tcp tarampampam/webhook-tester:1.1.0 serve --create-session 00000000-0000-0000-0000-000000000000 &&
           while ! nc -z localhost 9080; do sleep 1; done &&
           echo -e "${G}Webhook tester is up and running!"
         fi

.github/actions/prepare-backend/action.yml

@@ -5,7 +5,7 @@ inputs:
     default: '21'
   clojure-version:
     required: true
-    default: '1.11.1.1262'
+    default: '1.12.0.1488'
   m2-cache-key:
     description: 'Key to cache M2 packages from Maven Central'
     required: true

.github/actions/test-driver/action.yml

@@ -5,19 +5,24 @@ inputs:
     default: "driver"
   test-args:
     required: false
+  build-static-viz:
+    required: true
+    default: false
 
 runs:
   using: "composite"
   steps:
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
       with:
         m2-cache-key: driver
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+      if: ${{ inputs.build-static-viz == 'true' }}
     - name: Build static viz frontend
       run: yarn build-static-viz
       shell: bash
+      if: ${{ inputs.build-static-viz == 'true' }}
     - name: Test database driver
       run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash

.github/auto_request_review.yml

@@ -5,9 +5,9 @@
 files:
   # migrations related files
   'resources/migrations/**':
-    - team:core-backend-components
+    - team:core-workflows
   'src/metabase/db/custom_migrations.clj':
-    - team:core-backend-components
+    - team:core-workflows
 
 options:
   ignore_draft: true

.github/file-paths.yaml

@@ -79,7 +79,6 @@ backend_specs: &backend_specs
   - "test_modules/**"
   - "modules/drivers/*/test/**"
   - "test_config/**"
-  - "dev/**"
   - "test_resources/**"
 
 backend_all: &backend_all
@@ -94,14 +93,13 @@ sources: &sources
   - *backend_sources
 
 e2e_ci: &e2e_ci
-  - ".github/actions/build-e2e-matrix/**"
   - ".github/actions/prepare-frontend/**"
   - ".github/actions/prepare-backend/**"
   - ".github/actions/prepare-uberjar-artifact/**"
   - ".github/actions/e2e-prepare-containers/**"
   - ".github/actions/prepare-cypress/**"
   - ".github/actions/run-snowplow-micro/**"
-  - ".github/workflows/e2e-tests.yml"
+  - ".github/workflows/e2e-*"
 
 e2e_specs: &e2e_specs
   - "**/*.cy.*.js"

.github/scripts/handle-mochawesome-report.js

@@ -1,4 +1,5 @@
 const fs = require("fs");
+const { merge } = require("mochawesome-merge");
 
 const logger = { debug: console.debug, error: console.error };
 
@@ -50,15 +51,16 @@ const extractTestResultsInfo = ({ results, stats }) => {
   };
 };
 
-function parseReport() {
-  const content = fs.readFileSync(
-    "./cypress/reports/cypress-test-report.json",
-    "utf-8",
-  );
+async function generateReport() {
+  const files = ["./cypress/reports/mochareports/*.json"];
 
-  const data = JSON.parse(content);
+  return await merge({ files });
+}
 
-  return extractTestResultsInfo(data).failedTests.map(test => ({
+exports.generateReport = generateReport;
+
+function parseReport(report) {
+  return extractTestResultsInfo(report).failedTests.map(test => ({
     title: test.fullTitle,
     error: test.err?.message,
     path: test.path,

.github/scripts/run-presto-kerberos-integration-test.sh

@@ -10,9 +10,9 @@ export PATH="$PATH:$JAVA_HOME/bin"
 which java
 
 # install clojure version needed for Metabase
-curl -O https://download.clojure.org/install/linux-install-1.11.0.1100.sh
-chmod +x linux-install-1.11.0.1100.sh
-./linux-install-1.11.0.1100.sh
+curl -O https://download.clojure.org/install/linux-install-1.12.0.1488.sh
+chmod +x linux-install-1.12.0.1488.sh
+./linux-install-1.12.0.1488.sh
 
 RESOURCES_DIR=/app/source/resources
 

.github/team.json

@@ -12,28 +12,42 @@
         "metamben",
         "lbrdnk",
         "appleby",
-        "uladzimirdev"
+        "uladzimirdev",
+        "wzimrin",
+        "ericnormand"
       ]
     },
     {
       "name": "Drivers",
       "label": ".Team/Drivers",
-      "members": ["snoe"]
+      "projectUrl": "https://github.com/orgs/metabase/projects/98/views/1",
+      "members": [
+        "snoe",
+        "rileythomp"
+      ]
     },
     {
       "name": "Embedding",
       "label": ".Team/Embedding",
       "projectUrl": "https://github.com/orgs/metabase/projects/88/views/1",
-      "members": ["WiNloSt", "deniskaber", "oisincoveney", "npretto", "heypoom"]
+      "members": [
+        "WiNloSt",
+        "oisincoveney",
+        "npretto",
+        "heypoom",
+        "sanex3339"
+      ]
     },
     {
-      "name": "BEC",
-      "label": ".Team/BackendComponents",
+      "name": "Workflows",
+      "label": ".Team/Workflows",
       "projectUrl": "https://github.com/orgs/metabase/projects/50/views/1",
       "members": [
         "qnkhuat",
         "piranha",
-        "crisptrutski"
+        "crisptrutski",
+        "deniskaber",
+        "wotbrew"
       ]
     },
     {
@@ -46,7 +60,8 @@
         "johnswanson",
         "rafpaf",
         "sloansparger",
-        "iethree"
+        "iethree",
+        "nvoxland"
       ]
     },
     {
@@ -55,7 +70,9 @@
       "members": [
         "alxnddr",
         "kulyk",
-        "adam-james-v"
+        "adam-james-v",
+        "tsplude",
+        "lorem--ipsum"
       ]
     },
     {

.github/workflows/backend.yml

@@ -67,6 +67,7 @@ jobs:
       (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
     timeout-minutes: 10
+    name: Clj-Kondo
     steps:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
@@ -84,6 +85,7 @@ jobs:
       (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
     timeout-minutes: 20
+    name: Eastwood
     steps:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
@@ -103,7 +105,7 @@ jobs:
       github.event.pull_request.draft == true &&
       (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
-    name: be-tests-java-11-ee-pre-check
+    name: Java 11 EE Pre-Check
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
@@ -139,43 +141,100 @@ jobs:
       github.event.pull_request.draft == false &&
       (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
-    name: be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
-        edition: [oss, ee]
-        java-version: [11, 17, 21]
+        java-version:
+          - 11
+          - 17
+          - 21
+        job:
+          - name: Enterprise Tests
+            edition: ee
+            build-static-viz: 'false'
+            test-args: >-
+              :only '"enterprise/backend/test"'
+          - name: EE App DB Tests (Part 1)
+            edition: ee
+            build-static-viz: 'true'
+            test-args: >-
+              :only '["test" ".clj-kondo/test"]'
+              :partition/total 2
+              :partition/index 0
+          - name: EE App DB Tests (Part 2)
+            edition: ee
+            build-static-viz: 'true'
+            test-args: >-
+              :only '["test" ".clj-kondo/test"]'
+              :partition/total 2
+              :partition/index 1
+          - name: OSS App DB Tests (Part 1)
+            edition: oss
+            build-static-viz: 'true'
+            test-args: >-
+              :only '["test" ".clj-kondo/test"]'
+              :partition/total 2
+              :partition/index 0
+          - name: OSS App DB Tests (Part 2)
+            edition: oss
+            build-static-viz: 'true'
+            test-args: >-
+              :only '["test" ".clj-kondo/test"]'
+              :partition/total 2
+              :partition/index 1
+    name: "Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
+    env:
+      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
+      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
+      # it in to the command below.
+      __ADDITIONAL_EXCLUDED_TAG__: >-
+        ${{
+          (
+            github.event_name == 'push' &&
+            (
+              github.ref == 'master' ||
+              startsWith(github.ref, 'release-')
+            ) &&
+            ''
+          ) ||
+          ':mb/old-migrations-test'
+        }}
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
+        if: ${{ matrix.job.build-static-viz == 'true' }}
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: be-tests
+          java-version: "${{ matrix.java-version }}"
       # Depending on which files changed, we might either have to build static-viz
       # from scratch or download the previously built artifact
       - name: Build static-viz frontend
-        if: needs.files-changed.outputs.backend_all == 'true'
+        if: ${{ matrix.job.build-static-viz == 'true' && needs.files-changed.outputs.backend_all == 'true' }}
         run: yarn build-static-viz
       - name: Download Static Viz Bundle Artifact
-        if: needs.static-viz-files-changed.outputs.static_viz == 'true'
+        if: ${{ matrix.job.build-static-viz == 'true' && needs.static-viz-files-changed.outputs.static_viz == 'true' }}
         uses: actions/download-artifact@v4
         with:
           name: static-viz-bundle-${{ github.sha }}
           path: resources/frontend_client/app/dist
 
