bump

* Fix layout shift when switching tabs on the transform job page

The job Overview and Run history pages each rendered their own header:
Overview used an editable name input plus a `...` menu, while Run history
used a static title with no menu. The differing heights shifted the tab
row, so the clicked tab jumped when switching between the two.

Extract a shared JobHeader component (and a useJobHeaderState hook for the
readOnly/name-change logic) rendered identically by both pages, mirroring
the MetricHeader pattern. Run history now also shows the `...` menu and the
editable name, and Metabot is consistent across both tabs.

* Unify JobPage header logic with useJobHeaderState

JobPage duplicated the readOnly computation and name-change handler that
now live in useJobHeaderState. Source them from the hook instead; keep the
local useTransformPermissions call only for the page-level loading gate.

* Use strict undefined comparisons in job header code

Address review: job/jobId are never null, so compare with undefined
strictly and derive jobId from job.id in the JobHeader render.

.claude/commands/fix-flaky-test.md

@@ -1,264 +0,0 @@
----
-description: Diagnose and fix a flaky Cypress e2e test, then verify the fix with CI stress runs in a bounded loop
----
-
-Fix flaky e2e test: $ARGUMENTS
-
-You are orchestrating a **bounded flake-fix loop** with a real CI feedback signal. The
-only integration tool for the loop is `gh` (trigger the stress workflow + read results).
-The Linear issue is the input. Everything else is reasoning over files.
-
-**Hard rules — do not deviate:**
-- **Max 3 attempts.** One attempt = diagnose → fix → push → 2 stress runs → interpret.
-  After 3 failed attempts, stop and hand back.
-- **Branch existence is the go/no-go gate.** Before starting, check whether the remote branch
-  `automated-e2e-flake-fix-<TEAM_SLUG>-<ISSUE_NUMBER>` already exists (Phase 0). If it does, a run
-  is already in flight (or already landed a fix) → **stop, do nothing**. If it doesn't,
-  proceed through the whole loop and push without pausing for confirmation. This runs
-  identically whether a human or automation triggered the command.
-- **Linear access:** prefer the Linear MCP (`mcp__linear__*`); if it's unavailable (e.g.
-  headless CI), fall back to the Linear REST/GraphQL API with a token — for both reads and
-  comment writes.
-- **Each attempt triggers TWO stress runs in parallel** — `enable_network_throttling=true`
-  and `=false` — on the same branch/commit. The fix is verified only if **both** pass.
-- **CI is the source of truth.** No local Cypress runs, no `bin/` stress scripts.
-- **Branch names use `-` only, never `/`.**
-- **Persist state** to a scratch file so the loop survives `ScheduleWakeup` and context
-  summarization.
-
----
-
-## Phase 0 — Resolve the target
-
-1. Parse `$ARGUMENTS`:
-   - If it's a Linear ref (`DEV-####` or a Linear URL) → `mcp__linear__get_issue`. Trunk
-     titles these `Quarantined Test: <suite> > <test name>`. Extract the **exact test
-     name** (the part after `> ` — this is the grep string) and the **suite**. Read the
-     body for failure detail / screenshots / stack, and capture the **ranked failure
-     reasons** (Trunk lists them "most common" first) — #1 is what you fix first (Phase 1).
-   - Otherwise treat it as a spec path or fuzzy test name (fallback; no Linear context).
-2. **Compute the branch name + dedup gate (this is the go decision).** The branch name is
-   derived **only** from the Linear ref, never the test name:
-   `automated-e2e-flake-fix-<TEAM_SLUG>-<ISSUE_NUMBER>` (e.g. `DEV-2181` →
-   `automated-e2e-flake-fix-DEV-2181`). Check whether it already exists on the remote:
-   ```bash
-   git ls-remote --exit-code --heads origin automated-e2e-flake-fix-<TEAM_SLUG>-<ISSUE_NUMBER>
-   ```
-   - **Exists (exit 0)** → a run is already in flight or already landed a fix → **stop, do
-     nothing.** This is the whole dedup mechanism.
-   - **Doesn't exist (exit 2)** → that's the **go** signal. Proceed without pausing for
-     confirmation.
-   (On the no-Linear fallback path there's no ref to build the name from; that path stays
-   interactive and is for local debugging only.)
-3. **Resolve the spec file** from the exact test name:
-   ```bash
-   grep -rl "<exact test name>" e2e/test/scenarios
-   ```
-   Require **exactly one** match. If 0 or >1, stop and ask the user to disambiguate. (Try
-   a shorter unique substring of the test name if the literal has special characters.)
-4. **Decide `qa_db`:** scan the spec / its `describe` for external-DB helpers
-   (postgres/mysql/mongo-writable) or an `@external` tag → `true`, else `false`.
-5. **Write the state file** `local/claude/e2e-flake-fix/<TEAM_SLUG>-<ISSUE_NUMBER>.md`:
-   ```markdown
-   # Flake fix: <test name>
-   - linear: <DEV-#### or n/a>
-   - spec: <spec path>
-   - test_name (grep): <exact test name>
-   - qa_db: <true|false>
-   - edition: ee
-   - branch: automated-e2e-flake-fix-<TEAM_SLUG>-<ISSUE_NUMBER>
-   - attempt: 0 / 3
-
-   ## Failure reasons (Trunk, ranked — fix #1 first)
-   1. <dominant / most common>
-   2. <rarer>
-   ...
-
-   ## Attempts
-   ```
-   This file is the durable record. Re-read it on every `ScheduleWakeup` wake.
-
-## Phase 1 — Diagnose (run at the start of every attempt)
-
-- **Anchor on the #1 / most-common failure reason first.** Trunk lists the issue's failure
-  reasons ranked by frequency ("The N most common failure reasons…"). Fix the **dominant**
-  one and ignore the rarer reasons (#2, #3, …) unless the dominant one is fixed and they
-  still surface in CI. Do **not** rabbit-hole on a lower-frequency reason — that is the most
-  common way this loop wastes its 3 attempts. (Capture the ranked reasons in the state file
-  during Phase 0 so each attempt re-grounds on #1.)
-- Read the spec, focused on the failing test, its `describe`, and any `before*`/`after*`
-  hooks. Read shared helpers it calls.
-- Apply the flake anti-pattern checklist (from the `e2e-test-review` skill, as a mental
-  model — don't invoke it):
-  - numeric `cy.wait(<ms>)` instead of waiting on an alias
-  - `cy.intercept` registered **after** the action that triggers the request
-  - `.should("not.exist")` / negative assertions without a positive anchor first
-  - unscoped text selectors that can match more than one element
-  - off-by-one `.last()` / `.eq(-1)` without a length assertion
-  - JS conditionals on `cy` chains (no retry semantics)
-  - shared state / ordering assumptions between tests
-- Fold in any failure detail from the Linear issue (and, on attempts 2–3, the downloaded
-  CI artifacts from the previous attempt).
-- Write a **concrete hypothesis** to the state file's Attempts log before editing code.
-
-## Phase 2 — Fix on a branch
-
-- On **attempt 1 only**, create the branch computed in Phase 0 (dashes only, no `/`):
-  ```bash
-  git switch -c automated-e2e-flake-fix-<TEAM_SLUG>-<ISSUE_NUMBER>
-  ```
-  On later attempts, keep committing to the same branch.
-- Apply a **minimal** fix:
-  - **Default:** test-scoped (deterministic waits via `cy.intercept` + `cy.wait("@alias")`
-    before asserting; positive anchor before a negative assertion; scoped selectors).
-  - **Source code is allowed** only when you have **high conviction** the root cause is a
-    real product defect the test merely surfaces (e.g. a genuine race or non-deterministic
-    ordering). When you do, write the evidence for that conviction in the state file and
-    keep the **blast radius minimal**.
-
-## Phase 2.5 — Share the diagnosis on Linear (offer before pushing)
-
-- Once you have a confirmed root cause and a fix in hand, **before** the push/CI gate,
-  offer to post the **debugging story** as a comment on the Linear issue. Draft it and
-  show it to the user; post via `mcp__linear__save_comment` only if they accept (let them
-  edit first). Keep it a tight narrative: the observed failure, the root cause (why the
-  request never fires), and the fix. Skip silently if there's no Linear issue (spec/test
-  fallback path).
-- This is a separate, earlier offer from the Phase 5 PR/closeout comment — the value here
-  is capturing the *why* while it's fresh, independent of whether CI later confirms.
-
-## Phase 3 — Push + stress (burn_in=50, fail_fast=true)
-
-**One run, `fail_fast=true`, does both jobs.** A bad fix fails on the **first** iteration
-and stops immediately (fast red + artifacts) — no need for a separate cheap sanity stage.
-A good fix runs all 50 to green (full confirmation). So every attempt is a single pair of
-runs at `burn_in=50` with `fail_fast=true` (throttle on + off).
-
-- **Push without pausing for confirmation.** The branch-existence check in Phase 0 was the
-  go decision; if you reached this phase you're clear to commit, push, and trigger (same for
-  a human or automated trigger).
-- Commit and push (first attempt only creates the branch; later attempts push the revised
-  fix), then trigger.
-
-- **Decide `build_jar` (cumulative across the branch, not per-attempt).** With
-  `build_jar=false` the run downloads a prebuilt uberjar by walking the current commit's
-  ancestors; with `build_jar=true` it builds the uberjar from this branch, so the JAR is
-  guaranteed to match your source. Rule:
-  - If **every** commit on the branch (vs. the base) touches **only** test/spec code →
-    `build_jar=false`. There is no source change for a JAR to miss, so a download is correct
-    and saves the build time.
-  - If **any** commit on the branch changed backend or frontend source — whether this attempt
-    made it or an earlier one did → `build_jar=true`, and keep it `true` on every later run
-    (including a test-only attempt 2). We build defensively: it may be redundant if a matching
-    branch JAR already exists, but it removes any doubt that the stress run tested your actual
-    source. A redundant build is far cheaper than a hard-to-debug false green from a JAR that
-    silently didn't include the fix.
-  - Check with `git diff --name-only <base>...HEAD` and treat anything outside test paths
-    (`e2e/`, `**/*_test.clj`, `**.unit.*`, etc.) as source. Record the chosen value in the
-    state file.
-
-### Trigger helper
-**Always `git push` and confirm the remote branch is at your new commit BEFORE triggering.**
-`gh workflow run --ref <branch>` resolves the ref on GitHub's side at dispatch time, so a
-trigger that races an in-flight push will run the *previous* commit. After triggering,
-verify with `gh run view <id> --json headSha` and re-trigger if it's stale.
-```bash
-git add -A && git commit -m "Fix flaky test: <test name>"
-git push -u origin <branch>          # PUSH FIRST — then trigger
-TRIGGERED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-for throttle in true false; do
-  gh workflow run e2e-stress-test-flake-fix.yml --ref <branch> \
-    -f spec="<spec path>" \
-    -f grep="<exact test name>" \
-    -f burn_in="50" \
-    -f mb_edition="ee" \
-    -f qa_db="<true|false>" \
-    -f build_jar="<true|false>" \
-    -f enable_network_throttling="$throttle" \
-    -f fail_fast="true"
-done
-```
-- **Capture both run IDs**, then **verify each `headSha` matches your pushed commit**:
-  ```bash
-  gh run list --workflow=e2e-stress-test-flake-fix.yml --branch <branch> \
-    --json databaseId,status,createdAt,event,headSha --limit 10
-  ```
-  Save both run IDs + URLs to the state file, tagged `throttled` / `unthrottled`.
-
-## Phase 4 — Wait + interpret (gh only)
-
-- **Auto-poll** with `ScheduleWakeup` (~900s / 15 min cadence) until **both** runs leave
-  `queued`/`in_progress`. Pass the same `/fix-flaky-test $ARGUMENTS`
-  back so the loop resumes; re-read the state file on each wake (a manual wake must also
-  work). Don't poll faster than ~900s.
-- When both finish, read each conclusion:
-  ```bash
-  gh run view <id> --json status,conclusion
-  ```
-  - **Either `cancelled`** → assume a **human cancelled** it. Stop the whole task
-    immediately — do **not** retry, do **not** open a PR. Note it in the state file and
-    hand back. (A `cancelled` conclusion means manual cancellation; a `timed_out`
-    conclusion does **not** — treat `timed_out` like a failure below.)
-  - **Either `failure` / `timed_out`** → fix is not holding (`fail_fast` stopped at the
-    first bad iteration, so the artifact is fresh and minimal):
-    ```bash
-    gh run download <failed-id> --dir local/claude/e2e-flake-fix/<failed-id>-artifacts
-    ```
-    The Cypress error lives in the GitHub step log (`gh run view <id> --log-failed`) and the
-    screenshots/video — **not** in `logs/test.log` (that's only the backend health log).
-    Read the failure screenshot(s) (vision) and the step-log error; append findings to the
-    state file; increment `attempt`. If `attempt < 3` → loop back to **Phase 1** with the
-    new evidence. If `attempt == 3` → Phase 5 (exhausted).
-  - **Both `success`** (all 50 iterations passed, both throttle modes) → fixed → Phase 5.
-- Don't worry about CI cost.
-
-## Phase 5 — Conclude
-
-- **Fixed** — open a PR (the upfront OK already authorized the push; don't re-gate):
-  ```bash
-  gh pr create --title "Fix flaky test: <test name>" --body "<body>"
-  ```
-  **The PR can NEVER auto-merge** — it always requires at least one human approval, no
-  matter how green the stress runs are, and never enable auto-merge. A passing stress run is
-  *necessary but not sufficient*: it proves the test is stable, not that the root cause was
-  fixed rather than masked. The human owns the merge decision.
-  The PR description **must follow this exact order**: (1) the **first line is ALWAYS
-  `Resolves <DEV-####>`**, then (2) the root cause / fix / stress-test sections. The PR body
-  **must always include both stress-test runs** as links with their pass results:
-  ```markdown
-  Resolves <DEV-####>
-
-  ## Root cause
-  <one paragraph>
-
-  ## Fix
-  <what changed and why; note if source code was touched and the blast radius>
-
-  ## Stress test (burn_in=50, single test via grep)
-  - ✅ network throttling ON:  <run URL>
-  - ✅ network throttling OFF: <run URL>
-  ```
-  That `Resolves <ID>` reference (in the **PR description only — NEVER in a commit message
-  or body**, which would reopen the issue) closes the Linear issue **on merge**, via
-  Linear's GitHub integration. **NEVER close the Linear issue or change its status yourself**
-  (no status edits via the Linear MCP — only comments). Linear moves it to *In Progress* when
-  the PR links and to *Done* when the PR merges. Comment the outcome on the issue (link the
-  PR), and leave a copy-pasteable summary inline AND in `local/claude/`.
-- **Exhausted (3 attempts)** — do **not** guess further. Report each hypothesis tried, the
-  fixes attempted, all 6 stress-run links, and where the artifacts are. Hand back for human
-  judgment.
-
-- **Always — attach the run log to Linear (regardless of outcome).** As the final step on
-  both the fixed and exhausted paths, post the full state file
-  `local/claude/e2e-flake-fix/<TEAM_SLUG>-<ISSUE_NUMBER>.md` to the Linear issue as a comment titled
-  **"🤖 Flake-fix run log (audit trail)"** (fence it so it renders verbatim). This is the
-  end-to-end audit trail — every hypothesis, fix, commit, run URL, and verdict — kept for a
-  human reviewer and as a learning artifact even when the fix didn't land. Skip only on the
-  no-Linear fallback path.
-  - **Lead the comment with a run-cost line** (above the fenced log):
-    **total wall-clock time spent** on the run and **total tokens used** — e.g.
-    `⏱ 2h 14m · 🪙 1.8M tokens (N attempts)`. Compute time from the first state-file
-    timestamp to now; report tokens for the whole session (best available figure). This makes
-    the cost of each automated run visible at a glance on the issue. (Posting the markdown as a comment is sufficient; a file
-  attachment via `mcp__linear__create_attachment_from_upload` is optional if the user wants
-  a downloadable file.)

.claude/skills/clojure-write/SKILL.md

@@ -102,3 +102,7 @@ breakage keeps happening, *that* is the signal a comment was warranted.
 - End all files with a newline
 - When editing tabular code, where the columns line up, try to keep them aligned
 - Spaces on a line with nothing after it is not allowed
+- After changing module boundaries (adding/removing/renaming a `src` namespace, a cross-module `require`
+  or `:model/X` reference, or a new module), run `./bin/mage fix-modules-config` to regenerate
+  `.clj-kondo/config/modules/config.edn` and keep `metabase.core.modules-test` green. No-op when nothing
+  drifted; see "Module Boundaries" in the project `CLAUDE.md`.

.claude/skills/e2e-test-review/SKILL.md

@@ -22,10 +22,11 @@ Before starting, determine which mode to use:
 3. **(Conditional)** If after reading the spec a specific assertion or selector is **ambiguous** — you can't tell if it's the right anchor, or whether the test actually verifies what its title claims — briefly grep the related component for the test ID / role / text. **Don't read components by default.** Only do this when there's a real signal of confusion in the spec.
 4. Scan against the checklist + pattern table below.
 5. Number all issues sequentially. Skip nits — only flag what's worth fixing.
+6. **Always** finish with the honest e2e-vs-unit breakdown (see the section of that name below). It's part of every report, not an optional add-on.
 
 ### When to hand off instead of review
 
-If the spec references an issue (`metabase#NNNNN`) and the user wants to **fix** flakiness or assess whether the test still reproduces the original bug, that's outside the review skill's scope. Point them at `/fix-flakey-test` (or the dedicated flake-fixing workflow), which knows to fetch the issue and the resolving PR's diff. The review skill stays focused on "is this test well-written and conformant" — it doesn't fetch external issue context by default.
+If the spec references an issue (`metabase#NNNNN`) and the user wants to **fix** flakiness or assess whether the test still reproduces the original bug, that's outside the review skill's scope. Point them at the dedicated flake-fixing workflow, which knows to fetch the issue and the resolving PR's diff. The review skill stays focused on "is this test well-written and conformant" — it doesn't fetch external issue context by default.
 
 ## Review checklist
 
@@ -194,8 +195,41 @@ Use the pending review workflow:
 
 Each comment body starts with `**Issue N: [Brief title]**`.
 
+## Honest e2e-vs-unit breakdown (always include)
+
+Every report ends with this section. The numbered issues above are about whether the test is *well-written*; this section is about whether it should be an **e2e test at all**. They're orthogonal — a flawless spec can still be paying e2e prices for component-test value, and that's worth saying out loud.
+
+The bar is simple: **an `it()` earns its place in e2e only if it exercises a layer you cannot fake without gutting the test's value.** In this codebase that means one or more of:
+
+- a **real backend query against seeded data** (the assertion depends on the server actually filtering/sorting/bucketing rows, not on a mocked response);
+- **real rendering you then interact with** — clicking a charted ECharts SVG element at computed coordinates, drag/hit-testing, drill-through;
+- **routing across screens** — navigation, URL param round-trips that the backend then honors, browser back/forward;
+- **cross-screen traversal** — list → detail → back, where the value is the seam between screens.
+
+Conversely, a test belongs in **Jest + RTL** (the cheaper layer this repo already uses for component/unit coverage) when its real subject is frontend-only:
+
+- **pure frontend logic** — a bucketing/formatting/derivation decision (e.g. "single-day range → bucket by hour") that has one right answer independent of the backend;
+- **render assertions** — "the page mounts N titled cards and an SVG exists." A mocked dataset response + RTL verifies the titles; that an ECharts SVG renders is library behavior, not your logic;
+- **state/wiring** — tab → `aria-selected` → active-state, or select → querystring mapping. The *URL gets the param* half is component-level; only the *backend honors the param* half needs e2e.
+
+Write the breakdown in three honest buckets. Ground each call in **which layers the test actually touches**, not in how the test is named:
+
+1. **Genuinely must-be-e2e (keep)** — load-bearing. Name the layer(s) only a browser + backend can verify together.
+2. **Defensible-but-narrowable e2e** — justified as integration, but over-split or doing more boots than the coverage requires. Say what to merge.
+3. **Should be unit / component tests** — where the real savings are. Name the cheaper layer and what it would assert (often *more precisely* than the e2e test does indirectly).
+
+Then a one-paragraph **bottom line**: what to keep as e2e, what to push down, and — if you pulled CI timing from `e2e/support/timings.json` for the Performance check — roughly how much of that wall time is *earned* by the must-be-e2e set versus paid by the rest.
+
+Rules of engagement so this stays honest, not performative:
+
+- **Don't inflate the keep bucket to look balanced.** If most of the spec is component-test value paying e2e prices, say exactly that. If every test is load-bearing, say that too — a spec where all 12 tests must be e2e is a legitimate outcome, not a failure to find candidates.
+- **Be specific.** Cite the `it()` titles and line ranges. "Several tests could be unit tests" is useless; "tests 1/17/18 assert only that N titled cards mount — RTL with a mocked dataset" is actionable.
+- **This is advice to the author, not a blocking issue.** It's a recommendation, separate from the numbered issues. Don't renumber it into the issue list.
+- **Stay rooted in what exists.** The cheaper layer here is Jest + RTL component/unit tests. Don't invent infrastructure the repo doesn't have, and don't recommend deleting backend-dependent coverage just because part of the test is frontend-only — split it, keep the integration half.
+
 ## Final check
 
 1. Trim issues that won't materially help the author.
 2. Verify sequential numbering with no gaps.
 3. In PR mode, verify each issue was posted as a separate review comment.
+4. Verify the honest e2e-vs-unit breakdown is present — it's required in every report, even when the answer is "all of these need to be e2e."

.claude/skills/emotion-migrate/SKILL.md

@@ -21,7 +21,7 @@ For EACH styled component, go through every CSS property and ask: "Can this be a
 
 - `display` → `display` prop
 - `color` → `c` prop (`c="core-brand"`, `c="text-primary"`)
-- `background-color` → `bg` prop (`bg="background-primary"`)
+- `background-color` → `bg` prop (`bg="background_page-primary"`)
 - `font-size` → `fz` prop (`fz="md"`)
 - `font-weight` → `fw` prop (`fw="bold"`)
 - `line-height` → `lh` prop (`lh="md"`)
@@ -57,7 +57,7 @@ For EACH styled component, go through every CSS property and ask: "Can this be a
   align="center"            /* style prop */
   gap="sm"                  /* style prop */
   p="md"                    /* style prop */
-  bg="background-primary"   /* style prop */
+  bg="background_page-primary"   /* style prop */
 >
 ```
 
@@ -170,9 +170,9 @@ Create `ComponentName.module.css` alongside the component file:
 ```css
 /* Use design system tokens — NEVER raw color/spacing values */
 .root {
-  border: 1px solid var(--mb-color-border);
+  border: 1px solid var(--mb-color-border-neutral);
   border-radius: var(--mantine-radius-md);
-  background-color: var(--mb-color-background-primary);
+  background-color: var(--mb-color-background_page-primary);
 }
 
 /* Conditional states as separate classes, combined with cx() */
@@ -182,7 +182,7 @@ Create `ComponentName.module.css` alongside the component file:
 }
 
 .disabled {
-  color: var(--mb-color-text-tertiary);
+  color: var(--mb-color-text-disabled);
   pointer-events: none;
 }
 
@@ -192,7 +192,7 @@ Create `ComponentName.module.css` alongside the component file:
 
   &:hover {
     color: var(--mb-color-core-brand);
-    background-color: var(--mb-color-background-hover);
+    background-color: var(--mb-color-background_surface-hover);
   }
 }
 
@@ -255,9 +255,9 @@ Remove the old styled file entirely. Remove all imports of it from other files.
 
 **Colors** (`c`, `bg`):
 
-- Text: `"text-primary"`, `"text-secondary"`, `"text-tertiary"`
-- Background: `"background-primary"`, `"background-secondary"`, `"background-hover"`
-- Brand: `"core-brand"`, `"error"`, `"success"`, `"warning"`
+- Text: `"text-primary"`, `"text-secondary"`, `"text-disabled"`
+- Background: `"background_page-primary"`, `"background_page-secondary"`, `"background_surface-hover"`
+- Brand: `"core-brand"`, `"feedback-negative"`, `"feedback-positive"`, `"feedback-warning"`
 
 **Typography** (`fz`, `fw`, `lh`, `ta`, `ff`):
 
@@ -279,11 +279,11 @@ Remove the old styled file entirely. Remove all imports of it from other files.
 
 **Colors** — `var(--mb-color-<name>)`:
 
-- `--mb-color-text-primary`, `--mb-color-text-secondary`, `--mb-color-text-tertiary`
-- `--mb-color-background-primary`, `--mb-color-background-secondary`, `--mb-color-background-hover`
+- `--mb-color-text-primary`, `--mb-color-text-secondary`, `--mb-color-text-disabled`
+- `--mb-color-background_page-primary`, `--mb-color-background_page-secondary`, `--mb-color-background_surface-hover`
 - `--mb-color-border`, `--mb-color-border-strong`, `--mb-color-border-subtle`
 - `--mb-color-core-brand`, `--mb-color-core-brand-hover`
-- `--mb-color-error`, `--mb-color-success`, `--mb-color-warning`
+- `--mb-color-feedback-negative`, `--mb-color-feedback-positive`, `--mb-color-feedback-warning`
 - `--mb-color-shadow`, `--mb-color-focus`
 - `--mb-color-accent0` through `--mb-color-accent7`
 
@@ -398,7 +398,7 @@ export const Wrapper = styled.div`
 ```tsx
 export const Item = styled.div<{ isSelected: boolean; disabled: boolean }>`
   color: ${(props) =>
-    props.disabled ? color("text-tertiary") : color("text-primary")};
+    props.disabled ? color("text-disabled") : color("text-primary")};
   background-color: ${(props) =>
     props.isSelected ? color("core-brand") : "transparent"};
   cursor: ${(props) => (props.disabled ? "default" : "pointer")};
@@ -427,11 +427,11 @@ export const Item = styled.div<{ isSelected: boolean; disabled: boolean }>`
 }
 
 .disabled {
-  color: var(--mb-color-text-tertiary);
+  color: var(--mb-color-text-disabled);
   cursor: default;
 
   &:hover {
-    color: var(--mb-color-text-tertiary);
+    color: var(--mb-color-text-disabled);
   }
 }
 ```
@@ -574,7 +574,7 @@ export const Spinner = styled.div`
 | -------------------------- | ----------------------------------------------------------------- | ------------------------------------- |
 | `color("core-brand")`      | `var(--mb-color-core-brand)`                                      | `c="core-brand"` or `bg="core-brand"` |
 | `color("text-primary")`    | `var(--mb-color-text-primary)`                                    | `c="text-primary"`                    |
-| `color("border")`          | `var(--mb-color-border)`                                          | N/A (use CSS module)                  |
+| `color("border-neutral")`          | `var(--mb-color-border-neutral)`                                          | N/A (use CSS module)                  |
 | `alpha("core-brand", 0.2)` | `color-mix(in srgb, var(--mb-color-core-brand), transparent 80%)` | N/A (use CSS module)                  |
 
 ### Pattern 7: Responsive Spacing/Sizing → Responsive Style Props (NOT CSS Media Queries)

.clj-kondo/config.edn

@@ -179,14 +179,26 @@
      clojure.core.async/take!
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
+     metabase.ai-tracing.core/record!
      metabase.api.macros.defendpoint.tools-manifest/assert-optional-fields-nullable!
      metabase.channel.core/send!
+     metabase.channel.render.pdf/draw-too-large!
+     metabase.channel.render.pdf/draw-no-results!
+     metabase.channel.render.pdf/render-card-cell!
+     metabase.channel.render.pdf.font/load-fonts!
      metabase.warehouses.models.database/assert-not-h2!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
+     metabase.mcp.usage/record-mcp-session!
+     metabase.mcp.usage/record-mcp-session-end!
+     metabase.mcp.usage/record-mcp-tool-call!
      metabase.notification.models/create-notification!
      metabase.oauth-server.core/reset-provider!
      metabase.pulse.send/send-pulse!
      metabase-enterprise.transforms-python.python-runner-test/execute!
+     ;; MCP usage tests isolate their rows by unique keys (session id / tool name / duration /
+     ;; client version) and clean up only those, so these deletes are safe in parallel.
+     metabase-enterprise.mcp.usage-test/cleanup!
+     metabase-enterprise.mcp.usage-test/cleanup-calls!
      ;; Workspace isolation functions are safe in parallel tests because they operate on
      ;; isolated, test-specific workspaces and databases that don't affect other tests
      metabase-enterprise.workspaces.isolation/destroy-workspace-isolation!
@@ -248,9 +260,6 @@
   ;; misc config for built-in linters
   ;;
 
-  :invalid-arity       {:skip-args [metabase.util.match/match-one
-                                    metabase.util.match/match-many
-                                    metabase.util.match/replace]}                    ; TODO (cam): can we fix these?
   :refer-all           {:level :warning, :exclude [clojure.test]}
   :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
@@ -444,6 +453,10 @@
   instaparse.core/defparser                                                             clojure.core/def
   metabase-enterprise.action-v2.test-util/with-test-tables!                             clojure.core/let
   metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
+  metabase-enterprise.entity-retrieval.reconcile-test/with-isolated-index                 clojure.core/fn
+  metabase-enterprise.mfa.enrollment-flow-test/with-fresh-user-session!                  clojure.core/fn
+  metabase-enterprise.mfa.login-flow-test/with-enrolled-rasta!                           clojure.core/fn
+  metabase-enterprise.mfa.recovery-codes-test/with-confirmed-enrollment!                 clojure.core/fn
   metabase-enterprise.serialization.metadata-file-import.wire-format-test/with-tiny-fixture! clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
@@ -460,6 +473,7 @@
   metabase.channel.impl.http-test/with-captured-http-requests                           clojure.core/fn
   metabase.channel.impl.http-test/with-server                                           clojure.core/let
   metabase.collections.models.collection-test/with-collection-in-location               clojure.core/let
+  metabase.collections.test-utils/with-library                                          clojure.core/fn
   metabase.driver.mongo.connection/with-mongo-client                                    clojure.core/let
   metabase.driver.mongo.connection/with-mongo-database                                  clojure.core/let
   metabase.driver.mongo.query-processor/mongo-let                                       clojure.core/let
@@ -473,6 +487,7 @@
   metabase.notification.test-util/with-card-notification                                clojure.core/let
   metabase.notification.test-util/with-system-event-notification!                       clojure.core/let
   metabase.notification.test-util/with-temp-notification                                clojure.core/let
+  metabase.osi.ai-context.api-test/with-test-entry                                      clojure.core/let
   metabase.premium-features.core/defenterprise-schema                                   clj-kondo.lint-as/def-catch-all
   metabase.premium-features.defenterprise/defenterprise-schema                          clj-kondo.lint-as/def-catch-all
   metabase.premium-features.settings/define-premium-feature                             clojure.core/def
@@ -574,7 +589,7 @@
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
    metabase.api.macros/defendpoint                                                                                           hooks.metabase.api.macros/defendpoint
    metabase.app-db.schema-migrations-test.impl/test-migrations                                                               hooks.metabase.app-db.schema-migrations-test.impl/test-migrations
-   metabase.channel.render.js.svg/with-static-viz-context                                                                    hooks.common/with-one-top-level-binding
+   metabase.channel.render.js.pool/with-static-viz-context                                                                   hooks.common/with-one-top-level-binding
    metabase.channel.template.handlebars-helper/defhelper                                                                     hooks.metabase.channel.template.handlebars-helper/defhelper
    metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
    metabase.classloader.core/require                                                                                         hooks.clojure.core.require/lint-require
@@ -610,6 +625,9 @@
    metabase.model-persistence.api-test/with-persistence-setup!                                                               hooks.common/with-one-top-level-binding
    metabase.model-persistence.api-test/with-setup!                                                                           hooks.common/with-one-top-level-binding
    metabase.model-persistence.test-util/with-persistence-enabled!                                                            hooks.metabase.model-persistence.test-util/with-persistence-enabled!
+   metabase.mq.core/with-queue                                                                                               hooks.common/let-second
+   metabase.mq.test-util/with-test-mq                                                                                        hooks.common/with-one-binding
+   metabase.mq.core/def-listener!                                                                                            hooks.metabase.mq.impl/def-listener
    metabase.models.interface/define-batched-hydration-method                                                                 hooks.metabase.models.interface/define-hydration-method
    metabase.models.interface/define-simple-hydration-method                                                                  hooks.metabase.models.interface/define-hydration-method
    metabase.permissions.core/allow-changing-all-users-group-members                                                          hooks.common/do*
@@ -701,6 +719,10 @@
    metabase.util.log/warn                                                                                                    hooks.metabase.util.log/info
    metabase.util.log/warnf                                                                                                   hooks.metabase.util.log/infof
    metabase.util.malli.registry/def                                                                                          hooks.metabase.util.malli.registry/def
+   metabase.util.match/match-one                                                                                             hooks.metabase.util.match/match-one
+   metabase.util.match/match-many                                                                                            hooks.metabase.util.match/match-many
+   metabase.util.match/replace                                                                                               hooks.metabase.util.match/replace
+   metabase.util.match/replace-in                                                                                            hooks.metabase.util.match/replace-in
    metabase.util/case-enum                                                                                                   hooks.metabase.util/case-enum
    metabase.util/format-color                                                                                                hooks.metabase.util/format-color
    metabase.xrays.api.automagic-dashboards-test/with-indexed-model!                                                          hooks.metabase.xrays.api.automagic-dashboards-test/with-indexed-model!
@@ -744,6 +766,7 @@
    metabase.test/with-temporary-raw-setting-values                                              macros.metabase.test.util/with-temporary-raw-setting-values
    metabase.users.models.user-test/with-groups!                                                 macros.metabase.users.models.user-test/with-groups!
    metabase.util.namespaces/import-fn                                                           macros.metabase.util.namespaces/import-fn
+   metabase.util.namespaces/import-macro                                                        macros.metabase.util.namespaces/import-macro
    metabase.xrays.related-test/with-world                                                       macros.metabase.xrays.related-test/with-world}}
 
