ci: add Kesin11/actions-timeline to the heavy CI workflows

Adds a per-job/step Gantt chart (rendered as a mermaid diagram in the run
summary) to the 15 substantive CI workflows -- the 13 setup-backend
consumers plus superset-frontend.yml and docker.yml, the other two
heaviest CI paths. Skips trivial bot/label/notification workflows that run
in seconds and have nothing worth visualizing.

For single-job (or single-heavy-job-in-a-linear-chain) workflows, the step
is registered first, before checkout, so its post-processing hook -- which
is what actually renders the timeline -- captures the full job including
other steps' own cleanup. For workflows with multiple independent parallel
jobs, added a dedicated `actions-timeline` terminal job (`needs: [...]`,
`if: always()`) instead of duplicating the step into each parallel job:
the action fetches every job of the whole run from the GitHub API
regardless of which job it executes in, so one copy that runs after
every sibling job completes produces one authoritative timeline, while N
copies dropped into N parallel jobs would each race to render an
incomplete gantt before their siblings finish.

`expand-composite-actions: true` is set everywhere so setup-backend's
internal steps (Python setup, uv install, apt package caching, dependency
install) show up as their own bars rather than one opaque blob -- directly
useful given the last two PRs' worth of composite-action changes.

`actions: read` is added wherever needed to read job/step timing from the
Actions API, either to the workflow's top-level `permissions:` (when the
job in question has no job-level override) or directly into the relevant
job's own `permissions:` block (when one already exists, since a
job-level block replaces rather than merges with the workflow-level one).

.github/actions/setup-backend/action.yml

@@ -5,10 +5,6 @@ inputs:
     description: 'Python version to set up. Accepts a version number, "current", or "next".'
     required: true
     default: 'current'
-  cache:
-    description: 'Cache dependencies. Options: pip'
-    required: false
-    default: 'pip'
   requirements-type:
     description: 'Type of requirements to install. Options: base, development, default'
     required: false
@@ -43,17 +39,24 @@ runs:
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: ${{ steps.set-python-version.outputs.python-version }}
-        cache: ${{ inputs.cache }}
+    - name: Install uv
+      if: inputs.install-superset == 'true'
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      with:
+        python-version: ${{ steps.set-python-version.outputs.python-version }}
+        enable-cache: true
+    - name: Install apt packages
+      if: inputs.install-superset == 'true'
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+      with:
+        packages: libldap2-dev libsasl2-dev
+        version: 1.0
     - name: Install dependencies
       env:
         INPUT_INSTALL_SUPERSET: ${{ inputs.install-superset }}
         INPUT_REQUIREMENTS_TYPE: ${{ inputs.requirements-type }}
       run: |
         if [ "$INPUT_INSTALL_SUPERSET" = "true" ]; then
-          sudo apt-get update && sudo apt-get -y install libldap2-dev libsasl2-dev
-
-          pip install --upgrade pip setuptools wheel uv
-
           if [ "$INPUT_REQUIREMENTS_TYPE" = "dev" ]; then
             uv pip install --system -r requirements/development.txt
           elif [ "$INPUT_REQUIREMENTS_TYPE" = "base" ]; then

.github/workflows/bump-python-package.yml

@@ -45,7 +45,10 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        run: pip install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          python-version: "3.11"
+          enable-cache: true
 
       - name: supersetbot bump-python -p "${{ github.event.inputs.package }}"
         env:

.github/workflows/check-python-deps.yml

@@ -11,6 +11,7 @@ on:
 permissions:
   contents: read
   pull-requests: read
+  actions: read
 
 # cancel previous workflow jobs for PRs
 concurrency:
@@ -21,6 +22,10 @@ jobs:
   check-python-deps:
     runs-on: ubuntu-26.04
     steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true
+
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/codeql-analysis.yml

@@ -75,6 +75,6 @@ jobs:
           # queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -20,6 +20,7 @@ concurrency:
 
 permissions:
   contents: read
+  actions: read
 
 jobs:
   dependency-review:
@@ -50,6 +51,10 @@ jobs:
     # You cannot use a liccheck.ini file in this workflow.
     runs-on: ubuntu-26.04
     steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true
+
       - name: "Checkout Repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/docker.yml

@@ -213,3 +213,14 @@ jobs:
         shell: bash
         run: |
           docker compose -f docker-compose-image-tag.yml up superset-init --exit-code-from superset-init
+
+  actions-timeline:
+    needs: [docker-build, docker-compose-image-tag]
+    if: always()
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: read
+    steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true

.github/workflows/pre-commit.yml

@@ -15,6 +15,7 @@ on:
 
 permissions:
   contents: read
+  actions: read
 
 # cancel previous workflow jobs for PRs
 concurrency:
@@ -32,6 +33,10 @@ jobs:
         # rarely differ across patch versions, so 3x per PR is wasteful.
         python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
     steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true
+
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/superset-app-cli.yml