-      - name: Run tests
+      - name: "Test Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
         id: run-java-tests
-        run: clojure -X:dev:ci:test:${{ matrix.edition }}:${{ matrix.edition }}-dev
+        run: >-
+          clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev
+          :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          ${{ matrix.job.test-args }}
 
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always() && (steps.run-java-tests.conclusion != 'skipped' || steps.run-java-tests-21.conclusion != 'skipped')
         with:
           input-path: ./target/junit/
-          output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
+          output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
           aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
@@ -187,29 +246,12 @@ jobs:
         if: failure()
         with:
           path: "target/junit/**/*_test.xml"
-          name: JUnit Test Report be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
+          name: JUnit Test Report be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
           reporter: java-junit
           list-suites: failed
           list-tests: failed
           fail-on-error: false
 
-  be-tests-stub:
-    needs: [be-tests]
-    if: |
-      !cancelled() &&
-      github.event.pull_request.draft == false && needs.be-tests.result == 'skipped'
-    runs-on: ubuntu-22.04
-    name: be-tests-java-${{ matrix.java-version }}-${{ matrix.edition }}
-    timeout-minutes: 5
-    strategy:
-      fail-fast: false
-      matrix:
-        edition: [oss, ee]
-        java-version: [11, 17, 21]
-    steps:
-      - run: |
-          echo "Didn't run due to conditional filtering"
-
   # checks that all the namespaces we actually ship can be compiled, without any dependencies that we don't ship (such
   # as `:dev` dependencies). See #27009 for more context.
   be-check:
@@ -219,42 +261,28 @@ jobs:
       github.event.pull_request.draft == false &&
       (needs.files-changed.outputs.backend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true')
     runs-on: ubuntu-22.04
-    name: be-check-java-${{ matrix.java-version }}
     timeout-minutes: 10
     strategy:
       matrix:
         java-version: [11, 17, 21]
+    name: "Check Java ${{ matrix.java-version }}"
     steps:
       - uses: actions/checkout@v4
       - name: Prepare backend
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: be-check
+      # TODO -- we should probably also check WITHOUT ee -- do a check with only OSS namespaces on the classpath
       - name: Check namespaces
         run: clojure -M:ee:drivers:check
 
-  be-check-stub:
-    needs: [files-changed, static-viz-files-changed, be-check]
-    if: |
-      always() &&
-      github.event.pull_request.draft == false &&
-      needs.be-check.result == 'skipped'
-    runs-on: ubuntu-22.04
-    name: be-check-java-${{ matrix.java-version }}
-    timeout-minutes: 10
-    strategy:
-      matrix:
-        java-version: [11, 17, 21]
-    steps:
-      - run: |
-          echo "Didn't run due to conditional filtering"
-
   be-cljfmt:
     needs: [files-changed]
     if: |
       !cancelled() && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 10
+    name: Cljfmt
     steps:
       - uses: actions/checkout@v4
       - name: Prepare back-end environment
@@ -263,3 +291,44 @@ jobs:
           m2-cache-key: 'cljfmt'
       - name: Run cljfmt
         run: clojure -T:cljfmt check
+
+  be-tests-result:
+    needs:
+      - be-linter-eastwood
+      - be-linter-clj-kondo
+      - be-cljfmt
+      - be-check
+      - be-tests
+    if: always() && !cancelled()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      needs: ${{ toJson(needs) }}
+    steps:
+      - name: Check backend job status
+        uses: actions/github-script@v7
+        env:
+          needs: ${{ toJson(needs) }}
+        with:
+          script: | # js
+            const needs = JSON.parse(process.env.needs);
+            const jobs = Object.entries(needs).map(
+              ([jobName, jobValues]) => ({
+                name: jobName,
+                result: jobValues.result
+              }));
+
+            // are all jobs skipped or successful?
+            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
+              console.log('All jobs are skipped or successful');
+              process.exit(0);
+            }
+
+            // otherwise, something failed
+            console.log('Some backend jobs failed');
+            jobs.forEach((job) => {
+              if (job.result !== 'success') {
+                console.log(`${job.name} - ${job.result}`);
+              }
+            });
+            process.exit(1);

.github/workflows/backport.yml

@@ -6,25 +6,50 @@ on:
     types: [created]
 
 jobs:
+  check_pull_request_state:
+    name: Checks whether the PR has been merged
+    if: github.event.issue.pull_request && contains(github.event.comment.body, '@metabase-bot backport')
+    runs-on: ubuntu-22.04
+    outputs:
+      canBackport: ${{ steps.check_pull_request_state.outputs.result }}
+    steps:
+      - uses: actions/github-script@v7
+        id: check_pull_request_state
+        with:
+          script: |
+            const { data: pullRequest } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.issue.number
+            });
+
+            const canBackport = pullRequest.state === "closed"
+            if (!canBackport) {
+              await github.rest.issues.createComment({
+                issue_number: context.payload.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: "The backport command can only be used after the pull request has been merged. Please wait until the PR is merged before attempting to backport."
+              });
+            }
+            return canBackport
+
   create_pull_request:
     name: Creates a pull request
-    if: contains(github.event.comment.body, '@metabase-bot backport')
+    needs: [check_pull_request_state]
+    if: needs.check_pull_request_state.outputs.canBackport == 'true'
     runs-on: ubuntu-22.04
     steps:
-      - uses: tibdex/github-app-token@v2.1.0
-        id: generate-token
-        with:
-          app_id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private_key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
       - uses: actions/checkout@v4
         name: Cherry-pick commits and create PR
         with:
           fetch-depth: 0
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
       - name: Verify Membership
         id: verify-membership
         uses: ./.github/actions/verify-membership
         with:
-          github_token: ${{ steps.generate-token.outputs.token }}
+          github_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           organization_name: metabase
           username: ${{ github.event.comment.user.login }}
       - run: |
@@ -110,23 +135,50 @@ jobs:
 
             if [ -n "${SQUASHED_COMMIT}" ]; then
               echo "found commit ${SQUASHED_COMMIT}"
-              git cherry-pick ${SQUASHED_COMMIT}
             else
               echo "probably a PR wasn't merged with Squash And Merge button, searching again"
               SQUASHED_COMMIT=$(env -i git log ${ORIGINAL_BASE_REF} --grep="#${ORIGINAL_PULL_REQUEST_NUMBER}" --format="%H")
 
               if [ -n "${SQUASHED_COMMIT}" ]; then
                 echo "found commit ${SQUASHED_COMMIT}"
-                git cherry-pick ${SQUASHED_COMMIT}
               else
                 echo "No squashed commit found for PR #${ORIGINAL_PULL_REQUEST_NUMBER}"
                 exit 1
               fi
             fi
-
           else
-            echo "PR has not been merged, copying all commits"
-            git cherry-pick ${ORIGINAL_BASE_SHA}..${ORIGINAL_HEAD_SHA}
+            echo "The PR has not been merged"
+            exit 1
+          fi
+
+          git cherry-pick ${SQUASHED_COMMIT} || true
+
+          CONFLICTS=$(git ls-files -u | wc -l)
+          if [ "$CONFLICTS" -gt 0 ]; then
+            git cherry-pick --abort
+
+            echo "Could not cherry pick because of a conflict"
+            echo "has-conflicts=true" >> $GITHUB_OUTPUT
+
+            # Add a shell script for resolving conflicts
+            echo "git reset HEAD~1" > ./backport.sh
+            echo "rm ./backport.sh" >> ./backport.sh
+            echo "git cherry-pick ${SQUASHED_COMMIT}" >> ./backport.sh
+            echo "echo 'Resolve conflicts and force push this branch'" >> ./backport.sh
+            chmod +x ./backport.sh
+            git add ./backport.sh
+            git commit -m "Add backport resolution script"
+
+            PR_BODY=$(cat <<-END
+            #${ORIGINAL_PULL_REQUEST_NUMBER}
+            > [!IMPORTANT]
+            > Manual conflict resolution is required.
+            Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking.
+          END
+            )
+          else
+            echo "has-conflicts=false" >> $GITHUB_OUTPUT
+            PR_BODY="#${ORIGINAL_PULL_REQUEST_NUMBER}"
           fi
 
