Merge remote-tracking branch 'origin/master' into docs/testing-guidelines-test-function

Added comprehensive testing structure guidelines to LLMS.md that explain why and how to use test() instead of describe() and it(), following the "avoid nesting when testing" principle for better test isolation and readability.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.asf.yaml

@@ -17,7 +17,14 @@
 
 # https://cwiki.apache.org/confluence/display/INFRA/.asf.yaml+features+for+git+repositories
 ---
+notifications:
+  commits: commits@superset.apache.org
+  issues: notifications@superset.apache.org
+  pullrequests: notifications@superset.apache.org
+  discussions: notifications@superset.apache.org
+
 github:
+  del_branch_on_merge: true
   description: "Apache Superset is a Data Visualization and Data Exploration Platform"
   homepage: https://superset.apache.org/
   labels:
@@ -47,12 +54,17 @@ github:
     projects: true
     # Enable wiki for documentation
     wiki: true
+    # Enable discussions
+    discussions: true
 
   enabled_merge_buttons:
     squash: true
     merge: false
     rebase: false
 
+  ghp_branch:  gh-pages
+  ghp_path: /
+
   protected_branches:
     master:
       required_status_checks:
@@ -63,16 +75,22 @@ github:
         # combination here.
         contexts:
           - lint-check
+          - cypress-matrix (0, chrome)
           - cypress-matrix (1, chrome)
           - cypress-matrix (2, chrome)
           - cypress-matrix (3, chrome)
+          - cypress-matrix (4, chrome)
+          - cypress-matrix (5, chrome)
+          - dependency-review
           - frontend-build
-          - pre-commit (3.9)
-          - python-lint (3.9)
-          - test-mysql (3.9)
-          - test-postgres (3.9)
-          - test-postgres (3.10)
-          - test-sqlite (3.9)
+          - pre-commit (current)
+          - pre-commit (previous)
+          - test-mysql
+          - test-postgres (current)
+          - test-postgres-hive
+          - test-postgres-presto
+          - test-sqlite
+          - unit-tests (current)
 
       required_pull_request_reviews:
         dismiss_stale_reviews: false
@@ -80,3 +98,10 @@ github:
         required_approving_review_count: 1
 
       required_signatures: false
+    gh-pages:
+      required_pull_request_reviews:
+        dismiss_stale_reviews: false
+        require_code_owner_reviews: true
+        required_approving_review_count: 1
+
+      required_signatures: false

.claude/commands/js-to-ts.md

@@ -0,0 +1,10 @@
+# JavaScript to TypeScript Migration Command
+
+## Usage
+```
+/js-to-ts <core-filename>
+```
+- `<core-filename>` - Path to CORE file relative to `superset-frontend/` (e.g., `src/utils/common.js`, `src/middleware/loggerMiddleware.js`)
+
+## Agent Instructions
+**See:** [../projects/js-to-ts/AGENT.md](../projects/js-to-ts/AGENT.md) for complete migration guide.

.claude/projects/js-to-ts/AGENT.md

@@ -0,0 +1,684 @@
+# JavaScript to TypeScript Migration Agent Guide
+
+**Complete technical reference for converting JavaScript/JSX files to TypeScript/TSX in Apache Superset frontend.**
+
+**Agent Role:** Atomic migration unit - migrate the core file + ALL related tests/mocks as one cohesive unit. Use `git mv` to preserve history, NO `git commit`. NO global import changes. Report results upon completion.
+
+---
+
+## 🎯 Migration Principles
+
+1. **Atomic migration units** - Core file + all related tests/mocks migrate together
+2. **Zero `any` types** - Use proper TypeScript throughout
+3. **Leverage existing types** - Reuse established definitions
+4. **Type inheritance** - Derivatives extend base component types
+5. **Strategic placement** - File types for maximum discoverability
+6. **Surgical improvements** - Enhance existing types during migration
+
+---
+
+## Step 0: Dependency Check (MANDATORY)
+
+**Command:**
+```bash
+grep -E "from '\.\./.*\.jsx?'|from '\./.*\.jsx?'|from 'src/.*\.jsx?'" superset-frontend/{filename}
+```
+
+**Decision:**
+- ✅ No matches → Proceed with atomic migration (core + tests + mocks)
+- ❌ Matches found → EXIT with dependency report (see format below)
+
+---
+
+## Step 1: Identify Related Files (REQUIRED)
+
+**Atomic Migration Scope:**
+For core file `src/utils/example.js`, also migrate:
+- `src/utils/example.test.js` / `src/utils/example.test.jsx`
+- `src/utils/example.spec.js` / `src/utils/example.spec.jsx`
+- `src/utils/__mocks__/example.js`
+- Any other related test/mock files found by pattern matching
+
+**Find all related test and mock files:**
+```bash
+# Pattern-based search for related files
+basename=$(basename {filename} .js)
+dirname=$(dirname superset-frontend/{filename})
+
+# Find test files
+find "$dirname" -name "${basename}.test.js" -o -name "${basename}.test.jsx"
+find "$dirname" -name "${basename}.spec.js" -o -name "${basename}.spec.jsx"
+
+# Find mock files  
+find "$dirname" -name "__mocks__/${basename}.js"
+find "$dirname" -name "${basename}.mock.js"
+```
+
+**Migration Requirement:** All discovered related files MUST be migrated together as one atomic unit.
+
+**Test File Creation:** If NO test files exist for the core file, CREATE a minimal test file using the following pattern:
+- Location: Same directory as core file
+- Name: `{basename}.test.ts` (e.g., `DebouncedMessageQueue.test.ts`)
+- Content: Basic test structure importing and testing the main functionality
+- Use proper TypeScript types in test file
+
+---
+
+## 🗺️ Type Reference Map
+
+### From `@superset-ui/core`
+```typescript
+// Data & Query
+QueryFormData, QueryData, JsonObject, AnnotationData, AdhocMetric
+LatestQueryFormData, GenericDataType, DatasourceType, ExtraFormData
+DataMaskStateWithId, NativeFilterScope, NativeFiltersState, NativeFilterTarget
+
+// UI & Theme  
+FeatureFlagMap, LanguagePack, ColorSchemeConfig, SequentialSchemeConfig
+```
+
+### From `@superset-ui/chart-controls`
+```typescript
+Dataset, ColumnMeta, ControlStateMapping
+```
+
+### From Local Types (`src/types/`)
+```typescript
+// Authentication
+User, UserWithPermissionsAndRoles, BootstrapUser, PermissionsAndRoles
+
+// Dashboard
+Dashboard, DashboardState, DashboardInfo, DashboardLayout, LayoutItem
+ComponentType, ChartConfiguration, ActiveFilters
+
+// Charts
+Chart, ChartState, ChartStatus, ChartLinkedDashboard, Slice, SaveActionType
+
+// Data
+Datasource, Database, Owner, Role
+
+// UI Components
+TagType, FavoriteStatus, Filter, ImportResourceName
+```
+
+### From Domain Types
+```typescript
+// src/dashboard/types.ts
+RootState, ChartsState, DatasourcesState, FilterBarOrientation
+ChartCrossFiltersConfig, ActiveTabs, MenuKeys
+
+// src/explore/types.ts  
+ExplorePageInitialData, ExplorePageState, ExploreResponsePayload, OptionSortType
+
+// src/SqlLab/types.ts
+[SQL Lab specific types]
+```
+
+---
+
+## 🏗️ Type Organization Strategy
+
+### Type Placement Hierarchy
+
+1. **Component-Colocated** (90% of cases)
+   ```typescript
+   // Same file as component
+   interface MyComponentProps {
+     title: string;
+     onClick: () => void;
+   }
+   ```
+
+2. **Feature-Shared**
+   ```typescript
+   // src/[domain]/components/[Feature]/types.ts
+   export interface FilterConfiguration {
+     filterId: string;
+     targets: NativeFilterTarget[];
+   }
+   ```
+
+3. **Domain-Wide**
+   ```typescript
+   // src/[domain]/types.ts
+   export interface ExploreFormData extends QueryFormData {
+     viz_type: string;
+   }
+   ```
+
+4. **Global**
+   ```typescript
+   // src/types/[TypeName].ts
+   export interface ApiResponse<T> {
+     result: T;
+     count?: number;
+   }
+   ```
+
+### Type Discovery Commands
+```bash
+# Search existing types before creating
+find superset-frontend/src -name "types.ts" -exec grep -l "[TypeConcept]" {} \;
+grep -r "interface.*Props\|type.*Props" superset-frontend/src/
+```
+
+### Derivative Component Patterns
+
+**Rule:** Components that extend others should extend their type interfaces.
+
+```typescript
+// ✅ Base component type
+interface SelectProps {
+  value: string | number;
+  options: SelectOption[];
+  onChange: (value: string | number) => void;
+  disabled?: boolean;
+}
+
+// ✅ Derivative extends base
+interface ChartSelectProps extends SelectProps {
+  charts: Chart[];
+  onChartSelect: (chart: Chart) => void;
+}
+
+// ✅ Derivative with modified props  
+interface DatabaseSelectProps extends Omit<SelectProps, 'value' | 'onChange'> {
+  value: number;  // Narrowed type
+  onChange: (databaseId: number) => void;  // Specific signature
+}
+```
+
+**Common Patterns:**
+- **Extension:** `extends BaseProps` - adds new props
+- **Omission:** `Omit<BaseProps, 'prop'>` - removes props
+- **Modification:** `Omit<BaseProps, 'prop'> & { prop: NewType }` - changes prop type
+- **Restriction:** Override with narrower types (union → specific)
+
+---
+
+## 📋 Migration Recipe
+
+### Step 2: File Conversion
+```bash
+# Use git mv to preserve history
+git mv component.js component.ts
+git mv Component.jsx Component.tsx
+```
+
+### Step 3: Import & Type Setup
+```typescript
+// Import order (enforced by linting)
+import { FC, ReactNode } from 'react';
+import { JsonObject, QueryFormData } from '@superset-ui/core';
+import { Dataset } from '@superset-ui/chart-controls';
+import type { Dashboard } from 'src/types/Dashboard';
+```
+
+### Step 4: Function & Component Typing
+```typescript
+// Functions with proper parameter/return types
+export function processData(
+  data: Dataset[],
+  config: JsonObject
+): ProcessedData[] {
+  // implementation
+}
+
+// Component props with inheritance
+interface ComponentProps extends BaseProps {
+  data: Chart[];
+  onSelect: (id: number) => void;
+}
+
+const Component: FC<ComponentProps> = ({ data, onSelect }) => {
+  // implementation
+};
+```
+
+### Step 5: State & Redux Typing
+```typescript
+// Hooks with specific types
+const [data, setData] = useState<Chart[]>([]);
+const [selected, setSelected] = useState<number | null>(null);
+
+// Redux with existing RootState
+const mapStateToProps = (state: RootState) => ({
+  charts: state.charts,
+  user: state.user,
+});
+```
+
+---
+
+## 🧠 Type Debugging Strategies (Real-World Learnings)
+
+### The Evolution of Type Approaches
+When you hit type errors, follow this debugging evolution:
+
+#### 1. ❌ Idealized Union Types (First Attempt)
+```typescript
+// Looks clean but doesn't match reality
+type DatasourceInput = Datasource | QueryEditor;
+```
+**Problem**: Real calling sites pass variations, not exact types.
+
+#### 2. ❌ Overly Precise Types (Second Attempt)
+```typescript
+// Tried to match exact calling signatures
+type DatasourceInput =
+  | IDatasource  // From DatasourcePanel
+  | (QueryEditor & { columns: ColumnMeta[] });  // From SaveQuery
+```
+**Problem**: Too rigid, doesn't handle legacy variations.
+
+#### 3. ✅ Flexible Interface (Final Solution)
+```typescript
+// Captures what the function actually needs
+interface DatasourceInput {
+  name?: string | null;  // Allow null for compatibility
+  datasource_name?: string | null;  // Legacy variations
+  columns?: any[];  // Multiple column types accepted
+  database?: { id?: number };
+  // ... other optional properties
+}
+```
+**Success**: Works with all calling sites, focuses on function needs.
+
+### Type Debugging Process
+1. **Start with compilation errors** - they show exact mismatches
+2. **Examine actual usage** - look at calling sites, not idealized types  
+3. **Build flexible interfaces** - capture what functions need, not rigid contracts
+4. **Iterate based on downstream validation** - let calling sites guide your types
+
+---
+
+## 🚨 Anti-Patterns to Avoid
+
+```typescript
+// ❌ Never use any
+const obj: any = {};
+
+// ✅ Use proper types
+const obj: Record<string, JsonObject> = {};
+
+// ❌ Don't recreate base component props
+interface ChartSelectProps {
+  value: string;     // Duplicated from SelectProps
+  onChange: () => void;  // Duplicated from SelectProps
+  charts: Chart[];   // New prop
+}
+
+// ✅ Inherit and extend
+interface ChartSelectProps extends SelectProps {
+  charts: Chart[];   // Only new props
+}
+
+// ❌ Don't create ad-hoc type variations
+interface UserInfo {
+  name: string;
+  email: string;
+}
+
+// ✅ Extend existing types (DRY principle)
+import { User } from 'src/types/bootstrapTypes';
+type UserDisplayInfo = Pick<User, 'firstName' | 'lastName' | 'email'>;
+
+// ❌ Don't create overly rigid unions
+type StrictInput = ExactTypeA | ExactTypeB;
+
+// ✅ Create flexible interfaces for function parameters
+interface FlexibleInput {
+  // Focus on what the function actually needs
+  commonProperty: string;
+  optionalVariations?: any;  // Allow for legacy variations
+}
+```
+
+## 📍 DRY Type Guidelines (WHERE TYPES BELONG)
+
+### Type Placement Rules
+**CRITICAL**: Type variations must live close to where they belong, not scattered across files.
+
+#### ✅ Proper Type Organization
+```typescript
+// ❌ Don't create one-off interfaces in utility files
+// src/utils/datasourceUtils.ts
+interface DatasourceInput { /* custom interface */ }  // Wrong!
+
+// ✅ Use existing types or extend them in their proper domain
+// src/utils/datasourceUtils.ts
+import { IDatasource } from 'src/explore/components/DatasourcePanel';
+import { QueryEditor } from 'src/SqlLab/types';
+
+// Create flexible interface that references existing types
+interface FlexibleDatasourceInput {
+  // Properties that actually exist across variations
+}
+```
+
+#### Type Location Hierarchy
+1. **Domain Types**: `src/{domain}/types.ts` (dashboard, explore, SqlLab)
+2. **Component Types**: Co-located with components  
+3. **Global Types**: `src/types/` directory
+4. **Utility Types**: Only when they truly don't belong elsewhere
+
+#### ✅ DRY Type Patterns
+```typescript
+// ✅ Extend existing domain types
+interface SaveQueryData extends Pick<QueryEditor, 'sql' | 'dbId' | 'catalog'> {
+  columns: ColumnMeta[];  // Add what's needed
+}
+
+// ✅ Create flexible interfaces for cross-domain utilities
+interface CrossDomainInput {
+  // Common properties that exist across different source types
+  name?: string | null;  // Accommodate legacy null values
+  // Only include properties the function actually uses
+}
+```
+
+---
+
+## 🎯 PropTypes Auto-Generation (Elegant Approach)
+
+**IMPORTANT**: Superset has `babel-plugin-typescript-to-proptypes` configured to automatically generate PropTypes from TypeScript interfaces. Use this instead of manual PropTypes duplication!
+
+### ❌ Manual PropTypes Duplication (Avoid This)
+```typescript
+export interface MyComponentProps {
+  title: string;
+  count?: number;
+}
+
+// 8+ lines of manual PropTypes duplication 😱
+const propTypes = PropTypes.shape({
+  title: PropTypes.string.isRequired,
+  count: PropTypes.number,
+});
+
+export default propTypes;
+```
+
+### ✅ Auto-Generated PropTypes (Use This)
+```typescript
+import { InferProps } from 'prop-types';
+
+export interface MyComponentProps {
+  title: string;
+  count?: number;
+}
+
+// Single validator function - babel plugin auto-generates PropTypes! ✨
+export default function MyComponentValidator(props: MyComponentProps) {
+  return null; // PropTypes auto-assigned by babel-plugin-typescript-to-proptypes
+}
+
+// Optional: For consumers needing PropTypes type inference
+export type MyComponentPropsInferred = InferProps<typeof MyComponentValidator>;
+```
+
+### Migration Pattern for Type-Only Files
+
+**When migrating type-only files with manual PropTypes:**
+
+1. **Keep the TypeScript interfaces** (single source of truth)
+2. **Replace manual PropTypes** with validator function
+3. **Remove PropTypes imports** and manual shape definitions
+4. **Add InferProps import** if type inference needed
+
+**Example Migration:**
+```typescript
+// Before: 25+ lines with manual PropTypes duplication
+export interface AdhocFilterType { /* ... */ }
+const adhocFilterTypePropTypes = PropTypes.oneOfType([...]);
+
+// After: 3 lines with auto-generation
+export interface AdhocFilterType { /* ... */ }
+export default function AdhocFilterValidator(props: { filter: AdhocFilterType }) {
+  return null; // Auto-generated PropTypes by babel plugin
+}
+```
+
+### Component PropTypes Pattern
+
+**For React components, the babel plugin works automatically:**
+
+```typescript
+interface ComponentProps {
+  title: string;
+  onClick: () => void;
+}
+
+const MyComponent: FC<ComponentProps> = ({ title, onClick }) => {
+  // Component implementation
+};
+
+// PropTypes automatically generated by babel plugin - no manual work needed!
+export default MyComponent;
+```
+
+### Auto-Generation Benefits
+
+- ✅ **Single source of truth**: TypeScript interfaces drive PropTypes
+- ✅ **No duplication**: Eliminate 15-20 lines of manual PropTypes code
+- ✅ **Automatic updates**: Changes to TypeScript automatically update PropTypes
+- ✅ **Type safety**: Compile-time checking ensures PropTypes match interfaces
+- ✅ **Backward compatibility**: Existing JavaScript components continue working
+
+### Babel Plugin Configuration
+
+The plugin is already configured in `babel.config.js`:
+```javascript
+['babel-plugin-typescript-to-proptypes', { loose: true }]
+```
+
+**No additional setup required** - just use TypeScript interfaces and the plugin handles the rest!
+
+---
+
+## 🧪 Test File Migration Patterns
+
+### Test File Priority
+- **Always migrate test files** alongside production files
+- **Test files are often leaf nodes** - good starting candidates
+- **Create tests if missing** - Leverage new TypeScript types for better test coverage
+
+### Test-Specific Type Patterns
+```typescript
+// Mock interfaces for testing
+interface MockStore {
+  getState: () => Partial<RootState>;  // Partial allows minimal mocking
+}
+
+// Type-safe mocking for complex objects
+const mockDashboardInfo: Partial<DashboardInfo> as DashboardInfo = {
+  id: 123,
+  json_metadata: '{}',
+};
+
+// Sinon stub typing
+let postStub: sinon.SinonStub;
+beforeEach(() => {
+  postStub = sinon.stub(SupersetClient, 'post');
+});
+
+// Use stub reference instead of original method
+expect(postStub.callCount).toBe(1);
+expect(postStub.getCall(0).args[0].endpoint).toMatch('/api/');
+```
+
+### Test Migration Recipe
+1. **Migrate production file first** (if both need migration)
+2. **Update test imports** to point to `.ts/.tsx` files
+3. **Add proper mock typing** using `Partial<T> as T` pattern
+4. **Fix stub typing** - Use stub references, not original methods
+5. **Verify all tests pass** with TypeScript compilation
+
+---
+
+## 🔧 Type Conflict Resolution
+
+### Multiple Type Definitions Issue
+**Problem**: Same type name defined in multiple files causes compilation errors.
+
+**Example**: `DashboardInfo` defined in both:
+- `src/dashboard/reducers/types.ts` (minimal)
+- `src/dashboard/components/Header/types.ts` (different shape)  
+- `src/dashboard/types.ts` (complete - used by RootState)
+
+### Resolution Strategy
+1. **Identify the authoritative type**:
+   ```bash
+   # Find which type is used by RootState/main interfaces
+   grep -r "DashboardInfo" src/dashboard/types.ts
+   ```
+
+2. **Use import from authoritative source**:
+   ```typescript
+   // ✅ Import from main domain types
+   import { RootState, DashboardInfo } from 'src/dashboard/types';
+
+   // ❌ Don't import from component-specific files
+   import { DashboardInfo } from 'src/dashboard/components/Header/types';
+   ```
+
+3. **Mock complex types in tests**:
+   ```typescript
+   // For testing - provide minimal required fields
+   const mockInfo: Partial<DashboardInfo> as DashboardInfo = {
+     id: 123,
+     json_metadata: '{}',
+     // Only provide fields actually used in test
+   };
+   ```
+
+### Type Hierarchy Discovery Commands
+```bash
+# Find all definitions of a type
+grep -r "interface.*TypeName\|type.*TypeName" src/
+
+# Find import usage patterns
+grep -r "import.*TypeName" src/
+
+# Check what RootState uses
+grep -A 10 -B 10 "TypeName" src/*/types.ts
+```
+
+---
+
+## Agent Constraints (CRITICAL)
+
+1. **Use git mv** - Run `git mv file.js file.ts` to preserve git history, but NO `git commit`
+2. **NO global import changes** - Don't update imports across codebase
+3. **Type files OK** - Can modify existing type files to improve/align types
+4. **Single-File TypeScript Validation** (CRITICAL) - tsc has known issues with multi-file compilation:
+   - **Core Issue**: TypeScript's `tsc` has documented problems validating multiple files simultaneously in complex projects
+   - **Solution**: ALWAYS validate files one at a time using individual `tsc` calls
+   - **Command Pattern**: `cd superset-frontend && npx tscw --noEmit --allowJs --composite false --project tsconfig.json {single-file-path}`
+   - **Why**: Multi-file validation can produce false positives, miss real errors, and conflict during parallel agent execution
+5. **Downstream Impact Validation** (CRITICAL) - Your migration affects calling sites:
+   - **Find downstream files**: `find superset-frontend/src -name "*.tsx" -o -name "*.ts" | xargs grep -l "your-core-filename" 2>/dev/null || echo "No files found"`
+   - **Validate each downstream file individually**: `cd superset-frontend && npx tscw --noEmit --allowJs --composite false --project tsconfig.json {each-downstream-file}`
+   - **Fix type mismatches** you introduced in calling sites
+   - **NEVER ignore downstream errors** - they indicate your types don't match reality
+6. **Avoid Project-Wide Validation During Migration**:
+   - **NEVER use `npm run type`** during parallel agent execution - produces unreliable results
+   - **Single-file validation is authoritative** - trust individual file checks over project-wide scans
+6. **ESLint validation** - Run `npm run eslint -- --fix {file}` for each migrated file to auto-fix formatting/linting issues
+6. Zero `any` types - use proper TypeScript types
+7. Search existing types before creating new ones
+8. Follow patterns from this guide
+
+---
+
+## Success Report Format
+
+```
+SUCCESS: Atomic Migration of {core-filename}
+
+## Files Migrated (Atomic Unit)
+- Core: {core-filename} → {core-filename.ts/tsx}
+- Tests: {list-of-test-files} → {list-of-test-files.ts/tsx} OR "CREATED: {basename}.test.ts"
+- Mocks: {list-of-mock-files} → {list-of-mock-files.ts}
+- Type files modified: {list-of-type-files}
+
+## Types Created/Improved
+- {TypeName}: {location} ({scope}) - {rationale}
+- {ExistingType}: enhanced in {location} - {improvement-description}
+
+## Documentation Recommendations  
+- ADD_TO_DIRECTORY: {TypeName} - {reason}
+- NO_DOCUMENTATION: {TypeName} - {reason}
+
+## Quality Validation
+- **Single-File TypeScript Validation**: ✅ PASS - Core files individually validated
+  - Core file: `npx tscw --noEmit --allowJs --composite false --project tsconfig.json {core-file}`
+  - Test files: `npx tscw --noEmit --allowJs --composite false --project tsconfig.json {test-file}` (if exists)
+- **Downstream Impact Check**: ✅ PASS - Found {N} files importing this module, all validate individually
+  - Downstream files: {list-of-files-that-import-your-module}
+  - Individual validation: `npx tscw --noEmit --allowJs --composite false --project tsconfig.json {each-downstream-file}`
+- **ESLint validation**: ✅ PASS (using `npm run eslint -- --fix {files}` to auto-fix formatting)
+- **Zero any types**: ✅ PASS
+- **Local imports resolved**: ✅ PASS  
+- **Functionality preserved**: ✅ PASS
+- **Tests pass** (if test file): ✅ PASS
+- **Follow-up action required**: {YES/NO}
+
+## Validation Strategy Notes
+- **Single-file approach used**: Avoided multi-file tsc validation due to known TypeScript compilation issues
+- **Project-wide validation skipped**: `npm run type` not used during parallel migration to prevent false positives
+
+## Migration Learnings
+- Type conflicts encountered: {describe any multiple type definitions}
+- Mock patterns used: {describe test mocking approaches}
+- Import hierarchy decisions: {note authoritative type sources used}
+- PropTypes strategy: {AUTO_GENERATED via babel plugin | MANUAL_DUPLICATION_REMOVED | N/A}
+
+## Improvement Suggestions for Documentation
+- AGENT.md enhancement: {suggest additions to migration guide}
+- Common pattern identified: {note reusable patterns for future migrations}
+```
+
+---
+
+## Dependency Block Report Format
+
+```
+DEPENDENCY_BLOCK: Cannot migrate {filename}
+
+## Blocking Dependencies
+- {path}: {type} - {usage} - {priority}
+
+## Impact Analysis
+- Estimated types: {number}
+- Expected locations: {list}
+- Cross-domain: {YES/NO}
+
+## Recommended Order
+{ordered-list}
+```
+
+---
+
+## 📚 Quick Reference
+
+**Type Utilities:**
+- `Record<K, V>` - Object with specific key/value types
+- `Partial<T>` - All properties optional
+- `Pick<T, K>` - Subset of properties
+- `Omit<T, K>` - Exclude specific properties
+- `NonNullable<T>` - Exclude null/undefined
+
+**Event Types:**
+- `MouseEvent<HTMLButtonElement>`
+- `ChangeEvent<HTMLInputElement>`
+- `FormEvent<HTMLFormElement>`
+
+**React Types:**
+- `FC<Props>` - Functional component
+- `ReactNode` - Any renderable content
+- `CSSProperties` - Style objects
+
+---
+
+**Remember:** Every type should add value and clarity. The goal is meaningful type safety that catches bugs and improves developer experience.