@@ -11,6 +11,7 @@ on:
 permissions:
   contents: read
   pull-requests: read
+  actions: read
 
 # cancel previous workflow jobs for PRs
 concurrency:
@@ -40,6 +41,10 @@ jobs:
         ports:
           - 16379:6379
     steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true
+
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/superset-docs-deploy.yml

@@ -30,6 +30,7 @@ concurrency:
 
 permissions:
   contents: read
+  actions: read
 
 jobs:
   config:
@@ -59,6 +60,10 @@ jobs:
     name: Build & Deploy
     runs-on: ubuntu-26.04
     steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true
+
       - name: "Checkout ${{ github.event.workflow_run.head_sha || github.sha }}"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -76,7 +81,10 @@ jobs:
           distribution: "zulu"
           java-version: "21"
       - name: Install Graphviz
-        run: sudo apt-get install -y graphviz
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+        with:
+          packages: graphviz
+          version: 1.0
       - name: Compute Entity Relationship diagram (ERD)
         env:
           SUPERSET_SECRET_KEY: not-a-secret

.github/workflows/superset-e2e.yml

@@ -340,3 +340,14 @@ jobs:
             exit 1
           fi
           echo "playwright-tests result: $RESULT (changes: $CHANGES)"
+
+  actions-timeline:
+    needs: [cypress-matrix, playwright-tests]
+    if: always()
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: read
+    steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true

.github/workflows/superset-extensions-cli.yml

@@ -11,6 +11,7 @@ on:
 permissions:
   contents: read
   pull-requests: read
+  actions: read
 
 # cancel previous workflow jobs for PRs
 concurrency:
@@ -30,6 +31,10 @@ jobs:
       run:
         working-directory: superset-extensions-cli
     steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true
+
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/superset-frontend.yml

@@ -195,3 +195,14 @@ jobs:
         run: |
           docker run --rm $TAG bash -c \
           "npm run build-storybook && npx playwright install-deps && npx playwright install chromium && npm run test-storybook:ci"
+
+  actions-timeline:
+    needs: [report-coverage, lint-frontend, validate-frontend, test-storybook]
+    if: always()
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: read
+    steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true

.github/workflows/superset-helm-lint-test.yml

@@ -8,6 +8,7 @@ on:
 
 permissions:
   contents: read
+  actions: read
 
 # Serialize runs per PR without cancelling: when a first-time contributor's
 # queued runs are approved together, cancel-in-progress lets an older run
@@ -21,6 +22,10 @@ jobs:
   lint-test:
     runs-on: ubuntu-26.04
     steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true
+
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/superset-playwright.yml

@@ -54,6 +54,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
+      actions: read
     strategy:
       fail-fast: false
       matrix:
@@ -79,6 +80,10 @@ jobs:
         ports:
           - 16379:6379
     steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true
+
       # -------------------------------------------------------
       # Conditional checkout based on context (same as Cypress workflow)
       - name: Checkout for push or pull_request event

.github/workflows/superset-python-integrationtest.yml

@@ -255,3 +255,14 @@ jobs:
             exit 1
           fi
           echo "test-postgres result: $RESULT"
+
+  actions-timeline:
+    needs: [test-mysql, test-postgres, test-sqlite]
+    if: always()
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: read
+    steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true

.github/workflows/superset-python-presto-hive.yml

@@ -158,3 +158,14 @@ jobs:
           verbose: true
           use_oidc: true
           slug: apache/superset
+
+  actions-timeline:
+    needs: [test-postgres-presto, test-postgres-hive]
+    if: always()
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: read
+    steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true

.github/workflows/superset-python-unittest.yml

@@ -101,7 +101,14 @@ jobs:
     if: always()
     runs-on: ubuntu-26.04
     timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
     steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true
+
       - name: Check unit-tests result
         env:
           RESULT: ${{ needs.unit-tests.result }}

.github/workflows/superset-translations.yml

@@ -78,7 +78,10 @@ jobs:
 
       - name: Install gettext tools
         if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
-        run: sudo apt-get update && sudo apt-get install -y gettext
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+        with:
+          packages: gettext
+          version: 1.0
 
       # Fetch the base ref so we can compare PR-introduced regressions
       # against a fair baseline (also runs babel_update against the base
@@ -153,3 +156,14 @@ jobs:
       - name: Fail if regression detected
         if: steps.regression.outcome == 'failure'
         run: exit 1
+
+  actions-timeline:
+    needs: [frontend-check-translations, babel-extract]
+    if: always()
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: read
+    steps:
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+        with:
+          expand-composite-actions: true

superset/daos/dashboard.py

@@ -397,8 +397,7 @@ class DashboardDAO(BaseDAO[Dashboard]):
             md["color_namespace"] = data.get("color_namespace")
 
         md["expanded_slices"] = data.get("expanded_slices", {})
-        if "refresh_frequency" in data:
-            md["refresh_frequency"] = data["refresh_frequency"]
+        md["refresh_frequency"] = data.get("refresh_frequency", 0)
         md["color_scheme"] = data.get("color_scheme", "")
         md["label_colors"] = data.get("label_colors", {})
         md["shared_label_colors"] = data.get("shared_label_colors", [])

tests/unit_tests/dao/dashboard_test.py

@@ -24,7 +24,6 @@ from superset.connectors.sqla.models import Database, SqlaTable
 from superset.daos.dashboard import DashboardDAO
 from superset.models.dashboard import Dashboard
 from superset.models.slice import Slice
-from superset.utils import json
 from tests.unit_tests.conftest import with_feature_flags
 
