Merge origin/master into misc-charts-examples

Life Expectancy Histogram had the same bug as the earlier Bubble chart
fix: its adhoc filter pointed at 2014, which has zero SP_DYN_LE00_IN data
in the world_health dataset, so the thumbnail showed an empty chart.
Moved it to 2011, which has real data.

Deck.gl GeoJson rendered as a single solid-colored blob: the global
fill_color_picker (alpha=1) always overrides any per-feature fill color,
and line_width defaulted to ~1 meter, invisible at city zoom, so none of
the 25 zip-code boundaries were visible. Baked a population-ranked
choropleth fill-color into each zip code's GeoJSON Feature, set
fill_color_picker's alpha to 0 so the per-feature colors show through,
switched the stroke to a visible white pixel-width line, and turned off
the extruded flag since there's no per-feature elevation data backing it.

.github/workflows/docker.yml

@@ -51,6 +51,53 @@ jobs:
           echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
           echo $GITHUB_OUTPUT
 
+  # Runs unconditionally (no dependency on `changes`, and no build-preset
+  # matrix restriction) so a regression in the PY_VER override logic is
+  # always caught on PRs. Without this, the real docker-build job only runs
+  # when the change detector flags docker/python/frontend changes (a
+  # workflow-only edit like this one does not), and even then the PR build
+  # matrix never includes the "py311"/"py312" presets that logic protects -
+  # so a break here would otherwise first surface on a push to master.
+  pyver-override-check:
+    name: verify docker build PY_VER override
+    runs-on: ubuntu-26.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup supersetbot
+        uses: ./.github/actions/setup-supersetbot/
+      - name: Assert PY_VER override applies to every preset except py311/py312
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Asserts against the actual buildx command line `supersetbot docker
+          # --dry-run` would run, not just this repo's own extra-flags helper,
+          # so a regression in supersetbot itself (dropping the py311/py312
+          # PY_VER pin, or reordering args so our override no longer lands
+          # last) is caught here too, instead of only surfacing on master.
+          assert_effective_py_ver() {
+            local preset="$1" expected="$2" extra_flags command actual
+            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
+            command="$(supersetbot docker --preset "$preset" --platform linux/amd64 --extra-flags "$extra_flags" --dry-run)"
+            # docker buildx keeps the LAST value of a repeated --build-arg key.
+            actual="$(grep -oE -- '--build-arg PY_VER=[^[:space:]]+' <<<"$command" | tail -1)"
+            if [ "$actual" != "--build-arg PY_VER=$expected" ]; then
+              echo "::error::preset '$preset' expected effective --build-arg PY_VER=$expected, got: ${actual:-<none>} (full command: $command)"
+              exit 1
+            fi
+          }
+          for preset in dev lean websocket dockerize; do
+            assert_effective_py_ver "$preset" "3.11.14-slim-trixie"
+          done
+          assert_effective_py_ver py311 "3.11-slim-bookworm"
+          assert_effective_py_ver py312 "3.12-slim-bookworm"
+          echo "PY_VER override logic verified against the assembled buildx command for all build presets"
+
   docker-build:
     name: docker-build
     needs: [setup_matrix, changes]
@@ -124,19 +171,21 @@ jobs:
           # the whole job. buildx reuses the buildkit layer cache from the
           # failed attempt, so a retry mostly re-does just the failed push.
           #
-          # supersetbot's "dev"/"lean" presets pin their own --build-arg
-          # PY_VER, which lands ahead of --extra-flags on the assembled
-          # buildx command line; docker/buildx keeps the last value for a
-          # repeated --build-arg key, so appending PY_VER here overrides
-          # supersetbot's pin and keeps the build on the Dockerfile's own
-          # supported Python version.
+          # See scripts/docker-build-extra-flags.sh for why "py311"/"py312"
+          # are excluded from the PY_VER override applied to every other
+          # preset; that logic is also exercised on every PR by the
+          # always-on pyver-override-check job below, since this job itself
+          # only runs when the change detector flags docker/python/frontend
+          # changes and the PR build matrix never includes py311/py312.
+          EXTRA_FLAGS="$(scripts/docker-build-extra-flags.sh "$BUILD_PRESET" "$IMAGE_TAG")"
+
           for attempt in 1 2 3; do
             if supersetbot docker \
               $PUSH_OR_LOAD \
               --preset "$BUILD_PRESET" \
               --context "$EVENT" \
               --context-ref "$RELEASE" $FORCE_LATEST \
-              --extra-flags "--build-arg PY_VER=3.11.14-slim-trixie --build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
+              --extra-flags "$EXTRA_FLAGS" \
               $PLATFORM_ARG; then
               break
             fi

.github/workflows/frontend-bundle-size-nightly.yml

@@ -0,0 +1,135 @@
+name: Frontend bundle size (nightly baseline + analyzer)
+
+# Refreshes the bundle-size baseline that superset-frontend.yml's `bundle-size`
+# job compares PRs against, and publishes a browsable bundle-analyzer treemap
+# report of the same build. Deliberately NOT triggered on every push to
+# master: a day-old baseline/report is fine for catching relative
+# regressions on PRs and for browsing what's actually in the bundle, and
+# building the production bundle on every one of the many pushes master
+# gets per day would burn CI time for no benefit a nightly refresh doesn't
+# already cover.
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+env:
+  TAG: apache/superset:bundle-size-nightly-${{ github.run_id }}
+
+permissions:
+  contents: read
+
+jobs:
+  refresh-baseline:
+    runs-on: ubuntu-26.04
+    timeout-minutes: 30
+    env:
+      NETLIFY_SITE_ID: ${{ secrets.NETLIFY_BUNDLE_ANALYZER_SITE_ID }}
+    steps:
+      - name: "Checkout master"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: master
+
+      - name: Build Docker Image
+        run: |
+          docker buildx build \
+            -t $TAG \
+            --cache-from=type=registry,ref=apache/superset-cache:3.11-slim-trixie \
+            --target superset-node-ci \
+            .
+
+      # Same cache the PR-time bundle-size job restores/writes -- webpack's
+      # persistent filesystem cache turns a warm production build into ~20s
+      # instead of several minutes. See superset-frontend.yml for the
+      # matching restore step and why it's keyed this way.
+      - name: Restore webpack build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: superset-frontend/.temp_cache
+          key: >-
+            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
+            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
+            'superset-frontend/webpack.config.js') }}
+
+      # Only ever pull the last recorded data point off the cache, keyed by
+      # run ID -- `restore-keys` prefix-matches the most recently created
+      # entry. Absent on the very first run ever; benchmark-action starts a
+      # fresh history in that case.
+      - name: Restore bundle size history
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: bundle-size-history.json
+          key: bundle-size-history-${{ github.run_id }}
+          restore-keys: |
+            bundle-size-history-
+
+      # BUNDLE_ANALYZER rides along in the same build as BUNDLE_SIZE_STATS --
+      # they're independent env-gated additions in webpack.config.js (one
+      # sets `config.stats`, the other pushes plugins), so one production
+      # build produces both the numeric stats.json and the analyzer's
+      # report.html. Only report.html is mounted out, not
+      # BUNDLE_ANALYZER's sibling `statistics.html` sunburst -- that file is
+      # documented in webpack.config.js as routinely exceeding 100MB for
+      # this app (it's .gitignore'd for exactly that reason), too large to
+      # publish as a static site page.
+      - name: Build production bundle with stats and analyzer report
+        run: |
+          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
+          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
+          mkdir -p ${{ github.workspace }}/superset/static/assets
+          docker run \
+          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
+          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
+          -v ${{ github.workspace }}/superset/static/assets:/app/superset/static/assets \
+          --rm $TAG \
+          bash -c \
+          "npm i && BUNDLE_SIZE_STATS=true BUNDLE_ANALYZER=true npm run build -- --json=bundle-stats/stats.json"
+
+      - name: Summarize bundle size
+        run: |
+          node superset-frontend/scripts/bundle-size-summary.js \
+            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
+          rm -rf superset-frontend/bundle-stats
+
+      # No PR to comment on here, so comment-on-alert is off -- the job
+      # summary (summary-always) is the only surface for this run.
+      - name: Update bundle size baseline
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
+        with:
+          tool: customSmallerIsBetter
+          output-file-path: bundle-size-summary.json
+          external-data-json-path: bundle-size-history.json
+          fail-on-alert: false
+          summary-always: true
+
+      - name: Save bundle size history
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: bundle-size-history.json
+          key: bundle-size-history-${{ github.run_id }}
+
+      # Publishes the treemap to Netlify (the same host already used for
+      # superset-storybook.netlify.app and docs previews, reusing the
+      # existing NETLIFY_AUTH_TOKEN). Skipped until
+      # NETLIFY_BUNDLE_ANALYZER_SITE_ID exists -- create a new (free)
+      # Netlify site named superset-bundle-analyzer and add its site ID as
+      # that secret to turn this on; nothing else in this workflow depends
+      # on it.
+      - name: Publish bundle analyzer report to Netlify
+        if: ${{ env.NETLIFY_SITE_ID != '' }}
+        env:
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+        run: |
+          mkdir -p netlify-publish
+          cp superset/static/assets/report.html netlify-publish/index.html
+          # zizmor: ignore[adhoc-packages] - netlify-cli is a one-shot CI deploy
+          # tool, not an application dependency; a global/npx install has no
+          # lockfile context. Version pinned above the floor set by other
+          # ad-hoc installs in this repo (bump deliberately when upgrading).
+          npx --yes netlify-cli@27.0.1 deploy --prod --dir=netlify-publish