  :config-in-comment
@@ -801,7 +824,6 @@
   ;;
   {:pattern "^metabase(?:((?:-enterprise\\.sandbox)?\\.query-processor)|(?:\\.driver\\.sql(?!server)(?!ite))).*-test$"
    :name    general-qp-and-driver-test-namespaces}
-
   {:pattern "(?:^mage.*)"
    :name    mage-namespaces}]
 

.clj-kondo/config/modules/config.edn

@@ -159,7 +159,8 @@
   {:team    "Metabot"
    :api     #{metabase.agent-api.api
               metabase.agent-api.init}
-   :uses    #{api
+   :uses    #{ai-tracing
+              api
               auth-identity
               channel
               collections
@@ -180,6 +181,8 @@
                     :model/Collection
                     :model/Dashboard
                     :model/DashboardCard
+                    :model/DashboardTab
+                    :model/Database
                     :model/Table
                     :model/User}}
 
@@ -192,6 +195,15 @@
            models
            util}}
 
+  ai-tracing
+  {:team "Metabot"
+   :api  #{metabase.ai-tracing.api
+           metabase.ai-tracing.core
+           metabase.ai-tracing.init}
+   :uses #{api
+           settings
+           util}}
+
   analytics
   {:team "UX West"
    :api  #{metabase.analytics.api
@@ -357,6 +369,7 @@
   {:team "UX West"
    :api  #{metabase.audit-app.core
            metabase.audit-app.init}
+   :friends #{enterprise/memoize-monitor}
    :uses #{api
            app-db
            events
@@ -504,6 +517,7 @@
            pivot
            premium-features
            query-processor
+           request
            settings
            slackbot
            system
@@ -514,6 +528,8 @@
            util}
    :model-exports #{:model/Channel :model/ChannelTemplate}
    :model-imports #{:model/Dashboard
+                    :model/DashboardCard
+                    :model/DashboardTab
                     :model/Database
                     :model/PulseChannel
                     :model/User}}
@@ -569,6 +585,7 @@
   collections
   {:team "UX West"
    :api  #{metabase.collections.core
+           metabase.collections.curation
            metabase.collections.models.collection
            metabase.collections.models.collection.root
            metabase.collections.schema}
@@ -697,6 +714,7 @@
            audit-app
            collections
            config
+           embedding
            events
            lib
            models
@@ -707,6 +725,7 @@
            query-processor
            search
            settings
+           staleness
            sync
            util}
    :model-exports #{:model/Dashboard
@@ -821,7 +840,6 @@
            metabase.driver.common
            metabase.driver.connection
            metabase.driver.ddl.interface
-           metabase.driver.h2
            metabase.driver.impl
            metabase.driver.init
            metabase.driver.mysql
@@ -956,7 +974,14 @@
            request
            tiles
            util}
-   :model-imports #{:model/Card :model/Dashboard :model/EmbeddingTheme}}
+   :model-imports #{:model/Card :model/Dashboard :model/DashboardCard :model/EmbeddingTheme}}
+
+  entity-retrieval
+  {:team "Metabot"
+   :api  #{metabase.entity-retrieval.core
+           metabase.entity-retrieval.mirror}
+   :uses #{premium-features}
+   :model-imports #{:model/OsiAiContext}}
 
   events
   {:team "DevEx"
@@ -1050,6 +1075,27 @@
    :model-exports #{:model/ModelIndex :model/ModelIndexValue}
    :model-imports #{:model/Card :model/Collection}}
 
+  indexes
+  {:team "Gadget"
+   :api  #{metabase.indexes.models.table-index
+           metabase.indexes.reconcile
+           metabase.indexes.schema}
+   :uses #{driver
+           models
+           util}
+   :model-exports #{:model/TableIndex}}
+
+  indexes-rest
+  {:team "Gadget"
+   :api  #{metabase.indexes-rest.api}
+   :uses #{api
+           indexes
+           transforms-base
+           util}
+   :model-imports #{:model/Database
+                    :model/TableIndex
+                    :model/Transform}}
+
   initialization-status
   {:team "UX West"
    :api  #{metabase.initialization-status.core}
@@ -1089,6 +1135,7 @@
            metabase.lib.metadata
            metabase.lib.metadata.protocols
            metabase.lib.options
+           metabase.lib.pivot
            metabase.lib.schema
            metabase.lib.schema.actions
            metabase.lib.schema.aggregation
@@ -1176,7 +1223,10 @@
            sync
            util
            warehouse-schema}
-   :model-imports #{:model/Card :model/Database :model/Field :model/Table}}
+   :model-imports #{:model/Card
+                    :model/Database
+                    :model/Field
+                    :model/Table}}
 
   logger
   {:team "DevEx"
@@ -1209,13 +1259,19 @@
    :api  #{metabase.mcp.api
            metabase.mcp.callback-api
            metabase.mcp.core
-           metabase.mcp.init}
+           metabase.mcp.init
+           metabase.mcp.usage}
+   :model-exports #{:model/McpSessionLog
+                    :model/McpToolCallLog}
    :uses #{agent-api
+           ai-tracing
            api
            app-db
            config
            llm
+           metabot
            oauth-server
+           premium-features
            request
            server
            session
@@ -1254,6 +1310,7 @@
               slackbot}
    :uses    #{activity-feed
               agent-lib
+              ai-tracing
               analytics
               analytics-interface
               api
@@ -1265,6 +1322,7 @@
               config
               documents
               driver
+              entity-retrieval
               interestingness
               legacy-mbql
               lib
@@ -1284,7 +1342,6 @@
               settings
               slackbot
               sql-tools
-              store-api
               sync
               system
               task
@@ -1300,6 +1357,8 @@
    :model-imports #{:model/Card
                     :model/Collection
                     :model/Dashboard
+                    :model/DashboardCard
+                    :model/DashboardTab
                     :model/Database
                     :model/Field
                     :model/Glossary
@@ -1389,6 +1448,17 @@
                     :model/Table
                     :model/User}}
 
+  mq
+  {:team "UX West"
+   :api  #{metabase.mq.init}
+   :uses #{analytics-interface
+           app-db
+           classloader
+           settings
+           startup
+           task
+           util}}
+
   native-query-snippets
   {:team "Graphy"
    :api  #{metabase.native-query-snippets.api
@@ -1447,6 +1517,7 @@
                     :model/DashboardCard
                     :model/DashboardTab
                     :model/TaskHistory
+                    :model/TaskRun
                     :model/User}}
 
   oauth-server
@@ -1467,6 +1538,20 @@
            tracing
            util}}
 
+  osi
+  {:team "Metabot"
+   :api  #{metabase.osi.ai-context.api}
+   :uses #{api
+           app-db
+           entity-retrieval
+           models
+           request
+           util}
+   :model-exports #{:model/OsiAiContext}
+   :model-imports #{:model/Card
+                    :model/Measure
+                    :model/Segment}}
+
   ;; TODO -- too many API namespaces
   parameters
   {:team "Graphy"
@@ -1687,6 +1772,7 @@
            content-verification
            dashboards
            documents
+           embedding
            events
            graph
            lib
@@ -1702,6 +1788,8 @@
            query-processor
            request
            search
+           settings
+           staleness
            sync
            util
            view-log
@@ -1814,6 +1902,7 @@
            cache
            config
            dashboards
+           database-routing
            driver
            events
            formatter
@@ -1828,6 +1917,7 @@
            premium-features
            queries
            query-permissions
+           request
            server
            settings
            system
@@ -1836,8 +1926,6 @@
            util
            workspaces}
    :model-imports #{:model/Card
-                    :model/Dashboard
-                    :model/DashboardCard
                     :model/DashboardCardSeries
                     :model/Database
                     :model/QueryCache
@@ -1908,11 +1996,12 @@
   {:team "UX West"
    :api  #{metabase.sample-data.core
            metabase.sample-data.init}
-   :uses #{plugins
+   :uses #{driver
+           plugins
            settings
            sync
            util}
-   :model-imports #{:model/Database}}
+   :model-imports #{:model/DataPermissions :model/Database :model/Table}}
 
   search
   {:team "UX West"
@@ -2026,6 +2115,7 @@
            channel
            config
            events
+           premium-features
            request
            settings
            sso
@@ -2123,8 +2213,7 @@
   sql-parsing
   {:team "DevEx"
    :api #{metabase.sql-parsing.core}
-   :uses #{analytics-interface
-           util}}
+   :uses #{analytics-interface util}}
 
   sql-tools
   {:team "DevEx"
@@ -2158,6 +2247,10 @@
               util}
    :model-imports #{:model/AuthIdentity :model/PermissionsGroupMembership}}
 
+  staleness
+  {:team "UX West"
+   :api  #{metabase.staleness.core}}
+
   startup
   {:team "DevEx"
    :api  #{metabase.startup.core}
@@ -2239,7 +2332,7 @@
            task
            tracing
            util}
-   :model-exports #{:model/TaskHistory}
+   :model-exports #{:model/TaskHistory :model/TaskRun}
    :model-imports #{:model/Card :model/Dashboard :model/Database}}
 
   tenants
@@ -2259,9 +2352,11 @@
            config
            lib
            lib-be
+           mcp
            permissions
            premium-features
            search
+           session
            util}
    :model-imports #{:model/AiUsageLog
                     :model/Card
@@ -2285,7 +2380,8 @@
            parameters
            query-processor
            settings
-           util}}
+           util}
+   :model-imports #{:model/Card :model/Dashboard :model/DashboardCard}}
 
   timeline
   {:team "UX West"
@@ -2325,6 +2421,7 @@
            database-routing
            driver
            events
+           indexes
            lib
            lib-be
            models
@@ -2346,6 +2443,7 @@
               enterprise/transforms-python}
    :model-exports #{:model/Transform
                     :model/TransformJob
+                    :model/TransformJobRun
                     :model/TransformJobTransformTag
                     :model/TransformRun
                     :model/TransformTag}
@@ -2353,6 +2451,7 @@
                     :model/Database
                     :model/Field
                     :model/Table
+                    :model/TableIndex
                     :model/User}}
 
   transforms-base
@@ -2366,11 +2465,13 @@
    :model-imports #{:model/Database
                     :model/Field
                     :model/Table
+                    :model/TableIndex
                     :model/Transform
                     :model/TransformRun}
    :uses #{database-routing
            driver
            events
+           indexes
            lib
            lib-be
            premium-features
@@ -2399,6 +2500,7 @@
            util}
    :model-imports #{:model/Transform
                     :model/TransformJob
+                    :model/TransformJobRun
                     :model/TransformJobTransformTag
                     :model/TransformRun
                     :model/TransformTag}}
@@ -2796,6 +2898,7 @@
    :uses #{driver
            premium-features
            enterprise/advanced-config
+           enterprise/mfa
            enterprise/scim
            enterprise/semantic-search
            enterprise/sso}
@@ -2821,7 +2924,6 @@
            app-db
            audit-app
            classloader
-           config
            driver
            lib
            models
@@ -3030,7 +3132,6 @@
   {:team "UX West"
    :api  #{metabase-enterprise.database-routing.api}
    :uses #{api
-           config
            database-routing
            driver
            events
@@ -3126,6 +3227,22 @@
    ;; make token tracking a hook). Drop this dep once the relocation lands.
    :uses #{enterprise/semantic-search}}
 
+  enterprise/entity-retrieval
+  {:team "Metabot"
+   :api  #{metabase-enterprise.entity-retrieval.init}
+   :uses #{analytics-interface
+           collections
+           entity-retrieval
+           premium-features
+           task
+           util
+           enterprise/semantic-search}
+   :model-imports #{:model/Card
+                    :model/Measure
+                    :model/OsiAiContext
+                    :model/Segment
+                    :model/Table}}
+
   enterprise/erd
   {:team "Gadget"
    :api  #{metabase-enterprise.erd.api}
@@ -3187,6 +3304,32 @@
            premium-features}
    :model-imports #{:model/Card :model/Collection :model/Table}}
 
+  enterprise/mcp
+  {:team    "Metabot"
+   :api     #{metabase-enterprise.mcp.init}
+   :uses    #{analytics
+              mcp
+              metabot
+              premium-features
+              task
+              util}
+   :model-imports #{:model/McpSessionLog
+                    :model/McpToolCallLog}}
+
+  enterprise/memoize-monitor
+  {:team "Graphy"
+   :api  #{metabase-enterprise.memoize-monitor.init}
+   :uses #{analytics
+           analytics-interface
+           audit-app
+           collections
+           driver
+           models
+           util
+           warehouse-schema
+           warehouses
+           enterprise/serialization}}
+
   enterprise/metabot
   {:team    "Metabot"
    :api     #{metabase-enterprise.metabot.api
@@ -3226,6 +3369,22 @@
            util}
    :model-imports #{:model/MetabotConversation :model/MetabotFeedback :model/MetabotMessage}}
 
+  enterprise/mfa
+  {:team "Graphy"
+   :api  #{metabase-enterprise.mfa.core
+           metabase-enterprise.mfa.init
+           metabase-enterprise.mfa.routes}
+   :uses #{api
+           appearance
+           channel
+           config
+           events
+           premium-features
+           settings
+           sso
+           util}
+   :model-imports #{:model/AuthIdentity :model/User}}
+
   enterprise/permission-debug
   {:team "UX West"
    :api  #{metabase-enterprise.permission-debug.api}
@@ -3255,6 +3414,7 @@
            events
            models
            premium-features
+           search
            settings
            startup
            task
@@ -3392,14 +3552,19 @@
   {:team "Metabot"
    :api  #{metabase-enterprise.semantic-search.api
            metabase-enterprise.semantic-search.core
+           metabase-enterprise.semantic-search.db.datasource
+           metabase-enterprise.semantic-search.embedding
            metabase-enterprise.semantic-search.init}
    :uses #{activity-feed
            analytics
            analytics-interface
            api
            app-db
+           collections
            config
            connection-pool
+           events
+           lib-be
            llm
            metabot
            models
@@ -3410,7 +3575,9 @@
            task
            tracing
            util}
-   :model-imports #{:model/Collection}}
+   :model-imports #{:model/Collection
+                    :model/Dashboard
+                    :model/Table}}
 
   enterprise/serialization
   {:team "Graphy"
@@ -3420,12 +3587,12 @@
            metabase-enterprise.serialization.init
            metabase-enterprise.serialization.schema
            metabase-enterprise.serialization.v2.backfill-ids}
+   :friends #{enterprise/memoize-monitor}
    :uses #{analytics
            api
            app-db
            appearance
            collections
-           config
            events
            lib
            logger
@@ -3478,11 +3645,11 @@
    :uses #{analytics
            api
            collections
-           embedding
            premium-features
            queries
            request
            settings
+           staleness
            util}
    :model-imports #{:model/Card :model/Collection :model/Dashboard}}
 
@@ -3521,7 +3688,9 @@
   {:team "Graphy"
    :api  #{metabase-enterprise.transforms.api}
    :uses #{premium-features
-           enterprise/transforms-inspector}}
+           util
+           enterprise/transforms-inspector}
+   :model-imports #{:model/Transform}}
 
   enterprise/transforms-inspector
   {:team "Gadget"

.clj-kondo/config/test-helpers/config.edn

@@ -36,6 +36,9 @@
      ;; Definitely thread safe
      metabase.test.util.dynamic-redefs/patch-vars!
 
+     ;; test-only cleanup of in-memory throttle state (atom resets)
+     metabase.session.api/reset-throttlers-for-testing!
+
      ;; TODO: most of these symbols shouldn't be here, we should go through them and
      ;; find the functions/macros that use them and make sure their names end with !
      ;; best way to do this is try remove each of these and rely on kondo output to find places where it's used

.clj-kondo/macros/metabase/util/namespaces.clj

@@ -6,3 +6,8 @@
    `(def ~(-> sym name symbol) "docstring" ~sym))
   ([sym name]
    `(def ~name "docstring" ~sym)))
+
+(defmacro import-macro
+  "Kondo macro replacement for [[metabase.util.namespaces/import-macro]]."
+  [sym]
+  `(def ~(-> sym name symbol) "docstring" ~sym))

.clj-kondo/src/hooks/metabase/mq/impl.clj

@@ -0,0 +1,18 @@
+(ns hooks.metabase.mq.impl
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
+
+(defn def-listener
+  "Kondo hook for `mq/def-listener`. Rewrites to a `fn` form so kondo can analyze bindings.
+
+   Form:
+     (mq/def-listener! :queue/bar [msgs] body...)"
+  [{:keys [node]}]
+  (let [[_ _channel-name bindings & body] (:children node)
+        ;; rewrite as: (fn [bindings...] body...)
+        new-node (hooks/list-node
+                  (list*
+                   (hooks/token-node 'fn)
+                   bindings
+                   body))]
+    {:node new-node}))

.clj-kondo/src/hooks/metabase/util/match.clj

@@ -0,0 +1,132 @@
+(ns hooks.metabase.util.match
+  (:require [clj-kondo.hooks-api :as api]))
+
+(defn- token-node? [node token-name]
+  (and (api/token-node? node)
+       (= (str (:value node)) token-name)))
+
+(defn- keyword-node? [node k]
+  (and (api/keyword-node? node)
+       (= (:k node) k)))
+
+(defn- binding-symbol?
+  "True when the token is a plain symbol that should be treated as a binding
+  (not a keyword, not a boolean literal, not nil, not a number, not `_`)."
+  [node]
+  (and (api/token-node? node)
+       (let [v (:value node)]
+         (and (symbol? v)
+              (not (contains? '#{_ nil true false} v))))))
+
+;; To establish fake let bindings, we need to bind them to something. This "something" has to be vague enough to trick
+;; kondo into not looking too much into it. E.g., if we bind everything to `nil`, Kondo linters will get fired up.
+(def opaque-node (api/list-node (list (api/token-node 'rand-nth) (api/list-node []))))
+
+(defn collect-bindings
+  "Return a list of token nodes (symbols) introduced as bindings by `pattern`."
+  [pattern]
+  (cond
+    (binding-symbol? pattern)
+    [[pattern opaque-node]]
+
+    ;; Lists: (:or ...), (:and ...), (sym :guard pred ...), or a quoted symbol.
+    (api/list-node? pattern)
+    (let [[head & rst] (:children pattern)]
+      (cond (or (keyword-node? head :or)
+                (keyword-node? head :and))
+            (mapcat collect-bindings rst)
+
+            (api/token-node? head)
+            (cond-> []
+              (binding-symbol? head) (conj [head opaque-node])
+              (keyword-node? (first rst) :guard) (conj [(api/token-node '_) (second rst)]))
+
+            ;; anything else (e.g. a function call used as predicate) — no bindings
+            :else []))
+
+    (api/vector-node? pattern)
+    (mapcat (fn [node]
+              (when-not (token-node? node "&")
+                (collect-bindings node)))
+            (:children pattern))
+
+    ;; Maps: keys are literal selectors, values are sub-patterns.
+    ;; Special value-symbols &truthy and _ are NOT user bindings.
+    (api/map-node? pattern)
+    (let [children (:children pattern)
+          pairs    (partition 2 children)]
+      (mapcat (fn [[_k v]]
+                (when-not (or (token-node? v "&truthy")
+                              (token-node? v "_"))
+                  (collect-bindings v)))
+              pairs))
+
+    ;; For sets, make sure to use them because they may reference some of the outer local bindings, so if we don't
+    ;; include them, Kondo will complain about those bindings being unused.
+    (api/set-node? pattern)
+    [[(api/token-node '_) pattern]]
+
+    ;; Anything else — no bindings.
+    :else []))
+
+(defn- dedupe-bindings
+  "Prevent Kondo complaining that we have multiple fake bindings."
+  [pairs]
+  (loop [[[sym v] & r] pairs, seen #{}, result []]
+    (cond (nil? sym) result
+          (and (seen sym) (not (token-node? sym "_"))) (recur r seen result)
+          :else (recur r (conj seen sym) (conj result sym v)))))
+
+(defn match-one
+  "clj-kondo :analyze-call hook for match-one.
+
+  Rewrites
+
+    (match-one value
+      pat1 ret1
+      pat2 ret2
+      ...)
+
+  into a `let` form that declares all binding symbols introduced by the patterns, so clj-kondo knows they are
+  legitimate and won't warn about unresolved/unused symbols:
+
+    (let [<all-bindings> (rand-nth []) ...]
+      (or ret1 ret2 ...))"
+  [{:keys [node]}]
+  (let [[_ value & clauses] (:children node)]
+    (when (odd? (count clauses))
+      (api/reg-finding!
+       {:message  "match-one/match-many/replace requires an even number of pattern/result pairs"
+        :type     :metabase/match-odd-clauses
+        :row      (:row node)
+        :col      (:col node)
+        :filename (-> node meta :filename)}))
+    (let [pairs (partition 2 clauses)
+          all-bindings (->> pairs
+                            (mapcat (fn [[pat _ret]] (collect-bindings pat)))
+                            dedupe-bindings)
+          special-bindings [(api/token-node '_)        value
+                            (api/token-node '&match)   opaque-node
+                            (api/token-node '&parents) opaque-node
+                            (api/token-node '&recur)   opaque-node
+                            ;; Pretend to use &match, &parents, and &recur so that Kondo doesn't complain about them
+                            ;; if they are not used by the user code.
+                            (api/token-node '_) (api/token-node '&match)
+                            (api/token-node '_) (api/token-node '&parents)
+                            (api/token-node '_) (api/token-node '&recur)]
+          binding-nodes (into special-bindings all-bindings)
+          result-exprs (map second pairs)
+          new-node (api/list-node
+                    (list
+                     (api/token-node 'let)
+                     (api/vector-node binding-nodes)
+                     (api/list-node
+                      (concat [(api/token-node 'clojure.core/or)] result-exprs [opaque-node]))))]
+      {:node new-node})))
+
+(def match-many match-one)
+(def replace match-one)
+
+(defn replace-in [context]
+  ;; Everything is the same as in match-one, just drop the middle argument.
+  (match-one (update-in context [:node :children] (fn [[sym value path & clauses]] (list* sym value clauses)))))

.clj-kondo/test/hooks/metabase/util/match_test.clj

@@ -0,0 +1,59 @@
+(ns hooks.metabase.util.match-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.metabase.util.match :as sut]))
+
+(defn- expand [src]
+  (-> (sut/match-one {:node (hooks/parse-string (pr-str src))})
+      :node
+      hooks/sexpr))
+
+(defn- lint [src]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/match-odd-clauses {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (expand src)
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(deftest odd-clauses-triggers-warning-test
+  (is (=? [{:type :metabase/match-odd-clauses}]
+          (lint '(metabase.util.match/match-one [] [a b c])))))
+
+(deftest expansion-test
+  (testing "simple expansion example"
+    (is (= '(let [_ []
+                  &match (rand-nth ())
+                  &parents (rand-nth ())
+                  &recur (rand-nth ())
+                  _ &match
+                  _ &parents
+                  _ &recur
+                  a (rand-nth ())
+                  b (rand-nth ())
+                  c (rand-nth ())]
+              (clojure.core/or (+ a b) (rand-nth ())))
+           (expand '(match-one [] [a b c] (+ a b))))))
+  (testing "complicated expansion example that uses most match-one macro features, and also binding deduplication by the rewriter"
+    (is (= '(let [_ []
+                  &match (rand-nth ())
+                  &parents (rand-nth ())
+                  &recur (rand-nth ())
+                  _ &match
+                  _ &parents
+                  _ &recur
+                  val1 (rand-nth ())
+                  a (rand-nth ())
+                  _ #{maybe important}
+                  rst (rand-nth ())
+                  x (rand-nth ())
+                  _ (= x 3)
+                  b (rand-nth ())]
+              (clojure.core/or (+ a val1) (rand-nth ())))
+           (expand '(match-one []
+                               (:or [{:key1 val1, :key2 &truthy, :key3 _} _ a #{maybe important} & rst]
+                                    (:and (x :guard (= x 3))
+                                          [a b]))
+                               (+ a val1)))))))

.coderabbit.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  high_level_summary: false
+  review_status: false
+
+  auto_review:
+    enabled: false
+    drafts: true
+    labels:
+      - "coderabbit"
+
+  path_filters:
+    - "!**/*.snap"
+    - "!**/*.po"
+    - "!**/bun.lock"
+    - "!**/package-lock.json"
+
+  tools:
+    eslint:
+      enabled: false
+
+knowledge_base:
+  code_guidelines:
+    filePatterns:
+      - ".claude/skills/clojure-review/SKILL.md"
+      - ".claude/skills/typescript-review/SKILL.md"
+      - ".claude/skills/e2e-test-review/SKILL.md"
+      - ".claude/skills/docs-review/SKILL.md"

.dependency-cruiser.cjs

@@ -0,0 +1,32 @@
+// dependency-cruiser config for the actual frontend import graph (what's
+// imported, vs the *allowed* edges in module-boundaries.mjs). Consumed by
+// .github/scripts/create-test-plan.ts.
+//
+//   bunx depcruise frontend/src enterprise/frontend/src \
+//     --config .dependency-cruiser.cjs --output-type json > dependency-graph.json
+
+/** @type {import('dependency-cruiser').IConfiguration} */
+module.exports = {
+  options: {
+    // Keep only edges between our own source files (drops node_modules etc.),
+    // which keeps the JSON small.
+    includeOnly: "^(frontend/src|enterprise/frontend/src)/",
+
+    doNotFollow: { path: "node_modules" },
+
+    // Resolve the `"*": ["./frontend/src/*", ...]` aliases so bare imports like
+    // `metabase/lib/foo` map back to a real file.
+    tsConfig: { fileName: "tsconfig.json" },
+
+    // Keep type-only imports: a type-only dependent still breaks on a type change.
+    tsPreCompilationDeps: true,
+
+    moduleSystems: ["es6", "cjs", "tsd"],
+
+    enhancedResolveOptions: {
+      exportsFields: ["exports"],
+      conditionNames: ["import", "require", "node", "default", "types"],
+      extensions: [".js", ".jsx", ".ts", ".tsx", ".json"],
+    },
+  },
+};

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/vscode/devcontainers/java:21
+FROM mcr.microsoft.com/vscode/devcontainers/java:25
 
 # Set up nodesource, install node, bun, fontconfig for static viz, rlwrap for dev ergonomics
 

.dockerignore

@@ -1,5 +1,6 @@
+.git
 .babel_cache
-target/*
+target
 .circleci
 .cpcache
 .devcontainer
@@ -15,6 +16,7 @@ test_config/*
 test_modules/*
 test_resources/*
 node_modules
+**/node_modules
 **metabase.jar
 
 *.db

.gitattributes

@@ -7,3 +7,9 @@
 #
 # TODO (Bryan 12/12/25) -- reenable this when we can completely verify correctness
 # resources/migrations/*_update_migrations.yaml merge=yaml-migrations
+
+# Generated API documentation/specs — regenerated by the "Auto-update documentation for master"
+# CI automation, not edited by hand. Mark generated so tools/humans don't review or diff them as source.
+docs/api.json                  linguist-generated
+docs/api.html                  linguist-generated
+resources/openapi/openapi.json linguist-generated

.github/CODEOWNERS

@@ -12,13 +12,27 @@ enterprise/backend/src/metabase_enterprise/dependencies @metabase/graphy
 enterprise/frontend/src/metabase-enterprise/dependencies @metabase/graphy
 
 # @metabase/embedding
-enterprise/frontend/src/embedding-sdk-package @metabase/embedding
-enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
-enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
+
+frontend/src/metabase/embedding @metabase/embedding
 frontend/src/metabase/embedding-sdk @metabase/embedding
+frontend/src/embedding-sdk-bundle @metabase/embedding
+frontend/src/embedding-sdk-shared @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
 
+enterprise/frontend/src/embedding @metabase/embedding
+enterprise/frontend/src/embedding-sdk-ee @metabase/embedding
+enterprise/frontend/src/embedding-sdk-package @metabase/embedding
+
+enterprise/frontend/src/metabase-enterprise/embedding @metabase/embedding
+enterprise/frontend/src/metabase-enterprise/embedding_iframe_sdk @metabase/embedding
+enterprise/frontend/src/metabase-enterprise/embedding_iframe_sdk_setup @metabase/embedding
+enterprise/frontend/src/metabase-enterprise/embedding-sdk @metabase/embedding
+
+e2e/test-component @metabase/embedding
+e2e/test/scenarios/embedding @metabase/embedding
+e2e/embedding-sdk-host-apps @metabase/embedding
+
 # @metabase/tech-writers
 docs @metabase/tech-writers
 docs/developers-guide # exclude from tech-writer ownership