 
@@ -118,53 +117,3 @@ def test_set_dash_metadata_preserves_soft_deleted_members(
     )
     # And the position slot kept its UUID rather than being nulled.
     assert positions["CHART-trashed"]["meta"]["uuid"] == str(trashed_chart.uuid)
-
-
-def test_set_dash_metadata_preserves_refresh_frequency(session: Session) -> None:
-    """set_dash_metadata must not reset refresh_frequency when absent from data.
-
-    Regression test for #42116: ``data.get("refresh_frequency", 0)`` would
-    unconditionally overwrite the existing value with 0 whenever the caller
-    did not include ``refresh_frequency`` in the data dict.
-    """
-    Dashboard.metadata.create_all(session.get_bind())
-
-    dashboard = Dashboard(
-        dashboard_title="refresh_test_dash",
-        json_metadata=json.dumps({"refresh_frequency": 30}),
-    )
-    db.session.add(dashboard)
-    db.session.flush()
-
-    # Simulate a save that does NOT include refresh_frequency
-    # (e.g. changing only the title via the PropertiesModal).
-    DashboardDAO.set_dash_metadata(dashboard, {"color_scheme": "superset"})
-
-    md = json.loads(dashboard.json_metadata)
-    assert md["refresh_frequency"] == 30, (
-        "refresh_frequency should be preserved when not present in data"
-    )
-
-
-def test_set_dash_metadata_updates_refresh_frequency_when_present(
-    session: Session,
-) -> None:
-    """set_dash_metadata must update refresh_frequency when it IS in data."""
-    Dashboard.metadata.create_all(session.get_bind())
-
-    dashboard = Dashboard(
-        dashboard_title="refresh_test_dash_2",
-        json_metadata=json.dumps({"refresh_frequency": 30}),
-    )
-    db.session.add(dashboard)
-    db.session.flush()
-
-    # Simulate a save that explicitly sets refresh_frequency to 0.
-    DashboardDAO.set_dash_metadata(
-        dashboard, {"refresh_frequency": 0, "color_scheme": "superset"}
-    )
-
-    md = json.loads(dashboard.json_metadata)
-    assert md["refresh_frequency"] == 0, (
-        "refresh_frequency should be updated when present in data"
-    )

tests/unit_tests/result_set_test.py

@@ -571,53 +571,3 @@ def test_stringify_values_non_serializable_dict_falls_back_to_str() -> None:
     # Must not raise — falls back to str()
     result = stringify_values(data)
     assert result[0] == str({"key": _Unserializable()})
-
-
-def test_empty_result_set_preserves_column_metadata() -> None:
-    """
-    Test that column metadata is preserved when query returns zero rows.
-
-    When a query returns no data but has a valid cursor description, the
-    column names and types from cursor_description should be preserved
-    in the result set. This allows downstream consumers (like the UI)
-    to display column headers even for empty result sets.
-    """
-    data: DbapiResult = []
-    description = [
-        ("id", "int", None, None, None, None, True),
-        ("name", "varchar", None, None, None, None, True),
-        ("created_at", "timestamp", None, None, None, None, True),
-    ]
-
-    result_set = SupersetResultSet(
-        data,
-        description,  # type: ignore
-        BaseEngineSpec,
-    )
-
-    # Verify column count
-    assert len(result_set.columns) == 3
-
-    # Verify column names are preserved
-    column_names = [col["column_name"] for col in result_set.columns]
-    assert column_names == ["id", "name", "created_at"]
-
-    assert result_set.columns[0]["type"] == BaseEngineSpec.get_datatype(
-        description[0][1]
-    )
-    assert result_set.columns[1]["type"] == BaseEngineSpec.get_datatype(
-        description[1][1]
-    )
-    assert result_set.columns[2]["type"] == BaseEngineSpec.get_datatype(
-        description[2][1]
-    )
-
-    # Verify the PyArrow table has the correct schema
-    assert result_set.table.num_rows == 0
-    assert len(result_set.table.column_names) == 3
-    assert list(result_set.table.column_names) == ["id", "name", "created_at"]
-
-    # Verify DataFrame conversion works
-    df = result_set.to_pandas_df()
-    assert len(df) == 0
-    assert list(map(str, df.columns)) == ["id", "name", "created_at"]