.claude/projects/js-to-ts/COORDINATOR.md

@@ -0,0 +1,199 @@
+# JS-to-TS Coordinator Workflow
+
+**Role:** Strategic migration coordination - select leaf-node files, trigger agents, review results, handle integration, manage dependencies.
+
+---
+
+## 1. Core File Selection Strategy
+
+**Target ONLY Core Files**: Coordinators identify core files (production code), agents handle related tests/mocks atomically.
+
+**File Analysis Commands**:
+```bash
+# Find CORE files with no JS/JSX dependencies (exclude tests/mocks) - SIZE PRIORITIZED
+find superset-frontend/src -name "*.js" -o -name "*.jsx" | grep -v "test\|spec\|mock" | xargs wc -l | sort -n | head -20
+
+# Alternative: Get file sizes in lines with paths
+find superset-frontend/src -name "*.js" -o -name "*.jsx" | grep -v "test\|spec\|mock" | while read file; do
+  lines=$(wc -l < "$file")
+  echo "$lines $file"
+done | sort -n | head -20
+
+# Check dependencies for core files only (start with smallest)
+for file in <core-files-sorted-by-size>; do
+  echo "=== $file ($(wc -l < "$file") lines) ==="
+  grep -E "from '\.\./.*\.jsx?'|from '\./.*\.jsx?'|from 'src/.*\.jsx?'" "$file" || echo "✅ LEAF CANDIDATE"
+done
+
+# Identify heavily imported files (migrate last)  
+grep -r "from.*utils/common" superset-frontend/src/ | wc -l
+
+# Quick leaf analysis with size priority
+find superset-frontend/src -name "*.js" -o -name "*.jsx" | grep -v "test\|spec\|mock" | head -30 | while read file; do
+  deps=$(grep -E "from '\.\./.*\.jsx?'|from '\./.*\.jsx?'|from 'src/.*\.jsx?'" "$file" | wc -l)
+  lines=$(wc -l < "$file")
+  if [ "$deps" -eq 0 ]; then
+    echo "✅ LEAF: $lines lines - $file"
+  fi
+done | sort -n
+```
+
+**Priority Order** (Smallest files first for easier wins):
+1. **Small leaf files** (<50 lines) - No JS/JSX imports, quick TypeScript conversion
+2. **Medium leaf files** (50-200 lines) - Self-contained utilities and helpers  
+3. **Small dependency files** (<100 lines) - Import only already-migrated files
+4. **Larger components** (200+ lines) - Complex but well-contained functionality
+5. **Core foundational files** (utils/common.js, controls.jsx) - migrate last regardless of size
+
+**Size-First Benefits**:
+- Faster completion builds momentum
+- Earlier validation of migration patterns
+- Easier rollback if issues arise
+- Better success rate for agent learning
+
+**Migration Unit**: Each agent call migrates:
+- 1 core file (primary target)
+- All related `*.test.js/jsx` files
+- All related `*.mock.js` files  
+- All related `__mocks__/` files
+
+---
+
+## 2. Task Creation & Agent Control
+
+### Task Triggering
+When triggering the `/js-to-ts` command:
+- **Task Title**: Use the core filename as the task title (e.g., "DebouncedMessageQueue.js migration", "hostNamesConfig.js migration")
+- **Task Description**: Include the full relative path to help agent locate the file
+- **Reference**: Point agent to [AGENT.md](./AGENT.md) for technical instructions
+
+### Post-Processing Workflow
+After each agent completes:
+
+1. **Review Agent Report**: Always read and analyze the complete agent report
+2. **Share Summary**: Provide user with key highlights from agent's work:
+   - Files migrated (core + tests/mocks)
+   - Types created or improved
+   - Any validation issues or coordinator actions needed
+3. **Quality Assessment**: Evaluate agent's TypeScript implementation against criteria:
+   - ✅ **Type Usage**: Proper types used, no `any` types
+   - ✅ **Type Filing**: Types placed in correct hierarchy (component → feature → domain → global)
+   - ✅ **Side Effects**: No unintended changes to other files
+   - ✅ **Import Alignment**: Proper .ts/.tsx import extensions
+4. **Integration Decision**:
+   - **COMMIT**: If agent work is complete and high quality
+   - **FIX & COMMIT**: If minor issues need coordinator fixes
+   - **ROLLBACK**: If major issues require complete rework
+5. **Next Action**: Ask user preference - commit this work or trigger next migration
+
+---
+
+## 3. Integration Decision Framework
+
+**Automatic Integration** ✅:
+- `npm run type` passes without errors
+- Agent created clean TypeScript with proper types
+- Types appropriately filed in hierarchy
+
+**Coordinator Integration** (Fix Side-Effects) 🔧:
+- `npm run type` fails BUT agent's work is high quality
+- Good type usage, proper patterns, well-organized
+- Side-effects are manageable TypeScript compilation errors
+- **Coordinator Action**: Integrate the change, then fix global compilation issues
+
+**Rollback Only** ❌:
+- Agent introduced `any` types or poor type choices
+- Types poorly organized or conflicting with existing patterns
+- Fundamental approach issues requiring complete rework
+
+**Integration Process**:
+1. **Review**: Agent already used `git mv` to preserve history
+2. **Fix Side-Effects**: Update dependent files with proper import extensions
+3. **Resolve Types**: Fix any cascading type issues across codebase
+4. **Validate**: Ensure `npm run type` passes after fixes
+
+---
+
+## 4. Common Integration Patterns
+
+**Common Side-Effects (Expect These)**:
+- **Type import conflicts**: Multiple definitions of same type name
+- **Mock object typing**: Tests need complete type satisfaction
+- **Stub method references**: Use stub vars instead of original methods
+
+**Coordinator Fixes (Standard Process)**:
+1. **Import Resolution**:
+   ```bash
+   # Find authoritative type source
+   grep -r "TypeName" src/*/types.ts
+   # Import from domain types (src/dashboard/types.ts) not component types
+   ```
+
+2. **Test Mock Completion**:
+   ```typescript
+   // Use Partial<T> as T pattern for minimal mocking
+   const mockDashboard: Partial<DashboardInfo> as DashboardInfo = {
+     id: 123,
+     json_metadata: '{}',
+   };
+   ```
+
+3. **Stub Reference Fixes**:
+   ```typescript
+   // ✅ Use stub variable
+   expect(postStub.callCount).toBe(1);
+   // ❌ Don't use original method
+   expect(SupersetClient.post.callCount).toBe(1);
+   ```
+
+4. **Validation Commands**:
+   ```bash
+   npm run type          # TypeScript compilation
+   npm test -- filename  # Test functionality
+   git status           # Should show rename, not add/delete
+   ```
+
+---
+
+## 5. File Categories for Planning
+
+### Leaf Files (Start Here)
+**Self-contained files with minimal JS/JSX dependencies**:
+- Test files (80 files) - Usually only import the file being tested
+- Utility files without internal dependencies
+- Components importing only external libraries
+
+### Heavily Imported Files (Migrate Last)
+**Core files that many others depend on**:
+- `utils/common.js` - Core utility functions
+- `utils/reducerUtils.js` - Redux helpers  
+- `@superset-ui/core` equivalent files
+- Major state management files (`explore/store.js`, `dashboard/actions/`)
+
+### Complex Components (Middle Priority)  
+**Large files requiring careful type analysis**:
+- `components/Datasource/DatasourceEditor.jsx` (1,809 lines)
+- `explore/components/controls/AnnotationLayerControl/AnnotationLayer.jsx` (1,031 lines)
+- `explore/components/ExploreViewContainer/index.jsx` (911 lines)
+
+---
+
+## 6. Success Metrics & Continuous Improvement
+
+**Per-File Gates**:
+- ✅ `npm run type` passes after each migration
+- ✅ Zero `any` types introduced
+- ✅ All imports properly typed
+- ✅ Types filed in correct hierarchy
+
+**Linear Scheduling**:
+When agents report `DEPENDENCY_BLOCK`:
+- Queue dependencies in linear order
+- Process one file at a time to avoid conflicts
+- Handle cascading type changes between files
+
+**After Each Migration**:
+1. **Update guides** with new patterns discovered
+2. **Document coordinator fixes** that become common
+3. **Enhance agent instructions** based on recurring issues
+4. **Track success metrics** - automatic vs coordinator integration rates

.claude/projects/js-to-ts/PROJECT.md

@@ -0,0 +1,76 @@
+# JavaScript to TypeScript Migration Project
+
+Progressive migration of 219 JS/JSX files to TypeScript in Apache Superset frontend.
+
+## 📁 Project Documentation
+
+- **[AGENT.md](./AGENT.md)** - Complete technical migration guide for agents (includes type reference, patterns, validation)
+- **[COORDINATOR.md](./COORDINATOR.md)** - Strategic workflow for coordinators (file selection, task management, integration)
+
+## 🎯 Quick Start
+
+**For Agents:** Read [AGENT.md](./AGENT.md) for complete migration instructions
+**For Coordinators:** Read [COORDINATOR.md](./COORDINATOR.md) for workflow and [AGENT.md](./AGENT.md) for supervision
+
+**Command:** `/js-to-ts <filename>` - See [../../commands/js-to-ts.md](../../commands/js-to-ts.md)
+
+## 📊 Migration Progress
+
+**Scope**: 219 files total (112 JS + 107 JSX)
+- Production files: 139 (63%)  
+- Test files: 80 (37%)
+
+**Strategy**: Leaf-first migration with dependency-aware coordination
+
+### Completed Migrations ✅
+
+1. **roundDecimal** - `plugins/legacy-plugin-chart-map-box/src/utils/roundDecimal.js`
+   - Migrated core + test files
+   - Added proper TypeScript function signature with optional precision parameter
+   - All tests pass
+
+2. **timeGrainSqlaAnimationOverrides** - `src/explore/controlPanels/timeGrainSqlaAnimationOverrides.js`
+   - Migrated to TypeScript with ControlPanelState and Dataset types
+   - Added TimeGrainOverrideState interface for return type
+   - Used type guards for safe property access
+
+3. **DebouncedMessageQueue** - `src/utils/DebouncedMessageQueue.js`
+   - Migrated to TypeScript with proper generics
+   - Created DebouncedMessageQueueOptions interface
+   - **CREATED test file** with 4 comprehensive test cases
+   - Excellent class property typing with private/readonly modifiers
+
+**Files Migrated**: 3/219 (1.4%)
+**Tests Created**: 2 (roundDecimal had existing, DebouncedMessageQueue created)
+
+### Next Candidates (Leaf Nodes) 🎯
+
+**Identified leaf files with no JS/JSX dependencies:**
+- `src/utils/hostNamesConfig.js` - Domain configuration utility
+- `src/explore/controlPanels/Separator.js` - Control panel configuration  
+- `src/middleware/loggerMiddleware.js` - Logging middleware
+
+**Migration Quality**: All completed migrations have:
+- ✅ Zero `any` types
+- ✅ Proper TypeScript compilation
+- ✅ ESLint validation passed
+- ✅ Test coverage (created where missing)
+
+---
+
+## 📈 Success Metrics
+
+**Per-File Gates**:
+- ✅ `npm run type` passes after each migration
+- ✅ Zero `any` types introduced  
+- ✅ All imports properly typed
+- ✅ Types filed in correct hierarchy
+
+**Overall Progress**:
+- **Automatic Integration Rate**: 100% (3/3 migrations required no coordinator fixes)
+- **Test Coverage**: Improved (1 new test file created)
+- **Type Safety**: Enhanced with proper interfaces and generics
+
+---
+
+*This is a claudette-managed progressive refactor. All documentation and coordination resources are organized under `.claude/projects/js-to-ts/`*