.github/actions/create-test-plan/action.yml

@@ -0,0 +1,131 @@
+name: Create test plan
+description: Cruise the frontend import graph and compute the affected-tests plan.
+
+inputs:
+  changed-files:
+    description: All changed files (CSV).
+    required: true
+  fe-changed-files:
+    description: Changed frontend_sources files (CSV).
+    required: true
+  be-changed-files:
+    description: Changed backend_sources files (CSV).
+    required: true
+  unit-infra-touched:
+    description: Whether FE unit infra changed.
+    required: true
+  loki-infra-touched:
+    description: Whether Loki infra changed.
+    required: true
+  e2e-infra-touched:
+    description: Whether e2e harness/support code changed.
+    required: true
+  shared-sources-touched:
+    description: Whether cljc/cljs/package.json changed.
+    required: true
+
+outputs:
+  stats:
+    description: FE Affected Tests stats row (JSON).
+    value: ${{ steps.compute.outputs.stats }}
+  fe_unit_specs_to_run:
+    description: Unit specs to run (JSON array).
+    value: ${{ steps.compute.outputs.fe_unit_specs_to_run }}
+  loki_stories_to_run:
+    description: Loki stories to run (JSON array).
+    value: ${{ steps.compute.outputs.loki_stories_to_run }}
+  e2e_specs_to_run:
+    description: E2E specs to run (JSON array).
+    value: ${{ steps.compute.outputs.e2e_specs_to_run }}
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare Node + Bun
+      uses: ./.github/actions/prepare-node-bun
+    - name: Resolve closest-ancestor e2e coverage manifest
+      id: manifest
+      uses: actions/github-script@v9
+      with:
+        script: | # js
+          const { pathToFileURL } = require("url");
+          const { resolveCoverageManifest } = await import(
+            pathToFileURL(
+              `${process.env.GITHUB_WORKSPACE}/.github/scripts/resolve-coverage-manifest.mjs`,
+            ).href,
+          );
+          const result = await resolveCoverageManifest({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            headSha: context.payload.pull_request?.head?.sha ?? context.sha,
+          });
+          core.setOutput("path", result?.path ?? "");
+    - name: Build dependency graph
+      shell: bash
+      run: |
+        # Quiet on success; surface output only if install fails.
+        bun install --frozen-lockfile > /tmp/bun-install.log 2>&1 \
+          || { echo "bun install issues (continuing):"; tail -20 /tmp/bun-install.log; }
+        bunx depcruise frontend/src enterprise/frontend/src \
+          --config .dependency-cruiser.cjs \
+          --output-type json > dependency-graph.json || true
+
+    - name: Create test plan
+      id: compute
+      shell: bash
+      env:
+        CHANGED_FILES: ${{ inputs.changed-files }}
+        FE_CHANGED_FILES: ${{ inputs.fe-changed-files }}
+        BE_CHANGED_FILES: ${{ inputs.be-changed-files }}
+        UNIT_INFRA_TOUCHED: ${{ inputs.unit-infra-touched }}
+        LOKI_INFRA_TOUCHED: ${{ inputs.loki-infra-touched }}
+        E2E_INFRA_TOUCHED: ${{ inputs.e2e-infra-touched }}
+        SHARED_SOURCES_TOUCHED: ${{ inputs.shared-sources-touched }}
+        DEP_GRAPH_JSON: dependency-graph.json
+        E2E_SPEC_MANIFEST: ${{ steps.manifest.outputs.path }}
+      run: |
+        # stdout is the plan JSON; the planner's own info logs go to stderr.
+        bun .github/scripts/create-test-plan.ts > test-plan.json
+        echo "stats=$(jq -c '.stats' test-plan.json)" >> "$GITHUB_OUTPUT"
+        echo "fe_unit_specs_to_run=$(jq -c '.fe_unit_specs_to_run' test-plan.json)" >> "$GITHUB_OUTPUT"
+        echo "loki_stories_to_run=$(jq -c '.loki_stories_to_run' test-plan.json)" >> "$GITHUB_OUTPUT"
+        echo "e2e_specs_to_run=$(jq -c '.e2e_specs_to_run' test-plan.json)" >> "$GITHUB_OUTPUT"
+
+    - name: Report test plan
+      shell: bash
+      run: |
+        plan=test-plan.json
+        row() { # name, selected, total
+          if [ "$2" -eq "$3" ]; then echo "| $1 | all ($3) | $3 |"; else echo "| $1 | $2 | $3 |"; fi
+        }
+        {
+          echo "## Affected test plan"
+          echo
+          echo "| Suite | Selected | Total |"
+          echo "|---|---:|---:|"
+          row "Unit" "$(jq '.stats.unit_specs_to_run_usage' "$plan")" "$(jq '.stats.unit_specs_all' "$plan")"
+          row "Loki" "$(jq '.stats.loki_stories_to_run_usage' "$plan")" "$(jq '.stats.loki_stories_all' "$plan")"
+          row "E2E"  "$(jq '.stats.e2e_specs_to_run_usage' "$plan")"  "$(jq '.stats.e2e_specs_all' "$plan")"
+          echo
+          echo "Changed: $(jq '.stats.fe_files_changed' "$plan") FE / $(jq '.stats.be_files_changed' "$plan") BE file(s) · $(jq '.stats.fe_modules_affected_usage' "$plan") FE module(s) affected"
+          echo
+          e2e_run=$(jq '.stats.e2e_specs_to_run_usage' "$plan")
+          e2e_all=$(jq '.stats.e2e_specs_all' "$plan")
+          if [ "$e2e_run" -eq "$e2e_all" ]; then
+            echo "**E2E: full run** — no manifest, or a change the coverage manifest can't scope (backend, e2e infra, cljc/cljs)."
+          else
+            echo "<details><summary><b>E2E specs to run ($e2e_run)</b></summary>"
+            echo
+            jq -r '.e2e_specs_to_run[]' "$plan" | sed 's/^/- /'
+            echo
+            echo "</details>"
+          fi
+          echo
+          echo "<details><summary>Full stats (rules vs usage graph)</summary>"
+          echo
+          echo '```json'
+          jq '.stats' "$plan"
+          echo '```'
+          echo "</details>"
+        } | tee -a "${GITHUB_STEP_SUMMARY:-/dev/null}"

.github/actions/prepare-backend/action.yml

@@ -4,7 +4,7 @@ description: |
 inputs:
   java-version:
     required: true
-    default: "21"
+    default: "25"
   clojure-version:
     required: true
     default: "1.12.0.1488"

.github/actions/prepare-ci-conductor/action.yml

@@ -0,0 +1,52 @@
+name: Prepare CI Conductor
+description: >-
+  Make the ci-conductor sources runnable in the workspace.
+  Unless the checkout is headed for master, they are overlaid from master, so every
+  branch runs the latest scripts while its workflow wiring stays branch-historical.
+
+runs:
+  using: composite
+  steps:
+    - name: Detect bun
+      id: bun
+      shell: bash
+      run: |
+        if command -v bun >/dev/null; then
+          echo "present=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "present=false" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Install bun
+      if: steps.bun.outputs.present != 'true'
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      with:
+        bun-version-file: "package.json"
+        token: ${{ github.token }}
+
+    # Anything headed for master runs master's own sources, so a PR can test its own changes.
+    - name: Fetch ci-conductor sources from master
+      if: ${{ github.base_ref != 'master' && github.ref_name != 'master' }}
+      uses: actions/checkout@v6
+      with:
+        repository: metabase/metabase
+        ref: master
+        path: .ci-conductor-master
+        persist-credentials: false
+        sparse-checkout-cone-mode: false
+        sparse-checkout: |
+          release/ci-conductor
+          e2e/support/ci_conductor.ts
+
+    # e2e/support/config.js and e2e/support/ci_conductor.ts resolve these by relative
+    # path at bundle time, so the sources have to land where the branch expects them.
+    - name: Overlay ci-conductor sources from master
+      if: ${{ github.base_ref != 'master' && github.ref_name != 'master' }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        rm -rf release/ci-conductor
+        mv .ci-conductor-master/release/ci-conductor release/ci-conductor
+        mv .ci-conductor-master/e2e/support/ci_conductor.ts e2e/support/ci_conductor.ts
+        rm -rf .ci-conductor-master
+        echo "Overlaid ci-conductor sources from master."

.github/actions/prepare-cypress/action.yml

@@ -15,6 +15,10 @@ outputs:
 runs:
   using: "composite"
   steps:
+    # e2e/support/config.js imports the reporter, so it has to be in place before Cypress bundles.
+    - name: Prepare CI Conductor
+      uses: ./.github/actions/prepare-ci-conductor
+
     - name: Install Chrome v144
       uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
       with:

.github/actions/prepare-node-bun/action.yml

@@ -16,5 +16,5 @@ runs:
     - name: Install bun
       uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
-        bun-version: "1.3.7"
+        bun-version-file: 'package.json'
         token: ${{ github.token }}

.github/actions/prepare-release-scripts/action.yml

@@ -6,7 +6,7 @@ runs:
   steps:
     - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
-        bun-version: "1.3.7"
+        bun-version-file: 'package.json'
         token: ${{ github.token }}
 
     - name: Build release scripts

.github/actions/quarantine-gate/action.yml

@@ -0,0 +1,38 @@
+name: CI Conductor quarantine gate
+description: >-
+  Check this job's test failures against ci-conductor's quarantine list.
+  Either enforces the quarantine or only prints a verdict (dry run).
+  Fails closed when enforcing but the `CI_CONDUCTOR_BASE_URL` is missing or unreachable.
+
+inputs:
+  adapter:
+    description: Which gate to run — one of `backend`, `frontend`, `e2e`.
+    required: true
+  test-suite:
+    description: >-
+      Suite label to gate (CI_CONDUCTOR_TEST_SUITE). MUST match the label this
+      job reports under, or the gate checks the wrong quarantine list.
+    required: true
+  enforce-quarantine:
+    description: >-
+      Whether the gate actually gates the job. When "false", it only prints a verdict.
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare CI Conductor
+      uses: ./.github/actions/prepare-ci-conductor
+    - name: Check failures against the quarantine list
+      shell: bash
+      env:
+        CI_CONDUCTOR_TEST_SUITE: ${{ inputs.test-suite }}
+        ADAPTER: ${{ inputs.adapter }}
+        QUARANTINE_DRY_RUN: ${{ inputs.enforce-quarantine != 'true' }}
+      run: |
+        case "$ADAPTER" in
+          backend|frontend|e2e) ;;
+          *) echo "::error::quarantine-gate: unknown adapter '$ADAPTER' (expected backend|frontend|e2e)"; exit 1 ;;
+        esac
+        bun "release/ci-conductor/src/check-${ADAPTER}-quarantine.ts"

.github/actions/report-failures-to-ci-conductor/action.yml

@@ -0,0 +1,34 @@
+name: Report failures to CI Conductor
+description: >-
+  Report this job's test failures to ci-conductor. Best-effort; no-ops unless
+  CI_CONDUCTOR_BASE_URL is set. Gate it at the call site with continue-on-error
+  and an `if:` on the test step's outcome.
+
+inputs:
+  test-suite:
+    description: Per-job identity label (CI_CONDUCTOR_TEST_SUITE); unique per job/leg.
+    required: true
+  adapter:
+    description: Which reporter to run; resolves to report-<adapter>.ts. backend or frontend.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare CI Conductor
+      uses: ./.github/actions/prepare-ci-conductor
+    - name: Report failed tests to ci-conductor
+      shell: bash
+      env:
+        REPO_ID: ${{ github.event.repository.id }}
+        COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
+        CI_CONDUCTOR_TEST_SUITE: ${{ inputs.test-suite }}
+        ADAPTER: ${{ inputs.adapter }}
+      # Keep the path constrained to known entrypoints.
+      run: |
+        case "$ADAPTER" in
+          backend|frontend) ;;
+          *) echo "::error::Unknown ci-conductor adapter '$ADAPTER'"; exit 1 ;;
+        esac
+        bun "release/ci-conductor/src/report-${ADAPTER}.ts"

.github/actions/sdk-bundle-size-check/action.yml

@@ -1,15 +1,17 @@
 name: Embedding SDK Bundle Size Check
 description: |
-  Downloads the current branch's uberjar and builds the base ref's
-  embedding-sdk.js from source, compares their sizes,
-  and sets output if the size change exceeds the threshold.
+  Measures app + embedding SDK bundle sizes from the current and base-ref
+  uberjars (reusing the builds that already ran) plus their bundle-stats
+  artifacts, and flags changes to the chunked SDK's reachable, gzipped size
+  beyond the threshold. Skips when the base-ref artifacts aren't available
+  rather than rebuilding from source (which would compare across pipelines).
 
 inputs:
   edition:
     description: 'Metabase edition (ee or oss)'
     required: true
   base-ref-commit:
-    description: 'Commit SHA of the base ref (e.g. merge base).'
+    description: 'Commit SHA of the base ref.'
     required: true
   threshold-percent:
     description: 'Percent threshold for bundle size change'
@@ -26,86 +28,73 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Prepare backend
-      uses: ./.github/actions/prepare-backend
-    - name: Prepare frontend
-      uses: ./.github/actions/prepare-frontend
     - name: Download current uberjar
       uses: ./.github/actions/fetch-artifact
       with:
         commit: ${{ github.event.pull_request.head.sha || github.sha }}
         edition: ${{ inputs.edition }}
         extract-path: temp/current-uberjar
-    - name: Extract embedding-sdk bundles from current uberjar
-      shell: bash
-      run: |
-        # Try new layout first (app/embedding-sdk/legacy/), fall back to old layout (app/embedding-sdk.js)
-        unzip -j temp/current-uberjar/metabase.jar \
-          "frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" \
-          -d temp/current-bundle 2>/dev/null || \
-        unzip -j temp/current-uberjar/metabase.jar \
-          "frontend_client/app/embedding-sdk.js" \
-          -d temp/current-bundle
-
-        # Extract chunks directory if it exists (new layout only)
-        mkdir -p temp/current-chunks
-        unzip -j temp/current-uberjar/metabase.jar \
-          "frontend_client/app/embedding-sdk/chunks/*" \
-          -d temp/current-chunks 2>/dev/null || true
-    - name: Checkout base ref
-      uses: actions/checkout@v6
+    - name: Download base-ref uberjar
+      id: base-jar
+      continue-on-error: true
+      uses: ./.github/actions/fetch-artifact
       with:
-        ref: ${{ inputs.base-ref-commit }}
-        path: temp/base-ref-src
-    - name: Build base-ref embedding-sdk.js
-      shell: bash
-      run: |
-        cd temp/base-ref-src
-        bun install
-        MB_EDITION=${{ inputs.edition }} bun run build-release
-    - name: Compare sizes and set output
+        commit: ${{ inputs.base-ref-commit }}
+        edition: ${{ inputs.edition }}
+        extract-path: temp/base-uberjar
+    - name: Measure and compare bundle sizes
       id: compare
       shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        EDITION: ${{ inputs.edition }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        BASE_SHA: ${{ inputs.base-ref-commit }}
+        THRESHOLD: ${{ inputs.threshold-percent }}
+        MEASURE_BUNDLES: app,embedding-sdk-legacy,embedding-sdk-chunked
       run: |
-        # --- Legacy (monolithic) bundle comparison ---
-        current_size=$(wc -c < temp/current-bundle/embedding-sdk.js) || { echo "::error::Failed to read current bundle"; exit 1; }
+        set -uo pipefail
 
-        # Base ref: try new layout first, fall back to old
-        if [ -f "temp/base-ref-src/resources/frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" ]; then
-          base_ref_size=$(wc -c < "temp/base-ref-src/resources/frontend_client/app/embedding-sdk/legacy/embedding-sdk.js")
-        else
-          base_ref_size=$(wc -c < "temp/base-ref-src/resources/frontend_client/app/embedding-sdk.js")
-        fi
-        [ "$current_size" -gt 0 ] && [ "$base_ref_size" -gt 0 ] || { echo "::error::Bundle file is empty"; exit 1; }
+        skip() {
+          echo "::notice::Embedding SDK bundle-size check skipped: $1"
+          echo "status=stable" >> "$GITHUB_OUTPUT"
+          echo "size_change_percent=0" >> "$GITHUB_OUTPUT"
+          exit 0
+        }
 
-        diff=$((current_size - base_ref_size))
-        percent=$(( diff * 100 / base_ref_size ))
+        # The base ref needs an already-built uberjar. Rebuilding it from source
+        # would compare across two build pipelines (the bug this check used to
+        # have), so skip instead when it — or its stats — isn't available.
+        [ -f temp/base-uberjar/metabase.jar ] || skip "base-ref uberjar not found for ${BASE_SHA}"
 
-        echo "=== Legacy (monolithic) bundle ==="
-        echo "Current size: $current_size bytes"
-        echo "Base ref size: $base_ref_size bytes"
-        echo "Difference: $diff bytes ($percent%)"
+        extract_js() { # $1=jar  $2=dest-root
+          mkdir -p "$2/resources"
+          unzip -o "$1" \
+            "frontend_client/app/dist/*" \
+            "frontend_client/app/embed.js" \
+            "frontend_client/app/embedding-sdk/*" \
+            -d "$2/resources" >/dev/null || true
+        }
 
-        threshold="${{ inputs.threshold-percent }}"
-        if [ "$percent" -gt "$threshold" ]; then
-          status="increased"
-        elif [ "$percent" -lt "$(( -threshold ))" ]; then
-          status="decreased"
-        else
-          status="stable"
-        fi
+        fetch_stats() { # $1=sha  $2=dest-dir
+          local name="metabase-bundle-stats-${EDITION}-$1"
+          local id
+          id=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${name}" --jq '.artifacts[0].id // empty' 2>/dev/null)
+          [ -n "${id}" ] || return 1
+          mkdir -p "$2"
+          gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts/${id}/zip" > "$2.zip" 2>/dev/null || return 1
+          unzip -o "$2.zip" -d "$2" >/dev/null || return 1
+        }
 
-        echo "status=$status" >> $GITHUB_OUTPUT
-        echo "size_change_percent=$percent" >> $GITHUB_OUTPUT
+        extract_js temp/current-uberjar/metabase.jar temp/current
+        extract_js temp/base-uberjar/metabase.jar temp/base
 
-        # --- Chunked bundle (informational) ---
-        if ls temp/current-chunks/*.js 1>/dev/null 2>&1; then
-          chunks_size=$(cat temp/current-chunks/*.js | wc -c)
-          echo ""
-          echo "=== Chunked bundle (bootstrap + chunks) ==="
-          echo "Total chunked size: $chunks_size bytes"
-          echo "chunks_size=$chunks_size" >> $GITHUB_OUTPUT
-        else
-          echo ""
-          echo "No chunked bundle found (expected on master)"
-        fi
+        fetch_stats "${HEAD_SHA}" temp/current/artifacts || skip "bundle stats not found for current ${HEAD_SHA}"
+        fetch_stats "${BASE_SHA}" temp/base/artifacts || skip "bundle stats not found for base ${BASE_SHA}"
+
+        MEASURE_ROOT=temp/current node ./.github/scripts/measure-bundle-sizes.js > temp/current-sizes.json \
+          || { echo "::error::Failed to measure current bundle sizes"; exit 1; }
+        MEASURE_ROOT=temp/base node ./.github/scripts/measure-bundle-sizes.js > temp/base-sizes.json \
+          || { echo "::error::Failed to measure base bundle sizes"; exit 1; }
+
+        node ./.github/actions/sdk-bundle-size-check/compare.js temp/current-sizes.json temp/base-sizes.json

.github/actions/sdk-bundle-size-check/compare.js

@@ -0,0 +1,110 @@
+/* eslint-disable import/no-commonjs */
+// Diffs the bundle sizes produced by measure-bundle-sizes.js for the current
+// build and the base ref. Every (bundle, kind) is compared strictly against the
+// same (bundle, kind) — never one bundle type against another — using gzipped
+// (served) bytes. The gate is driven by the chunked SDK's reachable total, which
+// is what the SDK actually delivers.
+//
+// compareBundles is pure (data in, data out) so it can be unit-tested; main()
+// is the thin I/O wrapper that reads the size files, prints the report and sets
+// the step outputs / exit code.
+const fs = require("fs");
+
+const pick = (rows, bundle, kind) => rows.find(row => row.bundle === bundle && row.kind === kind);
+const keyOf = row => `${row.bundle}/${row.kind}`;
+const mb = bytes => (bytes / 1024 / 1024).toFixed(2);
+const percentOf = (currentBytes, baseBytes) =>
+  baseBytes ? Math.trunc(((currentBytes - baseBytes) * 100) / baseBytes) : 0;
+
+/**
+ * Compare two measurement sets and decide the gate. Returns a human-readable
+ * `report` (always), and exactly one of:
+ *  - `gate`  { status, percent }: the chunked SDK total moved by `percent`.
+ *  - `skip`  reason: the gate is non-actionable (report stable, no comment).
+ *  - `error` reason: the gate inputs are missing (hard failure).
+ */
+function compareBundles({ current, base, threshold }) {
+  const report = ["=== Bundle sizes (gzipped, current vs base) ==="];
+  const keys = [...new Set([...current, ...base].map(keyOf))].sort();
+  for (const key of keys) {
+    const [bundle, kind] = key.split("/");
+    const currentRow = pick(current, bundle, kind);
+    const baseRow = pick(base, bundle, kind);
+    if (!currentRow || !baseRow) {
+      report.push(`${key}: present only in ${currentRow ? "current" : "base"} build`);
+      continue;
+    }
+    const diff = currentRow.gzipBytes - baseRow.gzipBytes;
+    const percent = percentOf(currentRow.gzipBytes, baseRow.gzipBytes);
+    report.push(`${key}: ${mb(currentRow.gzipBytes)}MB vs ${mb(baseRow.gzipBytes)}MB (${percent}%, ${diff} bytes)`);
+  }
+
+  // Gate on the chunked SDK's reachable total (gzipped) — what the SDK ships.
+  const gateCurrent = pick(current, "embedding-sdk-chunked", "total");
+  const gateBase = pick(base, "embedding-sdk-chunked", "total");
+  if (!gateCurrent || !gateBase || !gateBase.gzipBytes) {
+    return { report, error: "Could not find embedding-sdk-chunked total (gzip) in both builds" };
+  }
+
+  // Both sides must measure "total" the same way. A base ref built before the
+  // reachableAssets enrichment collapses its total to the initial set, so
+  // comparing it against the current reachable total reports a phantom jump
+  // (~30%). Skip until the base ref also carries reachable stats (i.e. once
+  // this change is on the base).
+  if (Boolean(gateCurrent.reachable) !== Boolean(gateBase.reachable)) {
+    return {
+      report,
+      skip:
+        `chunked "total" measured differently on each side ` +
+        `(current reachable=${Boolean(gateCurrent.reachable)}, base reachable=${Boolean(gateBase.reachable)}); ` +
+        `the base ref predates the reachable-chunk stats. Resolves once this change is on the base ref.`,
+    };
+  }
+
+  const percent = percentOf(gateCurrent.gzipBytes, gateBase.gzipBytes);
+  const status = percent > threshold ? "increased" : percent < -threshold ? "decreased" : "stable";
+  return { report, gate: { status, percent } };
+}
+
+module.exports = { compareBundles };
+
+const setOutput = (name, value) => {
+  if (process.env.GITHUB_OUTPUT) {
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
+  }
+};
+
+function main() {
+  const [, , currentPath, basePath] = process.argv;
+  const threshold = Number(process.env.THRESHOLD ?? 2);
+
+  const current = JSON.parse(fs.readFileSync(currentPath, "utf8"));
+  const base = JSON.parse(fs.readFileSync(basePath, "utf8"));
+
+  const { report, gate, skip, error } = compareBundles({ current, base, threshold });
+  console.log(report.join("\n"));
+
+  if (error) {
+    console.error(`::error::${error}`);
+    process.exit(1);
+  }
+
+  if (skip) {
+    // Treat the gate as non-actionable: report stable so no regression comment
+    // is posted, mirroring the shell skip() for missing artifacts.
+    console.log(`::notice::Embedding SDK bundle-size gate skipped: ${skip}`);
+    setOutput("status", "stable");
+    setOutput("size_change_percent", "0");
+    process.exit(0);
+  }
+
+  console.log("");
+  console.log(`Gate: embedding-sdk-chunked total ${gate.percent}% (threshold ${threshold}%) → ${gate.status}`);
+
+  setOutput("status", gate.status);
+  setOutput("size_change_percent", gate.percent);
+}
+
+if (require.main === module) {
+  main();
+}

.github/actions/sdk-bundle-size-check/compare.unit.spec.js

@@ -0,0 +1,65 @@
+const { compareBundles } = require("./compare");
+
+const total = (gzipBytes, over = {}) => ({
+  bundle: "embedding-sdk-chunked",
+  kind: "total",
+  gzipBytes,
+  reachable: true,
+  ...over,
+});
+
+describe("compareBundles", () => {
+  it("gates on the chunked SDK total and flags an increase past the threshold", () => {
+    const { gate, report } = compareBundles({
+      current: [total(110)],
+      base: [total(100)],
+      threshold: 2,
+    });
+
+    expect(gate).toEqual({ status: "increased", percent: 10 });
+    expect(report[0]).toContain("current vs base");
+  });
+
+  it("flags a decrease and stays stable within the threshold", () => {
+    expect(compareBundles({ current: [total(90)], base: [total(100)], threshold: 2 }).gate).toEqual({
+      status: "decreased",
+      percent: -10,
+    });
+    expect(compareBundles({ current: [total(101)], base: [total(100)], threshold: 2 }).gate).toEqual({
+      status: "stable",
+      percent: 1,
+    });
+  });
+
+  it("skips when the two sides measured total differently (reachable mismatch)", () => {
+    const result = compareBundles({
+      current: [total(130, { reachable: true })],
+      base: [total(100, { reachable: false })],
+      threshold: 2,
+    });
+
+    expect(result.gate).toBeUndefined();
+    expect(result.skip).toContain("predates the reachable-chunk stats");
+  });
+
+  it("errors when the gate bundle is missing on either side", () => {
+    const result = compareBundles({
+      current: [{ bundle: "app", kind: "total", gzipBytes: 1 }],
+      base: [total(100)],
+      threshold: 2,
+    });
+
+    expect(result.gate).toBeUndefined();
+    expect(result.error).toContain("embedding-sdk-chunked total");
+  });
+
+  it("reports a bundle/kind present on only one side without erroring", () => {
+    const { report } = compareBundles({
+      current: [total(100), { bundle: "app", kind: "total", gzipBytes: 50 }],
+      base: [total(100)],
+      threshold: 2,
+    });
+
+    expect(report.some(line => line.includes("present only in current build"))).toBe(true);
+  });
+});

.github/actions/test-driver/action.yml

@@ -14,8 +14,15 @@ inputs:
     description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
   edition:
     required: false
-    default: 'ee'
+    default: "ee"
     description: Edition to test (oss or ee)
+  quarantine-engine:
+    required: false
+  driver-status:
+    required: false
+    default: ""
+    description: >-
+      Configured status for this driver ("info", "skip", "required", or empty), as reported by `mage driver-decisions`.
 
 outputs:
   test-outcome:
@@ -27,6 +34,10 @@ runs:
   steps:
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
+    - name: Resolve current job id
+      # Resolve JOB_ID early (before the long test step) so the ci-conductor
+      # reporter below can link failures to this exact job. Best-effort.
+      uses: ./.github/actions/resolve-job-id
     - name: Prepare front-end environment
       if: ${{ inputs.build-static-viz == 'true' }}
       uses: ./.github/actions/prepare-frontend
@@ -35,15 +46,25 @@ runs:
       run: bun run build-static-viz
       shell: bash
       env:
-        MB_EDITION: ee
+        MB_EDITION: ${{ inputs.edition }}
+
     - name: Test database driver
       run: clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash
       id: run-test
-      # Trunk Quarantine controls the final state of the run in the CI!
-      # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-      # whether to fail or to pass the whole job, based on the quarantine list.
+      # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
+      # Driver "info" status can affect this logic. See below.
       continue-on-error: true
+
+    - name: Report failed tests to ci-conductor
+      if: ${{ !cancelled() && steps.run-test.outcome == 'failure' }}
+      # This step should NEVER fail the job!
+      continue-on-error: true
+      uses: ./.github/actions/report-failures-to-ci-conductor
+      with:
+        test-suite: ${{ inputs.junit-name }}
+        adapter: backend
+
     - name: Publish Test Report (JUnit)
       uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
@@ -57,6 +78,7 @@ runs:
         list-suites: failed
         list-tests: failed
         fail-on-error: false
+
     - name: Upload Logs on Failure
       if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v7
@@ -66,3 +88,20 @@ runs:
         retention-days: 1
       # Failing to upload the artifact should never affect the outcome of the whole test run.
       continue-on-error: true
+
+    # Last, because this is the only step allowed to fail the job: everything above it reports the
+    # failure (JUnit report, logs, ci-conductor) and must run regardless of the verdict below.
+    - name: Quarantine gate
+      # Off master and release branches an "info" driver is data-collection only - the test always passes!
+      # On master and release branches "info" carries no weight - the quarantine logic applies.
+      if: |
+        !cancelled()
+        && steps.run-test.outcome == 'failure'
+        && !(inputs.driver-status == 'info'
+             && !(github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')))
+      continue-on-error: ${{ inputs.quarantine-engine != 'ci-conductor' }}
+      uses: ./.github/actions/quarantine-gate
+      with:
+        adapter: backend
+        test-suite: ${{ inputs.junit-name }}
+        enforce-quarantine: ${{ inputs.quarantine-engine == 'ci-conductor' }}

.github/actions/upload-test-results/action.yml

@@ -34,6 +34,10 @@ inputs:
     description: >-
       Optional label disambiguating matrix legs of the same job, so the info-driver
       job summary and PR comment stay distinct per leg.
+  run-trunk:
+    required: false
+    default: "true"
+    description: Whether to run the Trunk step at all.
 
 runs:
   using: "composite"
@@ -60,13 +64,12 @@ runs:
         aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
 
     - name: Upload results to Trunk
+      if: ${{ always() && github.repository_owner == 'metabase' && inputs.run-trunk == 'true' }}
       # Important!
-      # 1. This step must always run because it controls job's exit code.
-      # 2. There's no point in running this outside the organization
-      # 3. For "info" drivers our own status takes precedence: we let this step pass so
-      #    the job is reported as passing regardless of the real outcome (still uploaded).
-      if: always() && github.repository_owner == 'metabase'
-      continue-on-error: ${{ inputs.driver-status == 'info' }}
+      # For "info" drivers off master/release branches, our own status takes precedence: we let this
+      # step pass so the job is reported as passing regardless of the real outcome (still uploaded).
+      # On master and release branches, info status is ignored and the real outcome gates the job.
+      continue-on-error: ${{ inputs.driver-status == 'info' && !(github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
       uses: trunk-io/analytics-uploader@1198efcc0976501147b10a7e343c3fa069527526 # v2.0.9
       env:
         TRUNK_REPO_URL: git@github.com:metabase/metabase.git

.github/file-paths.yaml

@@ -7,6 +7,10 @@ default: &default
   - "locales/**"
   - "bin/**/!(*.md)"
 
+actionlint:
+  - ".github/workflows/*.yml"
+  - ".github/workflows/*.yaml"
+
 shared_sources: &shared_sources
   - "src/**/*.cljc"
   - "src/**/*.cljs"
@@ -95,6 +99,12 @@ frontend_loki_infra: &frontend_loki_infra
   - *shared_ci
   - *frontend_loki_ci
 
+# e2e harness/support code (commands, support file, runner). Not in the
+# instrumented bundle, so it maps to no covered module — a change here forces a
+# full e2e run (see create-test-plan / e2eInfraTouched).
+e2e_infra: &e2e_infra
+  - *shared_e2e
+
 backend_ci: &backend_ci
   - *shared_ci
   - ".github/actions/test-driver/**"

.github/scripts/affected-modules.ts

@@ -1,32 +1,191 @@
+import micromatch from "micromatch";
+
 export type ModuleDef = { type: string; pattern: string };
 export type Rule = { from: string[]; allow: string[] };
 