.github/workflows/github-action-validator.yml

@@ -45,5 +45,8 @@ jobs:
       - name: Run Script
         run: bash .github/workflows/github-action-validator.sh
 
+      - name: Test docs-deploy freshness gate
+        run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
+
       - name: Check for security issues on GHA workflows
         uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

.github/workflows/scripts/check-docs-deploy-freshness.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Shared freshness gate used by the Docs Deployment workflow
+# (superset-docs-deploy.yml) both up front (check-freshness) and again right
+# before the deploy step (recheck-freshness). Writes an output declaring
+# whether BUILD_SHA is still master's current tip, so a superseded run can
+# skip cleanly instead of racing (and clobbering, or being force-cancelled
+# by) a fresher run.
+#
+# Required env vars:
+#   BUILD_SHA     - the commit SHA this run is building
+#   REPO          - "owner/repo" to query, e.g. github.repository
+#   OUTPUT_NAME   - the GITHUB_OUTPUT key to write, e.g. "is-current"
+#   GITHUB_OUTPUT - path to append outputs to (set by the Actions runner)
+# Optional env vars:
+#   EVENT_NAME    - if "workflow_dispatch", bypasses the check and always
+#                   reports current, since a manual dispatch is a deliberate,
+#                   one-off action rather than something racing other triggers
+#   GH_TOKEN      - passed through to `gh`, needed to call the GitHub API
+
+set -euo pipefail
+
+if [ "${EVENT_NAME:-}" = "workflow_dispatch" ]; then
+  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
+  exit 0
+fi
+
+latest_sha="$(gh api "repos/${REPO}/commits/master" --jq .sha)"
+if [ "${latest_sha}" = "${BUILD_SHA}" ]; then
+  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
+else
+  echo "${OUTPUT_NAME}=false" >>"$GITHUB_OUTPUT"
+  echo "::notice::master has moved on to ${latest_sha} since ${BUILD_SHA} was triggered — skipping this stale run."
+fi

.github/workflows/scripts/check-docs-deploy-freshness.test.sh

@@ -0,0 +1,100 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Exercises check-docs-deploy-freshness.sh against a stubbed `gh`, covering
+# the dispatch-bypass, current-tip and stale-tip branches so the output
+# contract (is-current / still-current) can't silently regress. Run
+# directly, no extra tooling required:
+#   bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
+
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+script_under_test="${script_dir}/check-docs-deploy-freshness.sh"
+
+failures=0
+
+# Runs the script under test with a stubbed `gh` reporting $1 as master's
+# latest sha, asserting that GITHUB_OUTPUT ends up containing exactly $4.
+run_case() {
+  local case_name="$1"
+  local latest_sha="$2"
+  local build_sha="$3"
+  local event_name="$4"
+  local expected_line="$5"
+
+  local workdir
+  workdir="$(mktemp -d)"
+  trap 'rm -rf "${workdir}"' RETURN
+
+  # Fake `gh` that just echoes back the requested "latest" sha regardless of
+  # arguments, so the script under test never touches the network.
+  cat >"${workdir}/gh" <<EOF
+#!/bin/bash
+echo '${latest_sha}'
+EOF
+  chmod +x "${workdir}/gh"
+
+  local output_file="${workdir}/github_output"
+  : >"${output_file}"
+
+  if PATH="${workdir}:${PATH}" \
+    GITHUB_OUTPUT="${output_file}" \
+    OUTPUT_NAME="is-current" \
+    REPO="apache/superset" \
+    BUILD_SHA="${build_sha}" \
+    EVENT_NAME="${event_name}" \
+    GH_TOKEN="fake-token" \
+    bash "${script_under_test}"; then
+    :
+  else
+    echo "FAIL (${case_name}): script exited non-zero"
+    failures=$((failures + 1))
+    return
+  fi
+
+  local actual
+  actual="$(cat "${output_file}")"
+  if [ "${actual}" = "${expected_line}" ]; then
+    echo "PASS (${case_name})"
+  else
+    echo "FAIL (${case_name}): expected '${expected_line}', got '${actual}'"
+    failures=$((failures + 1))
+  fi
+}
+
+# `gh` prints "should-not-be-called" for the dispatch case above the trick:
+# it's never actually invoked since the bypass short-circuits before the
+# `gh api` call, but the fake still needs a body.
+run_case "workflow_dispatch bypasses the check" \
+  "unused" "abc123" "workflow_dispatch" \
+  "is-current=true"
+
+run_case "build sha matches master's tip" \
+  "abc123" "abc123" "push" \
+  "is-current=true"
+
+run_case "build sha is stale" \
+  "def456" "abc123" "push" \
+  "is-current=false"
+
+if [ "${failures}" -gt 0 ]; then
+  echo "${failures} case(s) failed"
+  exit 1
+fi
+
+echo "All cases passed"

.github/workflows/superset-docs-deploy.yml

@@ -18,16 +18,6 @@ on:
 
   workflow_dispatch: {}
 
-# Serialize deploys: the action pushes to apache/superset-site without
-# rebasing, so concurrent runs race on the final push and the loser fails
-# with `! [rejected] asf-site -> asf-site (fetch first)`. Cancel any
-# in-progress run as soon as a newer one starts — the destination repo
-# isn't touched until the final push step, so canceling mid-build is safe,
-# and the freshest content always wins.
-concurrency:
-  group: docs-deploy-asf-site
-  cancel-in-progress: true
-
 permissions:
   contents: read
   actions: read
@@ -48,17 +38,69 @@ jobs:
 