           git push origin "${BACKPORT_BRANCH}" --force-with-lease
@@ -134,12 +186,14 @@ jobs:
           if [[ $(gh pr list --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" -s "open") ]]; then
               echo "PR already exists"
           else
-              BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "#${ORIGINAL_PULL_REQUEST_NUMBER}")
+              BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${GITHUB_ACTOR}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
               BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
 
               echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT
               echo "New PR has been created"
           fi
+
+          git checkout master
         env:
           ORIGINAL_TITLE: ${{ fromJson(steps.branch_info.outputs.result).originalPullRequest.title }}
           ORIGINAL_BASE_REF: ${{ fromJson(steps.branch_info.outputs.result).originalPullRequest.base.ref }}
@@ -151,18 +205,25 @@ jobs:
           BACKPORT_BRANCH: ${{ fromJson(steps.branch_info.outputs.result).backportBranch }}
           START_SHA: ${{ fromJson(steps.branch_info.outputs.result).startSha }}
           END_SHA: ${{ fromJson(steps.branch_info.outputs.result).endSha }}
-          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
       - name: Auto approve backport PR
+        if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
         uses: juliangruber/approve-pull-request-action@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
       - name: Enable Pull Request Automerge
+        if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
         uses: peter-evans/enable-pull-request-automerge@v2
         with:
-          token: ${{ steps.generate-token.outputs.token }}
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           pull-request-number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
           merge-method: squash
+      - uses: ./.github/actions/notify-pull-request
+        if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'true' }}
+        with:
+          include-log: false
+          message: Manual conflict resolution is required
 
   notify_when_failed:
     runs-on: ubuntu-22.04

.github/workflows/bugs-triage-slack-notification.yml

@@ -3,14 +3,13 @@ name: Bugs Slack Notification
 on:
   issues:
     types:
-      - opened
+      - labeled
 jobs:
-  on-issue-opened:
+  on-issue-labeled:
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     if: |
-        contains(github.event.issue.labels.*.name, '.Needs Triage') &&
-        contains(github.event.issue.labels.*.name, 'Type:Bug')
+      github.event.label.name == '.Needs Triage' && contains(github.event.issue.labels.*.name, 'Type:Bug')
     steps:
       - name: Setting title
         uses: actions/github-script@v7
@@ -34,7 +33,7 @@ jobs:
       - name: Send the issue ${{ github.event.issue.number }} to Slack
         id: slack
         if: steps.check_labels.outputs.has_team_label == 'false'
-        uses: slackapi/slack-github-action@v1.23.0
+        uses: slackapi/slack-github-action@v1.26.0
         with:
           payload: |
             {

.github/workflows/build-for-release.yml

@@ -100,21 +100,14 @@ jobs:
             oss: getCanonicalVersion(version, 'oss'),
           };
 
-          const ossReleased = await hasBeenReleased({
+          const released = await hasBeenReleased({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version: versions.oss,
           });
 
-          const eeReleased = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.ee,
-          });
-
-          if (ossReleased || eeReleased) {
+          if (released) {
             throw new Error("This version has already been released!", version);
           }
 

.github/workflows/check-milestone.yml

@@ -16,7 +16,7 @@ jobs:
   set-milestone:
     name: Automatically set milestone
     runs-on: ubuntu-22.04
-    timeout-minutes: 15
+    timeout-minutes: 30
     env:
       isNewReleaseBranch: ${{ github.event_name == 'workflow_dispatch' }}
     permissions:

.github/workflows/chromatic.yml

@@ -43,6 +43,8 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
+      - name: Compile CLJS
+        run: NODE_ENV=development yarn build-pure:cljs
       - name: Publish to Chromatic
         uses: chromaui/action@v10.2.0
         env:

.github/workflows/doc-md-links.yml

@@ -1,18 +0,0 @@
-name: Lint doc Markdown links
-
-on:
-  push:
-    paths:
-      - docs/**
-  pull_request:
-    paths:
-      - docs/**
-jobs:
-  markdown-link-check:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Lint doc links
-        run: yarn run docs-lint-links

.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml

@@ -0,0 +1,247 @@
+name: E2E Cross-version Component Tests for Embedding SDK
+
+on:
+  push:
+    branches:
+      - "release-**"
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - "release-**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      e2e_all: ${{ steps.changes.outputs.e2e_all }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  # if this is a test on a release branch, we need to check the build requirements
+  get-build-requirements:
+    if: |
+      !cancelled()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get build dependencies
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const {
+              getBuildRequirements,
+              getVersionFromReleaseBranch,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const targetBranchName = '${{ github.base_ref || github.ref }}';
+
+            const version = getVersionFromReleaseBranch(targetBranchName);
+            const requirements = getBuildRequirements(version);
+
+            return {
+              java_version: requirements.java,
+              node_version: requirements.node,
+            };
+
+  build:
+    needs: [files-changed, get-build-requirements]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == false
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    env:
+      MB_EDITION: ee
+      INTERACTIVE: false
+      # make sure that builds on release branches get licenses, because we use them for releases
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: uberjar
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 11 }}"
+
+      - name: Build uberjar with ./bin/build.sh
+        run: ./bin/build.sh
+
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+  resolve-sdk-version:
+    if: |
+      !cancelled()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      sdk_version: ${{ fromJson(steps.dependencies.outputs.result).sdk_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get latest SDK release for this branch
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const { getSdkVersionFromReleaseBranchName } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const branchName = '${{ github.base_ref || github.ref }}';
+
+            const sdk_version = await getSdkVersionFromReleaseBranchName({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              branchName,
+            });
+
+            return {
+              sdk_version,
+            };
+
+  e2e-tests:
+    needs: [get-build-requirements, build, resolve-sdk-version]
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-tests-embedding-sdk
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # Needed to omit newly added tests for functionality that is not yet released
+      - name: Sparse checkout tests from SDK release commit
+        uses: actions/checkout@v4
+        with:
+          ref: embedding-sdk-${{ needs.resolve-sdk-version.outputs.sdk_version }}
+          path: sdk-release-e2e
+          sparse-checkout: e2e
+
+      - name: Move tests from the release commit into the repo
+        run: |
+          rm -rf ./e2e/support/helpers/*
+          mv ./sdk-release-e2e/e2e/support/helpers/* ./e2e/support/helpers
+          rm -rf ./e2e/test-component/*
+          mv ./sdk-release-e2e/e2e/test-component/* ./e2e/test-component
+        shell: bash
+
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Install Embedding SDK package v${{ needs.resolve-sdk-version.outputs.sdk_version }}
+        run: yarn add @metabase/embedding-sdk-react@${{ needs.resolve-sdk-version.outputs.sdk_version }}
+
+      - name: Run E2E tests for Embedding SDK
+        run: yarn run test-cypress-run-component-sdk --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-cross-version
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();
+
+  e2e-tests-skipped-stub:
+    needs: [e2e-tests]
+    if: |
+      !cancelled() &&
+      needs.e2e-tests.result == 'skipped'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    name: e2e-component-tests-embedding-sdk-cross-version
+    steps:
+      - run: |
+          echo "Didn't run due to conditional filtering"

.github/workflows/e2e-component-tests-embedding-sdk.yml

@@ -0,0 +1,209 @@
+name: E2E Component Tests for Embedding SDK
+
+on:
+  push:
+    branches:
+      - "master"
+      - "release-**"
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      e2e_all: ${{ steps.changes.outputs.e2e_all }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  # if this is a test on a release branch, we need to check the build requirements
+  get-build-requirements:
+    if: |
+      !cancelled() &&
+      contains(github.base_ref || github.ref, 'release-x')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get build dependencies
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const {
+              getBuildRequirements,
+              getVersionFromReleaseBranch,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const targetBranchName = '${{ github.base_ref || github.ref }}';
+
+            const version = getVersionFromReleaseBranch(targetBranchName);
+            const requirements = getBuildRequirements(version);
+
+            return {
+              java_version: requirements.java,
+              node_version: requirements.node,
+            };
+
+  build:
+    needs: [files-changed, get-build-requirements]
+    if: |
+      !cancelled() &&
+      github.event.pull_request.draft == false &&
+      needs.files-changed.outputs.e2e_all == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    env:
+      MB_EDITION: ee
+      INTERACTIVE: false
+      # make sure that builds on release branches get licenses, because we use them for releases
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: uberjar
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 11 }}"
+
+      - name: Build uberjar with ./bin/build.sh
+        run: ./bin/build.sh
+
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+  e2e-tests:
+    needs: [get-build-requirements, build]
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-tests-embedding-sdk
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ needs.get-build-requirements.outputs.java_version || 11 }}
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+        shell: bash
+
+      - name: Build Embedding SDK package
+        run: yarn build-embedding-sdk
+
+      - name: Run E2E tests for Embedding SDK
+        run: yarn run test-cypress-run-component-sdk --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-embedding-sdk
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-embedding-sdk-latest
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();
+
+  e2e-tests-skipped-stub:
+    needs: [e2e-tests]
+    if: |
+      !cancelled() &&
+      needs.e2e-tests.result == 'skipped'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    name: e2e-component-tests-embedding-sdk
+    steps:
+      - run: |
+          echo "Didn't run due to conditional filtering"