.coveragerc

@@ -0,0 +1,36 @@
+# .coveragerc to control coverage.py
+[run]
+branch = True
+source = superset
+# omit = bad_file.py
+
+[paths]
+source =
+    superset/
+    */site-packages/
+
+[report]
+# Regexes for lines to exclude from consideration
+exclude_lines =
+    # Have to re-enable the standard pragma
+    pragma: no cover
+
+    # Don't complain about missing debug-only code:
+    def __repr__
+    if self\.debug
+
+    # Don't complain if tests don't hit defensive assertion code:
+    raise AssertionError
+    raise NotImplementedError
+
+    # Don't complain if non-runnable code isn't run:
+    if 0:
+    if __name__ == .__main__.:
+
+    # Ignore importlib backport
+    from importlib
+
+    if TYPE_CHECKING:
+
+#fail_under = 100
+show_missing = True

.cursor/rules/dev-standard.mdc

@@ -0,0 +1,125 @@
+---
+description: Apache Superset development standards and guidelines for Cursor IDE
+globs: ["**/*.py", "**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx", "**/*.sql", "**/*.md"]
+alwaysApply: true
+---
+
+# Apache Superset Development Standards for Cursor IDE
+
+Apache Superset is a data visualization platform with Flask/Python backend and React/TypeScript frontend.
+
+## ⚠️ CRITICAL: Ongoing Refactors (What NOT to Do)
+
+**These migrations are actively happening - avoid deprecated patterns:**
+
+### Frontend Modernization
+- **NO `any` types** - Use proper TypeScript types
+- **NO JavaScript files** - Convert to TypeScript (.ts/.tsx)
+- **NO Enzyme** - Use React Testing Library/Jest (Enzyme fully removed)
+- **Use @superset-ui/core** - Don't import Ant Design directly
+
+### Testing Strategy Migration
+- **Prefer unit tests** over integration tests
+- **Prefer integration tests** over Cypress end-to-end tests
+- **Cypress is last resort** - Actively moving away from Cypress
+- **Use Jest + React Testing Library** for component testing
+
+### Backend Type Safety
+- **Add type hints** - All new Python code needs proper typing
+- **MyPy compliance** - Run `pre-commit run mypy` to validate
+- **SQLAlchemy typing** - Use proper model annotations
+
+## Code Standards
+
+### TypeScript Frontend
+- **NO `any` types** - Use proper TypeScript
+- **Functional components** with hooks
+- **@superset-ui/core** for UI components (not direct antd)
+- **Jest** for testing (NO Enzyme)
+- **Redux** for global state, hooks for local
+
+### Python Backend
+- **Type hints required** for all new code
+- **MyPy compliant** - run `pre-commit run mypy`
+- **SQLAlchemy models** with proper typing
+- **pytest** for testing
+
+### Apache License Headers
+- **New files require ASF license headers** - When creating new code files, include the standard Apache Software Foundation license header
+- **LLM instruction files are excluded** - Files like LLMS.md, CLAUDE.md, etc. are in `.rat-excludes` to avoid header token overhead
+
+## Key Directory Structure
+
+```
+superset/
+├── superset/                    # Python backend (Flask, SQLAlchemy)
+│   ├── views/api/              # REST API endpoints
+│   ├── models/                 # Database models
+│   └── connectors/             # Database connections
+├── superset-frontend/src/       # React TypeScript frontend
+│   ├── components/             # Reusable components
+│   ├── explore/                # Chart builder
+│   ├── dashboard/              # Dashboard interface
+│   └── SqlLab/                 # SQL editor
+├── superset-frontend/packages/
+│   └── superset-ui-core/       # UI component library (USE THIS)
+├── tests/                      # Python/integration tests
+├── docs/                       # Documentation (UPDATE FOR CHANGES)
+└── UPDATING.md                 # Breaking changes log
+```
+
+## Architecture Patterns
+
+### Dataset-Centric Approach
+Charts built from enriched datasets containing:
+- Dimension columns with labels/descriptions
+- Predefined metrics as SQL expressions
+- Self-service analytics within defined contexts
+
+### Security & Features
+- **RBAC**: Role-based access via Flask-AppBuilder
+- **Feature flags**: Control feature rollouts
+- **Row-level security**: SQL-based data access control
+
+## Test Utilities
+
+### Python Test Helpers
+- **`SupersetTestCase`** - Base class in `tests/integration_tests/base_tests.py`
+- **`@with_config`** - Config mocking decorator
+- **`@with_feature_flags`** - Feature flag testing
+- **`login_as()`, `login_as_admin()`** - Authentication helpers
+- **`create_dashboard()`, `create_slice()`** - Data setup utilities
+
+### TypeScript Test Helpers
+- **`superset-frontend/spec/helpers/testing-library.tsx`** - Custom render() with providers
+- **`createWrapper()`** - Redux/Router/Theme wrapper
+- **`selectOption()`** - Select component helper
+- **React Testing Library** - NO Enzyme (removed)
+
+## Pre-commit Validation
+
+**Use pre-commit hooks for quality validation:**
+
+```bash
+# Install hooks
+pre-commit install
+
+# Quick validation (faster than --all-files)
+pre-commit run                    # Staged files only
+pre-commit run mypy              # Python type checking
+pre-commit run prettier          # Code formatting
+pre-commit run eslint            # Frontend linting
+```
+
+## Development Guidelines
+
+- **Documentation**: Update docs/ for any user-facing changes
+- **Breaking Changes**: Add to UPDATING.md
+- **Docstrings**: Required for new functions/classes
+- **Follow existing patterns**: Mimic code style, use existing libraries and utilities
+- **Type Safety**: This codebase is actively modernizing toward full TypeScript and type safety
+- **Always run `pre-commit run`** to validate changes before committing
+
+---
+
+**Note**: This codebase is actively modernizing toward full TypeScript and type safety. Always run `pre-commit run` to validate changes. Follow the ongoing refactors section to avoid deprecated patterns.

.devcontainer/Dockerfile

@@ -0,0 +1,20 @@
+# Keep this in sync with the base image in the main Dockerfile (ARG PY_VER)
+FROM python:3.11.13-trixie AS base
+
+# Install system dependencies that Superset needs
+# This layer will be cached across Codespace sessions
+RUN apt-get update && apt-get install -y \
+    libsasl2-dev \
+    libldap2-dev \
+    libpq-dev \
+    tmux \
+    gh \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install uv for fast Python package management
+# This will also be cached in the image
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
+    echo 'export PATH="/root/.cargo/bin:$PATH"' >> /etc/bash.bashrc
+
+# Set the cargo/bin directory in PATH for all users
+ENV PATH="/root/.cargo/bin:${PATH}"

.devcontainer/README.md

@@ -0,0 +1,16 @@
+# Superset Development with GitHub Codespaces
+
+For complete documentation on using GitHub Codespaces with Apache Superset, please see:
+
+**[Setting up a Development Environment - GitHub Codespaces](https://superset.apache.org/docs/contributing/development#github-codespaces-cloud-development)**
+
+## Pre-installed Development Environment
+
+When you create a new Codespace from this repository, it automatically:
+
+1. **Creates a Python virtual environment** using `uv venv`
+2. **Installs all development dependencies** via `uv pip install -r requirements/development.txt`
+3. **Sets up pre-commit hooks** with `pre-commit install`
+4. **Activates the virtual environment** automatically in all terminals
+
+The virtual environment is located at `/workspaces/{repository-name}/.venv` and is automatically activated through environment variables set in the devcontainer configuration.

.devcontainer/bashrc-additions

@@ -0,0 +1,62 @@
+# Superset Codespaces environment setup
+# This file is appended to ~/.bashrc during Codespace setup
+
+# Find the workspace directory (handles both 'superset' and 'superset-2' names)
+WORKSPACE_DIR=$(find /workspaces -maxdepth 1 -name "superset*" -type d | head -1)
+
+if [ -n "$WORKSPACE_DIR" ]; then
+    # Check if virtual environment exists
+    if [ -d "$WORKSPACE_DIR/.venv" ]; then
+        # Activate the virtual environment
+        source "$WORKSPACE_DIR/.venv/bin/activate"
+        echo "✅ Python virtual environment activated"
+
+        # Verify pre-commit is installed and set up
+        if command -v pre-commit &> /dev/null; then
+            echo "✅ pre-commit is available ($(pre-commit --version))"
+            # Install git hooks if not already installed
+            if [ -d "$WORKSPACE_DIR/.git" ] && [ ! -f "$WORKSPACE_DIR/.git/hooks/pre-commit" ]; then
+                echo "🪝 Installing pre-commit hooks..."
+                cd "$WORKSPACE_DIR" && pre-commit install
+            fi
+        else
+            echo "⚠️  pre-commit not found. Run: pip install pre-commit"
+        fi
+    else
+        echo "⚠️  Python virtual environment not found at $WORKSPACE_DIR/.venv"
+        echo "   Run: cd $WORKSPACE_DIR && .devcontainer/setup-dev.sh"
+    fi
+
+    # Always cd to the workspace directory for convenience
+    cd "$WORKSPACE_DIR"
+fi
+
+# Add helpful aliases for Superset development
+alias start-superset="$WORKSPACE_DIR/.devcontainer/start-superset.sh"
+alias setup-dev="$WORKSPACE_DIR/.devcontainer/setup-dev.sh"
+
+# Show helpful message on login
+echo ""
+echo "🚀 Superset Codespaces Environment"
+echo "=================================="
+
+# Check if Superset is running
+if docker ps 2>/dev/null | grep -q "superset"; then
+    echo "✅ Superset is running!"
+    echo "   - Check the 'Ports' tab for your live Superset URL"
+    echo "   - Initial startup takes 10-20 minutes"
+    echo "   - Login: admin/admin"
+else
+    echo "⚠️  Superset is not running. Use: start-superset"
+    # Check if there's a startup log
+    if [ -f "/tmp/superset-startup.log" ]; then
+        echo "   📋 Startup log found: cat /tmp/superset-startup.log"
+    fi
+fi
+
+echo ""
+echo "Quick commands:"
+echo "  start-superset - Start Superset with Docker Compose"
+echo "  setup-dev      - Set up Python environment (if not already done)"
+echo "  pre-commit run - Run pre-commit checks on staged files"
+echo ""

.devcontainer/build-and-push-image.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# Script to build and push the devcontainer image to GitHub Container Registry
+# This allows caching the image between Codespace sessions
+
+# You'll need to run this with appropriate GitHub permissions
+# gh auth login --scopes write:packages
+
+REGISTRY="ghcr.io"
+OWNER="apache"
+REPO="superset"
+TAG="devcontainer-base"
+
+echo "Building devcontainer image..."
+docker build -t $REGISTRY/$OWNER/$REPO:$TAG .devcontainer/
+
+echo "Pushing to GitHub Container Registry..."
+docker push $REGISTRY/$OWNER/$REPO:$TAG
+
+echo "Done! Update .devcontainer/devcontainer.json to use:"
+echo "  \"image\": \"$REGISTRY/$OWNER/$REPO:$TAG\""

.devcontainer/devcontainer.json

@@ -0,0 +1,66 @@
+{
+  "name": "Apache Superset Development",
+  // Option 1: Use pre-built image directly
+  // "image": "ghcr.io/apache/superset:devcontainer-base",
+
+  // Option 2: Build from Dockerfile with cache (current approach)
+  "build": {
+    "dockerfile": "Dockerfile",
+    "context": ".",
+    // Cache from the Apache registry image
+    "cacheFrom": ["ghcr.io/apache/superset:devcontainer-base"]
+  },
+
+  "features": {
+    "ghcr.io/devcontainers/features/docker-in-docker:2": {
+      "moby": true,
+      "dockerDashComposeVersion": "v2"
+    },
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "20"
+    },
+    "ghcr.io/devcontainers/features/git:1": {},
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "configureZshAsDefaultShell": true
+    },
+    "ghcr.io/devcontainers/features/sshd:1": {
+      "version": "latest"
+    }
+  },
+
+  // Forward ports for development
+  "forwardPorts": [9001],
+  "portsAttributes": {
+    "9001": {
+      "label": "Superset (via Webpack Dev Server)",
+      "onAutoForward": "notify",
+      "visibility": "public"
+    }
+  },
+
+  // Run commands after container is created
+  "postCreateCommand": "bash .devcontainer/setup-dev.sh || echo '⚠️ Setup had issues - run .devcontainer/setup-dev.sh manually'",
+
+  // Auto-start Superset after ensuring Docker is ready
+  // Run in foreground to see any errors, but don't block on failures
+  "postStartCommand": "bash -c 'echo \"Waiting 30s for services to initialize...\"; sleep 30; .devcontainer/start-superset.sh || echo \"⚠️ Auto-start failed - run start-superset manually\"'",
+
+  // Set environment variables
+  "remoteEnv": {
+    // Removed automatic venv activation to prevent startup issues
+    // The setup script will handle this
+  },
+
+  // VS Code customizations
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "ms-python.python",
+        "ms-python.vscode-pylance",
+        "charliermarsh.ruff",
+        "dbaeumer.vscode-eslint",
+        "esbenp.prettier-vscode"
+      ]
+    }
+  }
+}

.devcontainer/setup-dev.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+# Setup script for Superset Codespaces development environment
+
+echo "🔧 Setting up Superset development environment..."
+
+# System dependencies and uv are now pre-installed in the Docker image
+# This speeds up Codespace creation significantly!
+
+# Create virtual environment using uv
+echo "🐍 Creating Python virtual environment..."
+if ! uv venv; then
+    echo "❌ Failed to create virtual environment"
+    exit 1
+fi
+
+# Install Python dependencies
+echo "📦 Installing Python dependencies..."
+if ! uv pip install -r requirements/development.txt; then
+    echo "❌ Failed to install Python dependencies"
+    echo "💡 You may need to run this manually after the Codespace starts"
+    exit 1
+fi
+
+# Install pre-commit hooks
+echo "🪝 Installing pre-commit hooks..."
+if source .venv/bin/activate && pre-commit install; then
+    echo "✅ Pre-commit hooks installed"
+else
+    echo "⚠️  Pre-commit hooks installation failed (non-critical)"
+fi
+
+# Install Claude Code CLI via npm
+echo "🤖 Installing Claude Code..."
+if npm install -g @anthropic-ai/claude-code; then
+    echo "✅ Claude Code installed"
+else
+    echo "⚠️  Claude Code installation failed (non-critical)"
+fi
+
+# Make the start script executable
+chmod +x .devcontainer/start-superset.sh
+
+# Add bashrc additions for automatic venv activation
+echo "🔧 Setting up automatic environment activation..."
+if [ -f ~/.bashrc ]; then
+    # Check if we've already added our additions
+    if ! grep -q "Superset Codespaces environment setup" ~/.bashrc; then
+        echo "" >> ~/.bashrc
+        cat .devcontainer/bashrc-additions >> ~/.bashrc
+        echo "✅ Added automatic venv activation to ~/.bashrc"
+    else
+        echo "✅ Bashrc additions already present"
+    fi
+else
+    # Create bashrc if it doesn't exist
+    cat .devcontainer/bashrc-additions > ~/.bashrc
+    echo "✅ Created ~/.bashrc with automatic venv activation"
+fi
+
+# Also add to zshrc since that's the default shell
+if [ -f ~/.zshrc ] || [ -n "$ZSH_VERSION" ]; then
+    if ! grep -q "Superset Codespaces environment setup" ~/.zshrc; then
+        echo "" >> ~/.zshrc
+        cat .devcontainer/bashrc-additions >> ~/.zshrc
+        echo "✅ Added automatic venv activation to ~/.zshrc"
+    fi
+fi
+
+echo "✅ Development environment setup complete!"
+echo ""
+echo "📝 The virtual environment will be automatically activated in new terminals"
+echo ""
+echo "🔄 To activate in this terminal, run:"
+echo "   source ~/.bashrc"
+echo ""
+echo "🚀 To start Superset:"
+echo "   start-superset"
+echo ""

.devcontainer/start-superset.sh

@@ -0,0 +1,108 @@
+#!/bin/bash
+# Startup script for Superset in Codespaces
+
+# Log to a file for debugging
+LOG_FILE="/tmp/superset-startup.log"
+echo "[$(date)] Starting Superset startup script" >> "$LOG_FILE"
+echo "[$(date)] User: $(whoami), PWD: $(pwd)" >> "$LOG_FILE"
+
+echo "🚀 Starting Superset in Codespaces..."
+echo "🌐 Frontend will be available at port 9001"
+
+# Find the workspace directory (Codespaces clones as 'superset', not 'superset-2')
+WORKSPACE_DIR=$(find /workspaces -maxdepth 1 -name "superset*" -type d | head -1)
+if [ -n "$WORKSPACE_DIR" ]; then
+    cd "$WORKSPACE_DIR"
+    echo "📁 Working in: $WORKSPACE_DIR"
+else
+    echo "📁 Using current directory: $(pwd)"
+fi
+
+# Wait for Docker to be available
+echo "⏳ Waiting for Docker to start..."
+echo "[$(date)] Waiting for Docker..." >> "$LOG_FILE"
+max_attempts=30
+attempt=0
+while ! docker info > /dev/null 2>&1; do
+    if [ $attempt -eq $max_attempts ]; then
+        echo "❌ Docker failed to start after $max_attempts attempts"
+        echo "[$(date)] Docker failed to start after $max_attempts attempts" >> "$LOG_FILE"
+        echo "🔄 Please restart the Codespace or run this script manually later"
+        exit 1
+    fi
+    echo "   Attempt $((attempt + 1))/$max_attempts..."
+    echo "[$(date)] Docker check attempt $((attempt + 1))/$max_attempts" >> "$LOG_FILE"
+    sleep 2
+    attempt=$((attempt + 1))
+done
+echo "✅ Docker is ready!"
+echo "[$(date)] Docker is ready" >> "$LOG_FILE"
+
+# Check if Superset containers are already running
+if docker ps | grep -q "superset"; then
+    echo "✅ Superset containers are already running!"
+    echo ""
+    echo "🌐 To access Superset:"
+    echo "   1. Click the 'Ports' tab at the bottom of VS Code"
+    echo "   2. Find port 9001 and click the globe icon to open"
+    echo "   3. Wait 10-20 minutes for initial startup"
+    echo ""
+    echo "📝 Login credentials: admin/admin"
+    exit 0
+fi
+
+# Clean up any existing containers
+echo "🧹 Cleaning up existing containers..."
+docker-compose -f docker-compose-light.yml down
+
+# Start services
+echo "🏗️  Starting Superset in background (daemon mode)..."
+echo ""
+
+# Start in detached mode
+docker-compose -f docker-compose-light.yml up -d
+
+echo ""
+echo "✅ Docker Compose started successfully!"
+echo ""
+echo "📋 Important information:"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "⏱️  Initial startup takes 10-20 minutes"
+echo "🌐 Check the 'Ports' tab for your Superset URL (port 9001)"
+echo "👤 Login: admin / admin"
+echo ""
+echo "📊 Useful commands:"
+echo "   docker-compose -f docker-compose-light.yml logs -f    # Follow logs"
+echo "   docker-compose -f docker-compose-light.yml ps         # Check status"
+echo "   docker-compose -f docker-compose-light.yml down       # Stop services"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+echo "💤 Keeping terminal open for 60 seconds to test persistence..."
+sleep 60
+echo "✅ Test complete - check if this terminal is still visible!"
+
+# Show final status
+docker-compose -f docker-compose-light.yml ps
+EXIT_CODE=$?
+
+# If it failed, provide helpful instructions
+if [ $EXIT_CODE -ne 0 ] && [ $EXIT_CODE -ne 130 ]; then  # 130 is Ctrl+C
+    echo ""
+    echo "❌ Superset startup failed (exit code: $EXIT_CODE)"
+    echo ""
+    echo "🔄 To restart Superset, run:"
+    echo "   .devcontainer/start-superset.sh"
+    echo ""
+    echo "🔧 For troubleshooting:"
+    echo "   # View logs:"
+    echo "   docker-compose -f docker-compose-light.yml logs"
+    echo ""
+    echo "   # Clean restart (removes volumes):"
+    echo "   docker-compose -f docker-compose-light.yml down -v"
+    echo "   .devcontainer/start-superset.sh"
+    echo ""
+    echo "   # Common issues:"
+    echo "   - Network timeouts: Just retry, often transient"
+    echo "   - Port conflicts: Check 'docker ps'"
+    echo "   - Database issues: Try clean restart with -v"
+fi