-type ModuleNode = { type: string; regex: RegExp };
+export type ModuleNode = { type: string; regex: RegExp };
+
+export type FileDependency = { source: string; dependencies: string[] };
+
+/** First match wins, so element order matters for nested patterns. */
+export function buildNodes(elements: ModuleDef[]): ModuleNode[] {
+  return elements.map((el) => ({
+    type: el.type,
+    // dot:true so files in dot-directories (e.g. .storybook) still match.
+    regex: micromatch.makeRe(el.pattern, { dot: true }),
+  }));
+}
+
+export function mapFileToModule(
+  nodes: ModuleNode[],
+  path: string,
+): string | null {
+  for (const node of nodes) {
+    if (node.regex.test(path)) {
+      return node.type;
+    }
+  }
+  return null;
+}
+
+export function getChangedModules(
+  nodes: ModuleNode[],
+  changedFiles: string[],
+): Set<string> {
+  const direct = new Set<string>();
+  for (const file of changedFiles) {
+    const module = mapFileToModule(nodes, file);
+    if (module) {
+      direct.add(module);
+    }
+  }
+  return direct;
+}
+
+export type FileGraph = {
+  nodes: ModuleNode[];
+  fileDependents: Map<string, Set<string>>;
+};
+
+/** Drops unresolvable imports (e.g. ambient types) that point at no real file. */
+export function parseCruiseModules(
+  modules: Array<{
+    source: string;
+    dependencies?: Array<{ resolved: string; couldNotResolve?: boolean }>;
+  }>,
+): FileDependency[] {
+  return modules.map((module) => ({
+    source: module.source,
+    dependencies: (module.dependencies ?? [])
+      .filter((dep) => !dep.couldNotResolve)
+      .map((dep) => dep.resolved),
+  }));
+}
+
+/** Inverts the import edges into the `fileDependents` reverse graph. */
+export function buildFileGraph(
+  elements: ModuleDef[],
+  fileDependencies: FileDependency[],
+): FileGraph {
+  const fileDependents = new Map<string, Set<string>>();
+  for (const { source, dependencies } of fileDependencies) {
+    for (const target of dependencies) {
+      let importers = fileDependents.get(target);
+      if (!importers) {
+        importers = new Set();
+        fileDependents.set(target, importers);
+      }
+      importers.add(source);
+    }
+  }
+  return { nodes: buildNodes(elements), fileDependents };
+}
+
+/** Changed files plus every file that transitively imports them. */
+export function getAffectedFiles(
+  fileGraph: FileGraph,
+  changedFiles: string[],
+): Set<string> {
+  const affected = new Set(changedFiles);
+  const queue = [...changedFiles];
+  while (queue.length > 0) {
+    const file = queue.shift()!;
+    for (const importer of fileGraph.fileDependents.get(file) ?? []) {
+      if (!affected.has(importer)) {
+        affected.add(importer);
+        queue.push(importer);
+      }
+    }
+  }
+  return affected;
+}
 
 export type ModuleGraph = {
   nodes: ModuleNode[];
+  /**
+   * dependents.get(M) is every module affected when M changes — the full
+   * transitive closure, so getAffectedModules only needs a single hop.
+   */
   dependents: Map<string, Set<string>>;
 };
 
+/** Expands a direct-dependents map into its transitive closure. */
+function transitiveClosure(
+  direct: Map<string, Set<string>>,
+): Map<string, Set<string>> {
+  const closure = new Map<string, Set<string>>();
+  for (const start of direct.keys()) {
+    const reached = new Set<string>();
+    const queue = [...(direct.get(start) ?? [])];
+    while (queue.length > 0) {
+      const node = queue.shift()!;
+      if (reached.has(node)) {
+        continue;
+      }
+      reached.add(node);
+      for (const next of direct.get(node) ?? []) {
+        queue.push(next);
+      }
+    }
+    reached.delete(start);
+    closure.set(start, reached);
+  }
+  return closure;
+}
+
 /**
- * Compiles a glob pattern to an anchored RegExp.
+ * Builds a module graph from the actual import graph. Reachability is computed
+ * per module at the file level and then collapsed to modules.
  */
-export function globToRegex(glob: string): RegExp {
-  const escapeSegment = (seg: string) =>
-    seg.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
-  const body = glob.split("**").map(escapeSegment).join(".*");
-  return new RegExp(`^${body}$`);
+export function buildUsageModuleGraph(
+  elements: ModuleDef[],
+  fileDependencies: FileDependency[],
+): ModuleGraph {
+  const nodes = buildNodes(elements);
+  const fileGraph = buildFileGraph(elements, fileDependencies);
+
+  const filesByModule = new Map<string, string[]>();
+  const allFiles = new Set<string>();
+  for (const { source, dependencies } of fileDependencies) {
+    allFiles.add(source);
+    for (const target of dependencies) {
+      allFiles.add(target);
+    }
+  }
+  for (const file of allFiles) {
+    const module = mapFileToModule(nodes, file);
+    if (module) {
+      const files = filesByModule.get(module);
+      if (files) {
+        files.push(file);
+      } else {
+        filesByModule.set(module, [file]);
+      }
+    }
+  }
+
+  const dependents = new Map<string, Set<string>>(
+    elements.map((el) => [el.type, new Set()]),
+  );
+  for (const [module, files] of filesByModule) {
+    const affected = new Set<string>();
+    for (const file of getAffectedFiles(fileGraph, files)) {
+      const owner = mapFileToModule(nodes, file);
+      if (owner && owner !== module) {
+        affected.add(owner);
+      }
+    }
+    dependents.set(module, affected);
+  }
+
+  return { nodes, dependents };
 }
 
 export function buildModuleGraph(
   elements: ModuleDef[],
   rules: Rule[],
 ): ModuleGraph {
-  const nodes = elements.map((el) => ({
-    type: el.type,
-    regex: globToRegex(el.pattern),
-  }));
-
+  const nodes = buildNodes(elements);
   const allTypes = elements.map((e) => e.type);
 
   function expandPattern(pattern: string): string[] {
@@ -40,9 +199,7 @@ export function buildModuleGraph(
     return allTypes.includes(pattern) ? [pattern] : [];
   }
 
-  // dependents.get(M) is the set of modules that depend on M
-  // i.e. modules that are affected when M changes
-  const dependents = new Map<string, Set<string>>(
+  const directDependents = new Map<string, Set<string>>(
     allTypes.map((type) => [type, new Set()]),
   );
   for (const rule of rules) {
@@ -51,46 +208,13 @@ export function buildModuleGraph(
     for (const target of allowTypes) {
       for (const importer of fromTypes) {
         if (importer !== target) {
-          dependents.get(target)?.add(importer);
+          directDependents.get(target)?.add(importer);
         }
       }
     }
   }
 
-  return { nodes, dependents };
-}
-
-/**
- * Returns the module type that owns the given file.
- * First match wins, so element ordering matters for nested patterns.
- */
-export function mapFileToModule(
-  moduleGraph: ModuleGraph,
-  path: string,
-): string | null {
-  for (const el of moduleGraph.nodes) {
-    if (el.regex.test(path)) {
-      return el.type;
-    }
-  }
-  return null;
-}
-
-/**
- * Returns the set of module types containing any of the changed files.
- */
-export function getChangedModules(
-  moduleGraph: ModuleGraph,
-  changedFiles: string[],
-): Set<string> {
-  const direct = new Set<string>();
-  for (const file of changedFiles) {
-    const module = mapFileToModule(moduleGraph, file);
-    if (module) {
-      direct.add(module);
-    }
-  }
-  return direct;
+  return { nodes, dependents: transitiveClosure(directDependents) };
 }
 
 /**
@@ -100,16 +224,10 @@ export function getAffectedModules(
   moduleGraph: ModuleGraph,
   changedFiles: string[],
 ): Set<string> {
-  const direct = getChangedModules(moduleGraph, changedFiles);
-  const affected = new Set(direct);
-  const queue = [...direct];
-  while (queue.length > 0) {
-    const module = queue.shift()!;
+  const affected = getChangedModules(moduleGraph.nodes, changedFiles);
+  for (const module of [...affected]) {
     for (const dep of moduleGraph.dependents.get(module) ?? []) {
-      if (!affected.has(dep)) {
-        affected.add(dep);
-        queue.push(dep);
-      }
+      affected.add(dep);
     }
   }
   return affected;

.github/scripts/affected-modules.unit.spec.ts

@@ -1,8 +1,13 @@
 import {
+  buildFileGraph,
   buildModuleGraph,
+  buildNodes,
+  buildUsageModuleGraph,
+  getAffectedFiles,
   getAffectedModules,
   getChangedModules,
   mapFileToModule,
+  parseCruiseModules,
 } from "./affected-modules";
 
 const ELEMENTS = [
@@ -31,6 +36,7 @@ const RULES = [
   { from: ["app/*"], allow: ["lib/*", "feature/*", "app/*"] },
 ];
 
+const nodes = buildNodes(ELEMENTS);
 const graph = buildModuleGraph(ELEMENTS, RULES);
 
 describe("affected modules", () => {
@@ -49,19 +55,19 @@ describe("affected modules", () => {
       ["external/lib/foo.ts", "feature/external"],
       ["src/embed.tsx", "app/main"],
     ])("should map %s to %s", (path, expected) => {
-      expect(mapFileToModule(graph, path)).toBe(expected);
+      expect(mapFileToModule(nodes, path)).toBe(expected);
     });
 
     it("should return null for files outside any pattern", () => {
-      expect(mapFileToModule(graph, "docs/foo.md")).toBe(null);
-      expect(mapFileToModule(graph, "README.md")).toBe(null);
-      expect(mapFileToModule(graph, "external/notlib/foo.ts")).toBe(null);
+      expect(mapFileToModule(nodes, "docs/foo.md")).toBe(null);
+      expect(mapFileToModule(nodes, "README.md")).toBe(null);
+      expect(mapFileToModule(nodes, "external/notlib/foo.ts")).toBe(null);
     });
   });
 
   describe("getChangedModules", () => {
     it("should return the unique set of modules whose files changed", () => {
-      const result = getChangedModules(graph, [
+      const result = getChangedModules(nodes, [
         "src/utils/colors.ts",
         "src/foo/x.ts",
         "src/foo/y.ts",
@@ -71,11 +77,81 @@ describe("affected modules", () => {
     });
 
     it("should return an empty set when no file maps to a module", () => {
-      expect(getChangedModules(graph, ["docs/foo.md"]).size).toBe(0);
+      expect(getChangedModules(nodes, ["docs/foo.md"]).size).toBe(0);
     });
   });
 
-  describe("getAffectedModules", () => {
+  describe("parseCruiseModules", () => {
+    it("should flatten to source + resolved-paths and drop unresolved deps", () => {
+      expect(
+        parseCruiseModules([
+          {
+            source: "src/foo/foo.tsx",
+            dependencies: [
+              { resolved: "src/utils/colors.ts" },
+              { resolved: "ambient/types", couldNotResolve: true },
+            ],
+          },
+          { source: "src/bar/bar.tsx" }, // no dependencies key
+        ]),
+      ).toEqual([
+        { source: "src/foo/foo.tsx", dependencies: ["src/utils/colors.ts"] },
+        { source: "src/bar/bar.tsx", dependencies: [] },
+      ]);
+    });
+  });
+
+  const FILE_DEPS = [
+    { source: "src/app.js", dependencies: ["src/foo/foo.tsx"] },
+    { source: "src/bar/bar.tsx", dependencies: ["src/embed.tsx"] },
+    { source: "src/foo/foo.tsx", dependencies: ["src/utils/colors.ts"] },
+  ];
+  const fileGraph = buildFileGraph(ELEMENTS, FILE_DEPS);
+
+  describe("getAffectedFiles", () => {
+    it("should return the changed file and everything that imports it", () => {
+      expect(
+        [...getAffectedFiles(fileGraph, ["src/utils/colors.ts"])].sort(),
+      ).toEqual(["src/app.js", "src/foo/foo.tsx", "src/utils/colors.ts"]);
+    });
+
+    it("should include a changed file with no importers (itself only)", () => {
+      // Nothing imports the app.js entry point.
+      expect([...getAffectedFiles(fileGraph, ["src/app.js"])]).toEqual([
+        "src/app.js",
+      ]);
+    });
+  });
+
+  describe("buildUsageModuleGraph + getAffectedModules", () => {
+    const usageGraph = buildUsageModuleGraph(ELEMENTS, FILE_DEPS);
+
+    it("should expand a changed module to its file-level affected modules", () => {
+      expect(
+        [...getAffectedModules(usageGraph, ["src/utils/colors.ts"])].sort(),
+      ).toEqual(["app/main", "feature/foo", "lib/utils"]);
+    });
+
+    it("should NOT pull in feature/bar via the app/main hub", () => {
+      const affected = getAffectedModules(usageGraph, ["src/foo/foo.tsx"]);
+      expect([...affected].sort()).toEqual(["app/main", "feature/foo"]);
+      expect(affected.has("feature/bar")).toBe(false);
+    });
+
+    it("should treat the whole changed module as changed", () => {
+      // app.js itself has no importers, but app/main also owns embed.tsx, which
+      // feature/bar imports so changing any app/main file flags feature/bar.
+      expect(
+        [...getAffectedModules(usageGraph, ["src/app.js"])].sort(),
+      ).toEqual(["app/main", "feature/bar"]);
+    });
+
+    it("should return empty when no file maps to a module", () => {
+      expect(getAffectedModules(usageGraph, ["docs/foo.md"]).size).toBe(0);
+    });
+  });
+
+  describe("getAffectedModules (rules graph)", () => {
     it("should affect feature/super and app/main but not feature/bar when feature/foo changes", () => {
       const result = getAffectedModules(graph, ["src/foo/x.ts"]);
       expect([...result].sort()).toEqual([

.github/scripts/affected-tests.ts

@@ -1,36 +1,40 @@
-// Per-suite affected-tests logic: combines module-affected closure with
-// per-suite "infra-touched" booleans (computed by dorny/paths-filter against
-// the `frontend_unit_infra` / `frontend_loki_infra` anchors in file-paths.yaml).
-// When infra files change, the whole suite runs in full.
+// Builds the affected-tests plan from raw inputs: computes the rules and usage
+// affected-module sets and selects, per suite, which specs to run under each.
+import { getFeatureModules } from "../../frontend/lint/module-boundaries.mjs";
 
 import {
+  type FileDependency,
   type ModuleDef,
-  type ModuleGraph,
+  type ModuleNode,
   type Rule,
   buildModuleGraph,
+  buildUsageModuleGraph,
   getAffectedModules,
   getChangedModules,
   mapFileToModule,
 } from "./affected-modules";
 
-export type TestSuiteDef = {
-  statsPrefix: string;
-  runAllTests?: boolean;
-};
-
 export type TestPlanStats = {
-  modules_changed: number;
-  modules_affected: number;
-  modules_affected_list: string[];
-  fe_unit_specs_total: number;
-  fe_unit_specs_run: number;
-  fe_unit_specs_skipped: number;
-  loki_stories_total: number;
-  loki_stories_run: number;
-  loki_stories_skipped: number;
-  e2e_specs_total: number;
-  e2e_specs_run: number;
-  e2e_specs_skipped: number;
+  fe_files_changed: number;
+  fe_files_total: number;
+  be_files_changed: number;
+  be_files_total: number;
+  unit_infra_touched: boolean;
+  loki_infra_touched: boolean;
+  shared_sources_touched: boolean;
+  fe_modules_total: number;
+  fe_modules_changed: number;
+  fe_modules_affected_rules: number;
+  fe_modules_affected_usage: number;
+  unit_specs_all: number;
+  unit_specs_to_run_rules: number;
+  unit_specs_to_run_usage: number;
+  loki_stories_all: number;
+  loki_stories_to_run_rules: number;
+  loki_stories_to_run_usage: number;
+  e2e_specs_all: number;
+  e2e_specs_to_run_rules: number;
+  e2e_specs_to_run_usage: number;
 };
 
 export type TestPlan = {
@@ -40,101 +44,187 @@ export type TestPlan = {
   e2e_specs_to_run: string[];
 };
 
-export const TEST_SUITES = {
-  unit: {
-    statsPrefix: "fe_unit_specs",
-  },
-  loki: {
-    statsPrefix: "loki_stories",
-  },
-  e2e: {
-    statsPrefix: "e2e_specs",
-    // We don't map changed files to e2e tests yet, so for now just run them all
-    runAllTests: true,
-  },
-} satisfies Record<string, TestSuiteDef>;
-
-export function createTestPlan({
-  elements,
-  rules,
-  testSuites,
-  changedFiles,
-  testFilesBySuite,
-  infraTouchedBySuite,
-}: {
+export type CreateTestPlanInput = {
   elements: ModuleDef[];
   rules: Rule[];
-  testSuites: Record<string, TestSuiteDef>;
   changedFiles: string[];
-  testFilesBySuite: Record<string, string[]>;
-  infraTouchedBySuite: Record<string, boolean>;
-}): TestPlan {
-  const moduleGraph = buildModuleGraph(elements, rules);
+  // Parsed dependency-cruiser edges, or null to fall back to the rules graph.
+  fileDependencies: FileDependency[] | null;
+  testFilesBySuite: { unit: string[]; loki: string[]; e2e: string[] };
+  e2eSpecFiles: Record<string, string[]> | null;
+  unitInfraTouched: boolean;
+  lokiInfraTouched: boolean;
+  e2eInfraTouched: boolean;
+  sharedSourcesTouched: boolean;
+  feFilesChanged: number;
+  beFilesChanged: number;
+  feFilesTotal: number;
+  beFilesTotal: number;
+};
 
-  const changedModules = getChangedModules(moduleGraph, changedFiles);
-  const modulesAffected = getAffectedModules(moduleGraph, changedFiles);
-  const modulesAffectedList = [...modulesAffected].sort();
-
-  const specsToRun: Record<string, string[]> = {};
-  const stats: Record<string, number | string[]> = {
-    modules_changed: changedModules.size,
-    modules_affected: modulesAffected.size,
-    modules_affected_list: modulesAffectedList,
-  };
-
-  for (const [name, testSuite] of Object.entries(testSuites)) {
-    const files = testFilesBySuite[name] ?? [];
-    const tests = createTestPlanForSuite(
-      moduleGraph,
-      testSuite,
-      infraTouchedBySuite[name] ?? false,
-      changedFiles,
-      files,
-    );
-    specsToRun[name] = tests;
-    stats[`${testSuite.statsPrefix}_total`] = files.length;
-    stats[`${testSuite.statsPrefix}_run`] = tests.length;
-    stats[`${testSuite.statsPrefix}_skipped`] = files.length - tests.length;
-  }
-
-  return {
-    stats: stats as TestPlanStats,
-    fe_unit_specs_to_run: specsToRun.unit ?? [],
-    loki_stories_to_run: specsToRun.loki ?? [],
-    e2e_specs_to_run: specsToRun.e2e ?? [],
-  };
-}
-
-/**
- * Computes the test plan for one test suite
- *
- * Runs the full suite when `runAllTests` is set or `infraTouched` is true,
- * otherwise runs the tests based on affected-modules.
- */
-export function createTestPlanForSuite(
-  moduleGraph: ModuleGraph,
-  testSuite: TestSuiteDef,
-  infraTouched: boolean,
-  changedFiles: string[],
-  allTestFiles: string[],
-): string[] {
-  if (testSuite.runAllTests || infraTouched) {
-    return allTestFiles;
-  }
-  const affected = getAffectedModules(moduleGraph, changedFiles);
-  return filterAffectedTests(moduleGraph, affected, allTestFiles);
-}
-
-/**
- * Filters the test-file list down to tests whose owning module is affected.
- */
+// Tests whose owning module is affected.
 export function filterAffectedTests(
-  moduleGraph: ModuleGraph,
+  nodes: ModuleNode[],
   affected: Set<string>,
   testFiles: string[],
 ): string[] {
   return testFiles.filter((file) => {
-    const module = mapFileToModule(moduleGraph, file);
+    const module = mapFileToModule(nodes, file);
     return module !== null && affected.has(module);
   });
 }
+
+// Collapse each spec's covered files to the *feature* modules it exercises,
+// once, for reuse across the rules/usage selects. Non-feature tiers
+// (shared/lib/...) are intentionally dropped: the manifest is a stale nightly
+// artifact, so its coupling to the module graph stays minimal ("does this spec
+// touch feature X?"). Accuracy comes from the fresh `affected` set, which
+// already expands a shared/infra change into the feature modules that depend on
+// it.
+export function specFeatureModules(
+  nodes: ModuleNode[],
+  featureModules: Set<string>,
+  specFiles: Record<string, string[]>,
+): Map<string, Set<string>> {
+  const moduleCache = new Map<string, string | null>();
+  const moduleOf = (file: string): string | null => {
+    let module = moduleCache.get(file);
+    if (module === undefined) {
+      module = mapFileToModule(nodes, file);
+      moduleCache.set(file, module);
+    }
+    return module;
+  };
+
+  const result = new Map<string, Set<string>>();
+  for (const [spec, files] of Object.entries(specFiles)) {
+    const features = new Set<string>();
+    for (const file of files) {
+      const module = moduleOf(file);
+      if (module !== null && featureModules.has(module)) {
+        features.add(module);
+      }
+    }
+    result.set(spec, features);
+  }
+  return result;
+}
+
+// A spec runs if any feature module it covers is affected.
+// A spec doesn't map to any feature module always runs because its scope is unknown
+export function filterAffectedE2eSpecs(
+  specFeatures: Map<string, Set<string>>,
+  affected: Set<string>,
+  e2eSpecs: string[],
+): string[] {
+  return e2eSpecs.filter((spec) => {
+    const features = specFeatures.get(spec);
+    if (!features || features.size === 0) {
+      return true;
+    }
+    return [...features].some((module) => affected.has(module));
+  });
+}
+
+export function createTestPlan({
+  elements,
+  rules,
+  changedFiles,
+  fileDependencies,
+  testFilesBySuite,
+  e2eSpecFiles,
+  unitInfraTouched,
+  lokiInfraTouched,
+  e2eInfraTouched,
+  sharedSourcesTouched,
+  feFilesChanged,
+  beFilesChanged,
+  feFilesTotal,
+  beFilesTotal,
+}: CreateTestPlanInput): TestPlan {
+  const rulesGraph = buildModuleGraph(elements, rules);
+  const usageGraph = fileDependencies
+    ? buildUsageModuleGraph(elements, fileDependencies)
+    : rulesGraph;
+
+  const nodes = rulesGraph.nodes;
+  // Distinct module types (an element type can span several patterns).
+  const totalModules = new Set(elements.map((el) => el.type)).size;
+  const changedModules = getChangedModules(nodes, changedFiles);
+  const rulesAffected = getAffectedModules(rulesGraph, changedFiles);
+  const usageAffected = getAffectedModules(usageGraph, changedFiles);
+
+  // The coarse "feature" tier is the only set the e2e manifest is ever
+  // collapsed to (see filterAffectedE2eSpecs).
+  const featureModules = new Set(getFeatureModules(elements));
+
+  // cljc/cljs compile into the FE bundle, so they force a full run that module
+  // selection can't narrow — same effect as a suite's own infra changing.
+  const unitForceAll = unitInfraTouched || sharedSourcesTouched;
+  const lokiForceAll = lokiInfraTouched || sharedSourcesTouched;
+  // e2e is integration-level, so anything the FE-coverage manifest can't see
+  // forces a full run: cljc/cljs in the bundle (sharedSourcesTouched), a backend
+  // change that can break the UI (beFilesChanged), an e2e harness/support change
+  // (e2eInfraTouched), or no manifest at all.
+  const e2eForceAll =
+    sharedSourcesTouched ||
+    e2eInfraTouched ||
+    beFilesChanged > 0 ||
+    e2eSpecFiles === null;
+
+  const select = (forceAll: boolean, affected: Set<string>, files: string[]) =>
+    forceAll ? files : filterAffectedTests(nodes, affected, files);
+
+  const { unit, loki, e2e } = testFilesBySuite;
+  const unitRules = select(unitForceAll, rulesAffected, unit);
+  const unitUsage = select(unitForceAll, usageAffected, unit);
+  const lokiRules = select(lokiForceAll, rulesAffected, loki);
+  const lokiUsage = select(lokiForceAll, usageAffected, loki);
+
+  // Precompute spec -> feature modules once (null when e2e runs in full).
+  const specFeatures =
+    e2eForceAll || e2eSpecFiles === null
+      ? null
+      : specFeatureModules(nodes, featureModules, e2eSpecFiles);
+  // A spec that was itself edited always runs, even when no app module changed.
+  const changedSet = new Set(changedFiles);
+  const selectE2e = (affected: Set<string>): string[] => {
+    if (specFeatures === null) {
+      return e2e;
+    }
+    const narrowed = new Set(
+      filterAffectedE2eSpecs(specFeatures, affected, e2e),
+    );
+    return e2e.filter((spec) => narrowed.has(spec) || changedSet.has(spec));
+  };
+  const e2eRules = selectE2e(rulesAffected);
+  const e2eUsage = selectE2e(usageAffected);
+
+  return {
+    stats: {
+      fe_files_changed: feFilesChanged,
+      fe_files_total: feFilesTotal,
+      be_files_changed: beFilesChanged,
+      be_files_total: beFilesTotal,
+      unit_infra_touched: unitInfraTouched,
+      loki_infra_touched: lokiInfraTouched,
+      shared_sources_touched: sharedSourcesTouched,
+      fe_modules_total: totalModules,
+      fe_modules_changed: changedModules.size,
+      fe_modules_affected_rules: rulesAffected.size,
+      fe_modules_affected_usage: usageAffected.size,
+      unit_specs_all: unit.length,
+      unit_specs_to_run_rules: unitRules.length,
+      unit_specs_to_run_usage: unitUsage.length,
+      loki_stories_all: loki.length,
+      loki_stories_to_run_rules: lokiRules.length,
+      loki_stories_to_run_usage: lokiUsage.length,
+      e2e_specs_all: e2e.length,
+      e2e_specs_to_run_rules: e2eRules.length,
+      e2e_specs_to_run_usage: e2eUsage.length,
+    },
+    fe_unit_specs_to_run: unitUsage,
+    loki_stories_to_run: lokiUsage,
+    e2e_specs_to_run: e2eUsage,
+  };
+}

.github/scripts/affected-tests.unit.spec.ts

@@ -1,9 +1,5 @@
-import { buildModuleGraph } from "./affected-modules";
-import {
-  createTestPlan,
-  createTestPlanForSuite,
-  filterAffectedTests,
-} from "./affected-tests";
+import { buildNodes } from "./affected-modules";
+import { createTestPlan, filterAffectedTests } from "./affected-tests";
 
 const ELEMENTS = [
   { type: "lib/utils", pattern: "src/utils/**" },
@@ -18,12 +14,6 @@ const RULES = [
   { from: ["feature/*"], allow: ["lib/*"] },
 ];
 
-const TEST_SUITE_DEFS = {
-  unit: { statsPrefix: "fe_unit_specs" },
-  loki: { statsPrefix: "loki_stories" },
-  e2e: { statsPrefix: "e2e_specs", runAllTests: true },
-};
-
 const UNIT_FILES = [
   "src/foo/foo.unit.spec.ts",
   "src/foo/bar.unit.spec.ts",
@@ -33,158 +23,227 @@ const UNIT_FILES = [
 const LOKI_FILES = ["src/foo/Foo.stories.tsx", "src/bar/Bar.stories.tsx"];
 const E2E_FILES = ["e2e/test/scenarios/a.cy.spec.ts"];
 
-const moduleGraph = buildModuleGraph(ELEMENTS, RULES);
+const baseInput = {
+  elements: ELEMENTS,
+  rules: RULES,
+  fileDependencies: null,
+  testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e: E2E_FILES },
+  e2eSpecFiles: null,
+  unitInfraTouched: false,
+  lokiInfraTouched: false,
+  e2eInfraTouched: false,
+  sharedSourcesTouched: false,
+  feFilesChanged: 0,
+  beFilesChanged: 0,
+  feFilesTotal: 0,
+  beFilesTotal: 0,
+};
 
-describe("affected tests", () => {
-  describe("createTestPlanForSuite", () => {
-    it("should run all tests when infra is touched", () => {
-      const result = createTestPlanForSuite(
-        moduleGraph,
-        TEST_SUITE_DEFS.unit,
-        true, // infraTouched
-        ["src/foo/x.ts"],
-        UNIT_FILES,
-      );
-      expect(result).toEqual(UNIT_FILES);
-    });
+describe("createTestPlan", () => {
+  it("runs only specs in affected modules (rules graph)", () => {
+    const plan = createTestPlan({ ...baseInput, changedFiles: ["src/foo/x.ts"] });
 
-    it("should fall back to affected-tests filtering when infra not touched", () => {
-      const result = createTestPlanForSuite(
-        moduleGraph,
-        TEST_SUITE_DEFS.unit,
-        false, // infraTouched
-        ["src/foo/x.ts"],
-        UNIT_FILES,
-      );
-      expect(result.sort()).toEqual([
-        "src/foo/bar.unit.spec.ts",
-        "src/foo/foo.unit.spec.ts",
-      ]);
-    });
-
-    it("should return nothing when infra not touched and no file maps to a module", () => {
-      const result = createTestPlanForSuite(
-        moduleGraph,
-        TEST_SUITE_DEFS.unit,
-        false,
-        ["docs/foo.md"],
-        UNIT_FILES,
-      );
-      expect(result).toEqual([]);
-    });
-
-    it("should run all tests for runAllTests suites regardless of inputs", () => {
-      expect(
-        createTestPlanForSuite(
-          moduleGraph,
-          TEST_SUITE_DEFS.e2e,
-          false,
-          ["docs/foo.md"],
-          E2E_FILES,
-        ),
-      ).toEqual(E2E_FILES);
-      expect(
-        createTestPlanForSuite(
-          moduleGraph,
-          TEST_SUITE_DEFS.e2e,
-          false,
-          ["src/foo/x.ts"],
-          E2E_FILES,
-        ),
-      ).toEqual(E2E_FILES);
-    });
+    expect(plan.stats.fe_modules_changed).toBe(1);
+    expect(plan.stats.fe_modules_affected_rules).toBe(1);
+    expect(plan.fe_unit_specs_to_run.sort()).toEqual([
+      "src/foo/bar.unit.spec.ts",
+      "src/foo/foo.unit.spec.ts",
+    ]);
+    expect(plan.stats.unit_specs_to_run_rules).toBe(2);
+    expect(plan.stats.loki_stories_to_run_rules).toBe(1);
+    // With no file deps, usage falls back to rules.
+    expect(plan.stats.unit_specs_to_run_usage).toBe(2);
   });
 
-  describe("createTestPlan", () => {
-    it("should return run lists and stats together", () => {
-      const result = createTestPlan({
-        elements: ELEMENTS,
-        rules: RULES,
-        testSuites: TEST_SUITE_DEFS,
-        changedFiles: ["src/foo/x.ts"],
-        testFilesBySuite: {
-          unit: UNIT_FILES,
-          loki: LOKI_FILES,
-          e2e: E2E_FILES,
-        },
-        infraTouchedBySuite: { unit: false, loki: false, e2e: false },
-      });
-
-      expect(result.fe_unit_specs_to_run.sort()).toEqual([
-        "src/foo/bar.unit.spec.ts",
-        "src/foo/foo.unit.spec.ts",
-      ]);
-      expect(result.loki_stories_to_run).toEqual(["src/foo/Foo.stories.tsx"]);
-      expect(result.e2e_specs_to_run).toEqual(E2E_FILES);
-
-      expect(result.stats).toEqual({
-        modules_changed: 1,
-        modules_affected: 1,
-        modules_affected_list: ["feature/foo"],
-        fe_unit_specs_total: 4,
-        fe_unit_specs_run: 2,
-        fe_unit_specs_skipped: 2,
-        loki_stories_total: 2,
-        loki_stories_run: 1,
-        loki_stories_skipped: 1,
-        e2e_specs_total: 1,
-        e2e_specs_run: 1,
-        e2e_specs_skipped: 0,
-      });
+  it("narrows further with the usage graph than the rules graph", () => {
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/utils/colors.ts"],
+      // Only feature/foo actually imports lib/utils.
+      fileDependencies: [
+        { source: "src/foo/foo.tsx", dependencies: ["src/utils/colors.ts"] },
+      ],
     });
 