.github/workflows/e2e-matrix-builder.yml

@@ -0,0 +1,72 @@
+name: E2E Matrix Builder
+
+on:
+  workflow_call:
+    inputs:
+      chunks:
+        required: true
+        type: number
+        default: 30
+    outputs:
+      matrix:
+        value: ${{ jobs.build-matrix.outputs.matrix }}
+      regularChunks:
+        value: ${{ jobs.build-matrix.outputs.regularChunks }}
+
+jobs:
+  build-matrix:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.matrix.outputs.config }}
+      regularChunks: ${{ steps.matrix.outputs.regularChunks }}
+    steps:
+      - uses: actions/setup-node@v3
+        with:
+          node-version: '20.x'
+      - uses: actions/github-script@v7
+        id: matrix
+        env:
+          chunks: ${{ inputs.chunks }}
+        with:
+          script: | # js
+            const java = 21;
+            const defaultRunner = "ubuntu-22.04";
+
+            const defaultOptions = {
+              "java-version": java,
+              runner: defaultRunner,
+              edition: "ee",
+            };
+
+            const allSpecs = "./e2e/test/scenarios/**/*.cy.spec.*";
+
+            // see config.js function getSplittableSpecs for logic that excludes some tests from auto splitting
+            const specialTests = [
+              { name: "embedding-sdk", specs: "./e2e/test/scenarios/embedding-sdk/**.cy.spec.*" },
+              { name: "oss-subset", edition: 'oss', tags: "@OSS", specs: allSpecs },
+              { name: "mongo", tags: "@mongo", specs: allSpecs },
+            ];
+
+            const inputChunks = Number(process.env.chunks);
+            const regularChunks = inputChunks - specialTests.length;
+
+            const regularTests = new Array(regularChunks).fill(1)
+              .map((files, index) => ({
+                name: `e2e-group-${index + 1}`,
+              }));
+
+            // regular chunks need to come before special chunks
+            const testSets = [...regularTests, ...specialTests];
+
+            const config = testSets.map((options) => ({
+              ...defaultOptions,
+              ...options,
+            }));
+
+
+            core.setOutput("regularChunks", JSON.stringify(regularChunks));
+            core.setOutput("config", JSON.stringify({ include: config }));
+
+            console.log({ regularChunks });
+            console.log("matrix config", config);

.github/workflows/e2e-test.yml

@@ -0,0 +1,171 @@
+name: E2E Test
+run-name: E2E Test - ${{ inputs.name }}
+
+on:
+  workflow_call:
+    inputs:
+      name:
+        required: true
+        type: string
+      edition: # oss | ee
+        required: false
+        type: string
+        default: ee
+      specs:
+        required: false
+        default: ./e2e/test/scenarios/**/*.cy.spec.*
+        type: string
+      tags:
+        required: false
+        type: string
+      runner:
+        required: false
+        type: string
+        default: ubuntu-22.04
+      total_chunks: # number of chunks
+        required: false
+        type: number
+      split_index: # index of the chunk
+        required: false
+        type: number
+
+jobs:
+  e2e-tests:
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 45
+    name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
+    env:
+      MB_EDITION: ${{ inputs.edition }}
+      DISPLAY: ""
+      QA_DB_ENABLED: true
+      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
+      JOB_NAME: ${{ inputs.name }}
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      MB_SNOWPLOW_AVAILABLE: true
+      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+      CYPRESS_QA_DB_MONGO: ${{ inputs.name == 'mongo' }}
+      CYPRESS_IS_EMBEDDING_SDK: ${{ inputs.name == 'embedding-sdk' }}
+      mongo: ${{ inputs.name == 'mongo' }}
+      postgres: ${{ inputs.name != 'mongo' }}
+      mysql: ${{ inputs.name != 'mongo' }}
+      openldap: true
+      maildev: true
+      webhook: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
+          openldap: ${{ env.openldap }}
+          postgres: ${{ env.postgres }}
+          mysql: ${{ env.mysql }}
+          mongo: ${{ env.mongo }}
+          webhook: ${{ env.webhook }}
+
+      - name: Run Embedding SDK Storybook
+        if: inputs.name == 'embedding-sdk'
+        uses: ./.github/actions/run-embedding-sdk-storybook
+
+      - name: Retrieve uberjar artifact for ${{ inputs.edition }}
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: 21
+          distribution: "temurin"
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Run Snowplow micro
+        uses: ./.github/actions/run-snowplow-micro
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Generate database snapshots
+        run: node e2e/runner/run_cypress_ci.js snapshot
+
+      - name: Run auto-split Cypress tests on ${{ inputs.name }}
+        if: ${{ !inputs.specs }}
+        env:
+          SPLIT: ${{ inputs.total_chunks }}
+          SPLIT_INDEX: ${{ inputs.split_index }}
+          SPLIT_FILE: "./e2e/support/timings.json"
+          SPLIT_OUTPUT_FILE: "newTimes.json"
+          SPLIT_TIME_THRESHOLD: 5.0
+          # do not write cypress-split summary to github
+          SPLIT_SUMMARY: false
+        shell: bash
+        run: |
+          node e2e/runner/run_cypress_ci.js test \
+            --env grepTags="-@mongo+-@flaky+-@OSS --@quarantine",grepOmitFiltered=true \
+            --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
+        if: ${{ inputs.specs }}
+        shell: bash
+        run: |
+          node e2e/runner/run_cypress_ci.js test \
+          --env grepTags="${{inputs.tags}} --@quarantine",grepOmitFiltered=true \
+          --spec '${{ inputs.specs }}' \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit
+          output-name: e2e-${{ inputs.name }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-recording-${{ inputs.name }}-${{ inputs.edition }}
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
+
+      - name: Publish Summary
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const {
+               generateReport,
+               parseReport,
+               formatSummary
+             } = require("./.github/scripts/handle-mochawesome-report.js");
+
+             const report = await generateReport();
+             const results = parseReport(report);
+             const summary = formatSummary(results);
+
+             await core.summary.addRaw(summary).write();

.github/workflows/e2e-tests.yml

@@ -29,15 +29,9 @@ jobs:
           filters: .github/file-paths.yaml
 
   e2e-matrix-builder:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    outputs:
-      matrix: ${{ steps.e2e-matrix.outputs.matrix }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Generate matrix for E2E tests
-        id: e2e-matrix
-        uses: ./.github/actions/build-e2e-matrix
+    uses: ./.github/workflows/e2e-matrix-builder.yml
+    with:
+      chunks: 50
 
   # if this is a test on a release branch, we need to check the build requirements
   get-build-requirements:
@@ -71,11 +65,10 @@ jobs:
             };
 
   build:
-    needs: [files-changed, e2e-matrix-builder, get-build-requirements]
+    needs: [files-changed, get-build-requirements]
     if: |
       !cancelled() &&
       github.event.pull_request.draft == false &&
-      needs.e2e-matrix-builder.result == 'success' &&
       needs.files-changed.outputs.e2e_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 25
@@ -107,180 +100,97 @@ jobs:
         with:
           name: metabase-${{ matrix.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
 