.dockerignore

@@ -34,7 +34,6 @@
 **/*.sqllite
 **/*.swp
 **/.terser-plugin-cache/
-**/.storybook/
 **/node_modules/
 
 tests/
@@ -42,6 +41,8 @@ docs/
 install/
 superset-frontend/cypress-base/
 superset-frontend/coverage/
+superset-frontend/.temp_cache/
 superset/static/assets/
 superset-websocket/dist/
 venv
+.venv

.gitattributes

@@ -1 +1,4 @@
 docker/**/*.sh text eol=lf
+*.svg binary
+*.ipynb binary
+*.geojson binary

.github/CODEOWNERS

@@ -2,7 +2,7 @@
 
 # https://github.com/apache/superset/issues/13351
 
-/superset/migrations/ @apache/superset-committers
+/superset/migrations/ @mistercrunch @michael-s-molina @betodealmeida @eschutho @sadpandajoe
 
 # Notify some committers of changes in the components
 
@@ -12,23 +12,31 @@
 
 # Notify Helm Chart maintainers about changes in it
 
-/helm/superset/ @craig-rueda @dpgaspar @villebro
+/helm/superset/ @craig-rueda @dpgaspar @villebro @nytai @michael-s-molina @mistercrunch @rusackas @Antonio-RiveroMartnez
 
 # Notify E2E test maintainers of changes
 
-/superset-frontend/cypress-base/ @jinghua-qa @geido @eschutho @rusackas @betodealmeida
+/superset-frontend/cypress-base/ @sadpandajoe @geido @eschutho @rusackas @betodealmeida @mistercrunch
 
 # Notify PMC members of changes to GitHub Actions
 
-/.github/ @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @craig-rueda @john-bodley @kgabryje @dpgaspar
+/.github/ @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @craig-rueda @kgabryje @dpgaspar
 
-# Notify PMC members of changes to required Github Actions
+# Notify PMC members of changes to required GitHub Actions
 
-/.asf.yaml @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @craig-rueda @john-bodley @kgabryje @dpgaspar
+/.asf.yaml @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @craig-rueda @kgabryje @dpgaspar @Antonio-RiveroMartnez
+
+# Maps are a finicky contribution process we care about
 
-# Maps are a finnicky contribution process we care about
 **/*.geojson @villebro @rusackas
 /superset-frontend/plugins/legacy-plugin-chart-country-map/ @villebro @rusackas
 
-# Translations are a finnicky contribution that we care about
-/superset/translations/ @villebro @rusackas @michael-s-molina
+# Notify PMC members of changes to extension-related files
+
+/superset-core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-extensions-cli/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset/core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset/extensions/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/packages/superset-core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/extensions/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -7,6 +7,7 @@ body:
       value: |
         Hello Superset Community member! Please keep things tidy by putting your post in the proper place:
 
+        🚨 Reporting a security issue: send an email to security@superset.apache.org. DO NOT USE GITHUB ISSUES TO REPORT SECURITY PROBLEMS.
         🐛 Reporting a bug: use this form.
         🙏 Asking a question or getting help: post in the [Superset Slack chat](http://bit.ly/join-superset-slack) or [GitHub Discussions](https://github.com/apache/superset/discussions) under "Q&A / Help".
         💡 Requesting a new feature: Search [GitHub Discussions](https://github.com/apache/superset/discussions) to see if it exists already. If not, add a new post there under "Ideas".
@@ -14,14 +15,9 @@ body:
     id: bug-description
     attributes:
       label: Bug description
-      description: A clear and concise description of what the bug is.
-    validations:
-      required: true
-  - type: textarea
-    id: repro-steps
-    attributes:
-      label: How to reproduce the bug
+      description: A clear description of what the bug is, including reproduction steps and expected behavior.
       placeholder: |
+        The bug is that...
         1. Go to '...'
         2. Click on '....'
         3. Scroll down to '....'
@@ -45,8 +41,8 @@ body:
       label: Superset version
       options:
         - master / latest-dev
-        - "3.1.1"
-        - "3.0.4"
+        - "5.0.0"
+        - "4.1.3"
     validations:
       required: true
   - type: dropdown

.github/actions/change-detector/action.yml

@@ -0,0 +1,34 @@
+name: Change Detector
+description: Detects file changes for pull request and push events
+inputs:
+  token:
+    description: GitHub token for authentication
+    required: true
+outputs:
+  python:
+    description: Whether Python-related files were changed
+    value: ${{ steps.change-detector.outputs.python }}
+  frontend:
+    description: Whether frontend-related files were changed
+    value: ${{ steps.change-detector.outputs.frontend }}
+  docker:
+    description: Whether docker-related files were changed
+    value: ${{ steps.change-detector.outputs.docker }}
+  docs:
+    description: Whether docs-related files were changed
+    value: ${{ steps.change-detector.outputs.docs }}
+  superset-extensions-cli:
+    description: Whether superset-extensions-cli package-related files were changed
+    value: ${{ steps.change-detector.outputs.superset-extensions-cli }}
+runs:
+  using: composite
+  steps:
+    - name: Detect file changes
+      id: change-detector
+      run: |
+        python --version
+        python scripts/change_detector.py
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.token }}
+        GITHUB_OUTPUT: ${{ github.output }}

.github/actions/change-detector/label-draft-pr.yml

@@ -0,0 +1,23 @@
+name: Label Draft PRs
+on:
+  pull_request:
+    types:
+      - opened
+      - converted_to_draft
+jobs:
+  label-draft:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if the PR is a draft
+        id: check-draft
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const isDraft = context.payload.pull_request.draft;
+            core.setOutput('isDraft', isDraft);
+      - name: Add `review:draft` Label
+        if: steps.check-draft.outputs.isDraft == 'true'
+        uses: actions-ecosystem/action-add-labels@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          labels: "review:draft"

.github/actions/setup-backend/action.yml

@@ -2,9 +2,9 @@ name: 'Setup Python Environment'
 description: 'Set up Python and install dependencies with optional configurations.'
 inputs:
   python-version:
-    description: 'Python version to set up.'
+    description: 'Python version to set up. Accepts a version number, "current", or "next".'
     required: true
-    default: '3.9'
+    default: 'current'
   cache:
     description: 'Cache dependencies. Options: pip'
     required: false
@@ -13,21 +13,46 @@ inputs:
     description: 'Type of requirements to install. Options: base, development, default'
     required: false
     default: 'dev'
+  install-superset:
+    description: 'Whether to install Superset itself. If false, only python is installed'
+    required: false
+    default: 'true'
 
 runs:
   using: 'composite'
   steps:
-    - name: Set up Python ${{ inputs.python-version }}
+    - name: Interpret Python Version
+      id: set-python-version
+      shell: bash
+      run: |
+        if [ "${{ inputs.python-version }}" = "current" ]; then
+          echo "PYTHON_VERSION=3.11" >> $GITHUB_ENV
+        elif [ "${{ inputs.python-version }}" = "next" ]; then
+          # currently disabled in GHA matrixes because of library compatibility issues
+          echo "PYTHON_VERSION=3.12" >> $GITHUB_ENV
+        elif [ "${{ inputs.python-version }}" = "previous" ]; then
+          echo "PYTHON_VERSION=3.10" >> $GITHUB_ENV
+        else
+          echo "PYTHON_VERSION=${{ inputs.python-version }}" >> $GITHUB_ENV
+        fi
+    - name: Set up Python ${{ env.PYTHON_VERSION }}
       uses: actions/setup-python@v5
       with:
-        python-version: ${{ inputs.python-version }}
+        python-version: ${{ env.PYTHON_VERSION }}
         cache: ${{ inputs.cache }}
     - name: Install dependencies
       run: |
-        pip install --upgrade pip setuptools wheel
-        if [ "${{ inputs.requirements-type }}" = "dev" ]; then
-          pip install -r requirements/development.txt
-        elif [ "${{ inputs.requirements-type }}" = "base" ]; then
-          pip install -r requirements/base.txt
+        if [ "${{ inputs.install-superset }}" = "true" ]; then
+          sudo apt-get update && sudo apt-get -y install libldap2-dev libsasl2-dev
+
+          pip install --upgrade pip setuptools wheel uv
+
+          if [ "${{ inputs.requirements-type }}" = "dev" ]; then
+            uv pip install --system -r requirements/development.txt
+          elif [ "${{ inputs.requirements-type }}" = "base" ]; then
+            uv pip install --system -r requirements/base.txt
+          fi
+
+          uv pip install --system -e .
         fi
       shell: bash

.github/actions/setup-docker/action.yml

@@ -0,0 +1,69 @@
+name: "Setup Docker Environment"
+description: "Reusable steps for setting up QEMU, Docker Buildx, DockerHub login, Supersetbot, and optionally Docker Compose"
+inputs:
+  build:
+    description: "Used for building?"
+    required: false
+    default: "false"
+  dockerhub-user:
+    description: "DockerHub username"
+    required: false
+  dockerhub-token:
+    description: "DockerHub token"
+    required: false
+  install-docker-compose:
+    description: "Flag to install Docker Compose"
+    required: false
+    default: "true"
+  login-to-dockerhub:
+    description: "Whether you want to log into dockerhub"
+    required: false
+    default: "true"
+outputs: {}
+runs:
+  using: "composite"
+  steps:
+
+    - name: Set up QEMU
+      if: ${{ inputs.build == 'true' }}
+      uses: docker/setup-qemu-action@v3
+
+    - name: Set up Docker Buildx
+      if: ${{ inputs.build == 'true' }}
+      uses: docker/setup-buildx-action@v3
+
+    - name: Try to login to DockerHub
+      if: ${{ inputs.login-to-dockerhub == 'true' }}
+      continue-on-error: true
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.dockerhub-user }}
+        password: ${{ inputs.dockerhub-token }}
+
+    - name: Install Docker Compose
+      if: ${{ inputs.install-docker-compose == 'true' }}
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y ca-certificates curl
+        sudo install -m 0755 -d /etc/apt/keyrings
+
+        # Download and save the Docker GPG key in the correct format
+        curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+
+        # Ensure the key file is readable
+        sudo chmod a+r /etc/apt/keyrings/docker.gpg
+
+        # Add the Docker repository using the correct key
+        echo \
+          "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
+          $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
+          sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+
+        # Update package lists and install Docker Compose plugin
+        sudo apt update
+        sudo apt install -y docker-compose-plugin
+
+    - name: Docker Version Info
+      shell: bash
+      run: docker info

.github/actions/setup-supersetbot/action.yml

@@ -0,0 +1,40 @@
+name: 'Setup supersetbot'
+description: 'Sets up supersetbot npm lib from the repo or npm'
+inputs:
+  from-npm:
+    description: 'Install from npm instead of local setup'
+    required: false
+    default: 'true' # Defaults to using the local setup
+runs:
+  using: 'composite'
+  steps:
+
+    - name: Setup Node Env
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+
+    - name: Install supersetbot from npm
+      if: ${{ inputs.from-npm == 'true' }}
+      shell: bash
+      run: npm install -g supersetbot
+
+    - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+      if: ${{ inputs.from-npm == 'false' }}
+      uses: actions/checkout@v4
+      with:
+        repository: apache-superset/supersetbot
+        path: supersetbot
+
+    - name: Setup supersetbot from repo
+      if: ${{ inputs.from-npm == 'false' }}
+      shell: bash
+      working-directory: supersetbot
+      run: |
+        # simple trick to install globally with dependencies
+        npm pack
+        npm install -g ./supersetbot*.tgz
+
+    - name: echo supersetbot version
+      shell: bash
+      run: supersetbot version

.github/copilot-instructions.md

@@ -0,0 +1 @@
+../AGENTS.md

.github/dependabot.yml

@@ -1,4 +1,5 @@
 version: 2
+enable-beta-ecosystems: true
 updates:
 
   - package-ecosystem: "github-actions"
@@ -8,8 +9,13 @@ updates:
 
   - package-ecosystem: "npm"
     ignore:
-      # not until  node >= 18.12.0
-      - dependency-name: "css-minimizer-webpack-plugin"
+      # not until React >= 18.0.0
+      - dependency-name: "storybook"
+      - dependency-name: "@storybook*"
+      # JSDOM v30 doesn't play well with Jest v30
+      # Source: https://jestjs.io/blog#known-issues
+      # GH thread: https://github.com/jsdom/jsdom/issues/3492
+      - dependency-name: "jest-environment-jsdom"
     directory: "/superset-frontend/"
     schedule:
       interval: "monthly"
@@ -19,14 +25,17 @@ updates:
     open-pull-requests-limit: 30
     versioning-strategy: increase
 
-  - package-ecosystem: "pip"
-    directory: "/requirements/"
+
+  # NOTE: `uv` support is in beta, more details here:
+  # https://github.com/dependabot/dependabot-core/pull/10040#issuecomment-2696978430
+  - package-ecosystem: "uv"
+    directory: "requirements/"
+    open-pull-requests-limit: 10
     schedule:
-      interval: "monthly"
+      interval: "weekly"
     labels:
-      - pip
+      - uv
       - dependabot
-    open-pull-requests-limit: 30
 
   - package-ecosystem: "npm"
     directory: ".github/actions"
@@ -325,6 +334,10 @@ updates:
 
   - package-ecosystem: "npm"
     directory: "/superset-frontend/packages/superset-ui-core/"
+    ignore:
+      # not until React >= 18.0.0
+      - dependency-name: "react-markdown"
+      - dependency-name: "remark-gfm"
     schedule:
       interval: "monthly"
     labels:

.github/labeler.yml

@@ -72,6 +72,11 @@
   - any-glob-to-any-file:
     - 'superset/translations/zh/**'
 
+"i18n:traditional-chinese":
+- changed-files:
+  - any-glob-to-any-file:
+    - 'superset/translations/zh_TW/**'
+
 "i18n:dutch":
 - changed-files:
   - any-glob-to-any-file:
@@ -122,6 +127,11 @@
   - any-glob-to-any-file:
     - 'superset/translations/es/**'
 
+"i18n:persian":
+- changed-files:
+  - any-glob-to-any-file:
+    - 'superset/translations/fa/**'
+
 ############################################
 # Sub-projects and monorepo packages
 ############################################

.github/supersetbot/.eslintrc.json

@@ -1,22 +0,0 @@
-{
-  "extends": "airbnb-base",
-  "rules": {
-    "import/extensions": 0,
-    "import/prefer-default-export": 0,
-    "func-names": 0,
-    "no-console": 0,
-    "class-methods-use-this": 0
-  },
-  "parserOptions": {
-    "ecmaVersion": 2020,
-    "sourceType": "module"
-  },
-  "parserOptions": {
-    "ecmaVersion": "latest",
-    "sourceType": "module",
-    "requireConfigFile": false
-  },
-  "env": {
-    "jest": true
-  }
-}

.github/supersetbot/README.md

@@ -1,37 +0,0 @@
-# supersetbot
-
-supersetbot is a utility bot that can be used to help around GitHub, CI and beyond.
-
-The bot can be used as a local CLI OR, for a subset of fitted use cases, can be invoked directly
-from GitHub comments.
-
-Because it's its own npm app, it can be tested/deployed/used in isolation from the rest of
-Superset, and take on some of the complexity from GitHub actions and onto a nifty
-utility that can be used in different contexts.
-
-## Features
-
-```bash
-$ use nvm 20
-$ npm i -g supersetbot
-$ supersetbot
-Usage: supersetbot [options] [command]
-
-Options:
-  -v, --verbose                      Output extra debugging information
-  -r, --repo <repo>                  The GitHub repo to use (ie: "apache/superset")
-  -d, --dry-run                      Run the command in dry-run mode
-  -a, --actor <actor>                The actor
-  -h, --help                         display help for command
-
-Commands:
-  label [options] <label>            Add a label to an issue or PR
-  unlabel [options] <label>          Remove a label from an issue or PR
-  release-label-pr [options] <prId>  Figure out first release for PR and label it
-  version                            Prints supersetbot's version number
-  release-label-prs [options]        Given a set of PRs, auto-release label them
-  release-label [options] <release>  Figure out first release for PR and label it
-  orglabel [options]                 Add an org label based on the author
-  docker [options]                   Generates/run docker build commands use in CI
-  help [command]                     display help for command
-```

.github/supersetbot/jest.config.js

@@ -1,8 +0,0 @@
-export default {
-  transform: {
-  },
-  testEnvironment: 'node',
-  moduleNameMapper: {
-    '^(\\.{1,2}/.*)\\.js$': '$1',
-  },
-};

.github/supersetbot/package.json

@@ -1,36 +0,0 @@
-{
-  "name": "supersetbot",
-  "version": "0.4.1",
-  "description": "A bot for the Superset GitHub repo",
-  "type": "module",
-  "main": "src/index.js",
-  "scripts": {
-    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
-    "eslint": "eslint",
-    "supersetbot": "supersetbot"
-  },
-  "keywords": [],
-  "author": "",
-  "license": "ISC",
-  "dependencies": {
-    "@octokit/plugin-throttling": "^8.1.3",
-    "@octokit/rest": "^20.0.2",
-    "commander": "^11.0.0",
-    "semver": "^7.6.0",
-    "simple-git": "^3.22.0",
-    "string-argv": "^0.3.2"
-  },
-  "devDependencies": {
-    "@jest/globals": "^29.7.0",
-    "eslint": "^8.56.0",
-    "eslint-config-airbnb": "^19.0.4",
-    "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-jsx-a11y": "^6.8.0",
-    "eslint-plugin-react": "^7.33.2",
-    "eslint-plugin-react-hooks": "^4.6.0",
-    "jest": "^29.7.0"
-  },
-  "bin": {
-    "supersetbot": "./src/supersetbot"
-  }
-}