         env:
           SUPERSET_SITE_BUILD: ${{ (secrets.SUPERSET_SITE_BUILD != '' && secrets.SUPERSET_SITE_BUILD != '') || '' }}
+
+  # Master gets frequent, sometimes bursty pushes, and each one can trigger a
+  # deploy attempt. Rather than let every superseded attempt get force-killed
+  # by the build-deploy concurrency group below (which shows up as a
+  # `cancelled` — i.e. red/failing-looking — check on that commit), have each
+  # run check up front whether it's still building master's current tip and,
+  # if not, skip cleanly. Deliberately outside the docs-deploy-asf-site
+  # concurrency group so it runs immediately for every trigger without
+  # blocking or being blocked by anything.
+  check-freshness:
+    runs-on: ubuntu-26.04
+    outputs:
+      is-current: ${{ steps.check.outputs.is-current }}
+    steps:
+      # Sparse checkout: this job's only job is to be fast, so it fetches
+      # nothing but the freshness-check script itself.
+      - name: Checkout freshness-check script
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            .github/workflows/scripts
+          sparse-checkout-cone-mode: false
+      - name: "Check whether this is still master's current commit"
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          EVENT_NAME: ${{ github.event_name }}
+          REPO: ${{ github.repository }}
+          OUTPUT_NAME: is-current
+        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
+
   build-deploy:
-    needs: config
+    needs: [config, check-freshness]
+    # Only the run for master's current tip proceeds; anything superseded
+    # already skipped at check-freshness above instead of landing here.
     # For workflow_run triggers, only deploy when the triggering run originated
     # from this repository (not a fork), ensuring the checked-out code and any
     # local actions executed with deploy credentials are trusted.
     if: >-
       needs.config.outputs.has-secrets &&
+      needs.check-freshness.outputs.is-current == 'true' &&
       (github.event_name != 'workflow_run' ||
        github.event.workflow_run.head_repository.full_name == github.repository)
     name: Build & Deploy
     runs-on: ubuntu-26.04
+    # Serialize deploys: the action pushes to apache/superset-site without
+    # rebasing, so concurrent runs race on the final push and the loser fails
+    # with `! [rejected] asf-site -> asf-site (fetch first)`. Queue instead of
+    # canceling: a run that already passed check-freshness can still be
+    # sitting in the queue for a runner when a newer run starts and finishes
+    # first. cancel-in-progress would let that stale, queued run kill the
+    # newer run's in-progress deploy the moment it's finally scheduled, and
+    # then skip itself at the re-check below — losing the deploy entirely.
+    # Queuing means the stale run just waits its turn and then no-ops at the
+    # re-check, so the fresher content that already deployed is never
+    # clobbered or lost. The check-freshness gate above means it should be
+    # rare for more than one run to reach this point, so the queue stays
+    # short in practice.
+    concurrency:
+      group: docs-deploy-asf-site
+      cancel-in-progress: false
     steps:
       - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
         with:
@@ -130,7 +172,24 @@ jobs:
         working-directory: docs
         run: |
           yarn build
+      # The check-freshness job above narrows the window but doesn't close it: an
+      # older run can observe is-current=true, then sit through this build while a
+      # newer run's own freshness check also passes and it deploys and finishes
+      # first. If this (stale) run then wins entry into the concurrency group, it
+      # would overwrite the newer content that already deployed. Re-check right
+      # before the one step that actually mutates superset-site, so a stale run
+      # skips deploying instead of clobbering a fresher one that already ran.
+      - name: "Re-check freshness immediately before deploying"
+        id: recheck-freshness
+        if: github.event_name != 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          REPO: ${{ github.repository }}
+          OUTPUT_NAME: still-current
+        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
       - name: deploy docs
+        if: github.event_name == 'workflow_dispatch' || steps.recheck-freshness.outputs.still-current == 'true'
         uses: ./.github/actions/github-action-push-to-another-repository
         env:
           API_TOKEN_GITHUB: ${{ secrets.SUPERSET_SITE_BUILD }}

.github/workflows/superset-frontend.yml

@@ -212,3 +212,100 @@ jobs:
       - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
         with:
           expand-composite-actions: true
+
+  # Compares a PR's own bundle size against the last nightly-recorded
+  # baseline (see frontend-bundle-size-nightly.yml, which owns actually
+  # persisting new baselines). PR-only: a push to master doesn't need this
+  # check re-run against itself, and re-persisting the baseline on every
+  # push to master -- which happens many times a day -- would burn a full
+  # production build for no benefit nightly refresh doesn't already cover.
+  bundle-size:
+    needs: frontend-build
+    if: needs.frontend-build.outputs.should-run == 'true' && github.event_name == 'pull_request'
+    runs-on: ubuntu-26.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+
+      - name: Download Docker Image Artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: docker-image
+
+      - name: Load Docker Image
+        run: |
+          zstd -d < docker-image.tar.zst | docker load
+
+      # webpack's persistent filesystem cache (superset-frontend/webpack.config.js)
+      # turns a warm production build into ~20s instead of several minutes,
+      # but GH-hosted runners are fresh VMs with nothing carried over between
+      # jobs -- without restoring it explicitly, every single PR would pay
+      # the full cold-build cost. Keyed on the same files webpack's own
+      # `buildDependencies` invalidates on, so a stale cache is never used.
+      - name: Restore webpack build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: superset-frontend/.temp_cache
+          key: >-
+            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
+            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
+            'superset-frontend/webpack.config.js') }}
+
+      # Only ever pull the last recorded data point off the cache, keyed by
+      # run ID -- `restore-keys` prefix-matches the most recently created
+      # entry, which is always the latest nightly run. Absent before the
+      # first nightly run ever happens; benchmark-action starts a fresh
+      # history in that case.
+      - name: Restore bundle size history
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: bundle-size-history.json
+          key: bundle-size-history-${{ github.run_id }}
+          restore-keys: |
+            bundle-size-history-
+
+      - name: Build production bundle with stats
+        run: |
+          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
+          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
+          docker run \
+          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
+          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
+          --rm $TAG \
+          bash -c \
+          "npm i && BUNDLE_SIZE_STATS=true npm run build -- --json=bundle-stats/stats.json"
+
+      - name: Summarize bundle size
+        run: |
+          node superset-frontend/scripts/bundle-size-summary.js \
+            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
+          rm -rf superset-frontend/bundle-stats
+
+      # Comparison + alert only -- this job never persists. See
+      # frontend-bundle-size-nightly.yml for why.
+      #
+      # comment-on-alert is gated to same-repo PRs: on a fork PR,
+      # GITHUB_TOKEN is forced read-only regardless of the `permissions`
+      # block above, so once the alert threshold is crossed the action's
+      # `pulls.createReview` call 403s. That error isn't gated by
+      # fail-on-alert (which only governs the deliberate alert-threshold
+      # failure) -- it propagates and fails the job outright. Fork PRs
+      # still get the comparison via the job summary (summary-always).
+      - name: Compare bundle size against nightly baseline
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
+        with:
+          tool: customSmallerIsBetter
+          output-file-path: bundle-size-summary.json
+          external-data-json-path: bundle-size-history.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          comment-on-alert: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+          alert-threshold: "110%"
+          fail-on-alert: false
+          summary-always: true

README.md

@@ -31,6 +31,8 @@ under the License.
 [![Open PRs](https://img.shields.io/github/issues-pr/apache/superset)](https://github.com/apache/superset/pulls)
 [![Get on Slack](https://img.shields.io/badge/slack-join-orange.svg)](https://bit.ly/join-superset-slack)
 [![Documentation](https://img.shields.io/badge/docs-apache.org-blue.svg)](https://superset.apache.org)
+[![Storybook](https://img.shields.io/badge/storybook-live-ff4785.svg)](https://superset-storybook.netlify.app)
+[![Bundle Analyzer](https://img.shields.io/badge/bundle%20analyzer-nightly-8dd6f9.svg)](https://superset-bundle-analyzer.netlify.app)
 