-  e2e-tests:
-    needs: [build, e2e-matrix-builder]
-    if: |
-      !cancelled() && needs.build.result == 'success'
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 45
-    name: e2e-tests-${{ matrix.name }}-${{ matrix.edition }}
-    env:
-      MB_EDITION: ${{ matrix.edition }}
-      DISPLAY: ""
-      QA_DB_ENABLED: true
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
-      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.even.head.sha }}
-      MB_SNOWPLOW_AVAILABLE: true
-      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJSON(needs.e2e-matrix-builder.outputs.matrix) }}
-
+  reset-e2e-test-comment:
+    if: ${{ github.event_name == 'pull_request' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Prepare Docker containers
-        uses: ./.github/actions/e2e-prepare-containers
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          maildev: true
-          openldap: ${{ startsWith(matrix.name, 'admin') }}
-          postgres: ${{ matrix.name != 'mongo'}}
-          mysql: ${{ matrix.name != 'mongo'}}
-          mongo: ${{ matrix.name == 'mongo'}}
-          webhook: true
-
-      - name: Retrieve uberjar artifact for ${{ matrix.edition }}
-        uses: actions/download-artifact@v4
-        with:
-          name: metabase-${{ matrix.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-
-      - name: Get the version info
-        run: |
-          jar xf target/uberjar/metabase.jar version.properties
-          mv version.properties resources/
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare JDK ${{ matrix.java-version }}
-        uses: actions/setup-java@v4
-        with:
-          java-version: ${{ matrix.java-version }}
-          distribution: "temurin"
-
-      - name: Prepare Cypress environment
-        id: cypress-prep
-        uses: ./.github/actions/prepare-cypress
-
-      - name: Run Snowplow micro
-        uses: ./.github/actions/run-snowplow-micro
-
-      - name: Run OSS-specific Cypress tests
-        if: matrix.edition == 'oss' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags=@OSS,grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run slow and resource-intensive Cypress tests
-        if: matrix.name == 'slow' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="@slow",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run Flaky Cypress tests
-        if: matrix.name == 'flaky' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="@flaky --@quarantine",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run EE Cypress tests on ${{ matrix.name }}
-        if: matrix.context == 'folder' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="-@slow+-@mongo+-@flaky --@quarantine",grepOmitFiltered=true \
-          --folder ${{ matrix.name }} \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-
-      - name: Run E2E tests that depend on Mongo
-        if: matrix.name == 'mongo'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="@mongo --@quarantine",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-        env:
-          CYPRESS_QA_DB_MONGO: true
-
-      - name: Run Embedding SDK Storybook
-        if: matrix.context == 'embedding-sdk' && github.event_name != 'schedule'
-        uses: ./.github/actions/run-embedding-sdk-storybook
-
-      - name: Run E2E tests for Embedding SDK
-        if: matrix.context == 'embedding-sdk' && github.event_name != 'schedule'
-        run: |
-          yarn run test-cypress-run \
-          --env grepTags="-@slow+-@flaky --@quarantine",grepOmitFiltered=true \
-          --folder 'embedding-sdk' \
-          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
-        env:
-          CYPRESS_IS_EMBEDDING_SDK: true
-        shell: bash
-
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-${{ matrix.name }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
-      - name: Upload Cypress Artifacts upon failure
-        uses: actions/upload-artifact@v4
-        if: failure()
-        with:
-          name: cypress-recording-${{ matrix.name }}-${{ matrix.edition }}
-          path: |
-            ./cypress
-            ./logs/test.log
-          if-no-files-found: ignore
-
-      - name: Publish Summary
-        if: failure()
+      - name: Remove test results comment
         uses: actions/github-script@v7
         with:
-          script: | #js
-            const {
-               parseReport,
-               formatSummary
-             } = require("./.github/scripts/handle-mochawesome-report.js");
+          script: | # js
+            const { owner, repo } = context.repo;
 
-             const report = parseReport();
-             const summary = formatSummary(report);
+            const { data: comments } = await github.rest.issues.listComments({
+              owner,
+              repo,
+              issue_number: context.issue.number,
+            }).catch(console.error);
 
-             await core.summary.addRaw(summary).write();
+            if (!comments) {
+              return;
+            }
 
-  e2e-tests-skipped-stub:
-    needs: [e2e-tests, e2e-matrix-builder]
+            const comment = comments.find((comment) => comment.body.includes('## e2e tests failed on '));
+
+            if (comment) {
+              await github.rest.issues.deleteComment({
+                owner,
+                repo,
+                comment_id: comment.id,
+              });
+            }
+
+  e2e-tests:
+    name: ${{ matrix.name }}-${{ matrix.edition }}
+    uses: ./.github/workflows/e2e-test.yml
+    needs:
+      - e2e-matrix-builder
+      - build
     if: |
-      !cancelled() &&
-      needs.e2e-tests.result == 'skipped'
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 5
-    name: e2e-tests-${{ matrix.name }}-${{ matrix.edition }}
+      !cancelled() && needs.build.result == 'success'
     strategy:
       fail-fast: false
-      matrix: ${{ fromJSON(needs.e2e-matrix-builder.outputs.matrix) }}
+      matrix: ${{ fromJson(needs.e2e-matrix-builder.outputs.matrix) }}
+    secrets: inherit
+    with:
+      name: ${{ matrix.name }}
+      edition: ${{ matrix.edition }}
+      specs: ${{ matrix.specs }}
+      total_chunks: ${{ fromJson(needs.e2e-matrix-builder.outputs.regularChunks) }}
+      split_index: ${{ strategy.job-index }}
+      tags: ${{ matrix.tags }}
+      runner: ${{ matrix.runner }}
+
+  # run this separately to make it non-blocking
+  flaky-e2e-tests:
+    name: Flaky e2e Tests
+    uses: ./.github/workflows/e2e-test.yml
+    needs: build
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    secrets: inherit
+    with:
+      name: Flaky
+      tags: "@flaky"
+      specs: "./e2e/test/scenarios/**/*.cy.spec.*"
+
+  e2e-tests-result:
+    needs:
+     - e2e-tests
+     - flaky-e2e-tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    name: e2e-tests-result
+    if: always() && !cancelled()
+    env:
+      E2E_TESTS_RESULT: ${{ needs.e2e-tests.result }}
+      FLAKY_E2E_TESTS_RESULT: ${{ needs.flaky-e2e-tests.result }}
     steps:
-      - run: |
+      - name: Stub
+        if: ${{ needs.e2e-tests.result == 'skipped' }}
+        run: |
           echo "Didn't run due to conditional filtering"
+      - name: Test results
+        if: ${{ needs.e2e-tests.result != 'skipped' }}
+        run: | # sh
+          echo "E2E Tests: ${{ needs.e2e-tests.result }}"
+          echo "Flaky E2E Tests: ${{ needs.flaky-e2e-tests.result }}"
+
+          if [ "${{ needs.e2e-tests.result }}" != "success" ]; then
+            echo "E2E Tests failed"
+            exit 1
+          fi
 
   pr-env:
     needs: [build]

.github/workflows/flake-issue-creator.yml

@@ -1,36 +0,0 @@
-name: Flake Issue Creator
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 6 * * 1-5' # every weekday at 1am US eastern time
-
-jobs:
-  flake-issue-creator:
-    # don't run this workflow on a cron for forks
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
-    - name: Update flake issues
-      uses: actions/github-script@v7
-      env:
-        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-      with:
-        script: | # js
-          const { updateFlakeIssues } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          if (!process.env.SLACK_BOT_TOKEN) {
-            throw new Error('SLACK_BOT_TOKEN is required');
-          }
-
-          await updateFlakeIssues({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-          });

.github/workflows/flake-status.yml

@@ -1,37 +0,0 @@
-name: Flake Status Report
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 6 * * 2,5' # Tuesdays and Fridays at 1am US eastern time
-
-jobs:
-  flake-status-report:
-    # don't run this workflow on a cron for forks
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
-    - name: Post Flake Status Report
-      uses: actions/github-script@v7
-      env:
-        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-      with:
-        script: | # js
-          const { summarizeFlakes } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          if (!process.env.SLACK_BOT_TOKEN) {
-            throw new Error('SLACK_BOT_TOKEN is required');
-          }
-
-          await summarizeFlakes({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            channelName: 'engineering-ci'
-          });

.github/workflows/frontend.yml

@@ -123,3 +123,43 @@ jobs:
           m2-cache-key: "cljs"
       - name: Run frontend timezones tests
         run: yarn run test-timezones
+
+  fe-tests-result:
+    needs:
+      - fe-lint
+      - fe-type-check
+      - fe-tests-unit
+      - fe-tests-timezones
+    if: always() && !cancelled()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      needs: ${{ toJson(needs) }}
+    steps:
+      - name: Check frontend job status
+        uses: actions/github-script@v7
+        env:
+          needs: ${{ toJson(needs) }}
+        with:
+          script: | # js
+            const needs = JSON.parse(process.env.needs);
+            const jobs = Object.entries(needs).map(
+              ([jobName, jobValues]) => ({
+                name: jobName,
+                result: jobValues.result
+              }));
+
+            // are all jobs skipped or successful?
+            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
+              console.log('All jobs are skipped or successful');
+              process.exit(0);
+            }
+
+            // otherwise, something failed
+            console.log('Some frontend jobs failed');
+            jobs.forEach((job) => {
+              if (job.result !== 'success') {
+                console.log(`${job.name} - ${job.result}`);
+              }
+            });
+            process.exit(1);