-    it("should run all unit specs when unit infra is touched", () => {
-      const result = createTestPlan({
-        elements: ELEMENTS,
-        rules: RULES,
-        testSuites: TEST_SUITE_DEFS,
-        changedFiles: ["docs/foo.md"],
-        testFilesBySuite: {
-          unit: UNIT_FILES,
-          loki: LOKI_FILES,
-          e2e: E2E_FILES,
-        },
-        infraTouchedBySuite: { unit: true, loki: false, e2e: false },
-      });
-      expect(result.stats.fe_unit_specs_run).toBe(UNIT_FILES.length);
-      expect(result.stats.fe_unit_specs_skipped).toBe(0);
-      // Only the unit suite was triggered.
-      expect(result.stats.loki_stories_run).toBe(0);
-    });
-
-    it("should not run anything when no infra is touched and no modules affected", () => {
-      const result = createTestPlan({
-        elements: ELEMENTS,
-        rules: RULES,
-        testSuites: TEST_SUITE_DEFS,
-        changedFiles: ["docs/foo.md"],
-        testFilesBySuite: {
-          unit: UNIT_FILES,
-          loki: LOKI_FILES,
-          e2e: E2E_FILES,
-        },
-        infraTouchedBySuite: { unit: false, loki: false, e2e: false },
-      });
-      expect(result.stats.fe_unit_specs_run).toBe(0);
-      expect(result.stats.loki_stories_run).toBe(0);
-      // e2e is runAllTests, so it still reports run = total.
-      expect(result.stats.e2e_specs_run).toBe(E2E_FILES.length);
-    });
+    // Rules allow both features to import lib/utils, so both are "affected".
+    expect(plan.stats.fe_modules_affected_rules).toBe(3);
+    // Usage sees only feature/foo + lib/utils.
+    expect(plan.stats.fe_modules_affected_usage).toBe(2);
+    expect(plan.stats.unit_specs_to_run_rules).toBe(4);
+    expect(plan.stats.unit_specs_to_run_usage).toBe(3);
   });
 
-  describe("filterAffectedTests", () => {
-    it("should keep only tests inside affected modules", () => {
-      const affected = new Set(["feature/foo", "lib/utils"]);
-      const tests = [
-        "src/foo/foo.unit.spec.ts",
-        "src/utils/colors.unit.spec.ts",
-        "src/bar/bar.unit.spec.ts",
-        "docs/unrelated.unit.spec.ts",
-      ];
-      expect(filterAffectedTests(moduleGraph, affected, tests)).toEqual([
-        "src/foo/foo.unit.spec.ts",
-        "src/utils/colors.unit.spec.ts",
-      ]);
+  it("forces a full FE run on a shared-sources (cljc) change with no affected modules", () => {
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["docs/readme.md"],
+      sharedSourcesTouched: true,
     });
+
+    expect(plan.stats.fe_modules_affected_rules).toBe(0);
+    expect(plan.stats.unit_specs_to_run_rules).toBe(UNIT_FILES.length);
+    expect(plan.stats.unit_specs_to_run_usage).toBe(UNIT_FILES.length);
+    expect(plan.stats.loki_stories_to_run_rules).toBe(LOKI_FILES.length);
+  });
+
+  it("forces only the suite whose infra changed", () => {
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["docs/readme.md"],
+      unitInfraTouched: true,
+    });
+
+    expect(plan.stats.unit_specs_to_run_rules).toBe(UNIT_FILES.length);
+    expect(plan.stats.loki_stories_to_run_rules).toBe(0);
+  });
+
+  it("runs the full e2e suite when no coverage manifest is available", () => {
+    const plan = createTestPlan({ ...baseInput, changedFiles: ["src/foo/x.ts"] });
+
+    expect(plan.stats.e2e_specs_to_run_rules).toBe(E2E_FILES.length);
+    expect(plan.stats.e2e_specs_to_run_usage).toBe(E2E_FILES.length);
+    expect(plan.e2e_specs_to_run).toEqual(E2E_FILES);
+  });
+
+  it("narrows e2e to specs covering affected feature modules", () => {
+    const e2e = [
+      "e2e/test/scenarios/foo.cy.spec.ts",
+      "e2e/test/scenarios/bar.cy.spec.ts",
+      "e2e/test/scenarios/new.cy.spec.ts",
+    ];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"], // affects feature/foo only
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: {
+        "e2e/test/scenarios/foo.cy.spec.ts": ["src/foo/a.ts"], // feature/foo
+        "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"], // feature/bar
+        // new.cy.spec.ts intentionally absent from the manifest
+      },
+    });
+
+    // foo's feature module is affected; bar's is not; the unmapped new spec
+    // always runs.
+    expect(plan.e2e_specs_to_run.sort()).toEqual([
+      "e2e/test/scenarios/foo.cy.spec.ts",
+      "e2e/test/scenarios/new.cy.spec.ts",
+    ]);
+    expect(plan.stats.e2e_specs_all).toBe(3);
+  });
+
+  it("runs a spec that maps to no feature module (unknown scope)", () => {
+    const e2e = ["e2e/test/scenarios/lib-only.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"], // affects feature/foo, NOT lib/utils
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: {
+        // Covers only a non-feature module (e.g. a home/auth spec whose feature
+        // the baseline subtracted), so its feature scope is unknown.
+        "e2e/test/scenarios/lib-only.cy.spec.ts": ["src/utils/colors.ts"],
+      },
+    });
+
+    // No feature module to gate on -> can't bound scope -> always runs.
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("force-runs all e2e on a backend change (invisible to FE coverage)", () => {
+    const e2e = ["e2e/test/scenarios/foo.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/metabase/api/card.clj"],
+      beFilesChanged: 1,
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"] },
+    });
+
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("force-runs all e2e when e2e infra (support/runner) changes", () => {
+    const e2e = ["e2e/test/scenarios/foo.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["e2e/support/commands/api/createQuestion.js"],
+      e2eInfraTouched: true,
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"] },
+    });
+
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("runs an edited spec even when no app module changed", () => {
+    const spec = "e2e/test/scenarios/foo.cy.spec.ts";
+    const e2e = [spec, "e2e/test/scenarios/bar.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: [spec], // only the spec itself changed
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: {
+        [spec]: ["src/bar/b.ts"], // covers feature/bar, which is NOT affected
+        "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"],
+      },
+    });
+
+    // No module is affected, but the edited spec must still run.
+    expect(plan.e2e_specs_to_run).toEqual([spec]);
+  });
+
+  it("runs a spec whose coverage was fully baseline-subtracted (empty files)", () => {
+    const e2e = ["e2e/test/scenarios/empty.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"], // affects feature/foo
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/empty.cy.spec.ts": [] },
+    });
+
+    // Empty coverage means unknown scope, so the spec runs.
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("forces a full e2e run when shared (cljc) sources change", () => {
+    const e2e = ["e2e/test/scenarios/foo.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"],
+      sharedSourcesTouched: true,
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"] },
+    });
+
+    // Manifest is present but cljc is invisible to JS coverage, so run all.
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("passes the FE/BE file counts through to stats", () => {
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: [],
+      feFilesChanged: 5,
+      beFilesChanged: 3,
+    });
+
+    expect(plan.stats.fe_files_changed).toBe(5);
+    expect(plan.stats.be_files_changed).toBe(3);
+  });
+});
+
+describe("filterAffectedTests", () => {
+  it("keeps only tests inside affected modules", () => {
+    const nodes = buildNodes(ELEMENTS);
+    const affected = new Set(["feature/foo", "lib/utils"]);
+    const tests = [
+      "src/foo/foo.unit.spec.ts",
+      "src/utils/colors.unit.spec.ts",
+      "src/bar/bar.unit.spec.ts",
+      "docs/unrelated.unit.spec.ts",
+    ];
+    expect(filterAffectedTests(nodes, affected, tests)).toEqual([
+      "src/foo/foo.unit.spec.ts",
+      "src/utils/colors.unit.spec.ts",
+    ]);
   });
 });

.github/scripts/bundle-size-stats-prepare.js

@@ -0,0 +1,152 @@
+/* eslint-disable import/no-commonjs */
+// Prepares the rows the bundle-size stats logger uploads to stats.metabase.com.
+//
+// For each measured (bundle, kind) it computes the delta — raw, gzipped and
+// brotli (as-served) bytes plus percent — against the previously *plotted* data
+// point (restored from a rolling cache), so the deltas can be charted directly.
+// It also decides whether this commit is worth recording at all: a point is kept
+// when the as-served size moved by at least MIN_DELTA_PERCENT, or when a new
+// bundle/kind appears. Only master builds run through here — releases form
+// non-linear lines whose deltas are meaningless, so they're not recorded (their
+// historical sizes are backfilled separately).
+//
+// buildStatsRows is pure (data in, data out) so it can be unit-tested; main()
+// is the thin I/O wrapper that reads env/files and writes the rows, cache and
+// step outputs.
+const fs = require("fs");
+const path = require("path");
+
+const deltaPercent = (current, base) =>
+  base ? Math.round(((current - base) * 10000) / base) / 100 : "";
+
+/**
+ * Turn the current measurements + the last plotted point into upload rows, the
+ * slim cache rows for the next diff, and the keep/skip decision.
+ *
+ * The significance threshold tracks the as-served size: brotli where the build
+ * ships a precompressed .br, otherwise gzip. Current measurements always carry
+ * brotliBytes (estimated when no .br shipped), but a cached base point recorded
+ * before brotli logging may not, so the delta still falls back to gzip per row.
+ */
+function buildStatsRows({ measurements, previous, threshold, date, commit, commitMessage, version }) {
+  const previousOf = (bundle, kind) => previous.find(row => row.bundle === bundle && row.kind === kind);
+
+  let maxServedDeltaPercent = 0;
+  let hasNewSeries = false;
+
+  const rows = measurements.map(measurement => {
+    const base = previousOf(measurement.bundle, measurement.kind);
+    const hasBrotli = measurement.brotliBytes != null && base?.brotliBytes != null;
+    const gzipDeltaPercent = deltaPercent(measurement.gzipBytes, base?.gzipBytes);
+    const brotliDeltaPercent = hasBrotli ? deltaPercent(measurement.brotliBytes, base.brotliBytes) : "";
+    if (!base) {
+      hasNewSeries = true;
+    } else {
+      const servedDeltaPercent = hasBrotli ? brotliDeltaPercent : gzipDeltaPercent;
+      maxServedDeltaPercent = Math.max(maxServedDeltaPercent, Math.abs(servedDeltaPercent));
+    }
+    return {
+      "Date": date,
+      "Version": version,
+      "Commit": commit,
+      "Bundle": measurement.bundle,
+      "Kind": measurement.kind, // "initial" or "total"
+      // The stats table carries a free-text Description column; append-csv
+      // requires every table column to be present. Populate it with the commit
+      // subject so the chart's points are self-describing.
+      "Description": commitMessage,
+      "Raw bytes": measurement.rawBytes,
+      "Gzip bytes": measurement.gzipBytes,
+      "Brotli bytes": measurement.brotliBytes, // as-served (shipped .br, else estimated)
+      "File count": measurement.fileCount,
+      "Raw bytes delta": base ? measurement.rawBytes - base.rawBytes : "",
+      "Gzip bytes delta": base ? measurement.gzipBytes - base.gzipBytes : "",
+      "Brotli bytes delta": hasBrotli ? measurement.brotliBytes - base.brotliBytes : "",
+      "Raw delta %": deltaPercent(measurement.rawBytes, base?.rawBytes),
+      "Gzip delta %": gzipDeltaPercent,
+      "Brotli delta %": brotliDeltaPercent,
+    };
+  });
+
+  const firstPoint = previous.length === 0;
+  const significant = firstPoint || hasNewSeries || maxServedDeltaPercent >= threshold;
+
+  // Slim rows the next run diffs against. The workflow only persists this to the
+  // cache when we actually push, so the cached reference always stays the last
+  // *plotted* point (cumulative drift is caught).
+  const cacheRows = measurements.map(({ bundle, kind, rawBytes, gzipBytes, brotliBytes }) => ({
+    bundle,
+    kind,
+    rawBytes,
+    gzipBytes,
+    brotliBytes,
+  }));
+
+  const reason = firstPoint
+    ? "first point"
+    : hasNewSeries
+      ? "new bundle/kind series"
+      : `max served Δ ${maxServedDeltaPercent.toFixed(2)}% (threshold ${threshold}%)`;
+
+  return { rows, cacheRows, significant, reason, maxServedDeltaPercent, firstPoint, hasNewSeries };
+}
+
+module.exports = { buildStatsRows };
+
+const readJson = filePath => (filePath && fs.existsSync(filePath) ? JSON.parse(fs.readFileSync(filePath, "utf8")) : null);
+const writeJson = (filePath, value) => {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(value));
+};
+const setOutput = (env, name, value) => {
+  if (env.GITHUB_OUTPUT) {
+    fs.appendFileSync(env.GITHUB_OUTPUT, `${name}=${value}\n`);
+  }
+};
+
+// version.properties (extracted from the uberjar) carries the build's tag.
+// Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
+function readVersion(versionPropsPath) {
+  const raw =
+    versionPropsPath && fs.existsSync(versionPropsPath)
+      ? (fs.readFileSync(versionPropsPath, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
+      : "";
+  return raw === "vUNKNOWN" ? "" : raw;
+}
+
+function main() {
+  const env = process.env;
+
+  const measurements = readJson(env.CURRENT);
+  if (!Array.isArray(measurements) || measurements.length === 0) {
+    console.error(`::error::No bundle measurements found at ${env.CURRENT}`);
+    process.exit(1);
+  }
+
+  const result = buildStatsRows({
+    measurements,
+    // The last plotted point, as slim rows: [{ bundle, kind, rawBytes, gzipBytes, brotliBytes }].
+    previous: readJson(env.LAST) || [],
+    threshold: Number(env.MIN_DELTA_PERCENT ?? 1),
+    date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+    commit: (env.HEAD_SHA || "").slice(0, 12),
+    commitMessage: (env.COMMIT_MESSAGE || "").split("\n")[0], // subject line only
+    version: readVersion(env.VERSION_PROPS),
+  });
+
+  writeJson(env.ROWS_OUT, result.rows);
+  writeJson(env.CACHE_OUT, result.cacheRows);
+
+  console.log(`${result.significant ? "RECORD" : "SKIP"} — ${result.reason}`);
+
+  setOutput(env, "significant", result.significant ? "true" : "false");
+  setOutput(
+    env,
+    "max_delta_percent",
+    result.firstPoint || result.hasNewSeries ? "" : result.maxServedDeltaPercent.toFixed(2),
+  );
+}
+
+if (require.main === module) {
+  main();
+}

.github/scripts/bundle-size-stats-prepare.unit.spec.js

@@ -0,0 +1,87 @@
+const { buildStatsRows } = require("./bundle-size-stats-prepare");
+
+const meta = { date: "2026-06-30", commit: "abc123", commitMessage: "Fix the thing (#123)", version: "" };
+const measurement = (over = {}) => ({
+  bundle: "embedding-sdk-chunked",
+  kind: "total",
+  rawBytes: 1000,
+  gzipBytes: 400,
+  brotliBytes: 300,
+  fileCount: 3,
+  ...over,
+});
+
+describe("buildStatsRows", () => {
+  it("records the first point and leaves every delta empty", () => {
+    const result = buildStatsRows({
+      ...meta,
+      measurements: [measurement()],
+      previous: [],
+      threshold: 1,
+    });
+
+    expect(result.firstPoint).toBe(true);
+    expect(result.significant).toBe(true);
+    expect(result.reason).toBe("first point");
+    expect(result.rows[0]["Gzip bytes delta"]).toBe("");
+    expect(result.rows[0]["Brotli delta %"]).toBe("");
+    expect(result.rows[0]["Description"]).toBe("Fix the thing (#123)");
+    expect(result.cacheRows[0]).toEqual({
+      bundle: "embedding-sdk-chunked",
+      kind: "total",
+      rawBytes: 1000,
+      gzipBytes: 400,
+      brotliBytes: 300,
+    });
+  });
+
+  it("records a never-seen bundle/kind as a new series", () => {
+    const result = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ bundle: "app", kind: "initial" })],
+      previous: [{ bundle: "app", kind: "total", rawBytes: 1, gzipBytes: 1, brotliBytes: 1 }],
+      threshold: 99,
+    });
+
+    expect(result.hasNewSeries).toBe(true);
+    expect(result.significant).toBe(true);
+    expect(result.reason).toBe("new bundle/kind series");
+  });
+
+  it("gates significance on the brotli (as-served) delta when both sides have it", () => {
+    const previous = [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400, brotliBytes: 300 }];
+
+    const big = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ brotliBytes: 315, gzipBytes: 400 })], // brotli +5%, gzip 0%
+      previous,
+      threshold: 1,
+    });
+    expect(big.maxServedDeltaPercent).toBeCloseTo(5);
+    expect(big.significant).toBe(true);
+    expect(big.rows[0]["Brotli delta %"]).toBeCloseTo(5);
+
+    const small = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ brotliBytes: 301, gzipBytes: 999 })], // brotli +0.33%, gzip ignored
+      previous,
+      threshold: 1,
+    });
+    expect(small.significant).toBe(false);
+    expect(small.reason).toContain("threshold 1%");
+  });
+
+  it("falls back to the gzip delta when the cached base predates brotli logging", () => {
+    const result = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ gzipBytes: 440, brotliBytes: 300 })], // gzip +10%
+      previous: [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400 }],
+      threshold: 1,
+    });
+
+    expect(result.maxServedDeltaPercent).toBeCloseTo(10);
+    expect(result.significant).toBe(true);
+    expect(result.rows[0]["Brotli bytes delta"]).toBe(""); // no base brotli to diff against
+    expect(result.rows[0]["Gzip delta %"]).toBeCloseTo(10);
+  });
+});

.github/scripts/create-test-plan.ts

@@ -1,67 +1,112 @@
-// Changed files come from dorny/paths-filter's `all_changed_files` output
+// I/O entrypoint: gather inputs (env vars, the cruise graph, the test-file
+// lists) and hand them to createTestPlan, which does the computing.
 
 import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+
+import micromatch from "micromatch";
 
 import { elements, rules } from "../../frontend/lint/module-boundaries.mjs";
 
-import { TEST_SUITES, createTestPlan } from "./affected-tests";
+import { type FileDependency, parseCruiseModules } from "./affected-modules";
+import { createTestPlan } from "./affected-tests";
+import { listSpecFiles } from "./e2e-spec-globs.mjs";
 
+const UNIT_ROOTS = ["frontend/src", "enterprise/frontend/src"];
 const UNIT_GLOBS = [
-  "frontend/src/**/*.unit.spec.js",
-  "frontend/src/**/*.unit.spec.jsx",
-  "frontend/src/**/*.unit.spec.ts",
-  "frontend/src/**/*.unit.spec.tsx",
-  "enterprise/frontend/src/**/*.unit.spec.js",
-  "enterprise/frontend/src/**/*.unit.spec.jsx",
-  "enterprise/frontend/src/**/*.unit.spec.ts",
-  "enterprise/frontend/src/**/*.unit.spec.tsx",
+  "frontend/src/**/*.unit.spec.{js,jsx,ts,tsx}",
+  "enterprise/frontend/src/**/*.unit.spec.{js,jsx,ts,tsx}",
 ];
 
+const STORY_ROOTS = ["frontend", "enterprise/frontend"];
 const STORY_GLOBS = [
-  "frontend/**/*.stories.js",
-  "frontend/**/*.stories.jsx",
-  "frontend/**/*.stories.ts",
-  "frontend/**/*.stories.tsx",
-  "enterprise/frontend/**/*.stories.js",
-  "enterprise/frontend/**/*.stories.jsx",
-  "enterprise/frontend/**/*.stories.ts",
-  "enterprise/frontend/**/*.stories.tsx",
+  "frontend/**/*.stories.{js,jsx,ts,tsx}",
+  "enterprise/frontend/**/*.stories.{js,jsx,ts,tsx}",
 ];
 
-const E2E_GLOBS = [
-  "e2e/test/scenarios/**/*.cy.spec.js",
-  "e2e/test/scenarios/**/*.cy.spec.jsx",
-  "e2e/test/scenarios/**/*.cy.spec.ts",
-  "e2e/test/scenarios/**/*.cy.spec.tsx",
-];
-
-function listFiles(globs: string[]): string[] {
-  return execFileSync("git", ["ls-files", "--", ...globs], { encoding: "utf8" })
+// Returns the tracked files under `roots` that match `globs`. The `dot: true`
+// option means files inside dot-directories such as `.storybook` are included.
+function listFiles(roots: string[], globs: string[]): string[] {
+  const tracked = execFileSync("git", ["ls-files", "--", ...roots], {
+    encoding: "utf8",
+  })
     .split("\n")
     .map((line) => line.trim())
     .filter(Boolean);
+  return micromatch(tracked, globs, { dot: true });
 }
 
-const changedFiles = (process.env.CHANGED_FILES ?? "")
-  .split(",")
-  .map((s) => s.trim())
-  .filter(Boolean);
+// dorny outputs comma-separated lists; CHANGED_FILES is `all_changed_files`.
+const csvToList = (csv: string | undefined) =>
+  (csv ?? "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+// Reads the dependency-cruiser graph (DEP_GRAPH_JSON). Null falls back to the
+// rules graph, so a missing or unparseable file never breaks the plan.
+function readFileDependencies(): FileDependency[] | null {
+  const path = process.env.DEP_GRAPH_JSON;
+  if (path && existsSync(path)) {
+    try {
+      const { modules } = JSON.parse(readFileSync(path, "utf8"));
+      process.stderr.write(`Using usage graph from ${path}.\n`);
+      return parseCruiseModules(modules);
+    } catch (error) {
+      process.stderr.write(
+        `Failed to read ${path}; falling back to rules graph: ${error}\n`,
+      );
+    }
+  } else {
+    process.stderr.write(
+      "No DEP_GRAPH_JSON found; falling back to rules graph.\n",
+    );
+  }
+  return null;
+}
+
+// Reads the nightly coverage manifest (E2E_SPEC_MANIFEST): { builtAt, specs:
+// { spec -> files } }. Returns the specs map, or null so e2e falls back to a
+// full run when the manifest is missing/unparseable.
+function readE2eSpecFiles(): Record<string, string[]> | null {
+  const path = process.env.E2E_SPEC_MANIFEST;
+  if (path && existsSync(path)) {
+    try {
+      const { specs } = JSON.parse(readFileSync(path, "utf8"));
+      if (specs && typeof specs === "object") {
+        process.stderr.write(`Using e2e coverage manifest from ${path}.\n`);
+        return specs;
+      }
+    } catch (error) {
+      process.stderr.write(
+        `Failed to read ${path}; e2e will run in full: ${error}\n`,
+      );
+    }
+  } else {
+    process.stderr.write("No E2E_SPEC_MANIFEST found; e2e will run in full.\n");
+  }
+  return null;
+}
 
 const testPlan = createTestPlan({
   elements,
   rules,
-  testSuites: TEST_SUITES,
-  changedFiles,
+  changedFiles: csvToList(process.env.CHANGED_FILES),
+  fileDependencies: readFileDependencies(),
   testFilesBySuite: {
-    unit: listFiles(UNIT_GLOBS),
-    loki: listFiles(STORY_GLOBS),
-    e2e: listFiles(E2E_GLOBS),
-  },
-  infraTouchedBySuite: {
-    unit: process.env.UNIT_INFRA_TOUCHED === "true",
-    loki: process.env.LOKI_INFRA_TOUCHED === "true",
-    e2e: false,
+    unit: listFiles(UNIT_ROOTS, UNIT_GLOBS),
+    loki: listFiles(STORY_ROOTS, STORY_GLOBS),
+    e2e: listSpecFiles(),
   },
+  e2eSpecFiles: readE2eSpecFiles(),
+  unitInfraTouched: process.env.UNIT_INFRA_TOUCHED === "true",
+  lokiInfraTouched: process.env.LOKI_INFRA_TOUCHED === "true",
+  e2eInfraTouched: process.env.E2E_INFRA_TOUCHED === "true",
+  sharedSourcesTouched: process.env.SHARED_SOURCES_TOUCHED === "true",
+  feFilesChanged: csvToList(process.env.FE_CHANGED_FILES).length,
+  beFilesChanged: csvToList(process.env.BE_CHANGED_FILES).length,
+  feFilesTotal: listFiles(["frontend", "enterprise/frontend"], ["**"]).length,
+  beFilesTotal: listFiles(["src", "enterprise/backend"], ["**"]).length,
 });
 
 process.stdout.write(JSON.stringify(testPlan) + "\n");

.github/scripts/csv-to-mb.js

@@ -19,23 +19,73 @@ function jsonToCsvFormData(jsonData) {
   return formData;
 }
 
-function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append' }) {
-  const formData = jsonToCsvFormData(jsonData);
-  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
+// Transient failures worth retrying: throttling and server-side errors. A 4xx
+// (bad request, auth) won't succeed on retry, so those fail fast.
+const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
 
-  return fetch(`${baseUrl}/api/table/${tableId}/${operation}`, {
-    method: 'POST',
-    headers: {
-      "x-api-key": process.env.API_KEY
-    },
-    body: formData
-  })
-  .then(response => {
-    if (!response.ok) {
-      throw new Error(`Upload failed`);
+class UploadError extends Error {
+  constructor(message, { retryable }) {
+    super(message);
+    this.retryable = retryable;
+  }
+}
+
+async function attemptUpload(url, jsonData, timeoutMs) {
+  let response;
+  try {
+    response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        "x-api-key": process.env.API_KEY
+      },
+      // Rebuilt per attempt: a consumed request body can't be reused.
+      body: jsonToCsvFormData(jsonData),
+      // Without this the request can hang indefinitely on a stalled server,
+      // eating the whole job timeout. An abort surfaces below as a retryable
+      // network error, so it retries with backoff instead.
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (networkError) {
+    throw new UploadError(networkError.message, { retryable: true });
+  }
+
+  if (response.ok) {
+    return;
+  }
+
+  const body = await response.text().catch(() => '');
+  throw new UploadError(
+    `Upload failed: ${response.status} ${response.statusText} ${body}`.trim(),
+    { retryable: RETRYABLE_STATUS.has(response.status) }
+  );
+}
+
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+/**
+ * Uploads jsonData as CSV, retrying transient API errors with exponential
+ * backoff. `retries` is the number of extra attempts after the first (so the
+ * default 2 means up to 3 tries). `timeoutMs` is a per-attempt total deadline
+ * (default 60s) that aborts a stalled request. Throws the last error once
+ * attempts are exhausted or the error is non-retryable.
+ */
+async function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append', retries = 2, retryDelayMs = 1000, timeoutMs = 60_000 }) {
+  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
+  const url = `${baseUrl}/api/table/${tableId}/${operation}`;
+
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await attemptUpload(url, jsonData, timeoutMs);
+      return { success: true };
+    } catch (error) {
+      if (!error.retryable || attempt >= retries) {
+        throw error;
+      }
+      const delay = retryDelayMs * 2 ** attempt;
+      console.warn(`Upload attempt ${attempt + 1} failed (${error.message}); retrying in ${delay}ms`);
+      await sleep(delay);
     }
-    return { success: true };
-  });
+  }
 }
 
 module.exports = { uploadCsvToMb };

.github/scripts/csv-to-mb.unit.spec.js

@@ -0,0 +1,50 @@
+const { uploadCsvToMb } = require("./csv-to-mb");
+
+const ok = () => ({ ok: true });
+const fail = status => ({ ok: false, status, statusText: "err", text: async () => "" });
+
+const upload = (over = {}) =>
+  uploadCsvToMb({
+    baseUrl: "https://stats.example.com",
+    tableId: 1,
+    jsonData: [{ a: 1 }],
+    retryDelayMs: 1,
+    ...over,
+  });
+
+describe("uploadCsvToMb retries", () => {
+  afterEach(() => {
+    delete global.fetch;
+  });
+
+  it("retries transient server errors then succeeds", async () => {
+    global.fetch = jest.fn().mockResolvedValueOnce(fail(503)).mockResolvedValueOnce(fail(500)).mockResolvedValueOnce(ok());
+
+    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
+    expect(global.fetch).toHaveBeenCalledTimes(3);
+  });
+
+  it("retries network errors", async () => {
+    global.fetch = jest
+      .fn()
+      .mockRejectedValueOnce(new Error("ECONNRESET"))
+      .mockResolvedValueOnce(ok());
+
+    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
+    expect(global.fetch).toHaveBeenCalledTimes(2);
+  });
+
+  it("gives up after exhausting retries and throws the last error", async () => {
+    global.fetch = jest.fn().mockResolvedValue(fail(500));
+
+    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 500");
+    expect(global.fetch).toHaveBeenCalledTimes(3); // 1 initial + 2 retries
+  });
+
+  it("does not retry a non-transient 4xx", async () => {
+    global.fetch = jest.fn().mockResolvedValue(fail(400));
+
+    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 400");
+    expect(global.fetch).toHaveBeenCalledTimes(1);
+  });
+});

.github/scripts/e2e-spec-globs.mjs

@@ -0,0 +1,32 @@
+import { execFileSync } from "node:child_process";
+
+import micromatch from "micromatch";
+
+const SPEC_DIR = "e2e/test/scenarios";
+
+// This is the nightly-only baseline helper that runs in the instrumented pass to
+// capture boot-time coverage. It is not a product spec, so it is excluded from
+// the test plan universe and from the manifest backfill reconciliation.
+export const BASELINE_SPEC = `${SPEC_DIR}/coverage-baseline.cy.spec.js`;
+
+// This glob set defines the spec "universe". The test planner
+// (create-test-plan.ts) selects which specs to run from it, and the coverage
+// manifest builder (build-coverage-manifest.mjs) reconciles against it when
+// backfilling specs that did not run.
+export const E2E_SPEC_GLOBS = [`${SPEC_DIR}/**/*.cy.spec.{js,jsx,ts,tsx}`];
+
+// Returns the tracked e2e specs as repo-relative paths, excluding the baseline
+// helper.
+export function listSpecFiles(cwd = process.cwd()) {
+  const tracked = execFileSync("git", ["ls-files", "--", SPEC_DIR], {
+    cwd,
+    encoding: "utf8",
+  })
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+  return micromatch(tracked, E2E_SPEC_GLOBS, {
+    ignore: [BASELINE_SPEC],
+    dot: true,
+  });
+}