 <picture width="500">
   <source

scripts/docker-build-extra-flags.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Computes the `--extra-flags` value passed to `supersetbot docker` for a
+# given build preset. Factored out of .github/workflows/docker.yml so the
+# PY_VER override logic below can be exercised by an always-on CI check
+# (docker.yml's docker-build job only runs when the change detector's
+# docker/python/frontend outputs are true, and the PR build matrix never
+# includes py311/py312 at all, so a regression here would otherwise go
+# unnoticed until the fix actually runs on master) without duplicating -
+# and risking drift from - the logic used by the real build step.
+#
+# supersetbot's "py311"/"py312" presets pin their own --build-arg PY_VER,
+# which lands ahead of --extra-flags on the assembled buildx command line;
+# docker/buildx keeps the last value for a repeated --build-arg key, so
+# appending PY_VER here would override supersetbot's pin and silently make
+# "py311"/"py312" build the exact same image as "lean". Every other preset
+# gets the override so its build lands on the Dockerfile's own supported
+# Python version.
+#
+# Usage: docker-build-extra-flags.sh <build_preset> <image_tag>
+
+set -euo pipefail
+
+BUILD_PRESET="${1:?usage: docker-build-extra-flags.sh <build_preset> <image_tag>}"
+IMAGE_TAG="${2:?usage: docker-build-extra-flags.sh <build_preset> <image_tag>}"
+
+EXTRA_FLAGS="--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG"
+if [ "$BUILD_PRESET" != "py311" ] && [ "$BUILD_PRESET" != "py312" ]; then
+  EXTRA_FLAGS="--build-arg PY_VER=3.11.14-slim-trixie $EXTRA_FLAGS"
+fi
+
+echo "$EXTRA_FLAGS"

superset-frontend/package.json

@@ -78,6 +78,7 @@
     "playwright:debug": "playwright test --debug",
     "playwright:report": "playwright show-report",
     "docs:screenshots": "playwright test --config=playwright/generators/playwright.config.ts docs/",
+    "playwright:thumbnails": "CAPTURE_THUMBNAILS=1 playwright test tests/tools/capture-viz-thumbnails.spec.ts --project chromium",
     "prod": "npm run build",
     "prune": "rm -rf ./{packages,plugins}/*/{node_modules,lib,esm,tsconfig.tsbuildinfo,package-lock.json} ./.temp_cache",
     "storybook": "cross-env NODE_ENV=development BABEL_ENV=development storybook dev -p 6006",