.github/workflows/links.yml

@@ -0,0 +1,32 @@
+name: Links
+
+on:
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * 0"
+
+jobs:
+  linkChecker:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write # required for peter-evans/create-issue-from-file
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Link Checker
+        id: lychee
+        uses: lycheeverse/lychee-action@v2
+        with:
+          fail: false
+          args: docs --config ./.lychee/config.toml --verbose --no-progress
+          format: markdown
+
+      - name: Create Issue From File
+        if: steps.lychee.outputs.exit_code != 0
+        uses: peter-evans/create-issue-from-file@v5
+        with:
+          title: Link Checker Report
+          content-filepath: ./.lychee/out.md
+          labels: "Type:Documentation"
+          assignees: jeff-bruemmer

.github/workflows/loki-update.yml

@@ -61,9 +61,9 @@ jobs:
         with:
           github-token: ${{secrets.METABASE_AUTOMATION_USER_TOKEN}}
           script: |
-            github.issues.removeLabel({
+            github.rest.issues.removeLabel({
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
               name: 'loki-update'
-            })
+            });

.github/workflows/loki.yml

@@ -49,29 +49,16 @@ jobs:
           m2-cache-key: "cljs"
 
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: NODE_ENV=development yarn build-pure:cljs
 
       - name: Build Storybook
         # We won't be able to use Storybook play's `userEvent` with production build
         # see https://github.com/storybookjs/storybook/issues/19758
         run: NODE_ENV=development yarn build-storybook
 
-      - name: Serve Storybook
-        run: yarn http-server storybook-static -p 6006 &
-        shell: bash
-
-      - name: Wait for Storybook to become available
-        run: |
-          echo "Waiting for Storybook to be served..."
-          while ! curl --silent --fail http://localhost:6006; do
-            sleep 5
-            echo "Retrying..."
-          done
-          echo "Storybook is being served!"
-
       - name: Run Loki Visual Tests
         run: |
-          yarn test-visual:loki
+          yarn loki --requireReference --reactUri file:./storybook-static --chromeFlags='--headless --disable-gpu'
 
       - name: Generate Visual Report on Failure
         if: failure()

.github/workflows/main.yml

@@ -0,0 +1,38 @@
+name: Slack Notification for New Feature Requests
+
+on:
+  issues:
+    types:
+      - labeled
+jobs:
+  on-issue-labeled:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: |
+      contains(github.event.issue.labels.*.name, 'Type:New Feature')
+    steps:
+      - name: Setting title
+        uses: actions/github-script@v7
+        id: vars
+        with:
+          script: |
+            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
+      - name: Send the issue ${{ github.event.issue.number }} to Slack
+        id: slack
+        uses: slackapi/slack-github-action@v1.26.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "New incoming feature request: ${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_FEATURE_REQUEST_TRIAGE_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/pre-release.yml

@@ -115,7 +115,7 @@ jobs:
           name: metabase-test-${{ matrix.edition }}-uberjar
       - name: Launch uberjar (and keep it running)
         run: >-
-          java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./target/uberjar/metabase.jar &
+          java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./metabase.jar &
       - name: Wait for Metabase to start
         run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
 

.github/workflows/release-embedding-sdk.yml

@@ -1,4 +1,5 @@
 name: Release Metabase Embedding SDK for React
+run-name: Release SDK from ${{ inputs.branch }}
 
 on:
   workflow_dispatch:
@@ -11,6 +12,7 @@ on:
         options:
           - master
           - release-x.51.x
+          - release-x.52.x
 
 concurrency:
   # We want to ensure only one job is running at a time per branch because
@@ -209,12 +211,16 @@ jobs:
 
       - name: Create a PR updating readme + published version, and changelog (using GitHub Metabase Automation account)
         run: |
+          # TODO: Remove this step once github includes the new gh CLI version 2.65.0
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          brew install gh
+
           git checkout -b update-sdk-version-${{ env.sdk_version }}
           git commit -a -m 'Update Readme version references and published npm version to ${{ env.sdk_version }}'
           git push origin HEAD
           gh pr create --base ${{ inputs.branch }}\
                        --assignee "${GITHUB_ACTOR}"\
-                       --title "Update SDK version to ${{ env.sdk_version }}"\
+                       --title "docs(sdk): Update SDK version to ${{ env.sdk_version }}"\
                        --body "Update Readme version references and published npm package version to ${{ env.sdk_version }}"
         env:
           GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
@@ -254,10 +260,10 @@ jobs:
         run: |
           echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
           # Please keep the value in sync with `inputs.branch`'s release branch
-          npm publish --tag ${{fromJson('{"master": "nightly", "release-x.51.x": "51-stable"}')[inputs.branch]}}
+          npm publish --tag ${{fromJson('{"master": "nightly", "release-x.51.x": "51-stable", "release-x.52.x": "52-stable"}')[inputs.branch]}}
 
-      - name: Add `latest` tag to the latest release branch (`release-x.51.x`) deployment
-        if: ${{ inputs.branch == 'release-x.51.x' }}
+      - name: Add `latest` tag to the latest release branch (`release-x.52.x`) deployment
+        if: ${{ inputs.branch == 'release-x.52.x' }}
         working-directory: sdk
         run: |
           npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest

.github/workflows/release-log.yml

@@ -1,15 +1,21 @@
 name: Update Release Log
-run-name: Update Release Log ${{ inputs.version }}
+run-name: Update Release Log ${{ inputs.version || github.ref_name }}
 
 on:
+  push:
+    branches:
+      - release-x.*
+    tags:
+      - v*
+      - nightly-*
+      - latest-*
+      - beta-*
   workflow_dispatch:
     inputs:
       version:
         description: 'Major Metabase version (e.g. 45, 52, 68)'
         type: number
         required: true
-  schedule:
-    - cron: '45 * * * *' # hourly
   workflow_call:
     inputs:
       version:
@@ -21,11 +27,8 @@ jobs:
   update-release-log:
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    # don't run this workflow on a cron for forks
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    env:
-      VERSION: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call')
-        && inputs.version || vars.CURRENT_VERSION }}
+    # don't run this workflow for forks
+    if: ${{ github.event_name != 'push' || github.repository == 'metabase/metabase' }}
     steps:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -35,9 +38,37 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
       - uses: actions/checkout@v4
         with:
+          ref: master # this only works on master
           fetch-depth: 0 # we want all branches and tags
       - name: Install Dependencies
         run: yarn --cwd release --frozen-lockfile && npm i -g tsx
+      - name: Build release scripts
+        run: yarn --cwd release build
+      - name: Get version number
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            const {
+              getVersionFromReleaseBranch,
+              getMajorVersion,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            console.log({ context });
+
+            // if the version is explicitly set, use that
+            if (context.payload?.inputs?.version) {
+              core.exportVariable('VERSION', context.payload.inputs.version);
+              return;
+            }
+
+            // otherwise, get the version from the release branch name
+            const branch = context.payload.ref;
+            const version = getVersionFromReleaseBranch(branch);
+            const majorVersion = getMajorVersion(version);
+
+            console.log({ branch, version, majorVersion });
+            core.exportVariable('VERSION', majorVersion);
+
       - name: generate release Log
         run: cd release && tsx ./src/release-log-run.ts $VERSION > v$VERSION.html
       - name: generate release channel log

.github/workflows/release-patch.yml

@@ -9,7 +9,7 @@ on:
         type: number
         required: true
   schedule:
-    - cron: '15 0 * * 2-6' # every weekday at 7/8:15 pm Eastern Time
+    - cron: '0 21 * * 1-5' # every weekday at 4 pm EST/5 pm EDT
 
 jobs:
   auto-patch-trigger:

.github/workflows/release-tag.yml

@@ -53,6 +53,9 @@ on:
         description: Apply to OSS
         type: boolean
         default: true
+      dot-x-tag:
+        type: boolean
+        default: false
 
 jobs:
   green-check-stub:
@@ -101,21 +104,14 @@ jobs:
             oss: getCanonicalVersion(version, 'oss'),
           };
 
-          const ossReleased = await hasBeenReleased({
+          const released = await hasBeenReleased({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version: versions.oss,
           });
 