.github/scripts/measure-bundle-sizes.js

@@ -0,0 +1,258 @@
+/* eslint-disable import/no-commonjs */
+// Measures the front-end bundles emitted into an extracted uberjar tree.
+//
+// Every bundle reports one or both of:
+//  - "initial": JS the browser downloads on first paint (the entry chunk plus
+//    its initial/sync split chunks). Never excludes initial chunks.
+//  - "total":   all *reachable* JS (initial plus async chunks that are actually
+//    loadable at runtime). Never includes unreachable/never-fetched chunks.
+// Reachability needs the per-entry asset list from the rspack stats file, so the
+// app and chunked SDK bundles require their stats file to be present.
+//
+// The pure pieces — the asset-name selection (initial vs reachable, runtime
+// filtering, the async-loadable flag) — are split out as select*Assets so they
+// can be unit-tested against a stats object. The measure* functions and main()
+// keep all the filesystem and env I/O, threading an explicit `config`.
+const fs = require("fs");
+const path = require("path");
+const zlib = require("zlib");
+
+const APP_DIST = "resources/frontend_client/app/dist";
+const SDK_ROOT = "resources/frontend_client/app/embedding-sdk";
+
+// The chunk runtime is inlined into the bootstrap, never sent as a standalone file.
+const SDK_RUNTIME_RE = /embedding-sdk-chunk-runtime\./;
+const notRuntime = name => !SDK_RUNTIME_RE.test(name);
+
+const assetFiles = (root, names) => names.map(name => path.join(root, name));
+const unique = files => [...new Set(files)];
+
+// MEASURE_ROOT lets callers point at an extracted tree (e.g. the PR bundle-size
+// check measures a current and a base-ref tree); defaults to cwd for the stats
+// workflow. MEASURE_BUNDLES restricts which bundles are measured (comma-separated).
+// SDK_ASYNC_CHUNKS_LOADABLE (see selectChunkedSdkAssets) toggles whether async
+// SDK chunks count toward "total".
+function buildConfig(env) {
+  const baseDir = env.MEASURE_ROOT ? path.resolve(env.MEASURE_ROOT) : process.cwd();
+  const bundleFilter = env.MEASURE_BUNDLES
+    ? new Set(env.MEASURE_BUNDLES.split(",").map(bundle => bundle.trim()))
+    : null;
+  return {
+    resolve: (...relativeParts) => path.resolve(baseDir, ...relativeParts),
+    isBundleWanted: bundle => !bundleFilter || bundleFilter.has(bundle),
+    // Async SDK chunks are reachable once output.publicPath is set so import()
+    // chunks are actually fetched at runtime — which landed in master. Defaults
+    // to true to match master; set SDK_ASYNC_CHUNKS_LOADABLE=false to measure an
+    // older commit built before the publicPath fix (async unreachable, so
+    // "total" collapses to "initial").
+    sdkAsyncChunksLoadable: env.SDK_ASYNC_CHUNKS_LOADABLE !== "false",
+  };
+}
+
+function sizeOf(files) {
+  let rawBytes = 0;
+  let gzipBytes = 0;
+  let brotliBytes = 0;
+  for (const file of files) {
+    const contents = fs.readFileSync(file);
+    rawBytes += contents.length;
+    // gzip: recompressed, a proxy for the on-the-fly gzip served on every version
+    gzipBytes += zlib.gzipSync(contents).length;
+    // brotli: as-served — count the precompressed .br the build ships; files
+    // without one (static-viz, sub-threshold chunks) are served compressed on
+    // the fly, so estimate with brotli. Always reported (like gzip).
+    const brotliPath = `${file}.br`;
+    brotliBytes += fs.existsSync(brotliPath)
+      ? fs.statSync(brotliPath).size
+      : zlib.brotliCompressSync(contents).length;
+  }
+  return {
+    fileCount: files.length,
+    rawBytes,
+    gzipBytes,
+    brotliBytes,
+  };
+}
+
+function collectJsFiles(absolutePath) {
+  if (fs.statSync(absolutePath).isFile()) {
+    return [absolutePath];
+  }
+  return fs
+    .readdirSync(absolutePath, { withFileTypes: true })
+    .flatMap(entry => {
+      const childPath = path.join(absolutePath, entry.name);
+      if (entry.isDirectory()) {
+        return collectJsFiles(childPath);
+      }
+      return entry.name.endsWith(".js") ? [childPath] : [];
+    });
+}
+
+function readStats(config, statsFile) {
+  const statsPath = config.resolve(statsFile);
+  return fs.existsSync(statsPath) ? JSON.parse(fs.readFileSync(statsPath, "utf8")) : null;
+}
+
+// An entrypoint's .js assets for a given field: "assets" = its initial
+// (synchronous) load; "reachableAssets" = initial plus everything it can lazily
+// import (the chunk graph walked at build time in bundle-stats.js).
+function entrypointJsAssets(stats, name, field = "assets") {
+  const entry = stats && stats.entrypoints && stats.entrypoints[name];
+  if (!entry || !entry[field]) {
+    return null;
+  }
+  return entry[field].map(asset => asset.name || asset).filter(assetName => assetName.endsWith(".js"));
+}
+
+/**
+ * Main app = the app-main entrypoint only (app/dist also holds other pages like
+ * app-public, app-embed*, which are not the app). `reachableAssets` is null on
+ * older stats built before the chunk-graph enrichment — the caller then falls
+ * back to sizing the whole app/dist.
+ */
+function selectAppAssets(stats) {
+  const initialAssets = entrypointJsAssets(stats, "app-main", "assets");
+  if (!initialAssets) {
+    throw new Error('app: stats-main.json / "app-main" entrypoint missing');
+  }
+  return { initialAssets, reachableAssets: entrypointJsAssets(stats, "app-main", "reachableAssets") };
+}
+
+/**
+ * Legacy SDK: the "embedding-sdk" entry, a single eager file in legacy/. It still
+ * emits on-demand chunks (jspdf, echarts, leaflet, ...) into the shared chunks/
+ * dir via dynamic import(). initial = the eager legacy file; total = initial plus
+ * its reachable async chunks, but only when those are loadable at runtime
+ * (sdkAsyncChunksLoadable), otherwise total collapses to initial. Returns null
+ * when the stats lack the entry (older layout) so the caller can fall back.
+ */
+function selectLegacySdkAssets(stats, { sdkAsyncChunksLoadable }) {
+  const initialNames = entrypointJsAssets(stats, "embedding-sdk", "assets");
+  if (!initialNames) {
+    return null;
+  }
+  const reachableNames = entrypointJsAssets(stats, "embedding-sdk", "reachableAssets") || initialNames;
+  const initial = unique(initialNames).filter(notRuntime);
+  return {
+    initialNames: initial,
+    reachableNames: sdkAsyncChunksLoadable ? unique(reachableNames).filter(notRuntime) : initial,
+  };
+}
+
+/**
+ * Chunked SDK delivery. initial = bootstrap (minus its inlined runtime) + the
+ * chunked entry's initial chunks. total = the chunked entry's reachable set
+ * (initial + async children, from the chunk graph). includesAsyncChunks is true
+ * only when the stats carry the reachable chunk graph AND those chunks are
+ * loadable at runtime (sdkAsyncChunksLoadable). A base ref built before the
+ * reachableAssets enrichment has no graph, so its "total" must collapse to
+ * "initial" — the flag lets the comparison avoid measuring a reachable total
+ * against a collapsed one (an apples-to-oranges ~30% phantom).
+ */
+function selectChunkedSdkAssets(stats, { sdkAsyncChunksLoadable }) {
+  const chunkedInitial = entrypointJsAssets(stats, "embedding-sdk-chunked", "assets");
+  if (!chunkedInitial) {
+    throw new Error('embedding-sdk-chunked: stats-embedding-sdk.json / "embedding-sdk-chunked" entrypoint missing');
+  }
+  const bootstrapInitial = entrypointJsAssets(stats, "embedding-sdk-bootstrap", "assets") || [];
+  const chunkedReachableAssets = entrypointJsAssets(stats, "embedding-sdk-chunked", "reachableAssets");
+  const chunkedReachable = chunkedReachableAssets || chunkedInitial;
+  const bootstrapReachable = entrypointJsAssets(stats, "embedding-sdk-bootstrap", "reachableAssets") || bootstrapInitial;
+  return {
+    initialNames: unique([...bootstrapInitial, ...chunkedInitial]).filter(notRuntime),
+    reachableNames: unique([...bootstrapReachable, ...chunkedReachable]).filter(notRuntime),
+    includesAsyncChunks: chunkedReachableAssets != null && sdkAsyncChunksLoadable,
+  };
+}
+
+function measureApp(config) {
+  const dist = config.resolve(APP_DIST);
+  if (!fs.existsSync(dist)) {
+    throw new Error(`Bundle output not found for "app": ${dist}`);
+  }
+  const { initialAssets, reachableAssets } = selectAppAssets(readStats(config, "artifacts/stats-main.json"));
+  if (!reachableAssets) {
+    console.warn("app: stats has no reachableAssets; app total falls back to the whole app/dist");
+  }
+  const totalFiles = reachableAssets ? assetFiles(dist, reachableAssets) : collectJsFiles(dist);
+  return [
+    { bundle: "app", kind: "initial", ...sizeOf(assetFiles(dist, initialAssets)) },
+    { bundle: "app", kind: "total", ...sizeOf(totalFiles) },
+  ];
+}
+
+function measureLegacySdk(config) {
+  const absRoot = config.resolve(SDK_ROOT);
+  const selected = selectLegacySdkAssets(readStats(config, "artifacts/stats-embedding-sdk.json"), config);
+  if (!selected) {
+    // No stats / older layout: fall back to whatever sits in the legacy dir.
+    const candidates = [`${SDK_ROOT}/legacy`, `${SDK_ROOT}.js`];
+    const chosen = candidates.find(candidate => fs.existsSync(config.resolve(candidate)));
+    if (!chosen) {
+      console.warn(`Skipping "embedding-sdk-legacy": output not found (${candidates.join(", ")})`);
+      return [];
+    }
+    return [{ bundle: "embedding-sdk-legacy", kind: "total", ...sizeOf(collectJsFiles(config.resolve(chosen))) }];
+  }
+  return [
+    { bundle: "embedding-sdk-legacy", kind: "initial", ...sizeOf(assetFiles(absRoot, selected.initialNames)) },
+    { bundle: "embedding-sdk-legacy", kind: "total", ...sizeOf(assetFiles(absRoot, selected.reachableNames)) },
+  ];
+}
+
+function measureChunkedSdk(config) {
+  const chunksDir = config.resolve(SDK_ROOT, "chunks");
+  if (!fs.existsSync(chunksDir)) {
+    // pre-chunked layout (monolith only) — nothing to measure here
+    return [];
+  }
+  const absRoot = config.resolve(SDK_ROOT);
+  const { initialNames, reachableNames, includesAsyncChunks } = selectChunkedSdkAssets(
+    readStats(config, "artifacts/stats-embedding-sdk.json"),
+    config,
+  );
+  const initial = sizeOf(assetFiles(absRoot, initialNames));
+  const total = includesAsyncChunks ? sizeOf(assetFiles(absRoot, reachableNames)) : initial;
+  return [
+    { bundle: "embedding-sdk-chunked", kind: "initial", ...initial },
+    { bundle: "embedding-sdk-chunked", kind: "total", reachable: includesAsyncChunks, ...total },
+  ];
+}
+
+// Single-file/dir bundles loaded in one shot — total only.
+function measureWholeDir(config, bundle, candidates) {
+  const chosen = candidates.find(candidate => fs.existsSync(config.resolve(candidate)));
+  if (!chosen) {
+    console.warn(`Skipping "${bundle}": output not found (${candidates.join(", ")})`);
+    return [];
+  }
+  return [{ bundle, kind: "total", ...sizeOf(collectJsFiles(config.resolve(chosen))) }];
+}
+
+const bundles = {
+  app: measureApp,
+  "embedding-sdk-legacy": measureLegacySdk,
+  "embedding-sdk-chunked": measureChunkedSdk,
+  "embedding-sdk-package": config => measureWholeDir(config, "embedding-sdk-package", ["resources/embedding-sdk/dist"]),
+  "embed-js": config => measureWholeDir(config, "embed-js", ["resources/frontend_client/app/embed.js"]),
+};
+
+function measureBundleSizes(config) {
+  return Object.entries(bundles)
+    .filter(([bundle]) => config.isBundleWanted(bundle))
+    .flatMap(([, measure]) => measure(config));
+}
+
+module.exports = {
+  measureBundleSizes,
+  buildConfig,
+  entrypointJsAssets,
+  selectAppAssets,
+  selectLegacySdkAssets,
+  selectChunkedSdkAssets,
+};
+
+if (require.main === module) {
+  console.log(JSON.stringify(measureBundleSizes(buildConfig(process.env)), null, 2));
+}

.github/scripts/measure-bundle-sizes.unit.spec.js

@@ -0,0 +1,87 @@
+const {
+  entrypointJsAssets,
+  selectAppAssets,
+  selectLegacySdkAssets,
+  selectChunkedSdkAssets,
+} = require("./measure-bundle-sizes");
+
+const RUNTIME = "embedding-sdk-chunk-runtime.deadbeef.js";
+
+const stats = entrypoints => ({ entrypoints });
+
+describe("entrypointJsAssets", () => {
+  it("returns the .js asset names for a field, accepting strings or {name}", () => {
+    const s = stats({ app: { assets: [{ name: "a.js" }, "b.js", { name: "c.css" }] } });
+    expect(entrypointJsAssets(s, "app", "assets")).toEqual(["a.js", "b.js"]);
+  });
+
+  it("returns null when the entrypoint or field is absent", () => {
+    expect(entrypointJsAssets(stats({}), "missing")).toBeNull();
+    expect(entrypointJsAssets(null, "app")).toBeNull();
+  });
+});
+
+describe("selectAppAssets", () => {
+  it("returns the initial set and a null reachable set on pre-enrichment stats", () => {
+    const s = stats({ "app-main": { assets: ["main.js"] } });
+    expect(selectAppAssets(s)).toEqual({ initialAssets: ["main.js"], reachableAssets: null });
+  });
+
+  it("throws when the app-main entrypoint is missing", () => {
+    expect(() => selectAppAssets(stats({}))).toThrow("app-main");
+  });
+});
+
+describe("selectChunkedSdkAssets", () => {
+  const base = {
+    "embedding-sdk-chunked": { assets: ["a.js", RUNTIME], reachableAssets: ["a.js", "b.js", RUNTIME] },
+    "embedding-sdk-bootstrap": { assets: ["boot.js"], reachableAssets: ["boot.js"] },
+  };
+
+  it("merges bootstrap + chunked, drops the inlined runtime, and counts async chunks", () => {
+    const result = selectChunkedSdkAssets(stats(base), { sdkAsyncChunksLoadable: true });
+    expect(result.initialNames).toEqual(["boot.js", "a.js"]);
+    expect(result.reachableNames).toEqual(["boot.js", "a.js", "b.js"]);
+    expect(result.includesAsyncChunks).toBe(true);
+  });
+
+  it("collapses total to initial when async chunks are not loadable", () => {
+    const result = selectChunkedSdkAssets(stats(base), { sdkAsyncChunksLoadable: false });
+    expect(result.includesAsyncChunks).toBe(false);
+  });
+
+  it("collapses total to initial when the stats carry no reachable graph", () => {
+    const noGraph = { "embedding-sdk-chunked": { assets: ["a.js"] } };
+    const result = selectChunkedSdkAssets(stats(noGraph), { sdkAsyncChunksLoadable: true });
+    expect(result.reachableNames).toEqual(["a.js"]);
+    expect(result.includesAsyncChunks).toBe(false);
+  });
+
+  it("throws when the chunked entrypoint is missing", () => {
+    expect(() => selectChunkedSdkAssets(stats({}), { sdkAsyncChunksLoadable: true })).toThrow(
+      "embedding-sdk-chunked",
+    );
+  });
+});
+
+describe("selectLegacySdkAssets", () => {
+  it("returns null when the legacy entry is absent so the caller can fall back", () => {
+    expect(selectLegacySdkAssets(stats({}), { sdkAsyncChunksLoadable: true })).toBeNull();
+  });
+
+  it("expands total to the reachable async set when loadable", () => {
+    const s = stats({ "embedding-sdk": { assets: ["legacy.js"], reachableAssets: ["legacy.js", "chunk.js"] } });
+    expect(selectLegacySdkAssets(s, { sdkAsyncChunksLoadable: true })).toEqual({
+      initialNames: ["legacy.js"],
+      reachableNames: ["legacy.js", "chunk.js"],
+    });
+  });
+
+  it("collapses total to initial when async chunks are not loadable", () => {
+    const s = stats({ "embedding-sdk": { assets: ["legacy.js"], reachableAssets: ["legacy.js", "chunk.js"] } });
+    expect(selectLegacySdkAssets(s, { sdkAsyncChunksLoadable: false })).toEqual({
+      initialNames: ["legacy.js"],
+      reachableNames: ["legacy.js"],
+    });
+  });
+});

.github/scripts/module-usage.ts

@@ -0,0 +1,123 @@
+// Builds module-level "usage" maps: for each module, the set of modules that
+// depend on it, both directly and indirectly
+//
+// Both are computed at the FILE level off the real dependency-cruiser import
+// graph, then collapsed to module granularity at the very end.
+//
+//   bunx depcruise frontend/src enterprise/frontend/src \
+//     --config .dependency-cruiser.cjs --output-type json > dependency-graph.json
+//   DEP_GRAPH_JSON=dependency-graph.json \
+//   OUT_JSON=usage.json OUT_DIRECT_JSON=usage-direct.json \
+//     bun .github/scripts/module-usage.ts
+
+import { readFileSync, writeFileSync } from "node:fs";
+
+import { elements } from "../../frontend/lint/module-boundaries.mjs";
+
+import {
+  buildFileGraph,
+  getAffectedFiles,
+  mapFileToModule,
+  parseCruiseModules,
+} from "./affected-modules";
+
+const depGraphPath = process.env.DEP_GRAPH_JSON ?? "dependency-graph.json";
+const { modules } = JSON.parse(readFileSync(depGraphPath, "utf8"));
+
+const fileDependencies = parseCruiseModules(modules);
+const fileGraph = buildFileGraph(elements, fileDependencies);
+
+// Group every known source file by its owning module. We seed from the cruise
+// output's `source` files plus everything that appears as a dependency target,
+// so files imported but never importing are still covered.
+const filesByModule = new Map<string, string[]>();
+const allFiles = new Set<string>();
+for (const { source, dependencies } of fileDependencies) {
+  allFiles.add(source);
+  for (const dep of dependencies) {
+    allFiles.add(dep);
+  }
+}
+for (const file of allFiles) {
+  const module = mapFileToModule(fileGraph.nodes, file);
+  if (!module) {
+    continue;
+  }
+  const list = filesByModule.get(module);
+  if (list) {
+    list.push(file);
+  } else {
+    filesByModule.set(module, [file]);
+  }
+}
+
+// Ensure every module appears as a key, even those nothing depends on.
+const emptyDependents = (): Record<string, Set<string>> => {
+  const map: Record<string, Set<string>> = {};
+  for (const module of filesByModule.keys()) {
+    map[module] = new Set();
+  }
+  return map;
+};
+
+// DIRECT usage: module B directly depends on module A if any file in B imports
+// any file in A — a single edge in the import graph, collapsed to modules.
+const directDependents = emptyDependents();
+for (const { source, dependencies } of fileDependencies) {
+  const importer = mapFileToModule(fileGraph.nodes, source);
+  if (!importer) {
+    continue;
+  }
+  for (const target of dependencies) {
+    const owner = mapFileToModule(fileGraph.nodes, target);
+    if (owner && owner !== importer) {
+      directDependents[owner].add(importer);
+    }
+  }
+}
+
+// TRANSITIVE usage: for each module, take all its files, walk the file-level
+// reverse graph to get every file that transitively imports them, collapse to
+// modules, and drop the module itself.
+const transitiveDependents = emptyDependents();
+for (const [module, files] of filesByModule) {
+  const affectedFiles = getAffectedFiles(fileGraph, files);
+  for (const file of affectedFiles) {
+    const owner = mapFileToModule(fileGraph.nodes, file);
+    if (owner && owner !== module) {
+      transitiveDependents[module].add(owner);
+    }
+  }
+}
+
+// Stable, sorted output for clean diffs.
+const toSorted = (
+  map: Record<string, Set<string>>,
+): Record<string, string[]> => {
+  const sorted: Record<string, string[]> = {};
+  for (const module of Object.keys(map).sort()) {
+    sorted[module] = [...map[module]].sort();
+  }
+  return sorted;
+};
+
+const writeOut = (
+  map: Record<string, Set<string>>,
+  outVar: string,
+  label: string,
+) => {
+  const sorted = toSorted(map);
+  const json = JSON.stringify(sorted, null, 2) + "\n";
+  const outPath = process.env[outVar];
+  if (outPath) {
+    writeFileSync(outPath, json);
+    process.stderr.write(
+      `Wrote ${Object.keys(sorted).length} modules (${label}) to ${outPath}.\n`,
+    );
+  } else {
+    process.stdout.write(json);
+  }
+};
+
+writeOut(transitiveDependents, "OUT_JSON", "transitive");
+writeOut(directDependents, "OUT_DIRECT_JSON", "direct");

.github/scripts/resolve-coverage-manifest.mjs

@@ -0,0 +1,94 @@
+/**
+ * Resolves the nightly e2e coverage manifest closest to a commit's point in
+ * history, so the test planner can narrow the e2e run.
+ *
+ * The whole flow lives here so callers "just get a manifest": list the retained
+ * manifest artifacts, find the one whose nightly commit is the nearest ancestor
+ * of `headSha` (via the GitHub compare API — no deep clone), download and unzip
+ * just that one, and return its parsed contents.
+ *
+ * `github` is an authenticated Octokit, as injected by actions/github-script.
+ * Returns { builtAt, specs, path, behindBy } or null when nothing is an
+ * ancestor (caller then runs e2e in full). Never throws: any API/IO failure is
+ * logged and resolves to null, because coverage resolution must not break the
+ * test plan.
+ */
+
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+
+const ARTIFACT_NAME = "spec-file-manifest";
+const EXTRACT_DIR = "e2e/coverage";
+const MANIFEST_PATH = `${EXTRACT_DIR}/${ARTIFACT_NAME}.json`;
+
+export async function resolveCoverageManifest({
+  github,
+  owner,
+  repo,
+  headSha,
+  log = console.log,
+}) {
+  try {
+    // Every retained manifest artifact, newest first. Each carries its
+    // nightly's head_sha — the commit it was built from (== builtAt).
+    const artifacts = await github.paginate(
+      github.rest.actions.listArtifactsForRepo,
+      { owner, repo, name: ARTIFACT_NAME, per_page: 100 },
+    );
+    const candidates = artifacts
+      .filter((artifact) => !artifact.expired && artifact.workflow_run?.head_sha)
+      .sort(
+        (a, b) =>
+          new Date(b.created_at).getTime() - new Date(a.created_at).getTime(),
+      );
+
+    // First candidate that is an ancestor of head is the closest in history
+    // (master is linear, candidates are chronological). compare base...head:
+    // behind_by === 0 ⇒ base is an ancestor of head; ahead_by is the distance.
+    let chosen = null;
+    for (const artifact of candidates) {
+      const base = artifact.workflow_run.head_sha;
+      // A stale candidate (force-pushed/GC'd commit) makes compare 404 — skip
+      // it rather than lose the optimization for everyone.
+      let comparison;
+      try {
+        ({ data: comparison } =
+          await github.rest.repos.compareCommitsWithBasehead({
+            owner,
+            repo,
+            basehead: `${base}...${headSha}`,
+          }));
+      } catch {
+        continue;
+      }
+      if (comparison.behind_by === 0) {
+        chosen = { artifact, base, behindBy: comparison.ahead_by };
+        break;
+      }
+    }
+
+    if (!chosen) {
+      log("No ancestor coverage manifest found; e2e will run in full.");
+      return null;
+    }
+
+    const download = await github.rest.actions.downloadArtifact({
+      owner,
+      repo,
+      artifact_id: chosen.artifact.id,
+      archive_format: "zip",
+    });
+    fs.writeFileSync(`${ARTIFACT_NAME}.zip`, Buffer.from(download.data));
+    execFileSync("unzip", ["-o", `${ARTIFACT_NAME}.zip`, "-d", EXTRACT_DIR]);
+
+    const manifest = JSON.parse(fs.readFileSync(MANIFEST_PATH, "utf8"));
+    log(
+      `Using coverage manifest ${chosen.base.slice(0, 12)} ` +
+        `(${chosen.behindBy} commits behind HEAD).`,
+    );
+    return { ...manifest, path: MANIFEST_PATH, behindBy: chosen.behindBy };
+  } catch (error) {
+    log(`Coverage manifest resolution failed; e2e will run in full: ${error}`);
+    return null;
+  }
+}

.github/scripts/setup-python-runner.sh

@@ -19,7 +19,8 @@ while [[ $# -gt 0 ]]; do
 done
 
 echo "Cloning python-runner repository..."
-git clone --depth 1 https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git python-runner
+git clone --depth 1 https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git --branch seccomp python-runner
+
 
 if [ "$SKIP_START" = false ]; then
   echo "Starting python-runner..."

.github/scripts/upload-affected-tests-stats.js

@@ -1,41 +1,64 @@
-// This script is used in .github/workflows/run-tests.yml.
-// It uploads the test-plan stats row produced by create-test-plan.js to
-// the stats.metabase.com tracking table.
-// Reads STATS_JSON, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
+// Appends the test-plan stats row produced by create-test-plan.ts to the
+// "FE Affected Tests" table on stats.metabase.com.
+// Reads STATS_JSON, TRIGGERED_BY, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
 
 const { uploadCsvToMb } = require("./csv-to-mb.js");
 
-const stats = JSON.parse(process.env.STATS_JSON);
-console.log("stats", stats);
+// "FE Affected Tests" uploaded table on stats.metabase.com.
+const TABLE_ID = 81818;
 
-const row = {
-  Date: new Date().toISOString(),
-  PR: Number(process.env.PR_NUMBER),
-  "Head SHA": process.env.HEAD_SHA,
-  "Base SHA": process.env.BASE_SHA,
-  "Modules changed": stats.modules_changed,
-  "Modules affected": stats.modules_affected,
-  "FE Unit specs total": stats.fe_unit_specs_total,
-  "FE Unit specs run": stats.fe_unit_specs_run,
-  "FE Unit specs skipped": stats.fe_unit_specs_skipped,
-  "Loki stories total": stats.loki_stories_total,
-  "Loki stories run": stats.loki_stories_run,
-  "Loki stories skipped": stats.loki_stories_skipped,
-  "E2E specs total": stats.e2e_specs_total,
-  "E2E specs run": stats.e2e_specs_run,
-  "E2E specs skipped": stats.e2e_specs_skipped,
-};
+async function main() {
+  // create-test-plan doesn't always produce stats (e.g. on release branches
+  // running an older planner), leaving STATS_JSON empty. Nothing to upload.
+  const raw = (process.env.STATS_JSON || "").trim();
+  if (!raw || raw === "null") {
+    console.log("No STATS_JSON to upload; skipping.");
+    return;
+  }
 
-uploadCsvToMb({
-  baseUrl: "https://stats.metabase.com",
-  tableId: 77008, // "Affected Tests Stats" table on stats.metabase.com
-  jsonData: [row],
-  mode: "append",
-})
-  .then(() => {
-    console.log("Data uploaded successfully");
-  })
-  .catch((error) => {
-    console.error("Error uploading data:", error);
-    process.exit(1);
+  const s = JSON.parse(raw);
+  console.log("stats", s);
+
+  const row = {
+    Date: new Date().toISOString(),
+    // "pr_update" or "merge_to_master". ("Trigger" is a reserved SQL word.)
+    "Triggered By": process.env.TRIGGERED_BY,
+    PR: Number(process.env.PR_NUMBER),
+    "Head SHA": process.env.HEAD_SHA,
+    "Base SHA": process.env.BASE_SHA,
+    "FE Files Changed": s.fe_files_changed,
+    "FE Files Total": s.fe_files_total,
+    "BE Files Changed": s.be_files_changed,
+    "BE Files Total": s.be_files_total,
+    "Unit Infra Touched": s.unit_infra_touched,
+    "Loki Infra Touched": s.loki_infra_touched,
+    "Shared Sources Touched": s.shared_sources_touched,
+    "FE Modules Total": s.fe_modules_total,
+    "FE Modules Changed": s.fe_modules_changed,
+    "FE Modules Affected (Rules)": s.fe_modules_affected_rules,
+    "FE Modules Affected (Usage)": s.fe_modules_affected_usage,
+    "Unit Specs All": s.unit_specs_all,
+    "Unit Specs To Run (Rules)": s.unit_specs_to_run_rules,
+    "Unit Specs To Run (Usage)": s.unit_specs_to_run_usage,
+    "Loki Stories All": s.loki_stories_all,
+    "Loki Stories To Run (Rules)": s.loki_stories_to_run_rules,
+    "Loki Stories To Run (Usage)": s.loki_stories_to_run_usage,
+    "E2E Specs All": s.e2e_specs_all,
+    "E2E Specs To Run (Rules)": s.e2e_specs_to_run_rules,
+    "E2E Specs To Run (Usage)": s.e2e_specs_to_run_usage,
+  };
+
+  await uploadCsvToMb({
+    baseUrl: "https://stats.metabase.com",
+    tableId: TABLE_ID,
+    jsonData: [row],
+    mode: "append",
   });
+  console.log("Data uploaded successfully");
+}
+
+// Best-effort: never let a telemetry failure turn the job red.
+main().catch((error) => {
+  console.error("Skipping stats upload after error:", error);
+  process.exit(0);
+});

.github/team.json

@@ -4,7 +4,6 @@
       "name": "Querying Platform",
       "label": ".Team/QueryingPlatform",
       "members": [
-        "bshepherdson",
         "metamben",
         "rileythomp",
         "camsaul",
@@ -48,7 +47,8 @@
       "members": [
         "fraserdrops",
         "nemanjaglumac",
-        "romeovs"
+        "romeovs",
+        "ChrisVandoo"
       ]
     },
     {
@@ -89,11 +89,12 @@
         "npfitz",
         "johnswanson",
         "nvoxland",
-        "edpaget",
+        "bshepherdson",
         "deniskaber",
         "andsalves",
         "kevinkelleher12",
-        "AndreyChernykh"
+        "AndreyChernykh",
+        "bowbahdoe"
       ]
     },
     {

.github/workflows/actionlint.yml

@@ -0,0 +1,42 @@
+name: Actionlint
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-**'
+    paths:
+      - '.github/workflows/**'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    name: Lint Github Actions Workflows
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Get changed Github actions
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+          list-files: shell
+      - name: Setup actionlint
+        id: download
+        shell: bash
+        run: |
+          if command -v actionlint; then
+            echo "executable=actionlint" >> "$GITHUB_OUTPUT"
+          else
+            # script sets executable output, for details see: https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
+            bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash)
+          fi
+      - name: Run actionlint
+        run: ${{ steps.download.outputs.executable }} --color --verbose ${{ steps.changes.outputs.actionlint_files }}

.github/workflows/app-db.yml

@@ -11,6 +11,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-app-db
   cancel-in-progress: true
 
+# Exposed to every job so the test-driver action can report failures to
+# ci-conductor (secrets: inherit is already set on the app-db call in
+# run-tests.yml). See DEV-2224.
+env:
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+
 jobs:
   be-tests-mariadb:
     if: ${{ !inputs.skip }}
@@ -69,7 +76,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -113,6 +120,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -124,6 +132,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mysql:
     if: ${{ !inputs.skip }}
@@ -184,7 +193,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -236,6 +245,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -247,6 +257,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-postgres:
     if: ${{ !inputs.skip }}
@@ -300,7 +311,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -346,6 +357,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -357,6 +369,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   app-db-tests-result:
     needs:

.github/workflows/backend.yml

@@ -11,6 +11,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-backend
   cancel-in-progress: true
 
+# Exposed to the test jobs so they can report failures to ci-conductor
+# (secrets: inherit is already set on the backend call in run-tests.yml).
+# See DEV-2224.
+env:
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+
 jobs:
   be-linter-clj-kondo:
     if: ${{ !inputs.skip }}
@@ -38,7 +45,7 @@ jobs:
 
   be-linter-eastwood-test:
     # Master / release safety net: lint every backend test namespace.
-    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-')) }}
+    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: Eastwood (tests only)
@@ -114,7 +121,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java-version: [21]
+        java-version: [25]
         job:
           - name: Enterprise Tests
             edition: ee
@@ -160,7 +167,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -179,20 +186,42 @@ jobs:
         env:
           MB_EDITION: ${{ matrix.job.edition }}
 
+      - name: Resolve current job id
+        # Resolve JOB_ID before the long test step so the ci-conductor reporter
+        # below can link failures to this exact job. Best-effort.
+        uses: ./.github/actions/resolve-job-id
+
       - name: "Test Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
         id: run-java-tests
         run: >-
           clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev
           :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           ${{ matrix.job.test-args }}
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
+      - name: Report failed tests to ci-conductor
+        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        # This step should NEVER fail the job!
+        continue-on-error: true
+        uses: ./.github/actions/report-failures-to-ci-conductor
+        with:
+          test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
+          adapter: backend
+
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: backend
+          test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
+
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
-        if: always() && (steps.run-java-tests.conclusion != 'skipped' || steps.run-java-tests-21.conclusion != 'skipped')
+        if: always()
         with:
           input-path: ./target/junit/
           output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
@@ -201,6 +230,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-java-tests.outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
@@ -229,7 +259,7 @@ jobs:
     timeout-minutes: 10
     strategy:
       matrix:
-        java-version: [21]
+        java-version: [25]
     name: "Check Java ${{ matrix.java-version }}"
     steps:
       - uses: actions/checkout@v6