superset-frontend/playwright/tests/tools/capture-viz-thumbnails.spec.ts

@@ -0,0 +1,630 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Crawls every dashboard on the target instance and refreshes viz-picker
+ * thumbnails and example galleries from live example charts.
+ *
+ * This is a maintenance tool, not a test: charts are DISCOVERED via the
+ * API (dashboards -> charts), so it keeps working as example dashboards
+ * evolve. Every distinct chart found for a viz type gets captured — the
+ * preferred (or alphabetically-first) chart becomes the 512x512
+ * `thumbnail.png`, and each additional distinct chart fills the next
+ * `exampleGallery` slot declared for that viz type, so the gallery shows
+ * real variety instead of the same chart resized. The two static pieces
+ * are the viz type -> image path maps below (VIZ_TYPE_THUMBNAILS,
+ * VIZ_TYPE_GALLERY), which change when a plugin's images or gallery
+ * shape change — never when examples change. Viz types found on
+ * dashboards but missing from both maps, and gallery slots left unfilled
+ * for lack of enough distinct example charts, are reported at the end
+ * without failing the run.
+ *
+ * It only runs when CAPTURE_THUMBNAILS=1 is set, so the regular
+ * Playwright suites never execute it.
+ *
+ * Usage (requires a running Superset with examples loaded):
+ *   npm run playwright:thumbnails
+ *   VIZ_TYPES=bullet,rose npm run playwright:thumbnails   # subset
+ *
+ * Notes:
+ * - Dark variants (`thumbnail-dark.png`, `example-dark.jpg`) are captured
+ *   via prefers-color-scheme emulation whenever the sibling file exists;
+ *   if the app ignores the emulation (dark theming disabled) the dark
+ *   file is left untouched.
+ * - A brand-new gallery image (rather than an existing file being
+ *   refreshed) still needs to be registered in the plugin's metadata
+ *   before it renders in the gallery; the capture logs a reminder.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { test, expect, Page } from '@playwright/test';
+
+const THUMBNAIL_SIZE = 512;
+const RENDERED_CHART_SELECTOR =
+  '[data-test="chart-container"]:has(svg, canvas, table):not(:has([data-test="loading-indicator"]))';
+/**
+ * Charts that render plain markup — no svg/canvas/table for the rendered
+ * selector to key on — get a looser signal plus a longer settle.
+ */
+const TEXT_ONLY_VIZ_TYPES = new Set([
+  'ag-grid-table',
+  'big_number_total',
+  'handlebars',
+  'pop_kpi',
+]);
+
+/**
+ * Hover this element just before the screenshot, so charts whose identity
+ * benefits from an interaction (a visible tooltip) capture mid-hover.
+ */
+const HOVER_BEFORE_CAPTURE: Record<string, string> = {
+  cal_heatmap: '[data-test="chart-container"] svg rect[class*=" r"]',
+};
+const TEXT_RENDERED_CHART_SELECTOR =
+  '[data-test="chart-container"]:not(:has([data-test="loading-indicator"]))';
+
+/** superset-frontend root, resolved from this spec's location. */
+const FRONTEND_ROOT = path.resolve(__dirname, '..', '..', '..');
+
+const ECHARTS = 'plugins/plugin-chart-echarts/src';
+const DECKGL = 'plugins/preset-chart-deckgl/src/layers';
+
+/**
+ * Where each viz type's gallery thumbnail lives, relative to
+ * superset-frontend. One entry per registered viz type with a thumbnail;
+ * add a line when a new plugin ships.
+ */
+const VIZ_TYPE_THUMBNAILS: Record<string, string> = {
+  'ag-grid-table':
+    'plugins/plugin-chart-ag-grid-table/src/images/thumbnail.png',
+  big_number: `${ECHARTS}/BigNumber/BigNumberWithTrendline/images/thumbnail.png`,
+  big_number_total: `${ECHARTS}/BigNumber/BigNumberTotal/images/thumbnail.png`,
+  box_plot: `${ECHARTS}/BoxPlot/images/thumbnail.png`,
+  bubble_v2: `${ECHARTS}/Bubble/images/thumbnail.png`,
+  bullet: `${ECHARTS}/Bullet/images/thumbnail.png`,
+  cal_heatmap: 'plugins/plugin-chart-calendar/src/images/thumbnail.png',
+  cartodiagram: 'plugins/plugin-chart-cartodiagram/src/images/thumbnail.png',
+  chord: 'plugins/plugin-chart-chord/src/images/thumbnail.png',
+  country_map: 'plugins/plugin-chart-country-map/src/images/thumbnail.png',
+  deck_arc: `${DECKGL}/Arc/images/thumbnail.png`,
+  deck_contour: `${DECKGL}/Contour/images/thumbnail.png`,
+  deck_geojson: `${DECKGL}/Geojson/images/thumbnail.png`,
+  deck_grid: `${DECKGL}/Grid/images/thumbnail.png`,
+  deck_heatmap: `${DECKGL}/Heatmap/images/thumbnail.png`,
+  deck_hex: `${DECKGL}/Hex/images/thumbnail.png`,
+  deck_multi: 'plugins/preset-chart-deckgl/src/Multi/images/thumbnail.png',
+  deck_path: `${DECKGL}/Path/images/thumbnail.png`,
+  deck_polygon: `${DECKGL}/Polygon/images/thumbnail.png`,
+  deck_scatter: `${DECKGL}/Scatter/images/thumbnail.png`,
+  deck_screengrid: `${DECKGL}/Screengrid/images/thumbnail.png`,
+  echarts_area: `${ECHARTS}/Timeseries/Area/images/thumbnail.png`,
+  echarts_timeseries: `${ECHARTS}/Timeseries/images/thumbnail.png`,
+  echarts_timeseries_bar: `${ECHARTS}/Timeseries/Regular/Bar/images/thumbnail.png`,
+  echarts_timeseries_line: `${ECHARTS}/Timeseries/Regular/Line/images/thumbnail.png`,
+  echarts_timeseries_scatter: `${ECHARTS}/Timeseries/Regular/Scatter/images/thumbnail.png`,
+  echarts_timeseries_smooth: `${ECHARTS}/Timeseries/Regular/SmoothLine/images/thumbnail.png`,
+  echarts_timeseries_step: `${ECHARTS}/Timeseries/Step/images/thumbnail.png`,
+  funnel: `${ECHARTS}/Funnel/images/thumbnail.png`,
+  gantt_chart: `${ECHARTS}/Gantt/images/thumbnail.png`,
+  gauge_chart: `${ECHARTS}/Gauge/images/thumbnail.png`,
+  graph_chart: `${ECHARTS}/Graph/images/thumbnail.png`,
+  // handlebars intentionally unmapped: its generic logo represents the
+  // template-anything nature of the chart better than any one example.
+  heatmap_v2: `${ECHARTS}/Heatmap/images/thumbnail.png`,
+  histogram_v2: `${ECHARTS}/Histogram/images/thumbnail.png`,
+  horizon: 'plugins/plugin-chart-horizon/src/images/thumbnail.png',
+  mixed_timeseries: `${ECHARTS}/MixedTimeseries/images/thumbnail.png`,
+  paired_ttest: 'plugins/plugin-chart-paired-t-test/src/images/thumbnail.png',
+  para: 'plugins/plugin-chart-parallel-coordinates/src/images/thumbnail.png',
+  partition: 'plugins/plugin-chart-partition/src/images/thumbnail.png',
+  pie: `${ECHARTS}/Pie/images/thumbnail.png`,
+  pivot_table_v2: 'plugins/plugin-chart-pivot-table/src/images/thumbnail.png',
+  point_cluster_map:
+    'plugins/plugin-chart-point-cluster-map/src/images/thumbnail.png',
+  pop_kpi: `${ECHARTS}/BigNumber/BigNumberPeriodOverPeriod/images/thumbnail.png`,
+  radar: `${ECHARTS}/Radar/images/thumbnail.png`,
+  rose: `${ECHARTS}/Rose/images/thumbnail.png`,
+  sankey_v2: `${ECHARTS}/Sankey/images/thumbnail.png`,
+  sunburst_v2: `${ECHARTS}/Sunburst/images/thumbnail.png`,
+  table: 'plugins/plugin-chart-table/src/images/thumbnail.png',
+  time_pivot: `${ECHARTS}/TimePivot/images/thumbnail.png`,
+  time_table: 'src/visualizations/TimeTable/images/thumbnail.png',
+  tree_chart: `${ECHARTS}/Tree/images/thumbnail.png`,
+  treemap_v2: `${ECHARTS}/Treemap/images/thumbnail.png`,
+  waterfall: `${ECHARTS}/Waterfall/images/thumbnail.png`,
+  word_cloud: 'plugins/plugin-chart-word-cloud/src/images/thumbnail.png',
+  world_map: 'plugins/plugin-chart-world-map/src/images/thumbnail.png',
+};
+
+/**
+ * When several example charts share a viz type, prefer these slices over
+ * the default alphabetically-first pick. Missing slices fall back to the
+ * default, so stale entries degrade gracefully.
+ */
+const PREFERRED_SLICES: Record<string, string> = {
+  big_number: 'Sales Year over Year',
+  bubble_v2: 'Life Expectancy VS Rural %',
+  bullet: 'Total Sales Bullet',
+  cal_heatmap: 'Sales Calendar Heatmap',
+  chord: 'Product Line Chord',
+  echarts_area: 'Sales Stacked Area',
+  echarts_timeseries_bar: 'Sales Stacked Bars',
+  echarts_timeseries_line: 'Monthly Sales Line',
+  echarts_timeseries_smooth: 'Monthly Sales Smooth',
+  echarts_timeseries_step: 'Quarterly Sales Steps',
+  funnel: 'Population Funnel',
+  gauge_chart: 'Rural Population Gauge',
+  heatmap_v2: 'Sales Grid Heatmap',
+  histogram_v2: 'Life Expectancy Histogram',
+  horizon: 'Population Growth Horizon',
+  mixed_timeseries: 'Sales Mixed Chart',
+  paired_ttest: 'Population Paired t-Test',
+  partition: 'Population Partition',
+  pie: 'Product Line Donut',
+  pivot_table_v2: 'Sales Pivot Highlights',
+  radar: 'Game Sales Radar',
+  rose: 'Population Nightingale Rose',
+  sunburst_v2: 'Population Sunburst',
+  table: 'Sales Summary Table',
+  time_pivot: 'Sales Period Pivot',