-          const eeReleased = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.ee,
-          });
-
-          if (!ossReleased || !eeReleased) {
+          if (!released) {
             throw new Error("This version has not been released yet!", version);
           }
 
@@ -281,25 +277,24 @@ jobs:
       with:
         fetch-depth: 0 # we want all branches and tags
         fetch-tags: true
-    - name: Add and push git tag
+    - name: Add and push git tag for nightly/beta/latest
+      if: ${{ !inputs.dot-x-tag }}
       run: | # sh
-
         if [[ "${{ matrix.edition }}" == "ee" ]]; then
-          git tag -f ${{ inputs.tag_name }}-ee ${{ needs.check-version.outputs.ee }}
+          git tag -f ${{ inputs.tag_name }}-ee ${{ needs.check-version.outputs.oss }}
           git push origin -f ${{ inputs.tag_name }}-ee
         elif [[ "${{ matrix.edition }}" == "oss" ]]; then
           git tag -f ${{ inputs.tag_name }}-oss ${{ needs.check-version.outputs.oss }}
           git push origin -f ${{ inputs.tag_name }}-oss
         fi
-
-  update-release-log:
-    needs: check-version
-    uses: ./.github/workflows/release-log.yml
-    with:
-      version: ${{ fromJSON(vars.CURRENT_VERSION) }} # cast string to number
-    secrets: inherit
+    - name: Add and push git tag for dot X tags
+      if: ${{ inputs.dot-x-tag && matrix.edition == 'oss' }} # we only need one git tag for dot X
+      run: | # sh
+        git tag -f ${{ inputs.tag_name }} ${{ needs.check-version.outputs.oss }}
+        git push origin tag -f ${{ inputs.tag_name }}
 
   update-version-info:
+    if: ${{ !inputs.dot-x-tag }}
     runs-on: ubuntu-22.04
     needs: check-version
     timeout-minutes: 5

.github/workflows/release.yml

@@ -88,21 +88,14 @@ jobs:
             oss: getCanonicalVersion(version, 'oss'),
           };
 
-          const ossReleased = await hasBeenReleased({
+          const released = await hasBeenReleased({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version: versions.oss,
           });
 
-          const eeReleased = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.ee,
-          });
-
-          if (ossReleased || eeReleased) {
+          if (released) {
             throw new Error("This version has already been released!", version);
           }
 
@@ -441,21 +434,7 @@ jobs:
           const { tagRelease } = require('${{ github.workspace }}/release/dist/index.cjs');
 
           const OSSversion = '${{ needs.check-version.outputs.oss }}';
-          const EEversion = '${{ needs.check-version.outputs.ee }}';
 
-          // push EE tag
-          await tagRelease({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: EEversion,
-            commitHash: '${{ inputs.commit }}',
-          }).catch((err) => {
-            console.error('Failed to tag release', EEversion, err);
-            process.exit(1);
-          });
-
-          // push OSS tag
           await tagRelease({
             github,
             owner: context.repo.owner,
@@ -466,83 +445,50 @@ jobs:
             console.error('Failed to tag release', OSSversion, err);
             process.exit(1);
           });
-    - name: Reorder release tags to put OSS first
-      run: |
-        git config user.name github-actions
-        git config user.email github-actions@github.com
-        $GITHUB_WORKSPACE/release/reorder-tags.sh ${{ needs.check-version.outputs.ee }} ${{ inputs.commit }}
 
-  trigger-docs-update:
-    if: ${{ !inputs.auto }}
-    needs:
-      - push-tags
-      - check-version
+  get-extra-tags:
+    needs: [ check-version ]
     runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    permissions:
-      contents: write
-      pull-requests: write
-    env:
-      NEW_OSS_VERSION: ${{ needs.check-version.outputs.oss }}
-      NEW_EE_VERSION: ${{ needs.check-version.outputs.ee }}
-      GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    outputs:
+      extra_tags: ${{ steps.taglist.outputs.extra_tags }}
     steps:
-      - uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          script: | # js
-            await github.rest.repos.createDispatchEvent({
-              owner: '${{ github.repository_owner }}',
-              repo: '${{ secrets.DOCS_REPO }}',
-              event_type: 'trigger-docs-update',
-              client_payload: {
-                version: '${{ inputs.version }}'
-              }
-            });
       - uses: actions/checkout@v4
         with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-      - name: update releases.md
+          sparse-checkout: release
+      - name: prepare release scripts
+        run: cd release && yarn && yarn build
+      - name: Get extra tags
+        id: taglist
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          result-encoding: string
           script: | # js
-            const fs = require('fs');
+            const { getExtraTagsForVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
 
-            const releaseText = fs.readFileSync('./docs/releases.md', 'utf8');
+            const version = '${{ inputs.version }}';
 
-            const newReleaseText = releaseText
-              .replace(
-                /## Metabase Enterprise Edition releases\n\n/,
-                `## Metabase Enterprise Edition releases\n\n- [${process.env.NEW_EE_VERSION}](https://github.com/metabase/metabase/releases/tag/${process.env.NEW_EE_VERSION})\n`
-              )
-              .replace(
-                /## Metabase Open Source Edition releases\n\n/,
-                `## Metabase Open Source Edition releases\n\n- [${process.env.NEW_OSS_VERSION}](https://github.com/metabase/metabase/releases/tag/${process.env.NEW_OSS_VERSION})\n`
-              );
+            const extra_tags = getExtraTagsForVersion({ version });
 
-            fs.writeFileSync('./docs/releases.md', newReleaseText);
+            console.log({ extra_tags });
+            core.setOutput('extra_tags', JSON.stringify(extra_tags));
 
-      - name: commit and push updates
-        run: | # bash
-          git config --global user.email "metabase-bot@metabase.com"
-          git config --global user.name "Metabase bot"
-
-          git checkout -b docs-add-$NEW_OSS_VERSION
-          cd docs/
-
-          git add releases.md
-          git commit -m "Add $NEW_OSS_VERSION to the list of releases"
-          git push origin docs-add-$NEW_OSS_VERSION --force
-
-      - name: open pr with updates
-        run: | # bash
-          gh pr create --fill \
-            --body "Like it says on the tin 😁" \
-            --label "Type:Documentation" \
-            --label "backport" \
-            --reviewer "jeff-bruemmer" \
-            --assignee "jeff-bruemmer"
+  add-extra-tags:
+    needs:
+      - get-extra-tags
+      - push-tags
+      - verify-docker-pull
+      - verify-s3-download
+    strategy:
+      matrix:
+        tag: ${{ fromJson(needs.get-extra-tags.outputs.extra_tags) }}
+    uses: ./.github/workflows/release-tag.yml
+    secrets: inherit
+    with:
+      version: ${{ inputs.version }}
+      tag_name: ${{ matrix.tag }}
+      tag_ee: ${{ contains(matrix.tag, 'v1') }}
+      tag_oss: ${{ contains(matrix.tag, 'v0') }}
+      dot-x-tag: true
 
   trigger-cloud-issues:
     if: ${{ !inputs.auto }}
@@ -590,7 +536,7 @@ jobs:
 
   draft-release-notes:
     if: ${{ !inputs.auto }}
-    needs: push-tags
+    needs: add-extra-tags
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     permissions: write-all
@@ -598,41 +544,26 @@ jobs:
       AWS_S3_DOWNLOADS_BUCKET: ${{ vars.AWS_S3_DOWNLOADS_BUCKET }}
       DOCKERHUB_OWNER: ${{ vars.DOCKERHUB_OWNER }}
       DOCKERHUB_REPO: ${{ vars.DOCKERHUB_REPO }}
-    strategy:
-      matrix:
-        edition: [oss, ee]
     steps:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: release
       - name: prepare release scripts
         run: cd release && yarn && yarn build
-      - uses: actions/download-artifact@v4
-        name: Retrieve uberjar artifact
-        with:
-          name: metabase-${{ matrix.edition }}-uberjar
-      - name: Read Checksum
-        run: |
-          CHECKSUM=$(cat SHA256.sum)
-          echo "CHECKSUM=$CHECKSUM" >> $GITHUB_ENV
       - name: Publish draft release notes
         uses: actions/github-script@v7
         with:
           result-encoding: string
-          script: |
+          script: | # js
             const { publishRelease, getCanonicalVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
 
             const version = '${{ inputs.version }}';
-            const edition = '${{ matrix.edition }}';
-
-            const canonical_version = getCanonicalVersion(version, edition);
 
             await publishRelease({
               github,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              version: canonical_version,
-              checksum: '${{ env.CHECKSUM }}',
+              version,
             }).then(() => {
               console.log('Successfully published release notes', '${{ inputs.version }}');
             }).catch((err) => {
@@ -716,7 +647,7 @@ jobs:
 
   publish-complete-message:
     runs-on: ubuntu-22.04
-    needs: set-release-channel
+    needs: [set-release-channel, add-extra-tags]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -774,11 +705,11 @@ jobs:
             owner: context.repo.owner,
             repo: context.repo.repo,
             version,
-          });
+          }).catch(console.error);
 
           await openNextMilestones({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version,
-          });
+          }).catch(console.error);