.github/supersetbot/src/cli.js

@@ -1,175 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { Command, Option } from 'commander';
-
-import * as docker from './docker.js';
-import * as utils from './utils.js';
-import Github from './github.js';
-import Git from './git.js';
-
-export default function getCLI(context) {
-  const program = new Command();
-
-  // Some reusable options
-  const issueOption = new Option('-i, --issue <issue>', 'The issue number', process.env.GITHUB_ISSUE_NUMBER);
-  const excludeCherriesOption = new Option('-c, --exclude-cherries', 'Generate cherry labels point to each release where the PR has been cherried');
-
-  // Setting up top-level CLI options
-  program
-    .option('-v, --verbose', 'Output extra debugging information')
-    .option('-r, --repo <repo>', 'The GitHub repo to use (ie: "apache/superset")', process.env.GITHUB_REPOSITORY)
-    .option('-d, --dry-run', 'Run the command in dry-run mode')
-    .option('-a, --actor <actor>', 'The actor', process.env.GITHUB_ACTOR);
-
-  program.command('label <label>')
-    .description('Add a label to an issue or PR')
-    .addOption(issueOption)
-    .action(async function (label) {
-      const opts = context.processOptions(this, ['issue', 'repo']);
-      const github = new Github({ context, issue: opts.issue });
-      await github.label(opts.issue, label, context, opts.actor, opts.verbose, opts.dryRun);
-    });
-
-  program.command('unlabel <label>')
-    .description('Remove a label from an issue or PR')
-    .addOption(issueOption)
-    .action(async function (label) {
-      const opts = context.processOptions(this, ['issue', 'repo']);
-      const github = new Github({ context, issueNumber: opts.issue });
-      await github.unlabel(opts.issue, label, context, opts.actor, opts.verbose, opts.dryRun);
-    });
-
-  program.command('release-label-pr <prId>')
-    .description('Figure out first release for PR and label it')
-    .addOption(excludeCherriesOption)
-    .action(async function (prId) {
-      const opts = context.processOptions(this, ['repo']);
-      const git = new Git(context);
-      await git.loadReleases();
-
-      let wrapped = context.commandWrapper({
-        func: git.getReleaseLabels,
-        verbose: opts.verbose,
-      });
-      const labels = await wrapped(parseInt(prId, 10), opts.verbose, opts.excludeCherries);
-      const github = new Github({ context, issueNumber: opts.issue });
-      wrapped = context.commandWrapper({
-        func: github.syncLabels,
-        verbose: opts.verbose,
-      });
-      await wrapped({labels, prId, actor: opts.actor, verbose: opts.verbose, dryRun: opts.dryRun});
-    });
-
-  program.command('version')
-    .description("Prints supersetbot's version number")
-    .action(async () => {
-      const version = await utils.currentPackageVersion();
-      context.log(version);
-    });
-
-  if (context.source === 'CLI') {
-    program.command('release-label-prs')
-      .description('Given a set of PRs, auto-release label them')
-      .option('-s, --search <search>', 'extra search string to append using the GitHub mini-language')
-      .option('-p, --pages <pages>', 'the number of pages (100 per page) to fetch and process', 10)
-      .action(async function () {
-        const opts = context.processOptions(this, ['repo']);
-
-        const github = new Github({ context, issueNumber: opts.issue });
-        const prs = await github.searchMergedPRs({
-          query: opts.search,
-          onlyUnlabeled: true,
-          verbose: opts.verbose,
-          pages: opts.pages,
-        });
-        const prIdLabelMap = new Map(prs.map((pr) => [pr.number, pr.labels]));
-        const git = new Git(context);
-        await git.loadReleases();
-
-        const prsPromises = prs.map(async (pr) => {
-          const labels = await git.getReleaseLabels(pr.number, opts.verbose);
-          return { prId: pr.number, labels };
-        });
-        const prsTargetLabel = await Promise.all(prsPromises);
-        // eslint-disable-next-line no-restricted-syntax
-        for (const { prId, labels } of prsTargetLabel) {
-          // Running sequentially to avoid rate limiting
-          // eslint-disable-next-line no-await-in-loop
-          await github.syncLabels({
-            labels,
-            existingLabels: prIdLabelMap.get(prId).map(l => l.name),
-            prId,
-            ...opts,
-          });
-        }
-      });
-
-    program.command('release-label <release>')
-      .description('Figure out first release for PR and label it')
-      .addOption(excludeCherriesOption)
-      .action(async function (release) {
-        const opts = context.processOptions(this, ['repo']);
-        const git = new Git(context);
-        await git.loadReleases();
-        const prs = await git.getPRsToSync(release, opts.verbose, opts.excludeCherries);
-
-        const github = new Github({ context });
-        // eslint-disable-next-line no-restricted-syntax
-        for (const { prId, labels } of prs) {
-          // Running sequentially to avoid rate limiting
-          // eslint-disable-next-line no-await-in-loop
-          await github.syncLabels({
-            prId,
-            labels,
-            ...opts,
-          });
-        }
-      });
-
-    program.command('orglabel')
-      .description('Add an org label based on the author')
-      .addOption(issueOption)
-      .action(async function () {
-        const opts = context.processOptions(this, ['issue', 'repo']);
-        const github = new Github({ context, issueNumber: opts.issue });
-        await github.assignOrgLabel(opts.issue, opts.verbose, opts.dryRun);
-      });
-
-
-    program.command('docker')
-      .description('Generates/run docker build commands use in CI')
-      .option('-t, --preset', 'Build preset', /^(lean|dev|dockerize|websocket|py310|ci)$/i, 'lean')
-      .option('-c, --context <context>', 'Build context', /^(push|pull_request|release)$/i, 'local')
-      .option('-r, --context-ref <ref>', 'Reference to the PR, release, or branch')
-      .option('-p, --platform <platform...>', 'Platforms (multiple values allowed)')
-      .option('-f, --force-latest', 'Force the "latest" tag on the release')
-      .option('-v, --verbose', 'Print more info')
-      .action(function (preset) {
-        const opts = context.processOptions(this);
-        opts.platform = opts.platform || ['linux/arm64'];
-        const cmd = docker.getDockerCommand({ preset, ...opts });
-        context.log(cmd);
-        if (!opts.dryRun) {
-          utils.runShellCommand(cmd, false);
-        }
-      });
-  }
-
-  return program;
-}

.github/supersetbot/src/context.js

@@ -1,152 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { parseArgsStringToArgv } from 'string-argv';
-
-class Context {
-  constructor(source) {
-    this.hasErrors = false;
-    this.source = source;
-    this.options = {};
-    this.errorLogs = [];
-    this.logs = [];
-    this.repo = null;
-    this.optToEnvMap = {
-      issue: 'GITHUB_ISSUE_NUMBER',
-      repo: 'GITHUB_REPOSITORY',
-    };
-  }
-
-  requireOption(optionName, options) {
-    const optionValue = options[optionName];
-    if (optionValue === undefined || optionValue === null) {
-      this.logError(`option [${optionName}] is required`);
-      // this.exit(1);
-    }
-  }
-
-  parseArgs(s) {
-    return parseArgsStringToArgv(s);
-  }
-
-  requireOptions(optionNames, options) {
-    optionNames.forEach((optionName) => {
-      this.requireOption(optionName, options);
-    });
-  }
-
-  processOptions(command, requiredOptions = []) {
-    const raw = command.parent?.rawArgs;
-    this.command = '???';
-    if (raw) {
-      this.command = raw.map((s) => (s.includes(' ') ? `"${s}"` : s)).join(' ').replace('node ', '');
-    }
-    this.options = { ...command.opts(), ...command.parent.opts() };
-
-    // Runtime defaults for unit tests since commanders can't receive callables as default
-    Object.entries(this.optToEnvMap).forEach(([k, v]) => {
-      if (!this.options[k]) {
-        this.options[k] = process.env[v];
-      }
-    });
-    this.requireOptions(requiredOptions, this.options);
-    this.issueNumber = this.options.issue;
-
-    if (this.source === 'GHA') {
-      this.options.actor = process.env.GITHUB_ACTOR || 'UNKNOWN';
-      this.options.repo = process.env.GITHUB_REPOSITORY;
-    }
-    this.repo = this.options.repo;
-
-    return this.options;
-  }
-
-  log(msg) {
-    console.log(msg);
-    this.logs = [...this.logs, msg];
-  }
-
-  logSuccess(msg) {
-    const augMsg = `🟢 SUCCESS: ${msg}`;
-    console.log(augMsg);
-    this.logs.push(augMsg);
-  }
-
-  logError(msg) {
-    this.hasErrors = true;
-    const augMsg = `🔴 ERROR: ${msg}`;
-    console.error(augMsg);
-    this.errorLogs.push(augMsg);
-  }
-
-  exit(code = 0) {
-    this.onDone();
-    process.exit(code);
-  }
-
-  commandWrapper({
-    func, successMsg, errorMsg = null, verbose = false, dryRun = false,
-  }) {
-    return async (...args) => {
-      let resp;
-      let hasError = false;
-
-      try {
-        if (!dryRun) {
-          resp = await func(...args);
-        }
-        if (verbose && resp) {
-          console.log(resp);
-        }
-      } catch (error) {
-        hasError = true;
-        if (errorMsg) {
-          this.logError(errorMsg);
-        } else {
-          this.logError(error);
-        }
-        throw (error);
-      }
-      if (successMsg && !hasError) {
-        this.logSuccess(successMsg);
-      }
-      return resp;
-    };
-  }
-
-  doneComment() {
-    const msgs = [...this.logs, ...this.errorLogs];
-    let comment = '';
-    comment += `> \`${this.command}\`\n`;
-    comment += '```\n';
-    comment += msgs.join('\n');
-    comment += '\n```';
-    return comment;
-  }
-
-  async onDone() {
-    let msg;
-    if (this.source === 'GHA') {
-      msg = this.doneComment();
-    }
-    return msg;
-  }
-}
-
-export default Context;

.github/supersetbot/src/docker.js

@@ -1,142 +0,0 @@
-import { spawnSync } from 'child_process';
-
-const REPO = 'apache/superset';
-const CACHE_REPO = `${REPO}-cache`;
-const BASE_PY_IMAGE = '3.9-slim-bookworm';
-
-export function runCmd(command, raiseOnFailure = true) {
-  const { stdout, stderr } = spawnSync(command, { shell: true, encoding: 'utf-8', env: process.env });
-
-  if (stderr && raiseOnFailure) {
-    throw new Error(stderr);
-  }
-  return stdout;
-}
-
-function getGitSha() {
-  return runCmd('git rev-parse HEAD').trim();
-}
-
-function getBuildContextRef(buildContext) {
-  const event = buildContext || process.env.GITHUB_EVENT_NAME;
-  const githubRef = process.env.GITHUB_REF || '';
-
-  if (event === 'pull_request') {
-    const githubHeadRef = process.env.GITHUB_HEAD_REF || '';
-    return githubHeadRef.replace(/[^a-zA-Z0-9]/g, '-').slice(0, 40);
-  } if (event === 'release') {
-    return githubRef.replace('refs/tags/', '').slice(0, 40);
-  } if (event === 'push') {
-    return githubRef.replace('refs/heads/', '').replace(/[^a-zA-Z0-9]/g, '-').slice(0, 40);
-  }
-  return '';
-}
-
-export function isLatestRelease(release) {
-  const output = runCmd(`../../scripts/tag_latest_release.sh ${release} --dry-run`, false) || '';
-  return output.includes('SKIP_TAG::false');
-}
-
-function makeDockerTag(parts) {
-  return `${REPO}:${parts.filter((part) => part).join('-')}`;
-}
-
-export function getDockerTags({
-  preset, platforms, sha, buildContext, buildContextRef, forceLatest = false,
-}) {
-  const tags = new Set();
-  const tagChunks = [];
-
-  const isLatest = isLatestRelease(buildContextRef);
-
-  if (preset !== 'lean') {
-    tagChunks.push(preset);
-  }
-
-  if (platforms.length === 1) {
-    const platform = platforms[0];
-    const shortBuildPlatform = platform.replace('linux/', '').replace('64', '');
-    if (shortBuildPlatform !== 'amd') {
-      tagChunks.push(shortBuildPlatform);
-    }
-  }
-
-  tags.add(makeDockerTag([sha, ...tagChunks]));
-  tags.add(makeDockerTag([sha.slice(0, 7), ...tagChunks]));
-
-  if (buildContext === 'release') {
-    tags.add(makeDockerTag([buildContextRef, ...tagChunks]));
-    if (isLatest || forceLatest) {
-      tags.add(makeDockerTag(['latest', ...tagChunks]));
-    }
-  } else if (buildContext === 'push' && buildContextRef === 'master') {
-    tags.add(makeDockerTag(['master', ...tagChunks]));
-  } else if (buildContext === 'pull_request') {
-    tags.add(makeDockerTag([`pr-${buildContextRef}`, ...tagChunks]));
-  }
-
-  return [...tags];
-}
-
-export function getDockerCommand({
-  preset, platform, buildContext, buildContextRef, forceLatest = false,
-}) {
-  const platforms = platform;
-
-  let buildTarget = '';
-  let pyVer = BASE_PY_IMAGE;
-  let dockerContext = '.';
-
-  if (preset === 'dev') {
-    buildTarget = 'dev';
-  } else if (preset === 'lean') {
-    buildTarget = 'lean';
-  } else if (preset === 'py310') {
-    buildTarget = 'lean';
-    pyVer = '3.10-slim-bookworm';
-  } else if (preset === 'websocket') {
-    dockerContext = 'superset-websocket';
-  } else if (preset === 'ci') {
-    buildTarget = 'ci';
-  } else if (preset === 'dockerize') {
-    dockerContext = '-f dockerize.Dockerfile .';
-  } else {
-    console.error(`Invalid build preset: ${preset}`);
-    process.exit(1);
-  }
-
-  let ref = buildContextRef;
-  if (!ref) {
-    ref = getBuildContextRef(buildContext);
-  }
-  const sha = getGitSha();
-  const tags = getDockerTags({
-    preset, platforms, sha, buildContext, buildContextRef: ref, forceLatest,
-  }).map((tag) => `-t ${tag}`).join(' \\\n        ');
-  const isAuthenticated = !!(process.env.DOCKERHUB_TOKEN);
-
-  const dockerArgs = isAuthenticated ? '--push' : '--load';
-  const targetArgument = buildTarget ? `--target ${buildTarget}` : '';
-  const cacheRef = `${CACHE_REPO}:${pyVer}`;
-  const platformArg = `--platform ${platforms.join(',')}`;
-  const cacheFromArg = `--cache-from=type=registry,ref=${cacheRef}`;
-  const cacheToArg = isAuthenticated ? `--cache-to=type=registry,mode=max,ref=${cacheRef}` : '';
-  const buildArg = pyVer ? `--build-arg PY_VER=${pyVer}` : '';
-  const actor = process.env.GITHUB_ACTOR;
-
-  return `docker buildx build \\
-      ${dockerArgs} \\
-      ${tags} \\
-      ${cacheFromArg} \\
-      ${cacheToArg} \\
-      ${targetArgument} \\
-      ${buildArg} \\
-      ${platformArg} \\
-      --label sha=${sha} \\
-      --label target=${buildTarget} \\
-      --label build_trigger=${ref} \\
-      --label base=${pyVer} \\
-      --label build_actor=${actor} \\
-      ${dockerContext}
-  `;
-}

.github/supersetbot/src/docker.test.js

@@ -1,244 +0,0 @@
-import * as dockerUtils from './docker.js';
-
-const SHA = '22e7c602b9aa321ec7e0df4bb0033048664dcdf0';
-const PR_ID = '666';
-const OLD_REL = '2.1.0';
-const NEW_REL = '2.1.1';
-const REPO = 'apache/superset';
-
-beforeEach(() => {
-  process.env.TEST_ENV = 'true';
-});
-
-afterEach(() => {
-  delete process.env.TEST_ENV;
-});
-
-describe('isLatestRelease', () => {
-  test.each([
-    ['2.1.0', false],
-    ['2.1.1', true],
-    ['1.0.0', false],
-    ['3.0.0', true],
-  ])('returns %s for release %s', (release, expectedBool) => {
-    expect(dockerUtils.isLatestRelease(release)).toBe(expectedBool);
-  });
-});
-
-describe('getDockerTags', () => {
-  test.each([
-    // PRs
-    [
-      'lean',
-      ['linux/arm64'],
-      SHA,
-      'pull_request',
-      PR_ID,
-      [`${REPO}:22e7c60-arm`, `${REPO}:${SHA}-arm`, `${REPO}:pr-${PR_ID}-arm`],
-    ],
-    [
-      'ci',
-      ['linux/amd64'],
-      SHA,
-      'pull_request',
-      PR_ID,
-      [`${REPO}:22e7c60-ci`, `${REPO}:${SHA}-ci`, `${REPO}:pr-${PR_ID}-ci`],
-    ],
-    [
-      'lean',
-      ['linux/amd64'],
-      SHA,
-      'pull_request',
-      PR_ID,
-      [`${REPO}:22e7c60`, `${REPO}:${SHA}`, `${REPO}:pr-${PR_ID}`],
-    ],
-    [
-      'dev',
-      ['linux/arm64'],
-      SHA,
-      'pull_request',
-      PR_ID,
-      [
-        `${REPO}:22e7c60-dev-arm`,
-        `${REPO}:${SHA}-dev-arm`,
-        `${REPO}:pr-${PR_ID}-dev-arm`,
-      ],
-    ],
-    [
-      'dev',
-      ['linux/amd64'],
-      SHA,
-      'pull_request',
-      PR_ID,
-      [`${REPO}:22e7c60-dev`, `${REPO}:${SHA}-dev`, `${REPO}:pr-${PR_ID}-dev`],
-    ],
-    // old releases
-    [
-      'lean',
-      ['linux/arm64'],
-      SHA,
-      'release',
-      OLD_REL,
-      [`${REPO}:22e7c60-arm`, `${REPO}:${SHA}-arm`, `${REPO}:${OLD_REL}-arm`],
-    ],
-    [
-      'lean',
-      ['linux/amd64'],
-      SHA,
-      'release',
-      OLD_REL,
-      [`${REPO}:22e7c60`, `${REPO}:${SHA}`, `${REPO}:${OLD_REL}`],
-    ],
-    [
-      'dev',
-      ['linux/arm64'],
-      SHA,
-      'release',
-      OLD_REL,
-      [
-        `${REPO}:22e7c60-dev-arm`,
-        `${REPO}:${SHA}-dev-arm`,
-        `${REPO}:${OLD_REL}-dev-arm`,
-      ],
-    ],
-    [
-      'dev',
-      ['linux/amd64'],
-      SHA,
-      'release',
-      OLD_REL,
-      [`${REPO}:22e7c60-dev`, `${REPO}:${SHA}-dev`, `${REPO}:${OLD_REL}-dev`],
-    ],
-    // new releases
-    [
-      'lean',
-      ['linux/arm64'],
-      SHA,
-      'release',
-      NEW_REL,
-      [
-        `${REPO}:22e7c60-arm`,
-        `${REPO}:${SHA}-arm`,
-        `${REPO}:${NEW_REL}-arm`,
-        `${REPO}:latest-arm`,
-      ],
-    ],
-    [
-      'lean',
-      ['linux/amd64'],
-      SHA,
-      'release',
-      NEW_REL,
-      [`${REPO}:22e7c60`, `${REPO}:${SHA}`, `${REPO}:${NEW_REL}`, `${REPO}:latest`],
-    ],
-    [
-      'dev',
-      ['linux/arm64'],
-      SHA,
-      'release',
-      NEW_REL,
-      [
-        `${REPO}:22e7c60-dev-arm`,
-        `${REPO}:${SHA}-dev-arm`,
-        `${REPO}:${NEW_REL}-dev-arm`,
-        `${REPO}:latest-dev-arm`,
-      ],
-    ],
-    [
-      'dev',
-      ['linux/amd64'],
-      SHA,
-      'release',
-      NEW_REL,
-      [
-        `${REPO}:22e7c60-dev`,
-        `${REPO}:${SHA}-dev`,
-        `${REPO}:${NEW_REL}-dev`,
-        `${REPO}:latest-dev`,
-      ],
-    ],
-    // merge on master
-    [
-      'lean',
-      ['linux/arm64'],
-      SHA,
-      'push',
-      'master',
-      [`${REPO}:22e7c60-arm`, `${REPO}:${SHA}-arm`, `${REPO}:master-arm`],
-    ],
-    [
-      'lean',
-      ['linux/amd64'],
-      SHA,
-      'push',
-      'master',
-      [`${REPO}:22e7c60`, `${REPO}:${SHA}`, `${REPO}:master`],
-    ],
-    [
-      'dev',
-      ['linux/arm64'],
-      SHA,
-      'push',
-      'master',
-      [
-        `${REPO}:22e7c60-dev-arm`,
-        `${REPO}:${SHA}-dev-arm`,
-        `${REPO}:master-dev-arm`,
-      ],
-    ],
-    [
-      'dev',
-      ['linux/amd64'],
-      SHA,
-      'push',
-      'master',
-      [`${REPO}:22e7c60-dev`, `${REPO}:${SHA}-dev`, `${REPO}:master-dev`],
-    ],
-
-  ])('returns expected tags', (preset, platforms, sha, buildContext, buildContextRef, expectedTags) => {
-    const tags = dockerUtils.getDockerTags({
-      preset, platforms, sha, buildContext, buildContextRef,
-    });
-    expect(tags).toEqual(expect.arrayContaining(expectedTags));
-  });
-});
-
-describe('getDockerCommand', () => {
-  test.each([
-    [
-      'lean',
-      ['linux/amd64'],
-      true,
-      SHA,
-      'push',
-      'master',
-      ['--push', `-t ${REPO}:master `],
-    ],
-    [
-      'dev',
-      ['linux/amd64'],
-      false,
-      SHA,
-      'push',
-      'master',
-      ['--load', `-t ${REPO}:master-dev `],
-    ],
-    // multi-platform
-    [
-      'lean',
-      ['linux/arm64', 'linux/amd64'],
-      true,
-      SHA,
-      'push',
-      'master',
-      ['--platform linux/arm64,linux/amd64'],
-    ],
-  ])('returns expected docker command', (preset, platform, isAuthenticated, sha, buildContext, buildContextRef, contains) => {
-    const cmd = dockerUtils.getDockerCommand({
-      preset, platform, isAuthenticated, sha, buildContext, buildContextRef,
-    });
-    contains.forEach((expectedSubstring) => {
-      expect(cmd).toContain(expectedSubstring);
-    });
-  });
-});