+  time_table: 'Product Line Time Table',
+  tree_chart: 'Sales Territory Tree',
+  treemap_v2: 'Population Treemap',
+  waterfall: 'Quarterly Sales Waterfall',
+};
+
+/** Gallery example images use a wide aspect, matching the existing art. */
+const EXAMPLE_WIDTH = 800;
+const EXAMPLE_HEIGHT = 460;
+
+/**
+ * Every plugin's `exampleGallery` image slots (never including
+ * `thumbnail.png`/`thumbnail-dark.png`, which stays governed by
+ * VIZ_TYPE_THUMBNAILS), in the order they appear in that plugin's
+ * `index.ts`. One entry per viz type that declares a gallery — including
+ * `handlebars`, whose gallery is filled even though its picker thumbnail
+ * intentionally stays the generic logo (unmapped in VIZ_TYPE_THUMBNAILS).
+ *
+ * For a viz type with N slots here, the crawler assigns its (N+1)
+ * distinct dashboard charts (the thumbnail's pick, then this many more)
+ * to thumbnail, slot 1, slot 2, ... in that order, so gallery images show
+ * different charts than the thumbnail and each other rather than the same
+ * chart resized. Fewer distinct charts than slots just leaves the
+ * trailing slots untouched (reported, not failed) — add more example
+ * charts to fill them.
+ *
+ * Update this when a plugin's exampleGallery array changes shape.
+ */
+const VIZ_TYPE_GALLERY: Record<string, string[]> = {
+  'ag-grid-table': [
+    'plugins/plugin-chart-ag-grid-table/src/images/Table.jpg',
+    'plugins/plugin-chart-ag-grid-table/src/images/Table2.jpg',
+    'plugins/plugin-chart-ag-grid-table/src/images/Table3.jpg',
+  ],
+  big_number: [
+    `${ECHARTS}/BigNumber/BigNumberWithTrendline/images/Big_Number_Trendline.jpg`,
+  ],
+  big_number_total: [
+    `${ECHARTS}/BigNumber/BigNumberTotal/images/BigNumber.jpg`,
+    `${ECHARTS}/BigNumber/BigNumberTotal/images/BigNumber2.jpg`,
+  ],
+  box_plot: [`${ECHARTS}/BoxPlot/images/BoxPlot.jpg`],
+  bubble_v2: [
+    `${ECHARTS}/Bubble/images/example1.png`,
+    `${ECHARTS}/Bubble/images/example2.png`,
+  ],
+  bullet: [`${ECHARTS}/Bullet/images/example.jpg`],
+  cal_heatmap: ['plugins/plugin-chart-calendar/src/images/example.jpg'],
+  cartodiagram: [
+    'plugins/plugin-chart-cartodiagram/src/images/example1.png',
+    'plugins/plugin-chart-cartodiagram/src/images/example2.png',
+  ],
+  chord: ['plugins/plugin-chart-chord/src/images/chord.jpg'],
+  country_map: [
+    'plugins/plugin-chart-country-map/src/images/exampleUsa.jpg',
+    'plugins/plugin-chart-country-map/src/images/exampleGermany.jpg',
+  ],
+  echarts_area: [`${ECHARTS}/Timeseries/Area/images/Area1.png`],
+  echarts_timeseries: [`${ECHARTS}/Timeseries/images/Time-series_Chart.jpg`],
+  echarts_timeseries_bar: [
+    `${ECHARTS}/Timeseries/Regular/Bar/images/Bar1.png`,
+    `${ECHARTS}/Timeseries/Regular/Bar/images/Bar2.png`,
+    `${ECHARTS}/Timeseries/Regular/Bar/images/Bar3.png`,
+  ],
+  echarts_timeseries_line: [
+    `${ECHARTS}/Timeseries/Regular/Line/images/Line1.png`,
+    `${ECHARTS}/Timeseries/Regular/Line/images/Line2.png`,
+    `${ECHARTS}/Timeseries/Regular/Line/images/Line3.png`,
+  ],
+  echarts_timeseries_scatter: [
+    `${ECHARTS}/Timeseries/Regular/Scatter/images/Scatter1.png`,
+  ],
+  echarts_timeseries_smooth: [
+    `${ECHARTS}/Timeseries/Regular/SmoothLine/images/SmoothLine1.png`,
+  ],
+  echarts_timeseries_step: [
+    `${ECHARTS}/Timeseries/Step/images/Step1.png`,
+    `${ECHARTS}/Timeseries/Step/images/Step2.png`,
+  ],
+  funnel: [`${ECHARTS}/Funnel/images/example.jpg`],
+  gantt_chart: [
+    `${ECHARTS}/Gantt/images/example1.png`,
+    `${ECHARTS}/Gantt/images/example2.png`,
+  ],
+  gauge_chart: [
+    `${ECHARTS}/Gauge/images/example1.jpg`,
+    `${ECHARTS}/Gauge/images/example2.jpg`,
+  ],
+  graph_chart: [`${ECHARTS}/Graph/images/example.jpg`],
+  handlebars: [
+    'plugins/plugin-chart-handlebars/src/images/example1.jpg',
+    'plugins/plugin-chart-handlebars/src/images/example2.jpg',
+  ],
+  heatmap_v2: [
+    `${ECHARTS}/Heatmap/images/example1.png`,
+    `${ECHARTS}/Heatmap/images/example2.png`,
+    `${ECHARTS}/Heatmap/images/example3.png`,
+  ],
+  histogram_v2: [
+    `${ECHARTS}/Histogram/images/example1.png`,
+    `${ECHARTS}/Histogram/images/example2.png`,
+  ],
+  horizon: ['plugins/plugin-chart-horizon/src/images/Horizon_Chart.jpg'],
+  mixed_timeseries: [`${ECHARTS}/MixedTimeseries/images/example.jpg`],
+  paired_ttest: ['plugins/plugin-chart-paired-t-test/src/images/example.jpg'],
+  para: [
+    'plugins/plugin-chart-parallel-coordinates/src/images/example1.jpg',
+    'plugins/plugin-chart-parallel-coordinates/src/images/example2.jpg',
+  ],
+  partition: ['plugins/plugin-chart-partition/src/images/example.jpg'],
+  pie: [
+    `${ECHARTS}/Pie/images/Pie1.jpg`,
+    `${ECHARTS}/Pie/images/Pie2.jpg`,
+    `${ECHARTS}/Pie/images/Pie3.jpg`,
+    `${ECHARTS}/Pie/images/Pie4.jpg`,
+  ],
+  pivot_table_v2: ['plugins/plugin-chart-pivot-table/src/images/example.jpg'],
+  point_cluster_map: [
+    'plugins/plugin-chart-point-cluster-map/src/images/MapBox.jpg',
+    'plugins/plugin-chart-point-cluster-map/src/images/MapBox2.jpg',
+  ],
+  radar: [
+    `${ECHARTS}/Radar/images/example1.jpg`,
+    `${ECHARTS}/Radar/images/example2.jpg`,
+  ],
+  rose: [
+    `${ECHARTS}/Rose/images/example1.jpg`,
+    `${ECHARTS}/Rose/images/example2.jpg`,
+  ],
+  sankey_v2: [
+    `${ECHARTS}/Sankey/images/example1.png`,
+    `${ECHARTS}/Sankey/images/example2.png`,
+  ],
+  sunburst_v2: [
+    `${ECHARTS}/Sunburst/images/Sunburst1.png`,
+    `${ECHARTS}/Sunburst/images/Sunburst2.png`,
+  ],
+  table: [
+    'plugins/plugin-chart-table/src/images/Table.jpg',
+    'plugins/plugin-chart-table/src/images/Table2.jpg',
+    'plugins/plugin-chart-table/src/images/Table3.jpg',
+  ],
+  time_pivot: [`${ECHARTS}/TimePivot/images/example.jpg`],
+  time_table: ['src/visualizations/TimeTable/images/example.jpg'],
+  tree_chart: [`${ECHARTS}/Tree/images/tree.png`],
+  treemap_v2: [
+    `${ECHARTS}/Treemap/images/treemap_v2_1.png`,
+    `${ECHARTS}/Treemap/images/treemap_v2_2.jpg`,
+  ],
+  waterfall: [
+    `${ECHARTS}/Waterfall/images/example1.png`,
+    `${ECHARTS}/Waterfall/images/example2.png`,
+    `${ECHARTS}/Waterfall/images/example3.png`,
+  ],
+  word_cloud: [
+    'plugins/plugin-chart-word-cloud/src/images/Word_Cloud.jpg',
+    'plugins/plugin-chart-word-cloud/src/images/Word_Cloud_2.jpg',
+  ],
+  world_map: [
+    'plugins/plugin-chart-world-map/src/images/WorldMap1.jpg',
+    'plugins/plugin-chart-world-map/src/images/WorldMap2.jpg',
+  ],
+  deck_arc: [`${DECKGL}/Arc/images/example.png`],
+  deck_contour: [`${DECKGL}/Contour/images/example.png`],
+  deck_geojson: [`${DECKGL}/Geojson/images/example.png`],
+  deck_grid: [`${DECKGL}/Grid/images/example.png`],
+  deck_heatmap: [`${DECKGL}/Heatmap/images/example.png`],
+  deck_hex: [`${DECKGL}/Hex/images/example.png`],
+  deck_multi: ['plugins/preset-chart-deckgl/src/Multi/images/example.png'],
+  deck_path: [`${DECKGL}/Path/images/example.png`],
+  deck_polygon: [`${DECKGL}/Polygon/images/example.png`],
+  deck_scatter: [`${DECKGL}/Scatter/images/example.png`],
+  deck_screengrid: [`${DECKGL}/Screengrid/images/example.png`],
+};
+
+interface ExampleChart {
+  id: number;
+  sliceName: string;
+  vizType: string;
+}
+
+interface DashboardRow {
+  id: number;
+}
+
+interface DashboardChartRow {
+  id?: number;
+  slice_name?: string;
+  form_data?: { viz_type?: string };
+}
+
+/** Pages through a list endpoint, returning every result row. */
+async function fetchAllPages<T>(page: Page, endpoint: string): Promise<T[]> {
+  const rows: T[] = [];
+  const pageSize = 100;
+  for (let pageNum = 0; ; pageNum += 1) {
+    const q = encodeURIComponent(
+      `(page_size:${pageSize},page:${pageNum},order_direction:asc)`,
+    );
+    const response = await page.request.get(`${endpoint}?q=${q}`);
+    expect(response.ok(), `GET ${endpoint} page ${pageNum}`).toBeTruthy();
+    const { result }: { result: T[] } = await response.json();
+    rows.push(...result);
+    if (result.length < pageSize) return rows;
+  }
+}
+
+/** Discovers every chart placed on any dashboard. */
+async function discoverDashboardCharts(page: Page): Promise<ExampleChart[]> {
+  const dashboards = await fetchAllPages<DashboardRow>(
+    page,
+    '/api/v1/dashboard/',
+  );
+  const chartsById = new Map<number, ExampleChart>();
+  for (const dashboard of dashboards) {
+    const response = await page.request.get(
+      `/api/v1/dashboard/${dashboard.id}/charts`,