.github/workflows/rerun-workflows.yml

@@ -50,6 +50,35 @@ jobs:
               const { WebClient } = require('@slack/web-api');
               const slack = new WebClient('${{ secrets.SLACK_BOT_TOKEN }}');
 
+              // find out which jobs failed
+              const { owner, repo } = context.repo;
+
+              const jobInfo = await github.rest.actions.listJobsForWorkflowRun({
+                owner,
+                repo,
+                run_id: ${{ github.event.workflow_run.id }},
+                per_page: 100,
+              });
+
+              const failedJobs = jobInfo.data.jobs
+                .filter(job => job.status === "completed" && job.conclusion === "failure" && !job.name.includes("-tests-result"));
+
+              // don't bother slack if only the flaky job failed
+              if (failedJobs.every(job => job.name.toLowerCase().includes("flaky"))) {
+                return;
+              }
+
+              const failedJobsList = failedJobs.map(job => ({
+                "type": "rich_text_section",
+                "elements": [
+                  {
+                    "type": "link",
+                    "text": job.name,
+                    "url": job.html_url,
+                  }
+                ]
+              }));
+
               await slack.chat.postMessage({
                 channel: 'engineering-ci',
                 text: 'Failing tests',
@@ -70,9 +99,20 @@ jobs:
                       "type": "section",
                       "text": {
                         "type": "mrkdwn",
-                        "text": `Commit <https://github.com/metabase/metabase/commit/${BREAKING_COMMIT}|${BREAKING_COMMIT.slice(0,7)}> by ${AUTHOR} has failing <${FAILED_RUN_URL}|${FAILED_RUN_NAME}> tests on the <https://github.com/metabase/metabase/commits/${BRANCH}|\`${BRANCH}\`> branch. :sad-panda:`
-                      }
+                        "text": `Commit <https://github.com/metabase/metabase/commit/${BREAKING_COMMIT}|${BREAKING_COMMIT.slice(0,7)}> by ${AUTHOR} has failing <${FAILED_RUN_URL}|${FAILED_RUN_NAME}> tests on <https://github.com/${owner}/${repo}/commits/${BRANCH}|\`${BRANCH}\`>`
+                      },
                     },
+                    {
+                      "type": "rich_text",
+                      "block_id": "block1",
+                      "elements": [
+                        {
+                          "type": "rich_text_list",
+                          "style": "bullet",
+                          "elements": failedJobsList,
+                        },
+                      ],
+                    }
                   ]
                 }]
               });

.github/workflows/snyk.yml

@@ -9,7 +9,7 @@ on:
       - '**/deps.edn'
       - '**/package.json'
       - '.github/workflows/snyk.yml'
-      - '.github/scripts/write-poms.xml'
+      - '.github/scripts/write-poms.sh'
   schedule:
     - cron: '0 5 * * *'
 
@@ -35,6 +35,6 @@ jobs:
         continue-on-error: true
         run: snyk test --all-projects --sarif-file-output=snyk.sarif
       - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: snyk.sarif

.github/workflows/stale.yml

@@ -1,20 +1,25 @@
-name: 'Close Stale PRs'
+name: Close Stale PRs
 on:
   schedule:
     - cron: '00 1 * * *'
 
 permissions:
+  contents: write
   pull-requests: write
+  issues: write
 
 jobs:
   close-stale-prs:
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - uses: actions/stale@v6
+      - uses: actions/stale@v9
         with:
-          stale-pr-message: 'This pull request has had no activity for one year, it will be closed in 1 week if no further activity occurs.'
-          close-pr-message: 'This pull request was closed because it had no activity for more than one year.'
-          days-before-pr-stale: 365
-          days-before-pr-close: 7
+          stale-pr-message: 'This pull request has had no activity for 90 days, it will be closed in 2 weeks if no further activity occurs.'
+          close-pr-message: 'This pull request was closed because it had no activity for more than 90 days.'
+          days-before-issue-stale: -1 # never auto-close issues
+          days-before-pr-stale: 90
+          days-before-pr-close: 14
+          operations-per-run: 999

.github/workflows/tag-for-release.yml

@@ -83,21 +83,14 @@ jobs:
             oss: getCanonicalVersion(version, 'oss'),
           };
 
-          const ossReleased = await hasBeenReleased({
+          const released = await hasBeenReleased({
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
             version: versions.oss,
           });
 
-          const eeReleased = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.ee,
-          });
-
-          if (ossReleased || eeReleased) {
+          if (released) {
             throw new Error("This version has already been released!", version);
           }
 

.github/workflows/uberjar.yml

@@ -5,7 +5,7 @@ on:
     branches:
       - "master"
       - metabot-v3-second-try
-      - trying-java-11-default
+      - feature-visualizer
     paths-ignore:
       # config files
       - ".**"
@@ -125,9 +125,6 @@ jobs:
       if: ${{ matrix.edition == 'ee-extra' }}
       uses: ./.github/actions/build-ee-extra
       with:
-        # Build with Java 11 so they compiled code doesn't try to use Java >11 classes... see
-        # https://metaboat.slack.com/archives/C5XHN8GLW/p1731517744549619?thread_ts=1731504670.951389&cid=C5XHN8GLW
-        java-version: 17
         iam-role: ${{ secrets.METABASE_EE_EXTRA_IAM_ROLE }}
     - name: Set up Docker Buildx
       id: buildx
@@ -182,33 +179,36 @@ jobs:
 
     - name: Run Trivy vulnerability scanner if master (ee)
       if: ${{ (github.ref_name == 'master') && matrix.edition == 'ee' }}
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@0.28.0
       env:
         TRIVY_OFFLINE_SCAN: true
       with:
         image-ref: docker.io/${{ github.repository_owner }}/metabase-enterprise-head:latest
         format: sarif
         output: trivy-results.sarif
+        version: "v0.57.1"
 
     - name: Run Trivy vulnerability scanner if master (oss)
       if: ${{ (github.ref_name == 'master') && matrix.edition == 'oss' }}
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@0.28.0
       env:
         TRIVY_OFFLINE_SCAN: true
       with:
         image-ref: docker.io/${{ github.repository_owner }}/metabase-head:latest
         format: sarif
         output: trivy-results.sarif
+        version: "v0.57.1"
 
-#    - name: Run Trivy vulnerability scanner if dev branch
-#      if: ${{ !(startsWith(github.ref_name,'master') || startsWith(github.ref_name,'backport')) && matrix.edition == 'ee' }}
-#      uses: aquasecurity/trivy-action@master
-#      env:
-#        TRIVY_OFFLINE_SCAN: true
-#      with:
-#        image-ref: docker.io/${{ github.repository_owner }}/metabase-dev:${{ steps.extract_branch.outputs.branch }}
-#        format: sarif
-#        output: trivy-results.sarif
+    - name: Run Trivy vulnerability scanner if dev branch
+      if: ${{ !(startsWith(github.ref_name,'master') || startsWith(github.ref_name,'backport')) && matrix.edition == 'ee' }}
+      uses: aquasecurity/trivy-action@0.28.0
+      env:
+        TRIVY_OFFLINE_SCAN: true
+      with:
+        version: "v0.57.1"
+        image-ref: docker.io/${{ github.repository_owner }}/metabase-dev:${{ steps.extract_branch.outputs.branch }}
+        format: sarif
+        output: trivy-results.sarif
 
     - name: Upload Trivy scan results to GitHub Security tab if master (ee)
       if: ${{ (github.ref_name == 'master') && matrix.edition == 'ee' }}

.gitignore

@@ -21,6 +21,7 @@
 /*.trace.db
 /.babel_cache
 /.env
+/.envrc
 /.lein-env
 /.lein-failures
 /.lein-plugins
@@ -116,3 +117,5 @@ modules/drivers/*/.lsp/*
 
 # swc
 .swc/
+
+*storybook.log