.github/supersetbot/src/git.js

@@ -1,120 +0,0 @@
-import simpleGit from 'simple-git';
-import semver from 'semver';
-
-import GitRelease from './git_release.js';
-
-export default class Git {
-  #releaseTags;
-
-  constructor(context, mainBranch = 'master') {
-    this.context = context;
-    this.mainBranch = mainBranch;
-    this.releases = new Map();
-    this.git = simpleGit();
-    this.mainBranchGitRelease = this.mainBranchGitRelease.bind(this);
-    this.getReleaseLabels = this.getReleaseLabels.bind(this);
-  }
-
-  async mainBranchGitRelease() {
-    let rel = this.releases.get(this.mainBranch);
-    if (!rel) {
-      rel = await this.loadRelease(this.mainBranch);
-    }
-    return rel;
-  }
-
-  async releaseTags() {
-    if (!this.#releaseTags) {
-      const tags = await this.git.tags();
-      // Filter tags to include only those that match semver and are official releases
-      const semverTags = tags.all.filter((tag) => semver.valid(tag) && !tag.includes('-') && !tag.includes('v'));
-      semverTags.sort((a, b) => semver.compare(a, b));
-      this.#releaseTags = semverTags;
-    }
-    return this.#releaseTags;
-  }
-
-  async loadMainBranch() {
-    await this.loadRelease(this.mainBranch);
-  }
-
-  async loadReleases(tags = null) {
-    const tagsToFetch = tags || await this.releaseTags();
-    if (!tags) {
-      await this.loadMainBranch();
-    }
-    const promises = [];
-    tagsToFetch.forEach((tag) => {
-      promises.push(this.loadRelease(tag));
-    });
-    await Promise.all(promises);
-  }
-
-  async loadRelease(tag) {
-    const release = new GitRelease(tag, this.context);
-    await release.load();
-    this.releases.set(tag, release);
-    return release;
-  }
-
-  static shortenSHA(sha) {
-    return sha.substring(0, 7);
-  }
-
-  async getReleaseLabels(prNumber, verbose, excludeCherries = false) {
-    const labels = [];
-    const main = await this.mainBranchGitRelease();
-    const commit = main.prIdCommitMap.get(prNumber);
-    if (commit) {
-      const { sha } = commit;
-      const shortSHA = Git.shortenSHA(sha);
-      if (verbose) {
-        console.log(`PR ${prNumber} is ${shortSHA} on branch ${this.mainBranch}`);
-      }
-
-      let firstGitReleased = null;
-      const tags = await this.releaseTags();
-      tags.forEach((tag) => {
-        const release = this.releases.get(tag);
-        if (release.shaCommitMap.get(sha) && !firstGitReleased && release.tag !== this.mainBranch) {
-          firstGitReleased = release.tag;
-          labels.push(`🚢 ${release.tag}`);
-        }
-        const commitInGitRelease = release.prIdCommitMap.get(prNumber);
-        if (!excludeCherries && commitInGitRelease && commitInGitRelease.sha !== sha) {
-          labels.push(`🍒 ${release.tag}`);
-        }
-      });
-      if (labels.length >= 1) {
-        // using this emoji to show it's been labeled by the bot
-        labels.push('🏷️ bot');
-      }
-    }
-    return labels;
-  }
-
-  async previousRelease(release) {
-    const tags = await this.releaseTags();
-    return tags[tags.indexOf(release) - 1];
-  }
-
-  async getPRsToSync(release, verbose = false, excludeCherries = false) {
-    const prevRelease = await this.previousRelease(release);
-    const releaseRange = new GitRelease(release, this.context, prevRelease);
-    await releaseRange.load();
-    const prIds = releaseRange.prIdCommitMap.keys();
-
-    const prs = [];
-    const promises = [];
-    [...prIds].forEach(prId => {
-      promises.push(
-        this.getReleaseLabels(prId, verbose, excludeCherries)
-          .then((labels) => {
-            prs.push({ prId, labels });
-          }),
-      );
-    });
-    await Promise.all(promises);
-    return prs;
-  }
-}

.github/supersetbot/src/git_release.js

@@ -1,50 +0,0 @@
-import simpleGit from 'simple-git';
-
-export default class GitRelease {
-  constructor(tag, context, from = null) {
-    this.tag = tag;
-    this.context = context;
-    this.prNumberRegex = /\(#(\d+)\)/;
-    this.shaCommitMap = null;
-    this.prIdCommitMap = null;
-    this.prCommitMap = null;
-    this.git = simpleGit();
-    this.from = from;
-  }
-
-  extractPRNumber(commitMessage) {
-    const match = (commitMessage || '').match(this.prNumberRegex);
-    return match ? parseInt(match[1], 10) : null;
-  }
-
-  async load() {
-    let from = this.from || await this.git.firstCommit();
-    if (from.includes('\n')) {
-      [from] = from.split('\n');
-    }
-    const range = `${this.from || 'first'}..${this.tag}`;
-    const commits = await this.git.log({ from, to: this.tag });
-    this.context.log(`${range} - fetched ${commits.all.length} commits`);
-
-    this.shaCommitMap = new Map();
-    commits.all.forEach((commit) => {
-      const sha = commit.hash.substring(0, 7);
-      this.shaCommitMap.set(
-        sha,
-        {
-          prId: this.extractPRNumber(commit.message),
-          message: commit.message,
-          sha,
-        },
-      );
-    });
-
-    this.prIdCommitMap = new Map();
-    // eslint-disable-next-line no-restricted-syntax
-    for (const commit of this.shaCommitMap.values()) {
-      if (commit.prId) {
-        this.prIdCommitMap.set(commit.prId, commit);
-      }
-    }
-  }
-}

.github/supersetbot/src/github.js

@@ -1,252 +0,0 @@
-import { Octokit } from '@octokit/rest';
-import { throttling } from '@octokit/plugin-throttling';
-
-import { ORG_LIST, PROTECTED_LABEL_PATTERNS, COMMITTER_TEAM } from './metadata.js';
-
-class Github {
-  #userInTeamCache;
-
-  constructor({ context, issueNumber = null, token = null }) {
-    this.context = context;
-    this.issueNumber = issueNumber;
-    const githubToken = token || process.env.GITHUB_TOKEN;
-    if (!githubToken) {
-      const msg = 'GITHUB_TOKEN is not set';
-      this.context.logError(msg);
-    }
-    const throttledOctokit = Octokit.plugin(throttling);
-    // eslint-disable-next-line new-cap
-    this.octokit = new throttledOctokit({
-      auth: githubToken,
-      throttle: {
-        id: 'supersetbot',
-        onRateLimit: (retryAfter, options, octokit, retryCount) => {
-          const howManyRetries = 10;
-          octokit.log.warn(`Retry ${retryCount} out of ${howManyRetries} - retrying in ${retryAfter} seconds!`);
-          if (retryCount < howManyRetries) {
-            return true;
-          }
-          return false;
-        },
-        onSecondaryRateLimit: (retryAfter, options, octokit) => {
-          octokit.log.warn(`SecondaryRateLimit detected for request ${options.method} ${options.url}`);
-        },
-      },
-    });
-    this.syncLabels = this.syncLabels.bind(this);
-    this.#userInTeamCache = new Map();
-  }
-
-  unPackRepo() {
-    const [owner, repo] = this.context.repo.split('/');
-    return { repo, owner };
-  }
-
-  async label(issueNumber, label, actor = null, verbose = false, dryRun = false) {
-    let hasPerm = true;
-    if (actor && Github.isLabelProtected(label)) {
-      hasPerm = await this.checkIfUserInTeam(actor, COMMITTER_TEAM, verbose);
-    }
-    if (hasPerm) {
-      const addLabelWrapped = this.context.commandWrapper({
-        func: this.octokit.rest.issues.addLabels,
-        successMsg: `label "${label}" added to issue ${issueNumber}`,
-        verbose,
-        dryRun,
-      });
-      await addLabelWrapped({
-        ...this.unPackRepo(),
-        issue_number: issueNumber,
-        labels: [label],
-      });
-    }
-  }
-
-  async createComment(body) {
-    if (this.issueNumber) {
-      await this.octokit.rest.issues.createComment({
-        ...this.unPackRepo(),
-        body,
-        issue_number: this.issueNumber,
-      });
-    }
-  }
-
-  async unlabel(issueNumber, label, actor = null, verbose = false, dryRun = false) {
-    let hasPerm = true;
-    if (actor && Github.isLabelProtected(label)) {
-      hasPerm = await this.checkIfUserInTeam(actor, COMMITTER_TEAM, verbose);
-    }
-    if (hasPerm) {
-      const removeLabelWrapped = this.context.commandWrapper({
-        func: this.octokit.rest.issues.removeLabel,
-        successMsg: `label "${label}" removed from issue ${issueNumber}`,
-        verbose,
-        dryRun,
-      });
-      await removeLabelWrapped({
-        ...this.unPackRepo(),
-        issue_number: issueNumber,
-        name: label,
-      });
-    }
-  }
-
-  async assignOrgLabel(issueNumber, verbose = false, dryRun = false) {
-    const issue = await this.octokit.rest.issues.get({
-      ...this.unPackRepo(),
-      issue_number: issueNumber,
-    });
-    const username = issue.data.user.login;
-    const orgs = await this.octokit.orgs.listForUser({ username });
-    const orgNames = orgs.data.map((v) => v.login);
-
-    // get list of matching github orgs
-    const matchingOrgs = orgNames.filter((org) => ORG_LIST.includes(org));
-    if (matchingOrgs.length) {
-      const wrapped = this.context.commandWrapper({
-        func: this.octokit.rest.issues.addLabels,
-        successMsg: `added label(s) ${matchingOrgs} to issue ${issueNumber}`,
-        errorMsg: "couldn't add labels to issue",
-        verbose,
-        dryRun,
-      });
-      wrapped({
-        ...this.unPackRepo(),
-        issue_number: issueNumber,
-        labels: matchingOrgs,
-      });
-    }
-  }
-
-  async searchMergedPRs({
-    query = '',
-    onlyUnlabeled = true,
-    verbose = false,
-    startPage = 0,
-    pages = 5,
-  }) {
-    // look for PRs
-    let q = `repo:${this.context.repo} is:merged ${query}`;
-    if (onlyUnlabeled) {
-      q = `${q} -label:"🏷️ bot"`;
-    }
-    if (verbose) {
-      this.context.log(`Query: ${q}`);
-    }
-    let prs = [];
-    for (let i = 0; i < pages; i += 1) {
-      if (verbose) {
-        this.context.log(`Fetching PRs to process page ${i + 1} out of ${pages}`);
-      }
-      // eslint-disable-next-line no-await-in-loop
-      const data = await this.octokit.search.issuesAndPullRequests({
-        q,
-        per_page: 100,
-        page: startPage + i,
-      });
-      prs = [...prs, ...data.data.items];
-    }
-    if (verbose) {
-      this.context.log(`Fetched ${prs.length}`);
-    }
-    return prs;
-  }
-
-  async syncLabels({
-    labels,
-    prId,
-    actor = null,
-    verbose = false,
-    dryRun = false,
-    existingLabels = null,
-  }) {
-    if (verbose) {
-      this.context.log(`[PR: ${prId}] - sync labels ${labels}`);
-    }
-    let hasPerm = true;
-    if (actor) {
-      hasPerm = await this.checkIfUserInTeam(actor, COMMITTER_TEAM, verbose);
-    }
-    if (!hasPerm) {
-      return;
-    }
-    let targetLabels = existingLabels;
-    if (targetLabels === null) {
-      // No labels have been passed as an array, so checking against GitHub
-      const resp = await this.octokit.issues.listLabelsOnIssue({
-        ...this.unPackRepo(),
-        issue_number: prId,
-      });
-      targetLabels = resp.data.map((l) => l.name);
-    }
-
-    if (verbose) {
-      this.context.log(`[PR: ${prId}] - target release labels: ${labels}`);
-      this.context.log(`[PR: ${prId}] - existing labels on issue: ${existingLabels}`);
-    }
-
-    // Extract existing labels with the given prefixes
-    const prefixes = ['🚢', '🍒', '🎯', '🏷️'];
-    const existingPrefixLabels = targetLabels
-      .filter((label) => prefixes.some((s) => typeof(label) === 'string' && label.startsWith(s)));
-
-    // Labels to add
-    const labelsToAdd = labels.filter((label) => !existingPrefixLabels.includes(label));
-    if (verbose) {
-      this.context.log(`[PR: ${prId}] - labels to add: ${labelsToAdd}`);
-    }
-    // Labels to remove
-    const labelsToRemove = existingPrefixLabels.filter((label) => !labels.includes(label));
-    if (verbose) {
-      this.context.log(`[PR: ${prId}] - labels to remove: ${labelsToRemove}`);
-    }
-
-    // Add labels
-    if (labelsToAdd.length > 0 && !dryRun) {
-      await this.octokit.issues.addLabels({
-        ...this.unPackRepo(),
-        issue_number: prId,
-        labels: labelsToAdd,
-      });
-    }
-
-    // Remove labels
-    if (labelsToRemove.length > 0 && !dryRun) {
-      await Promise.all(labelsToRemove.map((label) => this.octokit.issues.removeLabel({
-        ...this.unPackRepo(),
-        issue_number: prId,
-        name: label,
-      })));
-    }
-    this.context.logSuccess(`synched labels for PR ${prId} with labels ${labels}`);
-  }
-
-  async checkIfUserInTeam(username, team, verbose = false) {
-    let isInTeam = this.#userInTeamCache.get([username, team]);
-    if (isInTeam !== undefined) {
-      return isInTeam;
-    }
-
-    const [org, teamSlug] = team.split('/');
-    const wrapped = this.context.commandWrapper({
-      func: this.octokit.teams.getMembershipForUserInOrg,
-      errorMsg: `User "${username}" is not authorized to alter protected labels.`,
-      verbose,
-    });
-    const resp = await wrapped({
-      org,
-      team_slug: teamSlug,
-      username,
-    });
-    isInTeam = resp?.data?.state === 'active';
-    this.#userInTeamCache.set([username, team], isInTeam);
-    return isInTeam;
-  }
-
-  static isLabelProtected(label) {
-    return PROTECTED_LABEL_PATTERNS.some((pattern) => new RegExp(pattern).test(label));
-  }
-}
-
-export default Github;

.github/supersetbot/src/index.js

@@ -1,39 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import getCLI from './cli.js';
-import Context from './context.js';
-import Github from './github.js';
-
-async function runCommandFromGithubAction(rawCommand) {
-  const context = new Context('GHA');
-  const cli = getCLI(context);
-  const github = new Github(context);
-
-  // Make rawCommand look like argv
-  const cmd = rawCommand.trim().replace('@supersetbot', 'supersetbot');
-  const args = context.parseArgs(cmd);
-
-  await cli.parseAsync(['node', ...args]);
-  const msg = await context.onDone();
-
-  github.createComment(msg);
-}
-
-export { runCommandFromGithubAction };

.github/supersetbot/src/index.test.js

@@ -1,51 +0,0 @@
-// import * as stringArgv from 'string-argv';
-import { jest } from '@jest/globals';
-
-import Context from './context.js';
-import Github from './github.js';
-import * as index from './index.js';
-
-describe('runCommandFromGithubAction', () => {
-  const labelSpy = jest.spyOn(Github.prototype, 'label').mockImplementation(jest.fn());
-  // mocking some of the Context object
-  const onDoneSpy = jest.spyOn(Context.prototype, 'onDone');
-  const doneCommentSpy = jest.spyOn(Context.prototype, 'doneComment');
-  const parseArgsSpy = jest.spyOn(Context.prototype, 'parseArgs');
-  jest.spyOn(Github.prototype, 'createComment').mockImplementation(jest.fn());
-
-  let originalEnv;
-
-  afterEach(() => {
-    process.env = originalEnv;
-  });
-  beforeEach(() => {
-    jest.clearAllMocks();
-    originalEnv = process.env;
-    process.env.GITHUB_ISSUE_NUMBER = '666';
-    process.env.GITHUB_REPOSITORY = 'apache/superset';
-  });
-
-  it('should strip the command', async () => {
-    await index.runCommandFromGithubAction('  @supersetbot label test-label  ');
-    expect(parseArgsSpy).toHaveBeenCalledWith('supersetbot label test-label');
-
-    await index.runCommandFromGithubAction('  \n  @supersetbot label test-label  \n \n   \n');
-    expect(parseArgsSpy).toHaveBeenCalledWith('supersetbot label test-label');
-
-    await index.runCommandFromGithubAction('  \n \t@supersetbot label test-label \t  \n \n\t   \n');
-    expect(parseArgsSpy).toHaveBeenCalledWith('supersetbot label test-label');
-  });
-
-  it('should parse the raw command correctly and call commands.label and context.onDone', async () => {
-    await index.runCommandFromGithubAction('@supersetbot label test-label');
-
-    expect(labelSpy).toHaveBeenCalled();
-    expect(onDoneSpy).toHaveBeenCalled();
-  });
-
-  it('should generate a good comment message', async () => {
-    await index.runCommandFromGithubAction('@supersetbot label test-label');
-    const comment = doneCommentSpy.mock.results[0].value;
-    expect(comment).toContain('> `supersetbot label test-label`');
-  });
-});