+    );
+    if (!response.ok()) continue;
+    const { result }: { result: DashboardChartRow[] } = await response.json();
+    for (const chart of result) {
+      const vizType = chart.form_data?.viz_type;
+      if (chart.id && chart.slice_name && vizType) {
+        chartsById.set(chart.id, {
+          id: chart.id,
+          sliceName: chart.slice_name,
+          vizType,
+        });
+      }
+    }
+  }
+  return [...chartsById.values()];
+}
+
+/** thumbnail.png -> thumbnail-dark.png, example.jpg -> example-dark.jpg */
+function darkSibling(output: string): string {
+  return output.replace(/\.(png|jpg)$/, '-dark.$1');
+}
+
+async function renderAndShoot(
+  page: Page,
+  chart: ExampleChart,
+  colorScheme: 'light' | 'dark',
+): Promise<Buffer> {
+  // An explicit navigation timeout keeps one hung load from stalling the
+  // whole crawl until the test timeout.
+  await page.goto(`/explore/?slice_id=${chart.id}&standalone=1`, {
+    timeout: 60_000,
+  });
+  // Dashboards render charts on colorBgContainer cards, but the standalone
+  // explore page paints the gray colorBgLayout (via the antd Layout
+  // wrapper); match the dashboard context so thumbnails look like charts
+  // do where users see them.
+  await page
+    .addStyleTag({
+      content: `body, .ant-layout { background: ${
+        colorScheme === 'dark' ? '#141414' : '#ffffff'
+      } !important; }`,
+    })
+    .catch(() => {});
+  const textOnly = TEXT_ONLY_VIZ_TYPES.has(chart.vizType);
+  await page
+    .locator(textOnly ? TEXT_RENDERED_CHART_SELECTOR : RENDERED_CHART_SELECTOR)
+    .first()
+    .waitFor({ state: 'visible', timeout: 60_000 });
+  // Give animations/map tiles (or text-only chart data) time to settle
+  await page.waitForTimeout(textOnly ? 4_000 : 2_000);
+  // Some thumbnails read better mid-interaction (e.g. the calendar heatmap
+  // showing its tooltip); hover the configured element before the still.
+  const hoverSelector = HOVER_BEFORE_CAPTURE[chart.vizType];
+  if (hoverSelector) {
+    // Hover a mid-chart element rather than the first (often an empty
+    // corner cell), falling back to the first when there are few.
+    const cells = page.locator(hoverSelector);
+    const count = await cells.count().catch(() => 0);
+    await cells
+      .nth(Math.floor(count / 2))
+      .hover({ timeout: 5_000 })
+      .catch(() => {});
+    await page.waitForTimeout(500);
+  }
+  return page.screenshot();
+}
+
+/**
+ * Captures a chart light and (when a dark variant is wanted) dark. Dark
+ * rendering relies on the app following prefers-color-scheme (theme mode
+ * SYSTEM); if the dark render is byte-identical to the light one the app
+ * ignored the emulation, and the dark file is left untouched rather than
+ * overwritten with light-theme art.
+ */
+async function captureChart(
+  page: Page,
+  chart: ExampleChart,
+  output: string,
+  size: { width: number; height: number },
+): Promise<void> {
+  const outputPath = path.join(FRONTEND_ROOT, output);
+  const darkPath = path.join(FRONTEND_ROOT, darkSibling(output));
+  const isNewImage = !fs.existsSync(outputPath);
+  const wantDark = fs.existsSync(darkPath) || isNewImage;
+
+  await page.setViewportSize(size);
+  await page.emulateMedia({ colorScheme: 'light' });
+  const lightShot = await renderAndShoot(page, chart, 'light');
+  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+  fs.writeFileSync(outputPath, lightShot);
+  // eslint-disable-next-line no-console
+  console.log(`captured ${chart.sliceName} (${chart.vizType}) -> ${output}`);
+
+  if (wantDark) {
+    await page.emulateMedia({ colorScheme: 'dark' });
+    const darkShot = await renderAndShoot(page, chart, 'dark');
+    if (darkShot.equals(lightShot)) {
+      // eslint-disable-next-line no-console
+      console.log(
+        `SKIPPED dark variant for ${chart.sliceName}: the app ignored the dark color-scheme emulation (is dark theming enabled?)`,
+      );
+    } else {
+      fs.writeFileSync(darkPath, darkShot);
+      // eslint-disable-next-line no-console
+      console.log(
+        `captured ${chart.sliceName} (dark) -> ${darkSibling(output)}`,
+      );
+    }
+  }
+
+  if (isNewImage) {
+    // eslint-disable-next-line no-console
+    console.log(
+      `NOTE: ${output} is a new gallery image — register it in the plugin metadata (exampleGallery) to surface it.`,
+    );
+  }
+}
+
+test.describe('capture viz thumbnails', () => {
+  test.skip(
+    !process.env.CAPTURE_THUMBNAILS,
+    'Thumbnail capture only runs with CAPTURE_THUMBNAILS=1',
+  );
+
+  test('crawls example dashboards and refreshes gallery thumbnails', async ({
+    page,
+  }) => {
+    test.setTimeout(90 * 60_000);
+
+    const vizTypeFilter = process.env.VIZ_TYPES
+      ? new Set(process.env.VIZ_TYPES.split(',').map(v => v.trim()))
+      : null;
+
+    const charts = await discoverDashboardCharts(page);
+    expect(
+      charts.length,
+      'no dashboard charts found — are examples loaded?',
+    ).toBeGreaterThan(0);
+
+    // Every distinct chart per viz type gets captured: the preferred (or
+    // alphabetically-first) chart becomes the picker thumbnail, and each
+    // subsequent distinct chart fills the next declared gallery slot, so
+    // gallery images show real variety instead of the same chart resized.
+    const byVizType = new Map<string, ExampleChart[]>();
+    for (const chart of charts) {
+      const group = byVizType.get(chart.vizType) ?? [];
+      group.push(chart);
+      byVizType.set(chart.vizType, group);
+    }
+
+    const thumbnailSize = { width: THUMBNAIL_SIZE, height: THUMBNAIL_SIZE };
+    const exampleSize = { width: EXAMPLE_WIDTH, height: EXAMPLE_HEIGHT };
+    const unmapped: string[] = [];
+    const underfilledGalleries: string[] = [];
+    const failures: string[] = [];
+    for (const [vizType, group] of [...byVizType.entries()].sort()) {
+      if (vizTypeFilter && !vizTypeFilter.has(vizType)) continue;
+
+      const thumbOutput = VIZ_TYPE_THUMBNAILS[vizType];
+      const galleryOutputs = VIZ_TYPE_GALLERY[vizType] ?? [];
+      if (!thumbOutput && !galleryOutputs.length) {
+        unmapped.push(vizType);
+        continue;
+      }
+
+      // Preferred slice (if present) leads; the rest follow alphabetically.
+      group.sort((a, b) => a.sliceName.localeCompare(b.sliceName));
+      const preferredIndex = group.findIndex(
+        c => c.sliceName === PREFERRED_SLICES[vizType],
+      );
+      const ordered =
+        preferredIndex > 0
+          ? [
+              group[preferredIndex],
+              ...group.slice(0, preferredIndex),
+              ...group.slice(preferredIndex + 1),
+            ]
+          : group;
+
+      // Only advance past the thumbnail's chart when a thumbnail is
+      // actually captured (e.g. handlebars has no VIZ_TYPE_THUMBNAILS
+      // entry by design, so its gallery gets the full ordered list).
+      let nextIndex = 0;
+      if (thumbOutput) {
+        const chart = ordered[0];
+        nextIndex = 1;
+        try {
+          await captureChart(page, chart, thumbOutput, thumbnailSize);
+        } catch (error) {
+          failures.push(`${vizType} (${chart.sliceName}): ${error}`);
+        }
+      }
+
+      const missingSlots: string[] = [];
+      for (const output of galleryOutputs) {
+        const chart = ordered[nextIndex];
+        nextIndex += 1;
+        if (!chart) {
+          missingSlots.push(output);
+          continue;
+        }
+        try {
+          await captureChart(page, chart, output, exampleSize);
+        } catch (error) {
+          failures.push(`${vizType} gallery (${chart.sliceName}): ${error}`);
+        }
+      }
+      if (missingSlots.length) {
+        underfilledGalleries.push(
+          `${vizType}: not enough distinct dashboard charts for ${missingSlots.join(', ')}`,
+        );
+      }
+    }
+
+    if (unmapped.length) {
+      // eslint-disable-next-line no-console
+      console.log(
+        `viz types on dashboards with no thumbnail or gallery mapping (add to VIZ_TYPE_THUMBNAILS/VIZ_TYPE_GALLERY if wanted): ${unmapped.join(', ')}`,
+      );
+    }
+    if (underfilledGalleries.length) {
+      // eslint-disable-next-line no-console
+      console.log(
+        `gallery slots left untouched for lack of distinct example charts:\n${underfilledGalleries.join('\n')}`,
+      );
+    }
+    expect(failures, failures.join('\n')).toEqual([]);
+  });
+});