.github/workflows/bundle-size-stats.yml

@@ -0,0 +1,148 @@
+name: Bundle Size Stats
+
+# Reuses the uberjar built on every master merge: downloads the jar (for the
+# emitted JS) plus the bundle-stats and embedding-sdk artifacts, measures
+# initial/total bundle sizes, and appends them to stats.metabase.com.
+
+on:
+  workflow_run:
+    workflows: ["Build Uberjar"]
+    types: [completed]
+    # Master only: releases form non-linear lines whose deltas are meaningless,
+    # so their sizes are backfilled separately rather than logged here.
+    branches: [master]
+
+concurrency:
+  group: bundle-size-stats-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  bundle-size-stats:
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 15
+    env:
+      HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+      # Only record a data point when a bundle's as-served size (brotli where the
+      # build ships .br, else gzip) moved by at least this percent vs the last
+      # plotted point, keeping the chart to real changes.
+      MIN_DELTA_PERCENT: "0.5"
+    steps:
+      - name: Check out the code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+      - name: Download EE uberjar
+        uses: ./.github/actions/fetch-artifact
+        with:
+          commit: ${{ github.event.workflow_run.head_sha }}
+          edition: ee
+          extract-path: temp/uberjar
+      - name: Extract front-end bundles from uberjar
+        run: |
+          mkdir -p resources artifacts
+          unzip -o "temp/uberjar/metabase.jar" \
+            "frontend_client/app/dist/*" \
+            "frontend_client/app/embed.js" \
+            "frontend_client/app/embedding-sdk/*" \
+            -d resources
+          unzip -o -j "temp/uberjar/metabase.jar" version.properties -d artifacts
+      - name: Download bundle stats and SDK package artifacts
+        uses: actions/github-script@v9
+        with:
+          script: | # js
+            const fs = require("fs");
+
+            async function fetchArtifact(name) {
+              const res = await github.rest.actions.listArtifactsForRepo({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name,
+                per_page: 1,
+              });
+              const artifact = res.data?.artifacts?.[0];
+              if (!artifact) {
+                console.log(`Artifact not found: ${name}`);
+                return "";
+              }
+              const download = await github.rest.actions.downloadArtifact({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                artifact_id: artifact.id,
+                archive_format: "zip",
+              });
+              fs.writeFileSync(`${name}.zip`, Buffer.from(download.data));
+              console.log(`Downloaded ${name}`);
+              return `${name}.zip`;
+            }
+
+            const sha = process.env.HEAD_SHA;
+            core.exportVariable("STATS_ZIP", await fetchArtifact(`metabase-bundle-stats-ee-${sha}`));
+            core.exportVariable("PKG_ZIP", await fetchArtifact(`embedding-sdk-${sha}`));
+      - name: Extract stats and SDK package
+        run: |
+          mkdir -p artifacts resources/embedding-sdk
+          if [ -n "$STATS_ZIP" ]; then unzip -o "$STATS_ZIP" -d artifacts; fi
+          if [ -n "$PKG_ZIP" ]; then unzip -o "$PKG_ZIP" -d resources/embedding-sdk; fi
+      - name: Restore last plotted bundle sizes
+        uses: actions/cache/restore@v4
+        with:
+          path: bundle-size-cache
+          key: bundle-size-last-${{ github.run_id }}
+          restore-keys: |
+            bundle-size-last-
+      - name: Measure bundle sizes
+        run: node ./.github/scripts/measure-bundle-sizes.js | tee artifacts/bundle-sizes.json
+      - name: Compute deltas and decide whether to record this point
+        id: prepare
+        env:
+          CURRENT: artifacts/bundle-sizes.json
+          LAST: bundle-size-cache/last.json
+          CACHE_OUT: bundle-size-cache/last.json
+          ROWS_OUT: artifacts/upload-rows.json
+          VERSION_PROPS: artifacts/version.properties
+          # Passed via env (not interpolated into the shell) so the commit
+          # message can't inject commands; the script keeps only the subject.
+          COMMIT_MESSAGE: ${{ github.event.workflow_run.head_commit.message }}
+        run: node ./.github/scripts/bundle-size-stats-prepare.js
+      - name: Upload sizes (with deltas) to Stats
+        id: upload
+        if: steps.prepare.outputs.significant == 'true'
+        uses: actions/github-script@v9
+        env:
+          API_KEY: ${{ secrets.STATS_API_KEY }}
+        with:
+          script: | # js
+            const fs = require("fs");
+            const { uploadCsvToMb } = require("${{ github.workspace }}/.github/scripts/csv-to-mb.js");
+
+            const data = JSON.parse(
+              fs.readFileSync("${{ github.workspace }}/artifacts/upload-rows.json", "utf8"),
+            );
+
+            console.table(data);
+
+            try {
+              await uploadCsvToMb({
+                baseUrl: "https://stats.metabase.com",
+                tableId: 79702,
+                jsonData: data,
+                mode: "append",
+              });
+              console.log("Bundle sizes uploaded successfully");
+              core.setOutput("uploaded", "true");
+            } catch (error) {
+              // Stats logging is best-effort: if stats.metabase.com is still
+              // unreachable after the client's retries, keep the run green. The
+              // last-plotted cache is only saved on a successful upload (below),
+              // so this point is re-attempted on the next master build and
+              // nothing is silently dropped.
+              core.warning(`Bundle-size upload failed after retries; leaving run green: ${error.message}`);
+              core.setOutput("uploaded", "false");
+            }
+      - name: Remember this as the last plotted point
+        if: steps.upload.outputs.uploaded == 'true'
+        uses: actions/cache/save@v4
+        with:
+          path: bundle-size-cache
+          key: bundle-size-last-${{ github.run_id }}

.github/workflows/claude-e2e-flake-fix.yml

@@ -1,205 +0,0 @@
-name: "Claude E2E Flake Fix"
-
-# Runs the /fix-flaky-test command headlessly to fix a flaky e2e test tracked by a Linear
-# issue. Triggered manually or by automation (e.g. ci-conductor) via workflow_dispatch /
-# repository_dispatch. ci-conductor only dispatches this workflow — it never runs the agent
-# itself. The agent opens a green, review-ready PR; a human always reviews and merges.
-
-on:
-  workflow_dispatch:
-    inputs:
-      issue:
-        description: "Linear issue ref for the flaky test (e.g. DEV-2181)"
-        required: true
-        type: string
-  repository_dispatch:
-    types: [e2e-flake-fix]
-
-concurrency:
-  # One in-flight run per Linear issue. Belt-and-suspenders alongside the branch-existence
-  # dedup the command itself performs.
-  group: e2e-flake-fix-${{ github.event.inputs.issue || github.event.client_payload.issue }}
-  cancel-in-progress: false
-
-jobs:
-  flake-fix:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    # 3 attempts x 2 stress runs (burn_in=50) can run for hours. If this bumps the runner's
-    # job ceiling, decompose via workflow_run completion events + --resume (see DEV-2182).
-    timeout-minutes: 360
-    permissions:
-      contents: write
-      pull-requests: write
-      id-token: write
-    steps:
-      - name: Resolve Linear issue ref
-        id: ref
-        env:
-          DISPATCH_ISSUE: ${{ github.event.inputs.issue }}
-          PAYLOAD_ISSUE: ${{ github.event.client_payload.issue }}
-        run: |
-          if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
-            REF="$PAYLOAD_ISSUE"
-          else
-            REF="$DISPATCH_ISSUE"
-          fi
-          if [ -z "$REF" ]; then
-            echo "::error::No Linear issue ref supplied"
-            exit 1
-          fi
-          echo "ref=$REF" >> "$GITHUB_OUTPUT"
-          echo "branch=automated-e2e-flake-fix-$REF" >> "$GITHUB_OUTPUT"
-          echo "Flake fix for Linear issue: $REF"
-
-      # Check out metabase itself with the Metabase Automation token so the agent's
-      # git push / gh dispatch run as that user (a PAT, so it triggers the stress workflow).
-      - uses: actions/checkout@v6
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          fetch-depth: 0
-
-      - name: Dedup — skip if the fix branch already exists
-        id: dedup
-        env:
-          BRANCH: ${{ steps.ref.outputs.branch }}
-        run: |
-          if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
-            echo "::notice::$BRANCH already exists — a run is in flight or already landed. Skipping."
-            echo "exists=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "exists=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Configure git identity (Metabase Automation)
-        if: steps.dedup.outputs.exists == 'false'
-        run: |
-          git config --global user.name "Metabase Automation"
-          git config --global user.email "github-automation@metabase.com"
-
-      # Make the Linear MCP available to the agent (it prefers MCP, falls back to the
-      # REST/GraphQL API with the same key when MCP is absent).
-      - name: Register Linear MCP server
-        if: steps.dedup.outputs.exists == 'false'
-        env:
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
-        run: |
-          jq -n \
-            --arg key "$LINEAR_API_KEY" \
-            '{
-              mcpServers: {
-                "linear-server": {
-                  url: "https://mcp.linear.app/mcp",
-                  type: "http",
-                  headers: { Authorization: ("Bearer " + $key) }
-                }
-              }
-            }' > ~/.claude.json
-
-      # Fail fast if the model API is unreachable or the key is bad / over quota.
-      - name: Preflight — model API reachable & authorized
-        if: steps.dedup.outputs.exists == 'false'
-        env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY_E2E_FLAKE_FIX }}
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
-        run: |
-          code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 15 \
-            https://api.anthropic.com/v1/models \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01") \
-            || { echo "::error::Anthropic API unreachable (connect/timeout) — runner egress likely blocked"; exit 1; }
-          echo "Anthropic /v1/models -> HTTP $code"
-          case "$code" in
-            200)     ;;
-            401|403) echo "::error::Anthropic API auth failed (HTTP $code) — check ANTHROPIC_FLAKE_FIX_API_KEY"; exit 1 ;;
-            429)     echo "::error::Anthropic API rate limited / over quota (HTTP $code)"; exit 1 ;;
-            *)       echo "::error::Anthropic API unexpected status $code"; exit 1 ;;
-          esac
-
-          # Linear is non-fatal: surface egress/auth trouble without blocking an otherwise-fine run
-          # (the live path uses Bearer auth via MCP; this raw-key GraphQL probe may differ).
-          lcode=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 15 \
-            -X POST https://api.linear.app/graphql \
-            -H "Authorization: $LINEAR_API_KEY" \
-            -H "Content-Type: application/json" \
-            --data '{"query":"{ viewer { id } }"}') \
-            || { echo "::warning::Linear API unreachable (connect/timeout)"; lcode=000; }
-          echo "Linear /graphql -> HTTP $lcode"
-          [ "$lcode" = "200" ] || echo "::warning::Linear API check returned HTTP $lcode — not blocking"
-
-      - name: Run /fix-flaky-test with Claude Code
-        id: claude
-        if: steps.dedup.outputs.exists == 'false'
-        continue-on-error: true
-        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
-        env:
-          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
-          GITHUB_ACTIONS_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        timeout-minutes: 350
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_E2E_FLAKE_FIX }}
-          github_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          allowed_bots: linear
-          prompt: |
-            Read and follow the instructions in .claude/commands/fix-flaky-test.md to fix the
-            flaky e2e test tracked by Linear issue ${{ steps.ref.outputs.ref }}. Treat
-            "${{ steps.ref.outputs.ref }}" as the command's $ARGUMENTS.
-
-            ## CI Environment Notes
-            - You are running headlessly in GitHub Actions as the "Metabase Automation" user.
-              git, gh, and the Linear MCP are pre-configured — no human is watching, so never
-              ask for approval. The branch-existence dedup gate in Phase 0 is the only go/no-go.
-            - The fix branch is `${{ steps.ref.outputs.branch }}`.
-            - Polling: `ScheduleWakeup` is not available here. Instead, block on the stress runs
-              with `gh run watch <run-id> --exit-status` (the job is long-lived by design).
-            - NEVER merge: do not run `gh pr merge` or enable auto-merge. Stop at a green,
-              review-ready PR. A human owns the merge.
-            - If a phase fails catastrophically, post the failure (with GITHUB_ACTIONS_RUN_URL)
-              to the Linear issue before exiting, per the command's audit-trail step.
-          claude_args: >-
-            --allowedTools
-            "Glob,
-            Grep,
-            Read,
-            ToolSearch,
-            Skill(*),
-            WebFetch(domain:github.com),
-            Edit(//./**),
-            Edit(/tmp/**),
-            Write(//./**),
-            Write(/tmp/**),
-            Bash(cat *),
-            Bash(cd *),
-            Bash(diff *),
-            Bash(echo *),
-            Bash(find *),
-            Bash(gh *),
-            Bash(git *),
-            Bash(grep *),
-            Bash(head *),
-            Bash(jq *),
-            Bash(ls *),
-            Bash(mkdir *),
-            Bash(printf *),
-            Bash(sed *),
-            Bash(sort *),
-            Bash(tail *),
-            Bash(tee *),
-            Bash(wc *),
-            Bash(which *),
-            mcp__linear-server__get_issue,
-            mcp__linear-server__list_comments,
-            mcp__linear-server__list_issues,
-            mcp__linear-server__save_comment,
-            mcp__linear-server__create_attachment_from_upload"
-            --disallowedTools "Bash(gh pr merge*),Bash(git push origin master*),Bash(rm -rf /*)"
-
-      - name: Verify the run did not crash
-        if: steps.dedup.outputs.exists == 'false'
-        run: |
-          if [ "${{ steps.claude.outcome }}" = "failure" ]; then
-            echo "::error::Claude Code crashed or exited with an error"
-            exit 1
-          fi
-          echo "Flake-fix run completed (see the Linear issue for the audit trail and PR)."

.github/workflows/cross-branch-migrations.yml

@@ -26,7 +26,7 @@ concurrency:
 jobs:
   migrations-h2-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: h2
@@ -40,7 +40,7 @@ jobs:
 
   migrations-postgres-14-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: postgres
@@ -66,7 +66,7 @@ jobs:
 
   migrations-postgres-latest-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: postgres
@@ -92,7 +92,7 @@ jobs:
 
   migrations-mysql-8-0-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -117,7 +117,7 @@ jobs:
 
   migrations-mysql-latest-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -143,7 +143,7 @@ jobs:
 
   migrations-mariadb-10-6-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -168,7 +168,7 @@ jobs:
 
   migrations-mariadb-latest-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql

.github/workflows/docs-generate-63.yml

@@ -0,0 +1,22 @@
+name: Auto-update documentation (release)
+
+on:
+  schedule:
+    - cron: "0 23 * * 1-5" # Every Monday through Friday at 11 PM UTC
+  workflow_dispatch:
+    inputs:
+      target_branch:
+        description: "Target branch for documentation update"
+        required: false
+        default: "release-x.63.x"
+        type: string
+
+jobs:
+  update-release-docs:
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    name: Call documentation update for release branch
+    uses: ./.github/workflows/docs-generate-base.yml
+    with:
+      target_branch: ${{ inputs.target_branch || 'release-x.63.x' }}
+    secrets:
+      automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers.yml

@@ -11,6 +11,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-drivers
   cancel-in-progress: true
 
+# Exposed to every driver job so the test-driver action can report failures to
+# ci-conductor (secrets: inherit is already set on the drivers call in
+# run-tests.yml). See DEV-2224.
+env:
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+
 jobs:
   # This job determines which driver tests should run based on PR context.
   # All decision logic is consolidated in mage driver-decisions.
@@ -39,6 +46,7 @@ jobs:
       sqlserver-should-run: ${{ steps.driver-decisions.outputs.sqlserver-should-run }}
       vertica-should-run: ${{ steps.driver-decisions.outputs.vertica-should-run }}
       # Per-driver configured status from ci-test-config (skip | info | required)
+      h2-status: ${{ steps.driver-decisions.outputs.h2-status }}
       athena-status: ${{ steps.driver-decisions.outputs.athena-status }}
       bigquery-status: ${{ steps.driver-decisions.outputs.bigquery-status }}
       clickhouse-status: ${{ steps.driver-decisions.outputs.clickhouse-status }}
@@ -49,6 +57,7 @@ jobs:
       mongo-sharded-cluster-status: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-status }}
       mysql-mariadb-status: ${{ steps.driver-decisions.outputs.mysql-mariadb-status }}
       oracle-status: ${{ steps.driver-decisions.outputs.oracle-status }}
+      postgres-status: ${{ steps.driver-decisions.outputs.postgres-status }}
       presto-jdbc-status: ${{ steps.driver-decisions.outputs.presto-jdbc-status }}
       redshift-status: ${{ steps.driver-decisions.outputs.redshift-status }}
       snowflake-status: ${{ steps.driver-decisions.outputs.snowflake-status }}
@@ -129,7 +138,7 @@ jobs:
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> $GITHUB_OUTPUT
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }}
-          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}
+          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-x') }}
         shell: bash
 
   be-tests-athena-ee:
@@ -170,6 +179,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -183,6 +194,7 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
@@ -246,6 +258,8 @@ jobs:
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.bigquery-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -259,6 +273,7 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.bigquery-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -331,6 +346,8 @@ jobs:
         junit-name: 'be-tests-clickhouse-ee'
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.clickhouse-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -342,6 +359,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.clickhouse-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -385,6 +404,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -396,12 +417,39 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - name: Driver Tests Part 1
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 0
+          - name: Driver Tests Part 2
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 1
+          - name: Driver Tests Part 3
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 2
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -430,9 +478,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-databricks-ee'
-        test-args: >-
-          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
+        test-args: ${{ matrix.job.test-args }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -446,12 +494,38 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - name: Driver Tests Part 1
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 0
+          - name: Driver Tests Part 2
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 1
+          - name: Driver Tests Part 3
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 2
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -481,9 +555,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-databricks-multi-catalog-ee'
-        test-args: >-
-          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
+        test-args: ${{ matrix.job.test-args }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -497,6 +571,7 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-h2:
     needs: determine-driver-skips
@@ -516,6 +591,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -527,6 +604,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-h2-oss:
     needs: determine-driver-skips
@@ -547,6 +626,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -558,6 +639,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
@@ -620,7 +703,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -677,6 +760,8 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -688,6 +773,8 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -757,6 +844,8 @@ jobs:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -768,6 +857,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -839,6 +930,8 @@ jobs:
           test-args: >-
             :exclude-tags '[:mongo-sharded-cluster-tests :mb/transforms-python-test]'
             :only-tags [:mb/driver-tests]
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -850,6 +943,8 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
@@ -884,6 +979,8 @@ jobs:
         junit-name: 'be-tests-mongo-sharded-cluster-ee'
         test-args: >-
           :only metabase.driver.mongo.sharded-cluster-test
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -895,6 +992,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-oracle:
     needs: determine-driver-skips
@@ -969,6 +1068,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.oracle-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -980,6 +1081,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.oracle-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-postgres:
     needs: determine-driver-skips
@@ -1022,7 +1125,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -1073,6 +1176,8 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.postgres-status }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -1084,6 +1189,9 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.postgres-status }}
+          report-variant: ${{ matrix.version.name }}-${{ matrix.job.name }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -1160,6 +1268,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1171,6 +1281,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
@@ -1244,6 +1356,8 @@ jobs:
         test-args: >-
           ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.redshift-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: ${{ !matrix.job.skip && !cancelled() }}
@@ -1257,6 +1371,7 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.redshift-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1276,8 +1391,11 @@ jobs:
           - name: Driver Tests
             test-args: >-
               :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
+              :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
               :fail-fast? true
+          - name: Upload Tests
+            test-args: >-
+              :only-tags [:mb/upload-tests]
           - name: Transforms Python Tests
             test-args: >-
               :only-tags [:mb/transforms-python-test]
@@ -1326,6 +1444,8 @@ jobs:
         junit-name: 'be-tests-snowflake-ee'
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.snowflake-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1339,6 +1459,7 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.snowflake-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1380,6 +1501,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sparksql-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1391,6 +1514,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sparksql-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
@@ -1405,7 +1530,7 @@ jobs:
     - name: Fail on quarantine conflict
       if: ${{ needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
       run: |
-        echo "::error::SQLite driver is quarantined but you changed files in modules/drivers/sqlite/"
+        echo "::error::SQLite driver is quarantined but you changed files that affect it"
         echo ""
         echo "Your changes will NOT be tested because the driver is currently quarantined."
         echo "To run SQLite tests, add the label: break-quarantine-sqlite"
@@ -1421,6 +1546,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sqlite-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1432,6 +1559,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sqlite-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-sqlserver:
     needs: determine-driver-skips
@@ -1497,6 +1626,8 @@ jobs:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.version.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sqlserver-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1508,6 +1639,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sqlserver-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1622,6 +1755,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.vertica-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1633,6 +1768,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.vertica-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   drivers-tests-result:
     needs:
@@ -1686,11 +1823,13 @@ jobs:
               "be-tests-clickhouse-ee": "${{ needs.determine-driver-skips.outputs.clickhouse-status }}",
               "be-tests-databricks-ee": "${{ needs.determine-driver-skips.outputs.databricks-status }}",
               "be-tests-druid-jdbc-ee": "${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}",
+              "be-tests-h2": "${{ needs.determine-driver-skips.outputs.h2-status }}",
               "be-tests-mongo": "${{ needs.determine-driver-skips.outputs.mongo-status }}",
               "be-tests-mongo-ssl": "${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}",
               "be-tests-mongo-sharded-cluster-ee": "${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}",
               "be-tests-mysql-mariadb": "${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}",
               "be-tests-oracle": "${{ needs.determine-driver-skips.outputs.oracle-status }}",
+              "be-tests-postgres": "${{ needs.determine-driver-skips.outputs.postgres-status }}",
               "be-tests-presto-jdbc-ee": "${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}",
               "be-tests-redshift-ee": "${{ needs.determine-driver-skips.outputs.redshift-status }}",
               "be-tests-snowflake-ee": "${{ needs.determine-driver-skips.outputs.snowflake-status }}",

.github/workflows/e2e-coverage-manifest.yml

@@ -0,0 +1,145 @@
+name: E2E Coverage Manifest
+
+# Nightly: builds an instrumented frontend, runs the e2e suite sharded to
+# record which source files each spec exercises, and publishes a spec -> files
+# manifest used for selective e2e runs on PRs.
+#
+# Isolated from the PR e2e path on purpose - the per-shard worker
+# (e2e-coverage-shard.yml) is a dedicated, trimmed copy so coverage runs can
+# never affect PR test results.
+
+on:
+  schedule:
+    # Nightly, after the day's merges have settled (UTC).
+    - cron: "0 7 * * *"
+  workflow_dispatch:
+    inputs:
+      edition:
+        description: "Edition to instrument"
+        type: choice
+        options: ["ee", "oss"]
+        default: "ee"
+
+concurrency:
+  group: e2e-coverage-manifest-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-instrumented:
+    name: Build instrumented uberjar
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    env:
+      MB_EDITION: ${{ inputs.edition || 'ee' }}
+      INSTRUMENT_COVERAGE: "true"
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      # build.clj forwards INSTRUMENT_COVERAGE to the rspack build, so only the
+      # bundled FE is instrumented; everything else builds normally.
+      - name: Build instrumented uberjar
+        run: ./bin/build.sh
+      - name: Upload instrumented uberjar
+        uses: actions/upload-artifact@v7
+        with:
+          name: instrumented-uberjar
+          path: target/uberjar/metabase.jar
+          retention-days: 1
+
+  # Fixed-N sharding — coverage doesn't need the PR matrix-builder's tag/edition
+  # groups, just an even split of the regular spec set. The shard count lives in
+  # one place (SHARDS below); the matrix is generated from it.
+  setup:
+    name: Build shard matrix
+    runs-on: ubuntu-22.04
+    outputs:
+      matrix: ${{ steps.gen.outputs.matrix }}
+      count: ${{ steps.gen.outputs.count }}
+    steps:
+      - id: gen
+        env:
+          SHARDS: 100
+        run: |
+          matrix=$(node -e "console.log(JSON.stringify({split_index:[...Array(Number(process.env.SHARDS)).keys()]}))")
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+          echo "count=$SHARDS" >> "$GITHUB_OUTPUT"
+
+  shards:
+    name: Shard
+    needs: [build-instrumented, setup]
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
+    uses: ./.github/workflows/e2e-coverage-shard.yml
+    secrets: inherit
+    with:
+      edition: ${{ inputs.edition || 'ee' }}
+      total_chunks: ${{ fromJson(needs.setup.outputs.count) }}
+      split_index: ${{ matrix.split_index }}
+
+  merge:
+    name: Merge and publish manifest
+    needs: shards
+    if: always()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    # github-script lists/downloads the previous manifest artifact.
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      # merge-multiple unions every shard's per-spec dir into one tree; the
+      # per-spec file design means no conflict resolution is needed.
+      - name: Download all shard coverage
+        uses: actions/download-artifact@v8
+        with:
+          pattern: coverage-shard-*
+          path: e2e/coverage-manifest-raw
+          merge-multiple: true
+      # Backfill source: the newest existing manifest is the previous nightly
+      # (this run hasn't uploaded yet). build-coverage-manifest.mjs carries over
+      # any still-existing spec that didn't run today.
+      - name: Download previous manifest for backfill
+        id: prev
+        uses: actions/github-script@v9
+        with:
+          script: | # js
+            const fs = require("fs");
+            const { owner, repo } = context.repo;
+            const { data } = await github.rest.actions.listArtifactsForRepo({
+              owner, repo, name: "spec-file-manifest", per_page: 20,
+            });
+            const art = (data.artifacts ?? [])
+              .filter((a) => !a.expired)
+              .sort((a, b) => new Date(b.created_at) - new Date(a.created_at))[0];
+            if (!art) {
+              console.log("No previous manifest; nothing to backfill.");
+              return;
+            }
+            const dl = await github.rest.actions.downloadArtifact({
+              owner, repo, artifact_id: art.id, archive_format: "zip",
+            });
+            fs.writeFileSync("prev-manifest.zip", Buffer.from(dl.data));
+            core.setOutput("found", "true");
+      - name: Unzip previous manifest
+        if: steps.prev.outputs.found == 'true'
+        run: unzip -o prev-manifest.zip -d prev-manifest
+      # GITHUB_SHA (the master commit this nightly built from) is stamped into
+      # the manifest as `builtAt`, so a PR can later pick the manifest closest
+      # to its own point in history. See resolve-coverage-manifest.mjs.
+      - name: Build coverage manifest
+        env:
+          PREV_MANIFEST: ${{ steps.prev.outputs.found == 'true' && 'prev-manifest/spec-file-manifest.json' || '' }}
+        run: node e2e/coverage/build-coverage-manifest.mjs
+      - name: Upload manifest
+        uses: actions/upload-artifact@v7
+        with:
+          name: spec-file-manifest
+          path: e2e/coverage/spec-file-manifest.json
+          retention-days: 30

.github/workflows/e2e-coverage-shard.yml

@@ -0,0 +1,112 @@
+name: E2E Coverage Shard
+
+# Reusable per-shard worker for the coverage manifest run. Trimmed extract of
+# e2e-test.yml: runs one cypress-split shard against an instrumented build and
+# uploads that shard's per-spec coverage. Intentionally omits the PR-only
+# concerns (failed-spec retry, Trunk quarantine, S3 result upload, timing
+# output) since this is a nightly, non-blocking job.
+
+on:
+  workflow_call:
+    inputs:
+      edition:
+        type: string
+        default: ee
+      total_chunks:
+        type: number
+        required: true
+      split_index:
+        type: number
+        required: true
+
+env:
+  DISPLAY: ""
+  TERM: xterm
+  TZ: US/Pacific
+  INSTRUMENT_COVERAGE: "true"
+
+jobs:
+  run:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    name: coverage-shard-${{ inputs.split_index }}
+    env:
+      MB_EDITION: ${{ inputs.edition }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: true
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
+          openldap: true
+          webhook: true
+          snowplow: true
+          postgres: true
+          mysql: true
+          mongo: true
+
+      # The orchestrator built and uploaded this in an earlier job of the same run.
+      - name: Download instrumented uberjar
+        uses: actions/download-artifact@v8
+        with:
+          name: instrumented-uberjar
+          path: target/uberjar
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Compile CLJS
+        run: bun run build-pure:cljs
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Generate database snapshots
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js snapshot
+
+      # cypress-split divides the spec set by timing data; INSTRUMENT_COVERAGE
+      # makes the support hook drain __coverage__ into e2e/coverage-manifest-raw/.
+      - name: Run shard ${{ inputs.split_index }}
+        # No SPLIT_FILE: cypress-split shards evenly by spec count using
+        # SPLIT/SPLIT_INDEX alone. Omitting it means no timings are read or
+        # written, which avoids cypress-split's after:run writeback (it would
+        # otherwise try to overwrite ./e2e/support/timings.json from a cwd where
+        # that subpath isn't reachable, crashing the run). Even-by-count is fine
+        # here — every spec runs exactly once across the shards.
+        env:
+          SPLIT: ${{ inputs.total_chunks }}
+          SPLIT_INDEX: ${{ inputs.split_index }}
+          SPLIT_SUMMARY: false
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: |
+          node e2e/runner/run_cypress_ci.js e2e \
+            --expose grepTags="-@mongo+-@python+-@OSS+-@skip"
+        # Don't let a single failing/flaky spec abort the shard — we still want
+        # coverage from the specs that did run.
+        continue-on-error: true
+
+      - name: Upload shard coverage
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-shard-${{ inputs.split_index }}
+          path: e2e/coverage-manifest-raw/
+          retention-days: 7
+          if-no-files-found: warn

.github/workflows/e2e-matrix-builder.yml

@@ -46,7 +46,7 @@ jobs:
             const { buildMatrix } = require('${{ github.workspace }}/.github/scripts/build-e2e-matrix.js');
             const inputSpecs = "${{ inputs.specs }}";
             const inputChunks = Number(process.env.chunks);
-            const java = 21;
+            const java = 25;
             const defaultRunner = "${{ vars.DEFAULT_RUNNER_KEY }}";
             const options = {
               java,

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -41,6 +41,49 @@ on:
         type: boolean
         required: false
         default: false
+  # Reusable form so other workflows (e.g. the flaky-test-fix PR auto-runner) can fan a
+  # matrix of changed specs into individual stress runs. Inputs mirror workflow_dispatch;
+  # both triggers read them via the `inputs` context.
+  workflow_call:
+    inputs:
+      spec:
+        description: "Relative path of the target spec"
+        type: string
+        required: true
+      burn_in:
+        description: "Number of times to run the test (e.g. 20)"
+        type: string
+        required: false
+        default: "20"
+      grep:
+        description: "Grep and filter tests to run in isolation"
+        type: string
+        required: false
+      mb_edition:
+        description: 'Set MB_EDITION env var to "ee" (enterprise) or "oss" (open-source)'
+        type: string
+        required: false
+        default: "ee"
+      qa_db:
+        description: "Whether to set up and include external QA databases"
+        type: boolean
+        required: false
+        default: false
+      enable_network_throttling:
+        description: "Enable network throttling simulation (4g slow like in chrome dev tools)"
+        type: boolean
+        required: false
+        default: true
+      fail_fast:
+        description: "Stop running remaining tests after the first failure"
+        type: boolean
+        required: false
+        default: false
+      build_jar:
+        description: "Build the uberjar from this branch (required to test frontend fixes) instead of downloading a prebuilt one"
+        type: boolean
+        required: false
+        default: false
 
 jobs:
   determine-test-type:
@@ -160,13 +203,13 @@ jobs:
 
       # For all options and fine-grained control, take a look at the documentation
       # https://github.com/cypress-io/cypress/tree/develop/npm/grep
-      - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
+      - name: Stress-test ${{ inputs.spec }} ${{ inputs.burn_in }} times
         env:
-          GREP: ${{ github.event.inputs.grep }}
+          GREP: ${{ inputs.grep }}
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
           FAIL_FAST: ${{ inputs.fail_fast }}
-          SPEC: ${{ github.event.inputs.spec }}
-          BURN_IN: ${{ github.event.inputs.burn_in }}
+          SPEC: ${{ inputs.spec }}
+          BURN_IN: ${{ inputs.burn_in }}
         run: |
           node e2e/runner/run_cypress_ci.js ${{ needs.determine-test-type.outputs.type }} \
           --spec "${SPEC}" \