.github/supersetbot/src/metadata.js

@@ -1,35 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-export const ORG_LIST = [
-  'preset-io',
-  'airbnb',
-  'dropbox',
-  'lyft',
-  'Turing',
-  'Superset-Community-Partners',
-  'CybercentreCanada',
-];
-export const PROTECTED_LABEL_PATTERNS = [
-  'protected.*',
-  'released.*',
-  'hold.*',
-  '^v\\d+(\\.\\d+)*$',
-  '(🚢|🍒|🎯).*',
-];
-export const COMMITTER_TEAM = 'apache/superset-committers';

.github/supersetbot/src/supersetbot

@@ -1,27 +0,0 @@
-#!/usr/bin/env node
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import getCLI from './cli.js';
-import Context from './context.js';
-
-const envContext = new Context('CLI');
-const cli = getCLI(envContext);
-
-cli.parse();

.github/supersetbot/src/utils.js

@@ -1,78 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { spawn } from 'child_process';
-import { readFile } from 'fs/promises';
-import { fileURLToPath } from 'url';
-import path from 'path';
-
-const dirname = path.dirname(fileURLToPath(import.meta.url));
-
-async function loadPackageJson() {
-  try {
-    const packageJsonPath = path.join(dirname, '../package.json');
-    const data = await readFile(packageJsonPath, 'utf8');
-    const packageJson = JSON.parse(data);
-    return packageJson;
-  } catch (error) {
-    console.error('Error reading package.json:', error);
-    return null;
-  }
-}
-export async function currentPackageVersion() {
-  const data = await loadPackageJson();
-  return data.version;
-}
-
-export function runShellCommand(command, raiseOnError = true) {
-  return new Promise((resolve, reject) => {
-    // Split the command string into an array of arguments
-    const args = command.split(/\s+/).filter((s) => !!s && s !== '\\');
-    const childProcess = spawn(args.shift(), args);
-    let stdoutData = '';
-    let stderrData = '';
-
-    // Capture stdout data
-    childProcess.stdout.on('data', (data) => {
-      stdoutData += data;
-      console.log(`stdout: ${data}`);
-    });
-
-    // Capture stderr data
-    childProcess.stderr.on('data', (data) => {
-      stderrData += data;
-      console.error(`stderr: ${data}`);
-    });
-
-    // Handle process exit
-    childProcess.on('close', (code) => {
-      if (code === 0) {
-        resolve(stdoutData);
-      } else {
-        const msg = `Command failed with code ${code}: ${stderrData}`;
-        if (raiseOnError) {
-          reject(new Error(msg));
-        } else {
-          console.error(msg);
-          process.exit(1);
-        }
-      }
-    });
-  });
-}

.github/workflows/bashlib.sh

@@ -31,20 +31,6 @@ say() {
   fi
 }
 
-# default command to run when the `run` input is empty
-default-setup-command() {
-  apt-get-install
-  pip-upgrade
-}
-
-apt-get-install() {
-  say "::group::apt-get install dependencies"
-  sudo apt-get update && sudo apt-get install --yes \
-    libsasl2-dev \
-    libldap2-dev
-  say "::endgroup::"
-}
-
 pip-upgrade() {
   say "::group::Upgrade pip"
   pip install --upgrade pip
@@ -103,6 +89,8 @@ EOF
 setup-mysql() {
   say "::group::Initialize database"
   mysql -h 127.0.0.1 -P 13306 -u root --password=root <<-EOF
+    SET GLOBAL transaction_isolation='READ-COMMITTED';
+    SET GLOBAL TRANSACTION ISOLATION LEVEL READ COMMITTED;
     DROP DATABASE IF EXISTS superset;
     CREATE DATABASE superset DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci;
     DROP DATABASE IF EXISTS sqllab_test_db;
@@ -129,9 +117,17 @@ testdata() {
   say "::endgroup::"
 }
 
-codecov() {
-  say "::group::Upload code coverage"
-  bash ".github/workflows/codecov.sh" "$@"
+celery-worker() {
+  cd "$GITHUB_WORKSPACE"
+  say "::group::Start Celery worker"
+  # must specify PYTHONPATH to make `tests.superset_test_config` importable
+  export PYTHONPATH="$GITHUB_WORKSPACE"
+  celery \
+    --app=superset.tasks.celery_app:app \
+    worker \
+      --concurrency=2 \
+      --detach \
+      --optimization=fair
   say "::endgroup::"
 }
 
@@ -147,73 +143,113 @@ cypress-install() {
   cache-save cypress
 }
 
-# Run Cypress and upload coverage reports
-cypress-run() {
+cypress-run-all() {
+  local USE_DASHBOARD=$1
+  local APP_ROOT=$2
   cd "$GITHUB_WORKSPACE/superset-frontend/cypress-base"
 
-  local page=$1
-  local group=${2:-Default}
-  local cypress="./node_modules/.bin/cypress run"
-  local browser=${CYPRESS_BROWSER:-chrome}
-
-  export TERM="xterm"
-  export ELECTRON_DISABLE_GPU=true # Attempt to disable GPU for Electron-based Cypress
-
-  say "::group::Run Cypress for [$page]"
-  if [[ -z $CYPRESS_KEY ]]; then
-    xvfb-run --auto-servernum --server-args='-screen 0, 1024x768x24' $cypress --spec "cypress/e2e/$page" --browser "$browser"
-  else
-    export CYPRESS_RECORD_KEY=$(echo $CYPRESS_KEY | base64 --decode)
-    # additional flags for Cypress dashboard recording
-    xvfb-run --auto-servernum --server-args='-screen 0, 1024x768x24' $cypress --spec "cypress/e2e/$page" --browser "$browser" \
-      --record --group "$group" --tag "${GITHUB_REPOSITORY},${GITHUB_EVENT_NAME}" \
-      --parallel --ci-build-id "${GITHUB_SHA:0:8}-${NONCE}"
-
-  fi
-
-  # don't add quotes to $record because we do want word splitting
-  say "::endgroup::"
-}
-
-cypress-run-all() {
   # Start Flask and run it in background
   # --no-debugger means disable the interactive debugger on the 500 page
   # so errors can print to stderr.
   local flasklog="${HOME}/flask.log"
   local port=8081
-  export CYPRESS_BASE_URL="http://localhost:${port}"
+  CYPRESS_BASE_URL="http://localhost:${port}"
+  if [ -n "$APP_ROOT" ]; then
+    export SUPERSET_APP_ROOT=$APP_ROOT
+    CYPRESS_BASE_URL=${CYPRESS_BASE_URL}${APP_ROOT}
+  fi
+  export CYPRESS_BASE_URL
 
   nohup flask run --no-debugger -p $port >"$flasklog" 2>&1 </dev/null &
   local flaskProcessId=$!
 
-  cypress-run "*/**/*"
+  USE_DASHBOARD_FLAG=''
+  if [ "$USE_DASHBOARD" = "true" ]; then
+    USE_DASHBOARD_FLAG='--use-dashboard'
+  fi
+
+  # UNCOMMENT the next few commands to monitor memory usage
+  # monitor_memory &  # Start memory monitoring in the background
+  # memoryMonitorPid=$!
+  python ../../scripts/cypress_run.py --parallelism $PARALLELISM --parallelism-id $PARALLEL_ID --group $PARALLEL_ID --retries 5 $USE_DASHBOARD_FLAG
+  # kill $memoryMonitorPid
 
   # After job is done, print out Flask log for debugging
-  say "::group::Flask log for default run"
+  echo "::group::Flask log for default run"
   cat "$flasklog"
-  say "::endgroup::"
-
-  # Rerun SQL Lab tests with backend persist disabled
-  export SUPERSET_CONFIG=tests.integration_tests.superset_test_config_sqllab_backend_persist_off
-
-  # Restart Flask with new configs
+  echo "::endgroup::"
+  # make sure the program exits
   kill $flaskProcessId
+}
+
+playwright-install() {
+  cd "$GITHUB_WORKSPACE/superset-frontend"
+
+  say "::group::Install Playwright browsers"
+  npx playwright install --with-deps chromium
+  # Create output directories for test results and debugging
+  mkdir -p playwright-results
+  mkdir -p test-results
+  say "::endgroup::"
+}
+
+playwright-run() {
+  local APP_ROOT=$1
+
+  # Start Flask from the project root (same as Cypress)
+  cd "$GITHUB_WORKSPACE"
+  local flasklog="${HOME}/flask-playwright.log"
+  local port=8081
+  PLAYWRIGHT_BASE_URL="http://localhost:${port}"
+  if [ -n "$APP_ROOT" ]; then
+    export SUPERSET_APP_ROOT=$APP_ROOT
+    PLAYWRIGHT_BASE_URL=${PLAYWRIGHT_BASE_URL}${APP_ROOT}/
+  fi
+  export PLAYWRIGHT_BASE_URL
+
   nohup flask run --no-debugger -p $port >"$flasklog" 2>&1 </dev/null &
   local flaskProcessId=$!
 
-  cypress-run "sqllab/*" "Backend persist"
+  # Ensure cleanup on exit
+  trap "kill $flaskProcessId 2>/dev/null || true" EXIT
 
-  # Upload code coverage separately so each page can have separate flags
-  # -c will clean existing coverage reports, -F means add flags
-  # || true to prevent CI failure on codecov upload
-  codecov -c -F "cypress" || true
+  # Wait for server to be ready with health check
+  local timeout=60
+  say "Waiting for Flask server to start on port $port..."
+  while [ $timeout -gt 0 ]; do
+    if curl -f ${PLAYWRIGHT_BASE_URL}/health >/dev/null 2>&1; then
+      say "Flask server is ready"
+      break
+    fi
+    sleep 1
+    timeout=$((timeout - 1))
+  done
 
-  say "::group::Flask log for backend persist"
-  cat "$flasklog"
+  if [ $timeout -eq 0 ]; then
+    echo "::error::Flask server failed to start within 60 seconds"
+    echo "::group::Flask startup log"
+    cat "$flasklog"
+    echo "::endgroup::"
+    return 1
+  fi
+
+  # Change to frontend directory for Playwright execution
+  cd "$GITHUB_WORKSPACE/superset-frontend"
+
+  say "::group::Run Playwright tests"
+  echo "Running Playwright with baseURL: ${PLAYWRIGHT_BASE_URL}"
+  npx playwright test auth/login --reporter=github --output=playwright-results
+  local status=$?
   say "::endgroup::"
 
+  # After job is done, print out Flask log for debugging
+  echo "::group::Flask log for Playwright run"
+  cat "$flasklog"
+  echo "::endgroup::"
   # make sure the program exits
   kill $flaskProcessId
+
+  return $status
 }
 
 eyes-storybook-dependencies() {
@@ -222,6 +258,21 @@ eyes-storybook-dependencies() {
   say "::endgroup::"
 }
 
+monitor_memory() {
+  # This is a small utility to monitor memory usage. Useful for debugging memory in GHA.
+  # To use wrap your command as follows
+  #
+  # monitor_memory &  # Start memory monitoring in the background
+  # memoryMonitorPid=$!
+  # YOUR_COMMAND_HERE
+  # kill $memoryMonitorPid
+  while true; do
+    echo "$(date) - Top 5 memory-consuming processes:"
+    ps -eo pid,comm,%mem --sort=-%mem | head -n 6  # First line is the header, next 5 are top processes
+    sleep 2
+  done
+}
+
 cypress-run-applitools() {
   cd "$GITHUB_WORKSPACE/superset-frontend/cypress-base"
 
@@ -235,9 +286,7 @@ cypress-run-applitools() {
   nohup flask run --no-debugger -p $port >"$flasklog" 2>&1 </dev/null &
   local flaskProcessId=$!
 
-  $cypress --spec "cypress/e2e/*/**/*.applitools.test.ts" --browser "$browser" --headless --config ignoreTestFiles="[]"
-
-  codecov -c -F "cypress" || true
+  $cypress --spec "cypress/applitools/**/*" --browser "$browser" --headless
 
   say "::group::Flask log for default run"
   cat "$flasklog"

.github/workflows/bump-python-package.yml

@@ -0,0 +1,77 @@
+name: Bump Python Package
+
+on:
+  # Can be triggered manually
+  workflow_dispatch:
+    inputs:
+      package:
+        required: false
+        description: The python package to bump (all if empty)
+      group:
+        required: false
+        description: The optional dependency group to bump (as defined in pyproject.toml)
+      limit:
+        required: true
+        description: Max number of PRs to open (0 for no limit)
+        default: 5
+      extra-flags:
+        required: false
+        default: --only-base
+        description: Additional flags to pass to the bump-python command
+  #schedule:
+  #  - cron: '0 0 * * *'  # Runs daily at midnight UTC
+
+jobs:
+  bump-python-package:
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
+      checks: write
+    steps:
+
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: true
+          ref: master
+
+      - name: Setup supersetbot
+        uses: ./.github/actions/setup-supersetbot/
+
+      - name: Set up Python ${{ inputs.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
+      - name: Install uv
+        run: pip install uv
+
+      - name: supersetbot bump-python -p "${{ github.event.inputs.package }}"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config --global user.email "action@github.com"
+          git config --global user.name "GitHub Action"
+
+          PACKAGE_OPT=""
+          if [ -n "${{ github.event.inputs.package }}" ]; then
+            PACKAGE_OPT="-p ${{ github.event.inputs.package }}"
+          fi
+
+          GROUP_OPT=""
+          if [ -n "${{ github.event.inputs.group }}" ]; then
+            GROUP_OPT="-g ${{ github.event.inputs.group }}"
+          fi
+
+          EXTRA_FLAGS="${{ github.event.inputs.extra-flags }}"
+
+          supersetbot bump-python \
+            --verbose \
+            --use-current-repo \
+            --include-subpackages \
+            --limit ${{ github.event.inputs.limit }} \
+            $PACKAGE_OPT \
+            $GROUP_OPT \
+            $EXTRA_FLAGS

.github/workflows/cancel_duplicates.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   cancel-duplicate-runs:
     name: Cancel duplicate workflow runs
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     permissions:
       actions: write
       contents: read
@@ -31,7 +31,7 @@ jobs:
 
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         if: steps.check_queued.outputs.count >= 20
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Cancel duplicate workflow runs
         if: steps.check_queued.outputs.count >= 20

.github/workflows/check-python-deps.yml

@@ -0,0 +1,59 @@
+name: Check python dependencies
+
+on:
+  push:
+    branches:
+      - "master"
+      - "[0-9].[0-9]*"
+  pull_request:
+    types: [synchronize, opened, reopened, ready_for_review]
+
+# cancel previous workflow jobs for PRs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  check-python-deps:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          submodules: recursive
+          fetch-depth: 1
+
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Python
+        if: steps.check.outputs.python
+        uses: ./.github/actions/setup-backend/
+
+      - name: Run uv
+        if: steps.check.outputs.python
+        run: ./scripts/uv-pip-compile.sh
+
+      - name: Check for uncommitted changes
+        if: steps.check.outputs.python
+        run: |
+          echo "Full diff (for logging/debugging):"
+          git diff
+
+          echo "Filtered diff (excluding comments and whitespace):"
+          filtered_diff=$(git diff -U0 | grep '^[-+]' | grep -vE '^[-+]{3}' | grep -vE '^[-+][[:space:]]*#' | grep -vE '^[-+][[:space:]]*$' || true)
+          echo "$filtered_diff"
+
+          if [[ -n "$filtered_diff" ]]; then
+            echo
+            echo "ERROR: The pinned dependencies are not up-to-date."
+            echo "Please run './scripts/uv-pip-compile.sh' and commit the changes."
+            echo "More info: https://github.com/apache/superset/tree/master/requirements"
+            exit 1
+          else
+            echo "Pinned dependencies are up-to-date."
+          fi

.github/workflows/check_db_migration_confict.yml

@@ -5,7 +5,7 @@ on:
       - "superset/migrations/**"
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
   pull_request:
     paths:
       - "superset/migrations/**"
@@ -19,13 +19,13 @@ concurrency:
 jobs:
   check_db_migration_conflict:
     name: Check DB migration conflict
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Check and notify
         uses: actions/github-script@v7
         with:

.github/workflows/claude.yml

@@ -0,0 +1,82 @@
+name: Claude PR Assistant
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+jobs:
+  check-permissions:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude'))
+    runs-on: ubuntu-latest
+    outputs:
+      allowed: ${{ steps.check.outputs.allowed }}
+    steps:
+      - name: Check if user is allowed
+        id: check
+        run: |
+          # List of allowed users
+          ALLOWED_USERS="mistercrunch,rusackas"
+
+          # Get the commenter's username
+          COMMENTER="${{ github.event.comment.user.login }}"
+
+          echo "Checking permissions for user: $COMMENTER"
+
+          # Check if user is in allowed list
+          if [[ ",$ALLOWED_USERS," == *",$COMMENTER,"* ]]; then
+            echo "allowed=true" >> $GITHUB_OUTPUT
+            echo "✅ User $COMMENTER is allowed to use Claude"
+          else
+            echo "allowed=false" >> $GITHUB_OUTPUT
+            echo "❌ User $COMMENTER is not allowed to use Claude"
+          fi
+
+  deny-access:
+    needs: check-permissions
+    if: needs.check-permissions.outputs.allowed == 'false'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Comment access denied
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const message = `👋 Hi @${{ github.event.comment.user.login || github.event.review.user.login || github.event.issue.user.login }}!
+
+            Thanks for trying to use Claude Code, but currently only certain team members have access to this feature.
+
+            If you believe you should have access, please contact a project maintainer.`;
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: message
+            });
+
+  claude-code-action:
+    needs: check-permissions
+    if: needs.check-permissions.outputs.allowed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+      with:
+        fetch-depth: 1
+
+    - name: Run Claude PR Action
+      uses: anthropics/claude-code-action@beta
+      with:
+        anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+        timeout_minutes: "60"

.github/workflows/codeql-analysis.yml

@@ -2,14 +2,10 @@ name: "CodeQL"
 
 on:
   push:
-    branches: ["master", "[0-9].[0-9]"]
-    paths:
-      - "superset/**"
+    branches: ["master", "[0-9].[0-9]*"]
   pull_request:
     # The branches below must be a subset of the branches above
     branches: ["master"]
-    paths:
-      - "superset/**"
   schedule:
     - cron: "0 4 * * *"
 