superset-frontend/plugins/plugin-chart-ag-grid-table/src/index.ts

@@ -19,14 +19,14 @@
 import { t } from '@apache-superset/core/translation';
 import { Behavior, ChartMetadata, ChartPlugin } from '@superset-ui/core';
 import transformProps from './transformProps';
-import thumbnail from './images/thumbnail.png';
-import thumbnailDark from './images/thumbnail-dark.png';
-import example1 from './images/Table.jpg';
-import example1Dark from './images/Table-dark.jpg';
-import example2 from './images/Table2.jpg';
-import example2Dark from './images/Table2-dark.jpg';
-import example3 from './images/Table3.jpg';
-import example3Dark from './images/Table3-dark.jpg';
+import thumbnail from './images/custom_thumb_thumbnail.png';
+import thumbnailDark from './images/custom_thumb_thumbnail-dark.png';
+import example1 from './images/custom_thumb_Table.jpg';
+import example1Dark from './images/custom_thumb_Table-dark.jpg';
+import example2 from './images/custom_thumb_Table2.jpg';
+import example2Dark from './images/custom_thumb_Table2-dark.jpg';
+import example3 from './images/custom_thumb_Table3.jpg';
+import example3Dark from './images/custom_thumb_Table3-dark.jpg';
 import controlPanel from './controlPanel';
 import buildQuery from './buildQuery';
 import { TableChartFormData, TableChartProps } from './types';

superset-frontend/plugins/plugin-chart-calendar/src/index.ts

@@ -19,8 +19,8 @@
 import { ChartMetadata, ChartPlugin } from '@superset-ui/core';
 import { t } from '@apache-superset/core/translation';
 import transformProps from './transformProps';
-import example from './images/example.jpg';
-import exampleDark from './images/example-dark.jpg';
+import example from './images/custom_thumb_example.jpg';
+import exampleDark from './images/custom_thumb_example-dark.jpg';
 import controlPanel from './controlPanel';
 import thumbnail from './images/thumbnail.png';
 import thumbnailDark from './images/thumbnail-dark.png';

superset-frontend/plugins/plugin-chart-cartodiagram/src/plugin/index.ts

@@ -21,12 +21,12 @@ import { ChartMetadata, ChartPlugin } from '@superset-ui/core';
 import buildQuery from './buildQuery';
 import controlPanel from './controlPanel';
 import transformProps from './transformProps';
-import thumbnail from '../images/thumbnail.png';
-import thumbnailDark from '../images/thumbnail-dark.png';
-import example1 from '../images/example1.png';
-import example1Dark from '../images/example1-dark.png';
-import example2 from '../images/example2.png';
-import example2Dark from '../images/example2-dark.png';
+import thumbnail from '../images/custom_thumb_thumbnail.png';
+import thumbnailDark from '../images/custom_thumb_thumbnail-dark.png';
+import example1 from '../images/custom_thumb_example1.png';
+import example1Dark from '../images/custom_thumb_example1-dark.png';
+import example2 from '../images/custom_thumb_example2.png';
+import example2Dark from '../images/custom_thumb_example2-dark.png';
 import { CartodiagramPluginConstructorOpts } from '../types';
 import { getLayerConfig } from '../util/controlPanelUtil';
 

superset-frontend/plugins/plugin-chart-country-map/src/index.ts

@@ -19,10 +19,10 @@
 import { t } from '@apache-superset/core/translation';
 import { ChartMetadata, ChartPlugin, Behavior } from '@superset-ui/core';
 import transformProps from './transformProps';
-import exampleUsa from './images/exampleUsa.jpg';
-import exampleUsaDark from './images/exampleUsa-dark.jpg';
-import exampleGermany from './images/exampleGermany.jpg';
-import exampleGermanyDark from './images/exampleGermany-dark.jpg';
+import exampleUsa from './images/custom_thumb_exampleUsa.jpg';
+import exampleUsaDark from './images/custom_thumb_exampleUsa-dark.jpg';
+import exampleGermany from './images/custom_thumb_exampleGermany.jpg';
+import exampleGermanyDark from './images/custom_thumb_exampleGermany-dark.jpg';
 import thumbnail from './images/thumbnail.png';
 import thumbnailDark from './images/thumbnail-dark.png';
 import controlPanel from './controlPanel';

superset-frontend/plugins/plugin-chart-echarts/src/BigNumber/BigNumberPeriodOverPeriod/index.ts

@@ -21,8 +21,8 @@ import { ChartMetadata, ChartPlugin } from '@superset-ui/core';
 import buildQuery from './buildQuery';
 import controlPanel from './controlPanel';
 import transformProps from './transformProps';
-import thumbnail from './images/thumbnail.png';
-import thumbnailDark from './images/thumbnail-dark.png';
+import thumbnail from './images/custom_thumb_thumbnail.png';
+import thumbnailDark from './images/custom_thumb_thumbnail-dark.png';
 
 export default class PopKPIPlugin extends ChartPlugin {
   constructor() {

superset-frontend/plugins/plugin-chart-echarts/src/Bubble/index.ts

@@ -25,8 +25,8 @@ import buildQuery from './buildQuery';
 import controlPanel from './controlPanel';
 import example1 from './images/example1.png';
 import example1Dark from './images/example1-dark.png';
-import example2 from './images/example2.png';
-import example2Dark from './images/example2-dark.png';
+import example2 from './images/custom_thumb_example2.png';
+import example2Dark from './images/custom_thumb_example2-dark.png';
 import { EchartsBubbleChartProps, EchartsBubbleFormData } from './types';
 
 // TODO: Implement cross filtering

superset-frontend/plugins/plugin-chart-echarts/src/Bubble/transformProps.test.ts

@@ -0,0 +1,70 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { SqlaFormData } from '@superset-ui/core';
+import transformProps from './transformProps';
+import { EchartsBubbleChartProps } from './types';
+
+const baseFormData: SqlaFormData = {
+  datasource: '1__table',
+  viz_type: 'bubble_v2',
+  entity: 'customer_name',
+  x: 'price',
+  y: 'sales',
+  size: 'count',
+};
+
+const baseChartProps = {
+  width: 400,
+  height: 400,
+  hooks: {},
+  queriesData: [
+    {
+      data: [
+        { customer_name: 'A', price: 10, sales: 100, count: 5 },
+        { customer_name: 'B', price: 20, sales: 200, count: 8 },
+      ],
+    },
+  ],
+  theme: { colorText: '#000' },
+};
+
+test('nests xAxisLabelInterval under axisLabel rather than the axis itself', () => {
+  // Regression test: xAxis.interval forces echarts' IntervalScale into a
+  // fixed-tick-spacing mode that expects a number and crashes on the
+  // 'auto'/'0' strings this control actually produces (observed as an
+  // uncaught assertion deep in echarts' axis "nice" tick calculation,
+  // reproducing on every dashboard bubble chart). The interval belongs on
+  // axisLabel, where it only controls how many labels are skipped.
+  const { echartOptions } = transformProps({
+    ...baseChartProps,
+    formData: baseFormData,
+  } as unknown as EchartsBubbleChartProps);
+
+  expect((echartOptions.xAxis as any).interval).toBeUndefined();
+  expect((echartOptions.xAxis as any).axisLabel.interval).toBe('auto');
+});
+
+test('honors an explicit xAxisLabelInterval override', () => {
+  const { echartOptions } = transformProps({
+    ...baseChartProps,
+    formData: { ...baseFormData, xAxisLabelInterval: '0' },
+  } as unknown as EchartsBubbleChartProps);
+
+  expect((echartOptions.xAxis as any).axisLabel.interval).toBe('0');
+});