.github/workflows/e2e-stress-test-flaky-pr.yml

@@ -0,0 +1,94 @@
+name: E2E Stress Test (flaky-test-fix PR)
+
+# Auto-runs the e2e stress test on every changed Cypress spec in a PR
+
+on:
+  pull_request:
+    # `opened`/`reopened` catch PRs created already labelled; `labeled` catches the label
+    # being added later; `synchronize` re-burns after new commits while the label is set.
+    types: [opened, reopened, synchronize, labeled]
+
+concurrency:
+  # One in-flight set of stress runs per PR branch — new commits cancel the previous burn.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  detect-changed-specs:
+    name: Detect changed e2e specs
+    # The PR must carry the `flaky-test-fix` label (covers opened/reopened/synchronize), AND
+    # when this is a `labeled` event we only proceed if the label *just added* is
+    # `flaky-test-fix` — otherwise adding any unrelated label to an already-labelled
+    # PR would needlessly re-burn the whole stress matrix.
+    if: >-
+      contains(github.event.pull_request.labels.*.name, 'flaky-test-fix') &&
+      (github.event.action != 'labeled' || github.event.label.name == 'flaky-test-fix')
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    outputs:
+      # JSON array of spec paths, consumed by the matrix below.
+      specs: ${{ steps.detect.outputs.specs }}
+      should_run: ${{ steps.detect.outputs.should_run }}
+      # burn-50 / burn-100 labels bump the burn-in past 20
+      burn_in: >-
+        ${{ contains(github.event.pull_request.labels.*.name, 'burn-100') && '100'
+            || contains(github.event.pull_request.labels.*.name, 'burn-50') && '50'
+            || '20' }}
+    steps:
+      - name: Detect changed Cypress spec files
+        id: detect
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: | # sh
+          # List every file in the PR, drop deletions, then keep only regular e2e Cypress
+          # specs: paths under e2e/ ending in .cy.spec.{js,ts,tsx}, excluding the
+          # embedding-SDK component specs under e2e/test-component/ (those use a different
+          # runner and are out of scope here). The greps are guarded with `|| true` so an
+          # empty match doesn't trip `pipefail`.
+          FILES=$(
+            gh api "repos/${REPO}/pulls/${PR_NUMBER}/files" \
+              --paginate \
+              --jq '.[] | select(.status != "removed") | .filename' \
+            | { grep -E '^e2e/.*\.cy\.spec\.(js|ts|tsx)$' || true; } \
+            | { grep -v '^e2e/test-component/' || true; } \
+            | sort -u
+          )
+
+          if [[ -z "$FILES" ]]; then
+            echo "No changed e2e Cypress spec files found — nothing to stress test."
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Changed e2e Cypress specs:"
+          echo "$FILES" | sed 's/^/  - /'
+
+          # Compact JSON array for the matrix, e.g. ["e2e/test/scenarios/a.cy.spec.js"].
+          SPECS_JSON=$(echo "$FILES" | jq -R . | jq -cs .)
+          echo "specs=${SPECS_JSON}" >> "$GITHUB_OUTPUT"
+          echo "should_run=true" >> "$GITHUB_OUTPUT"
+
+          echo "Note: you can use the burn-50 or burn-100 labels to increase the burn-in count from the default of 20." >> $GITHUB_STEP_SUMMARY
+
+  stress-test:
+    name: Stress test
+    needs: detect-changed-specs
+    if: needs.detect-changed-specs.outputs.should_run == 'true'
+    strategy:
+      # Don't let one flaky spec (or one throttling regime) cancel the burn-in of the others.
+      fail-fast: false
+      matrix:
+        spec: ${{ fromJson(needs.detect-changed-specs.outputs.specs) }}
+        # Burn each spec with and without throttle
+        enable_network_throttling: [true, false]
+    uses: ./.github/workflows/e2e-stress-test-flake-fix.yml
+    secrets: inherit
+    with:
+      spec: ${{ matrix.spec }}
+      burn_in: ${{ needs.detect-changed-specs.outputs.burn_in }}
+      qa_db: true
+      mb_edition: ee
+      build_jar: true
+      enable_network_throttling: ${{ matrix.enable_network_throttling }}

.github/workflows/e2e-test.yml

@@ -37,10 +37,11 @@ env:
   HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
   PR_NUMBER: ${{ github.event.pull_request.number || '' }}
   JOB_NAME: ${{ inputs.name }}
-  # ci-conductor failed-tests reporting (DEV-1999). Secret holds the webhooks
-  # base URL (".../webhooks"); the reporter appends the endpoint. Callers pass
+  # ci-conductor reporting (DEV-1999). Secret holds the base origin
+  # (e.g. "https://conductor.<host>"); each consumer appends the path it needs
+  # (the reporter POSTs to "/webhooks/failed-tests"). Callers pass
   # `secrets: inherit`; reporting no-ops when it's unset.
-  CI_CONDUCTOR_WEBHOOK_URL: ${{ secrets.CI_CONDUCTOR_WEBHOOK_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
   # Shared secret sent as the `x-internal-secret` header to authenticate.
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
   REPO_ID: ${{ github.event.repository.id }}
@@ -58,6 +59,11 @@ jobs:
     name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
     env:
       MB_EDITION: ${{ inputs.edition }}
+      # Absolute path for the quarantine failures file (DEV-2082). The after:spec
+      # recorder runs in Cypress' plugins process, whose cwd differs from the
+      # workspace where the gate step runs; an absolute path anchored to the
+      # workspace makes both agree regardless of cwd.
+      QUARANTINE_FAILURES_FILE: ${{ github.workspace }}/target/quarantine-failures.jsonl
       # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
       # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
       # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
@@ -158,9 +164,7 @@ jobs:
           node e2e/runner/run_cypress_ci.js e2e \
             --expose grepTags="-@mongo+-@python+-@OSS+-@skip" \
             --spec "$SPEC_PATH"
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
       - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
@@ -173,11 +177,9 @@ jobs:
         run: |
           echo "Running tests with specs: $SPEC_PATH"
           node e2e/runner/run_cypress_ci.js e2e \
-          --expose grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@skip'}}" \
+          --expose grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@mongo+-@python+-@OSS+-@skip'}}" \
           --spec "$SPEC_PATH"
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
       - name: Rewrite JUnit hook failures
@@ -207,6 +209,18 @@ jobs:
           variant: e2e-tests
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ inputs.specs && steps.tagged-e2e.outcome || steps.split-e2e.outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+
+      - name: Quarantine gate
+        # Only one of the two run steps executes; the other reports `skipped`. Only gate on actual failure.
+        if: ${{ !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure') }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: e2e
+          test-suite: e2e
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v7

.github/workflows/embedding-sdk-component-tests.yml

@@ -8,6 +8,12 @@ env:
   TERM: xterm
   TZ: US/Pacific # to make Node match the instance tz
   MB_EDITION: "ee"
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  REPO_ID: ${{ github.event.repository.id }}
+  COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+  TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
+  QUARANTINE_FAILURES_FILE: ${{ github.workspace }}/target/quarantine-failures.jsonl
 
 jobs:
   sdk-component-tests:
@@ -19,6 +25,7 @@ jobs:
         react-version: [18, 19]
       fail-fast: false
     env:
+      CI_CONDUCTOR_TEST_SUITE: embedding-sdk-component-react-${{ matrix.react-version }}
       # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
       # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
       # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
@@ -69,6 +76,8 @@ jobs:
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Make app db snapshot
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
@@ -86,6 +95,8 @@ jobs:
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: node e2e/runner/run_cypress_ci.js component
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
+        continue-on-error: true
 
       - name: Rewrite JUnit hook failures
         if: always()
@@ -111,10 +122,21 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-tests.outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: e2e
+          test-suite: ${{ env.CI_CONDUCTOR_TEST_SUITE }}
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: "SDK component tests > Upload Cypress Artifacts upon failure"
         uses: actions/upload-artifact@v7
-        if: failure()
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         with:
           name: cypress-recording-embedding-sdk-react-${{ matrix.react-version }}
           path: |
@@ -123,7 +145,7 @@ jobs:
           if-no-files-found: ignore
 
       - name: "SDK component tests > Publish Summary"
-        if: failure()
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         uses: actions/github-script@v9
         with:
           script: | #js
@@ -168,6 +190,7 @@ jobs:
     env:
       MB_RUN_MODE: "e2e"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CI_CONDUCTOR_TEST_SUITE: embedding-sdk-component-backward-compatibility
       # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
       # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
       # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
@@ -237,6 +260,8 @@ jobs:
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Make app db snapshot
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
@@ -252,6 +277,8 @@ jobs:
         run: |
           node e2e/runner/run_cypress_ci.js component \
             --expose grepTags="-@skip-backward-compatibility"
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
+        continue-on-error: true
 
       - name: Rewrite JUnit hook failures
         if: always()
@@ -277,10 +304,21 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-tests.outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: e2e
+          test-suite: ${{ env.CI_CONDUCTOR_TEST_SUITE }}
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v7
-        if: failure()
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         with:
           name: cypress-recording-embedding-sdk-cross-version
           path: |
@@ -289,7 +327,7 @@ jobs:
           if-no-files-found: ignore
 
       - name: Publish Summary
-        if: failure()
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         uses: actions/github-script@v9
         with:
           script: | #js

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -171,6 +171,8 @@ jobs:
       - name: Log free disk space
         run: df -h /
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Run e2e tests for Sample App
         id: run-e2e-tests
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
@@ -238,6 +240,8 @@ jobs:
           shoppy-datadog-application-id: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_APPLICATION_ID }}
           shoppy-datadog-client-token: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_CLIENT_TOKEN }}
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Run e2e tests for Shoppy
         id: run-e2e-tests
         if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
@@ -316,6 +320,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Run synthetic monitoring tests
         id: run-e2e-tests
         if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
@@ -363,6 +369,19 @@ jobs:
     timeout-minutes: 45
     name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
+      # Host apps are the only suite here running through Metabase's Cypress config,
+      # whose `after:spec` hook reports failures and writes QUARANTINE_FAILURES_FILE.
+      # Sample-app suites load their own config (no-op), so ci-conductor is scoped to this job.
+      CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+      CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+      CI_CONDUCTOR_TEST_SUITE: embedding-sdk-host-app
+      REPO_ID: ${{ github.event.repository.id }}
+      COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
+      QUARANTINE_FAILURES_FILE: ${{ github.workspace }}/target/quarantine-failures.jsonl
+      # `Fail job if tests failed` is the arbiter until ci-conductor takes over.
+      # Exactly one of the two gates the job.
+      CI_CONDUCTOR_QUARANTINE_ACTIVE: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
@@ -399,6 +418,8 @@ jobs:
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Generate database snapshots
         run: |
           node e2e/runner/run_cypress_ci.js snapshot \
@@ -416,14 +437,24 @@ jobs:
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v7
-        if: ${{ steps.run-e2e-tests.outcome != 'success' }}
+        if: ${{ !cancelled() && steps.run-e2e-tests.outcome == 'failure' }}
         with:
           name: cypress-recording-host-app-${{ matrix.test_suite }}-${{ matrix.environment }}-latest
           path: |
             ./cypress
           if-no-files-found: ignore
 
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.run-e2e-tests.outcome == 'failure' }}
+        continue-on-error: ${{ env.CI_CONDUCTOR_QUARANTINE_ACTIVE != 'true' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: e2e
+          test-suite: ${{ env.CI_CONDUCTOR_TEST_SUITE }}
+          enforce-quarantine: ${{ env.CI_CONDUCTOR_QUARANTINE_ACTIVE }}
+
       - name: Fail job if tests failed
-        if: ${{ steps.run-e2e-tests.outcome != 'success' }}
+        if: ${{ !cancelled() && steps.run-e2e-tests.outcome == 'failure' && env.CI_CONDUCTOR_QUARANTINE_ACTIVE != 'true' }}
         run: |
           exit 1

.github/workflows/embedding-sdk.yml

@@ -150,7 +150,7 @@ jobs:
         with:
           remove-previous-comment: true
           add-new-comment: true
-          message: "⚠️ Embedding SDK bundle size increased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). Please contact Embedding team."
+          message: "⚠️ Embedding SDK chunked bundle size (gzipped) increased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). Please contact Embedding team."
           include-log: false
 
       - name: Send notification to Slack via Zapier
@@ -165,7 +165,7 @@ jobs:
           PR_URL: ${{ github.event.pull_request.html_url }}
         run: |
           curl -s -X POST "$ZAPIER_WEBHOOK_URL" \
-            -d "⚠️ Embedding SDK bundle size increased by ${SIZE_CHANGE_PERCENT}% (threshold: ${BUNDLE_SIZE_THRESHOLD_PERCENT}%)
+            -d "⚠️ Embedding SDK chunked bundle size (gzipped) increased by ${SIZE_CHANGE_PERCENT}% (threshold: ${BUNDLE_SIZE_THRESHOLD_PERCENT}%)
 
           PR #${PR_NUMBER} ${PR_TITLE} (${PR_URL})"
 
@@ -175,7 +175,7 @@ jobs:
         with:
           remove-previous-comment: true
           add-new-comment: true
-          message: "🎉 Embedding SDK bundle size decreased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
+          message: "🎉 Embedding SDK chunked bundle size (gzipped) decreased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
           include-log: false
 
   embedding-sdk-tests-result:

.github/workflows/frontend.yml

@@ -31,6 +31,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-frontend
   cancel-in-progress: true
 
+env:
+  # Consumed by the report-failures-to-ci-conductor step in fe-tests-unit. Absent
+  # (e.g. fork PRs without secret access) the reporter no-ops. Matches the other
+  # suite workflows (backend, drivers, e2e, app-db, semantic-search).
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+
 jobs:
   fe-lint:
     if: ${{ !inputs.skip-lint }}
@@ -96,13 +103,32 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
+      - name: Resolve current job id
+        # Resolve JOB_ID before the long test step so the ci-conductor reporter
+        # below can link failures to this exact job. Best-effort.
+        uses: ./.github/actions/resolve-job-id
       - name: Run frontend unit tests
         id: fe-tests
         run: bun run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
+      - name: Report failed tests to ci-conductor
+        if: ${{ !cancelled() && steps.fe-tests.outcome == 'failure' }}
+        # This step should NEVER fail the job!
+        continue-on-error: true
+        uses: ./.github/actions/report-failures-to-ci-conductor
+        with:
+          test-suite: fe-tests-unit
+          adapter: frontend
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.fe-tests.outcome == 'failure' }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: frontend
+          test-suite: fe-tests-unit
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always() && github.event_name != 'workflow_dispatch'
@@ -114,6 +140,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.fe-tests.outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   fe-tests-timezones:
     if: ${{ !inputs.skip }}

.github/workflows/loki-stress-test-flake-fix.yml

@@ -13,10 +13,10 @@ on:
         type: string
         required: true
       burn_in:
-        description: "Number of times to run the test (e.g. 50)"
+        description: "Number of times to run the test (e.g. 10)"
         type: string
         required: true
-        default: "50"
+        default: "10"
 
 jobs:
   detect-changed-stories:
@@ -93,7 +93,7 @@ jobs:
         env:
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
           STORY_FILES: ${{ needs.detect-changed-stories.outputs.story_files }}
-          BURN_IN: ${{ inputs.burn_in || 50 }}
+          BURN_IN: ${{ inputs.burn_in || 10 }}
           EVENT_NAME: ${{ github.event_name }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           PR_ACTOR: ${{ github.event.pull_request.user.login }}
@@ -154,7 +154,7 @@ jobs:
 
       - name: Stress-test Loki
         run: |
-          BURN_IN=${{ inputs.burn_in || '50' }}
+          BURN_IN=${{ inputs.burn_in || '10' }}
           STORY_FILES='${{ needs.detect-changed-stories.outputs.story_files }}'
 
           echo "Story files: $STORY_FILES"

.github/workflows/module-boundaries-stats.yml

@@ -13,6 +13,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: 'package.json'
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: get module boundary stats

.github/workflows/pre-release.yml

@@ -122,7 +122,7 @@ jobs:
     strategy:
       matrix:
         edition: [oss, ee]
-        java-version: [21]
+        java-version: [25]
     steps:
       - name: Prepare JRE (Java Run-time Environment)
         uses: actions/setup-java@v5.2.0

.github/workflows/release-milestone-check.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.7"
+          bun-version-file: 'package.json'
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Prepare build scripts
         run: bun install --cwd release --frozen-lockfile && bun run --cwd release build

.github/workflows/release-tests.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.7"
+          bun-version-file: 'package.json'
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
         run: bun install --cwd release --frozen-lockfile
@@ -58,13 +58,34 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.7"
+          bun-version-file: 'package.json'
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
         run: bun install --cwd release --frozen-lockfile
       - name: Run release unit tests
         run: bun run --cwd release test:unit
 
+  ci-conductor-tests:
+    needs: files-changed
+    if: needs.files-changed.outputs.release_source == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: "release/ci-conductor"
+      - name: Install bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: 'package.json'
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Install ci-conductor dependencies
+        run: bun install --cwd release/ci-conductor --frozen-lockfile
+      - name: Type-check ci-conductor
+        run: bun run --cwd release/ci-conductor type-check
+      - name: Run ci-conductor unit tests
+        run: bun run --cwd release/ci-conductor test
+
   release-test-build:
     needs: files-changed
     if: needs.files-changed.outputs.release_source == 'true'
@@ -77,7 +98,7 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.7"
+          bun-version-file: 'package.json'
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
         run: bun install --cwd release --frozen-lockfile

.github/workflows/run-tests.yml

@@ -44,7 +44,6 @@ jobs:
       e2e_specs_to_run: ${{ steps.compute.outputs.e2e_specs_to_run }}
     steps:
       - uses: actions/checkout@v6
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       - name: Test which files changed
         uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
@@ -55,23 +54,21 @@ jobs:
           filters: .github/file-paths.yaml
       - name: Create test plan
         id: compute
-        if: ${{ github.event_name == 'pull_request' }}
-        env:
-          CHANGED_FILES: ${{ steps.changes.outputs.all_changed_files }}
-          UNIT_INFRA_TOUCHED: ${{ steps.changes.outputs.frontend_unit_infra }}
-          LOKI_INFRA_TOUCHED: ${{ steps.changes.outputs.frontend_loki_infra }}
-        run: |
-          OUTPUT=$(bun .github/scripts/create-test-plan.ts)
-          echo "$OUTPUT" | jq '.stats'
-          echo "stats=$(echo "$OUTPUT" | jq -c '.stats')" >> $GITHUB_OUTPUT
-          echo "fe_unit_specs_to_run=$(echo "$OUTPUT" | jq -c '.fe_unit_specs_to_run')" >> $GITHUB_OUTPUT
-          echo "loki_stories_to_run=$(echo "$OUTPUT" | jq -c '.loki_stories_to_run')" >> $GITHUB_OUTPUT
-          echo "e2e_specs_to_run=$(echo "$OUTPUT" | jq -c '.e2e_specs_to_run')" >> $GITHUB_OUTPUT
+        if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master') }}
+        uses: ./.github/actions/create-test-plan
+        with:
+          changed-files: ${{ steps.changes.outputs.all_changed_files }}
+          fe-changed-files: ${{ steps.changes.outputs.frontend_sources_files }}
+          be-changed-files: ${{ steps.changes.outputs.backend_sources_files }}
+          unit-infra-touched: ${{ steps.changes.outputs.frontend_unit_infra }}
+          loki-infra-touched: ${{ steps.changes.outputs.frontend_loki_infra }}
+          e2e-infra-touched: ${{ steps.changes.outputs.e2e_infra }}
+          shared-sources-touched: ${{ steps.changes.outputs.shared_sources }}
 
   upload-affected-tests-stats:
     needs: create-test-plan
     # Only land rows for the upstream repo so forks don't pollute the table.
-    if: ${{ !cancelled() && needs.create-test-plan.result == 'success' && github.event.pull_request.head.repo.full_name == 'metabase/metabase' }}
+    if: ${{ !cancelled() && needs.create-test-plan.result == 'success' && (github.event.pull_request.head.repo.full_name == 'metabase/metabase' || (github.event_name == 'push' && github.repository == 'metabase/metabase')) }}
     # Stats upload is best-effort — a failure here shouldn't fail the PR run.
     continue-on-error: true
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
@@ -79,11 +76,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Upload affected tests stats
+        # On push (merge to master) there is no PR context, so fall back to the
+        # commit SHAs and a 0 PR number.
         env:
           STATS_JSON: ${{ needs.create-test-plan.outputs.stats }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          TRIGGERED_BY: ${{ github.event_name == 'pull_request' && 'pr_update' || 'merge_to_master' }}
+          PR_NUMBER: ${{ github.event_name == 'pull_request' && github.event.pull_request.number || 0 }}
+          HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
           API_KEY: ${{ secrets.STATS_API_KEY }}
         run: node .github/scripts/upload-affected-tests-stats.js
 
@@ -154,8 +154,11 @@ jobs:
       # here we pass the list of changed files
       # e.g. e2e/test/scenarios/onboarding/command-palette.cy.spec.js,e2e/test/scenarios/question/document-title.cy.spec.js
       # e2e_all_files includes all changes which trigger all e2e tests, if the list of changes files is included in the
-      # list of changed specs files, then only specs are changed and we can run only those specs
-      specs: ${{ needs.create-test-plan.outputs.e2e_all_files == needs.create-test-plan.outputs.e2e_specs_files && needs.create-test-plan.outputs.e2e_specs_files || '' }}
+      # list of changed specs files, then only specs are changed and we can run only those specs.
+      # Only narrow to changed specs on pull requests. On push to master/release branches (and the
+      # merge queue) the paths-filter still computes these file lists, so without this guard a push
+      # that touched only specs would silently run a narrowed suite — we always want the full suite there.
+      specs: ${{ github.event_name == 'pull_request' && needs.create-test-plan.outputs.e2e_all_files == needs.create-test-plan.outputs.e2e_specs_files && needs.create-test-plan.outputs.e2e_specs_files || '' }}
 
   embedding-sdk-package:
     needs: [create-test-plan]
@@ -218,6 +221,18 @@ jobs:
       self_hosting: false
       analytics_dev_mode: true
 
+  pr-env-stats-dump:
+    needs: [uberjar]
+    if: |
+      !cancelled() &&
+      contains(github.event.pull_request.labels.*.name, 'PR-Env-Stats-Dump')
+    uses: ./.github/workflows/pr-env.yml
+    secrets: inherit
+    with:
+      self_hosting: false
+      analytics_dev_mode: false
+      stats_dump: true
+
   containerize:
     needs: [uberjar]
     if: |

.github/workflows/semantic-search.yml

@@ -11,6 +11,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-semantic-search
   cancel-in-progress: true
 
+# Exposed to every job so the test-driver action can report failures to
+# ci-conductor (secrets: inherit is already set on the semantic-search call in
+# run-tests.yml). See DEV-2224.
+env:
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+
 jobs:
   semantic-search-tests-h2:
     if: ${{ !inputs.skip }}
@@ -27,7 +34,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -54,6 +61,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -65,6 +73,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-mariadb:
     if: ${{ !inputs.skip }}
@@ -86,7 +95,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -127,6 +136,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -138,6 +148,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-mysql:
     if: ${{ !inputs.skip }}
@@ -159,7 +170,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -200,6 +211,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -211,6 +223,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-postgres:
     if: ${{ !inputs.skip }}
@@ -232,7 +245,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -274,6 +287,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -285,6 +299,73 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+
+  # pgvector-on-the-app-db mode: the app db itself is a pgvector-capable Postgres and
+  # MB_PGVECTOR_DB_URL is deliberately unset. The dedicated-harness tests gate themselves off; the
+  # appdb-pgvector-mode round trip (and the URL-independent unit tests) run for real.
+  semantic-search-tests-appdb-mode:
+    if: ${{ !inputs.skip }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - name: pgvector pg17 as app db, no dedicated pgvector
+            junit-name: semantic-search-tests-appdb-mode-pg17
+            appdb-image: pgvector/pgvector:pg17
+        job:
+          - name: Semantic Search Tests
+            build-static-viz: false
+            test-args: >-
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
+            exclude-tag: ':mb/driver-tests'
+
+    services:
+      postgres:
+        image: ${{ matrix.version.appdb-image }}
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    env:
+      CI: 'true'
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
+      # opts this job into the destructive appdb-pgvector-mode round trip, which then FAILS (rather
+      # than silently skipping) if the app db can't actually host pgvector
+      MB_APPDB_PGVECTOR_MODE_TEST: 'true'
+    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
+    steps:
+      - uses: actions/checkout@v6
+      - name: Test ${{ matrix.version.name }}
+        id: test-driver
+        uses: ./.github/actions/test-driver
+        with:
+          build-static-viz: ${{ matrix.job.build-static-viz }}
+          junit-name: ${{ matrix.version.junit-name }}
+          test-args: >-
+            ${{ matrix.job.test-args }}
+            :exclude-tags '[${{ matrix.job.exclude-tag }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit/
+          output-name: ${{ github.job }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-result:
     needs:
@@ -292,6 +373,7 @@ jobs:
       - semantic-search-tests-mariadb
       - semantic-search-tests-mysql
       - semantic-search-tests-postgres
+      - semantic-search-tests-appdb-mode
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: semantic-search-tests-result

.github/workflows/snowplow.yml

@@ -32,7 +32,7 @@ jobs:
         uses: actions/setup-java@v5.2.0
         with:
           distribution: temurin
-          java-version: 21
+          java-version: 25
       - name: Set up Babashka
         uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
         with:

.github/workflows/snyk.yml

@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.7"
+          bun-version-file: 'package.json'
           token: ${{ secrets.GITHUB_TOKEN }}
         # Snyk doesn't support bun.lock yet, so we generate yarn.lock and scan that.
         # Bun has a bug where it normalizes "< 3.0.0" to "< 3" in alias entries
@@ -131,9 +131,6 @@ jobs:
           - name: Driver - SparkSQL
             file: modules/drivers/sparksql/pom.xml
             category: driver-sparksql
-          - name: Driver - SQLite
-            file: modules/drivers/sqlite/pom.xml
-            category: driver-sqlite
           - name: Driver - SQL Server
             file: modules/drivers/sqlserver/pom.xml
             category: driver-sqlserver

.github/workflows/tag-for-release.yml

@@ -201,7 +201,7 @@ jobs:
       uses: actions/setup-java@v5.2.0
       with:
         distribution: 'temurin'
-        java-version: 21
+        java-version: 25
 
     - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
       uses: ./.github/actions/fetch-artifact

.github/workflows/team-issues-slack-notification.yml

@@ -1,3 +1,15 @@
+# .github/workflows/team-issues-slack-notification.yml
+#
+# Posts newly team-labeled bugs to the team's Slack channel (e.g.
+# #team-graphy-bugs), now including a link to the synced Linear issue.
+#
+# Changes from the current version:
+# - Checks out .github/scripts so we can reuse find-linear-issue.js
+# - The message-building step now queries Linear (via attachmentsForURL)
+#   with a short retry, and appends "Linear: <link|ID>" when found
+# - Degrades gracefully: if no Linear issue is attached (or the API is
+#   down), the message posts without the Linear issue link
+
 name: Team Issues Slack Notification
 
 on:
@@ -14,18 +26,58 @@ jobs:
        ( contains(github.event.issue.labels.*.name, 'Type:Bug') ||
          contains(github.event.issue.labels.*.name, 'flaky-test-fix') )
     steps:
-      - name: Setting title
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github/scripts
+
+      - name: Build Slack message (with Linear link if available)
         uses: actions/github-script@v9
         id: vars
+        env:
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
         with:
           script: |
-            core.setOutput('issue_title', JSON.stringify(${{ toJson(github.event.issue.title) }} + '\n' + ${{ toJson(github.event.issue.html_url) }}));
+            const { findLinearIssue } = require('./.github/scripts/find-linear-issue.js');
+
+            const title = context.payload.issue.title;
+            const issueUrl = context.payload.issue.html_url;
+
+            let text = title + '\n' + issueUrl;
+
+            // The Linear issue is usually already synced by the time the
+            // team label lands at triage, but retry briefly just in case.
+            try {
+              const delaysSeconds = [0, 15, 30];
+              let result = null;
+
+              for (const delay of delaysSeconds) {
+                if (delay) await new Promise((r) => setTimeout(r, delay * 1000));
+                result = await findLinearIssue({
+                  githubIssueUrl: issueUrl,
+                  linearApiKey: process.env.LINEAR_API_KEY,
+                });
+                if (result.success) break;
+              }
+
+              if (result && result.success) {
+                const id = result.issue; // e.g. "GIT-1234"
+                text += `\nLinear: <https://linear.app/metabase/issue/${id}|${id}>`;
+              } else {
+                core.info(`No Linear issue found for ${issueUrl}; posting without link.`);
+              }
+            } catch (e) {
+              // Never block the notification on a Linear lookup failure
+              core.warning(`Linear lookup failed: ${e.message}`);
+            }
+
+            core.setOutput('message', JSON.stringify(text));
+
       - name: Extracting team name
         id: team_name
         env:
           LABEL_NAME: ${{ github.event.label.name }}
         run: |
-          team_label=$(sed 's/&/\$/g' <<< "$LABEL_NAME")
+          team_label="${LABEL_NAME//&/$}"
           echo "$team_label"
           team_name=${team_label#*.Team/}
           echo "$team_name"
@@ -55,7 +107,7 @@ jobs:
                   "type": "section",
                   "text": {
                     "type": "mrkdwn",
-                    "text": ${{ steps.vars.outputs.issue_title }}
+                    "text": ${{ steps.vars.outputs.message }}
                   }
                 }
               ]

.github/workflows/uberjar.yml

@@ -128,6 +128,9 @@ jobs:
       MB_EDITION: ${{ matrix.edition }}
       INTERACTIVE: false
       SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}  # faster builds for dev
+      # Emit bundle stats on trunk/release builds (tracked over time) and on PRs
+      # (the bundle-size check reads them for both the PR head and its base ref).
+      EMIT_BUNDLE_STATS: ${{ (github.ref_name == 'master' || startsWith(github.ref_name, 'release-') || github.event_name == 'pull_request') && 'true' || 'false' }}
     steps:
       - name: Check out the code
         uses: actions/checkout@v6
@@ -140,9 +143,17 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 25 }}"
       - name: Build
         run: ./bin/build.sh
+      - name: Upload bundle stats
+        if: ${{ matrix.edition == 'ee' && env.EMIT_BUNDLE_STATS == 'true' }}
+        continue-on-error: true
+        uses: actions/upload-artifact@v7
+        with:
+          name: metabase-bundle-stats-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
+          path: target/bundle-stats
+          if-no-files-found: warn
       - name: Prepare uberjar artifact
         uses: ./.github/actions/prepare-uberjar-artifact
         with:
@@ -163,7 +174,7 @@ jobs:
     strategy:
       matrix:
         edition: ["ee", "oss"]
-        java-version: [21]
+        java-version: [25]
     steps:
       - name: Check out the code
         uses: actions/checkout@v6

.gitignore

@@ -57,6 +57,16 @@ cypress.env.json
 /e2e/tmp/db_dumps/*
 !/e2e/tmp/db_dumps/.gitkeep
 /e2e/support/assets/example_custom_viz_plugin*.tgz
+# Coverage artifacts
+/e2e/coverage-manifest-raw
+/e2e/coverage-manifest
+/e2e/coverage/analysis
+/e2e/coverage/spec-file-manifest.json
+/e2e/support/.nyc_output
+/e2e/support/coverage
+/e2e/support/e2e
+/.nyc_output
+
 /lein-plugins/*/target
 /local
 /locales/metabase-*.pot
@@ -92,6 +102,7 @@ cypress.env.json
 /resources/metabase/config/modules.edn
 /resources/namespaces.edn
 /resources/sample-dataset.db.trace.db
+!/resources/sample-database.*
 /resources/version.properties
 /screenshots
 /sqlite.db
@@ -190,3 +201,7 @@ __pycache__/
 .claude/scheduled_tasks.lock
 .playwright-mcp
 .ci_reports/
+
+# dependency-cruiser output
+dependency-graph.json
+.playwright-cli/