@@ -21,7 +17,7 @@ concurrency:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       actions: read
       contents: read
@@ -35,7 +31,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
@@ -50,6 +52,7 @@ jobs:
           # queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
+        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: github/codeql-action/analyze@v3
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -5,23 +5,67 @@
 # Source repository: https://github.com/actions/dependency-review-action
 # Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
 name: "Dependency Review"
-on: [pull_request]
+on:
+  push:
+    branches:
+      - "master"
+      - "[0-9].[0-9]*"
+  pull_request:
+    types: [synchronize, opened, reopened, ready_for_review]
+
+# cancel previous workflow jobs for PRs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: "Dependency Review"
         uses: actions/dependency-review-action@v4
+        continue-on-error: true
         with:
           fail-on-severity: critical
           # compatible/incompatible licenses addressed here: https://www.apache.org/legal/resolved.html
           # find SPDX identifiers here: https://spdx.org/licenses/
           deny-licenses: MS-LPL, BUSL-1.1, QPL-1.0, Sleepycat, SSPL-1.0, CPOL-1.02, AGPL-3.0, GPL-1.0+, BSD-4-Clause-UC, NPL-1.0, NPL-1.1, JSON
-          # adding an exception for an ambigious license on store2, which has been resolved in the latest version. It's MIT: https://github.com/nbubna/store/blob/master/LICENSE-MIT
-          allow-dependencies-licenses: 'pkg:npm/store2@2.14.2'
+          # pkg:npm/store2@2.14.2
+          #   adding an exception for an ambigious license on store2, which has been resolved in
+          #   the latest version. It's MIT: https://github.com/nbubna/store/blob/master/LICENSE-MIT
+          # pkg:npm/applitools/*
+          #   adding exception for all applitools modules (eyes-cypress and its dependencies),
+          #   which has an explicit OSS license approved by ASF
+          #   license: https://applitools.com/legal/open-source-terms-of-use/
+          # pkg:npm/node-forge@1.3.1
+          #   selecting BSD-3-Clause licensing terms for node-forge to ensure compatibility with Apache
+          allow-dependencies-licenses: pkg:npm/store2@2.14.2, pkg:npm/applitools/core, pkg:npm/applitools/core-base, pkg:npm/applitools/css-tree, pkg:npm/applitools/ec-client, pkg:npm/applitools/eg-socks5-proxy-server, pkg:npm/applitools/eyes, pkg:npm/applitools/eyes-cypress, pkg:npm/applitools/nml-client, pkg:npm/applitools/tunnel-client, pkg:npm/applitools/utils, pkg:npm/node-forge@1.3.1, pkg:npm/rgbcolor, pkg:npm/jszip@3.10.1
+
+  python-dependency-liccheck:
+    # NOTE: Configuration for liccheck lives in our pyproject.yml.
+    # You cannot use a liccheck.ini file in this workflow.
+    runs-on: ubuntu-22.04
+    steps:
+      - name: "Checkout Repository"
+        uses: actions/checkout@v5
+
+      - name: Setup Python
+        uses: ./.github/actions/setup-backend/
+        with:
+          requirements-type: base
+
+      - name: "Set up liccheck"
+        run: |
+          uv pip install --system liccheck
+      - name: "Run liccheck"
+        run: |
+          # run the checks
+          liccheck -R output.txt
+          # Print the report
+          cat output.txt

.github/workflows/docker-release.yml

@@ -1,85 +0,0 @@
-name: Docker Publish Release
-
-on:
-  release:
-    types: [published, edited]
-
-  # Can be triggered manually
-  workflow_dispatch:
-    inputs:
-      release:
-        required: true
-        description: The version to generate
-      git-ref:
-        required: true
-        description: The git reference to checkout prior to running the docker build
-      force-latest:
-        required: true
-        type: choice
-        default: 'false'
-        description: Whether to force a latest tag on the release
-        options:
-          - true
-          - false
-jobs:
-  config:
-    runs-on: "ubuntu-latest"
-    outputs:
-      has-secrets: ${{ steps.check.outputs.has-secrets }}
-    steps:
-      - name: "Check for secrets"
-        id: check
-        shell: bash
-        run: |
-          if [ -n "${{ (secrets.DOCKERHUB_USER != '' && secrets.DOCKERHUB_TOKEN != '') || '' }}" ]; then
-            echo "has-secrets=1" >> "$GITHUB_OUTPUT"
-          fi
-
-  docker-release:
-    needs: config
-    if: needs.config.outputs.has-secrets
-    name: docker-release
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        build_preset: ["dev", "lean", "py310", "websocket", "dockerize"]
-      fail-fast: false
-    steps:
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Setup Node Env
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-      - run: npm install -g supersetbot
-      - name: Execute custom Node.js script
-        env:
-          DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
-          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-        run: |
-          RELEASE="${{ github.event.release.tag_name }}"
-          FORCE_LATEST=""
-          EVENT="${{github.event_name}}"
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            # in the case of a manually-triggered run, read release from input
-            RELEASE="${{ github.event.inputs.release }}"
-            if [ "${{ github.event.inputs.force-latest }}" = "true" ]; then
-              FORCE_LATEST="--force-latest"
-            fi
-            # build_docker.py may not exist on that SHA, let's switcharoo to /tmp
-            cp ./scripts/build_docker.py /tmp
-            git checkout "${{ github.event.inputs.git-ref }}"
-            cp /tmp/build_docker.py scripts/
-            EVENT="release"
-          fi
-
-          supersetbot docker \
-            --preset ${{ matrix.build_preset }} \
-            --context "$EVENT" \
-            --context-ref "$RELEASE" $FORCE_LATEST \
-            --platform "linux/arm64" \
-            --platform "linux/amd64"

.github/workflows/docker.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
   pull_request:
     branches:
       - "master"
@@ -14,21 +14,22 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+
   setup_matrix:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       matrix_config: ${{ steps.set_matrix.outputs.matrix_config }}
     steps:
       - id: set_matrix
         run: |
-          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["ci"]'; else echo '["dev", "lean", "py310", "websocket", "dockerize"]'; fi)
+          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]'; fi)
           echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
           echo $GITHUB_OUTPUT
 
   docker-build:
     name: docker-build
     needs: setup_matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         build_preset: ${{fromJson(needs.setup_matrix.outputs.matrix_config)}}
@@ -36,47 +37,104 @@ jobs:
     env:
       DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+      IMAGE_TAG: apache/superset:GHA-${{ matrix.build_preset }}-${{ github.run_id }}
 
     steps:
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Try to login to DockerHub
-        continue-on-error: true
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USER }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Setup Node Env
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-      - name: install supersetbot
-        run: |
-          npm install -g supersetbot
-
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
 
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Docker Environment
+        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
+        uses: ./.github/actions/setup-docker
+        with:
+          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          build: "true"
+
+      - name: Setup supersetbot
+        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
+        uses: ./.github/actions/setup-supersetbot/
+
       - name: Build Docker Image
+        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
         shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           # Single platform builds in pull_request context to speed things up
           if [ "${{ github.event_name }}" = "push" ]; then
             PLATFORM_ARG="--platform linux/arm64 --platform linux/amd64"
+            # can only --load images in single-platform builds
+            PUSH_OR_LOAD="--push"
           elif [ "${{ github.event_name }}" = "pull_request" ]; then
             PLATFORM_ARG="--platform linux/amd64"
+            PUSH_OR_LOAD="--load"
           fi
 
           supersetbot docker \
+            $PUSH_OR_LOAD \
             --preset ${{ matrix.build_preset }} \
             --context "$EVENT" \
             --context-ref "$RELEASE" $FORCE_LATEST \
+            --extra-flags "--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
             $PLATFORM_ARG
+
+      # in the context of push (using multi-platform build), we need to pull the image locally
+      - name: Docker pull
+        if: github.event_name == 'push' && (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker)
+        run:  docker pull $IMAGE_TAG
+
+      - name: Print docker stats
+        if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
+        run: |
+          echo "SHA: ${{ github.sha }}"
+          echo "IMAGE: $IMAGE_TAG"
+          docker images $IMAGE_TAG
+          docker history $IMAGE_TAG
+
+      - name: docker-compose sanity check
+        if: (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && matrix.build_preset == 'dev'
+        shell: bash
+        run: |
+          export SUPERSET_BUILD_TARGET=${{ matrix.build_preset }}
+          # This should reuse the CACHED image built in the previous steps
+          docker compose build superset-init --build-arg DEV_MODE=false --build-arg INCLUDE_CHROMIUM=false
+          docker compose up superset-init --exit-code-from superset-init
+
+  docker-compose-image-tag:
+    # Run this job only on pushes to master (not for PRs)
+    # goal is to check that building the latest image works, not required for all PR pushes
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup Docker Environment
+        if: steps.check.outputs.docker
+        uses: ./.github/actions/setup-docker
+        with:
+          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          build: "false"
+          install-docker-compose: "true"
+      - name: docker-compose sanity check
+        if: steps.check.outputs.docker
+        shell: bash
+        run: |
+          docker compose -f docker-compose-image-tag.yml up superset-init --exit-code-from superset-init

.github/workflows/embedded-sdk-release.yml

@@ -4,11 +4,11 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
 
 jobs:
   config:
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-24.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -23,16 +23,16 @@ jobs:
   build:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     defaults:
       run:
         working-directory: superset-embedded-sdk
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: actions/setup-node@v4
         with:
-          node-version: "16"
-          registry-url: "https://registry.npmjs.org"
+          node-version-file: './superset-embedded-sdk/.nvmrc'
+          registry-url: 'https://registry.npmjs.org'
       - run: npm ci
       - run: npm run ci:release
         env:

.github/workflows/embedded-sdk-test.yml

@@ -13,15 +13,15 @@ concurrency:
 
 jobs:
   embedded-sdk-test:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     defaults:
       run:
         working-directory: superset-embedded-sdk
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: actions/setup-node@v4
         with:
-          node-version: "16"
+          node-version-file: './superset-embedded-sdk/.nvmrc'
           registry-url: 'https://registry.npmjs.org'
       - run: npm ci
       - run: npm test

.github/workflows/ephemeral-env-pr-close.yml

@@ -1,4 +1,10 @@
-name: Cleanup ephemeral envs (PR close)
+name: Cleanup ephemeral envs (PR close) [DEPRECATED]
+
+# ⚠️  DEPRECATION NOTICE ⚠️
+# This workflow is deprecated and will be removed in a future version.
+# The new Superset Showtime workflow handles cleanup automatically.
+# See .github/workflows/showtime.yml and showtime-cleanup.yml for replacements.
+# Migration guide: https://github.com/mistercrunch/superset-showtime
 
 on:
   pull_request_target:
@@ -6,7 +12,7 @@ on:
 
 jobs:
   config:
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-24.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -22,7 +28,7 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: Cleanup ephemeral envs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       pull-requests: write
     steps:
@@ -71,5 +77,5 @@ jobs:
               issue_number: ${{ github.event.number }},
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: 'Ephemeral environment shutdown and build artifacts deleted.'
+              body: '⚠️ **DEPRECATED WORKFLOW** - Ephemeral environment shutdown and build artifacts deleted. Please migrate to the new Superset Showtime system for future PRs.'
             })

.github/workflows/ephemeral-env.yml

@@ -1,132 +1,192 @@
-name: Ephemeral env workflow
+name: Ephemeral env workflow [DEPRECATED]
+
+# ⚠️  DEPRECATION NOTICE ⚠️
+# This workflow is deprecated and will be removed in a future version.
+# Please use the new Superset Showtime workflow instead:
+# - Use label "🎪 trigger-start" instead of "testenv-up"
+# - Showtime provides better reliability and easier management
+# - See .github/workflows/showtime.yml for the replacement
+# - Migration guide: https://github.com/mistercrunch/superset-showtime
+
+# Example manual trigger:
+# gh workflow run ephemeral-env.yml --ref fix_ephemerals --field label_name="testenv-up" --field issue_number=666
 
 on:
-  issue_comment:
-    types: [created]
+  pull_request_target:
+    types:
+      - labeled
+  workflow_dispatch:
+    inputs:
+      label_name:
+        description: 'Label name to simulate label-based /testenv trigger'
+        required: true
+        default: 'testenv-up'
+      issue_number:
+        description: 'Issue or PR number'
+        required: true
 
 jobs:
-  config:
-    runs-on: "ubuntu-latest"
-    if: github.event.issue.pull_request
-    outputs:
-      has-secrets: ${{ steps.check.outputs.has-secrets }}
-    steps:
-      - name: "Check for secrets"
-        id: check
-        shell: bash
-        run: |
-          if [ -n "${{ (secrets.AWS_ACCESS_KEY_ID != '' && secrets.AWS_SECRET_ACCESS_KEY != '') || '' }}" ]; then
-            echo "has-secrets=1" >> "$GITHUB_OUTPUT"
-          fi
-
-  ephemeral-env-comment:
+  ephemeral-env-label:
     concurrency:
-      group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}-comment
+      group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}-label
       cancel-in-progress: true
-    needs: config
-    if: needs.config.outputs.has-secrets
-    name: Evaluate ephemeral env comment trigger (/testenv)
-    runs-on: ubuntu-latest
+    name: Evaluate ephemeral env label trigger
+    runs-on: ubuntu-24.04
     permissions:
       pull-requests: write
     outputs:
-      slash-command: ${{ steps.eval-body.outputs.result }}
+      slash-command: ${{ steps.eval-label.outputs.result }}
       feature-flags: ${{ steps.eval-feature-flags.outputs.result }}
+      sha: ${{ steps.get-sha.outputs.sha }}
+    env:
+      DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
 
     steps:
-    - name: Debug
-      run: |
-        echo "Comment on PR #${{ github.event.issue.number }} by ${{ github.event.issue.user.login }}, ${{ github.event.comment.author_association }}"
+      - name: Check for the "testenv-up" label
+        id: eval-label
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            LABEL_NAME="${{ github.event.inputs.label_name }}"
+          else
+            LABEL_NAME="${{ github.event.label.name }}"
+          fi
 
-    - name: Eval comment body for /testenv slash command
-      uses: actions/github-script@v7
-      id: eval-body
-      with:
-        result-encoding: string
-        script: |
-          const pattern = /^\/testenv (up|down)/
-          const result = pattern.exec(context.payload.comment.body)
-          return result === null ? 'noop' : result[1]
+          echo "Evaluating label: $LABEL_NAME"
 
-    - name: Eval comment body for feature flags
-      uses: actions/github-script@v7
-      id: eval-feature-flags
-      with:
-        script: |
-          const pattern = /FEATURE_(\w+)=(\w+)/g;
-          let results = [];
-          [...context.payload.comment.body.matchAll(pattern)].forEach(match => {
-            const config = {
-              name: `SUPERSET_FEATURE_${match[1]}`,
-              value: match[2],
-            };
-            results.push(config);
-          });
-          return results;
+          if [[ "$LABEL_NAME" == "testenv-up" ]]; then
+            echo "result=up" >> $GITHUB_OUTPUT
+          else
+            echo "result=noop" >> $GITHUB_OUTPUT
+          fi
 
-    - name: Limit to committers
-      if: >
-        steps.eval-body.outputs.result != 'noop' &&
-        github.event.comment.author_association != 'MEMBER' &&
-        github.event.comment.author_association != 'OWNER'
-      uses: actions/github-script@v7
-      with:
-        github-token: ${{github.token}}
-        script: |
-          const errMsg = '@${{ github.event.comment.user.login }} Ephemeral environment creation is currently limited to committers.'
-          github.rest.issues.createComment({
-            issue_number: ${{ github.event.issue.number }},
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: errMsg
-          })
-          core.setFailed(errMsg)
+      - name: Get event SHA
+        id: get-sha
+        if: steps.eval-label.outputs.result == 'up'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            let prSha;
+
+            // If event is workflow_dispatch, use the issue_number from inputs
+            if (context.eventName === "workflow_dispatch") {
+              const prNumber = "${{ github.event.inputs.issue_number }}";
+              if (!prNumber) {
+                console.log("No PR number found.");
+                return;
+              }
+
+              // Fetch PR details using the provided issue_number
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: prNumber
+              });
+
+              prSha = pr.head.sha;
+            } else {
+              // If it's not workflow_dispatch, use the PR head sha from the event
+              prSha = context.payload.pull_request.head.sha;
+            }
+
+            console.log(`PR SHA: ${prSha}`);
+            core.setOutput("sha", prSha);
+
+      - name: Looking for feature flags in PR description
+        uses: actions/github-script@v7
+        id: eval-feature-flags
+        if: steps.eval-label.outputs.result == 'up'
+        with:
+          script: |
+            const description = context.payload.pull_request
+              ? context.payload.pull_request.body || ''
+              : context.payload.inputs.pr_description || '';
+
+            const pattern = /FEATURE_(\w+)=(\w+)/g;
+            let results = [];
+            [...description.matchAll(pattern)].forEach(match => {
+              const config = {
+                name: `SUPERSET_FEATURE_${match[1]}`,
+                value: match[2],
+              };
+              results.push(config);
+            });
+
+            return results;
+
+      - name: Reply with confirmation comment
+        uses: actions/github-script@v7
+        if: steps.eval-label.outputs.result == 'up'
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const action = '${{ steps.eval-label.outputs.result }}';
+            const user = context.actor;
+            const runId = context.runId;
+            const workflowUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId}`;
+
+            const issueNumber = context.payload.pull_request
+              ? context.payload.pull_request.number
+              : context.payload.inputs.issue_number;
+
+            if (!issueNumber) {
+              throw new Error("Issue number is not available.");
+            }
+
+            const body = `⚠️ **DEPRECATED WORKFLOW** ⚠️\n\n@${user} This workflow is deprecated! Please use the new **Superset Showtime** system instead:\n\n` +
+              `- Replace "testenv-up" label with "🎪 trigger-start"\n` +
+              `- Better reliability and easier management\n` +
+              `- See https://github.com/mistercrunch/superset-showtime for details\n\n` +
+              `Processing your ephemeral environment request [here](${workflowUrl}). Action: **${action}**.` +
+              ` More information on [how to use or configure ephemeral environments]` +
+              `(https://superset.apache.org/docs/contributing/howtos/#github-ephemeral-environments)`;
+
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issueNumber,
+              body,
+            });
 
   ephemeral-docker-build:
     concurrency:
-      group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}-build
+      group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}-build
       cancel-in-progress: true
-    needs: ephemeral-env-comment
+    needs: ephemeral-env-label
+    if: needs.ephemeral-env-label.outputs.slash-command == 'up'
     name: ephemeral-docker-build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - name: Get Info from comment
-        uses: actions/github-script@v7
-        id: get-pr-info
+      - name: "Checkout ${{ github.ref }} ( ${{ needs.ephemeral-env-label.outputs.sha }} : ${{steps.get-sha.outputs.sha}} )"
+        uses: actions/checkout@v5
         with:
-          script: |
-            const request = {
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                pull_number: ${{ github.event.issue.number }},
-            }
-            core.info(`Getting PR #${request.pull_number} from ${request.owner}/${request.repo}`)
-            const pr = await github.rest.pulls.get(request);
-            return pr.data;
-
-      - name: Debug
-        id: get-sha
-        run: |
-          echo "sha=${{ fromJSON(steps.get-pr-info.outputs.result).head.sha }}" >> $GITHUB_OUTPUT
-
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} : ${{steps.get-sha.outputs.sha}} )"
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ steps.get-sha.outputs.sha }}
+          ref: ${{ needs.ephemeral-env-label.outputs.sha }}
           persist-credentials: false
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Setup Docker Environment
+        uses: ./.github/actions/setup-docker
+        with:
+          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          build: "true"
+          install-docker-compose: "false"
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Setup supersetbot
+        uses: ./.github/actions/setup-supersetbot/
 
       - name: Build ephemeral env image
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          ./scripts/build_docker.py \
-            "ci" \
-            "pull_request" \
-            --build_context_ref ${{ github.event.issue.number }}
+          supersetbot docker \
+            --push \
+            --load \
+            --preset ci \
+            --platform  linux/amd64 \
+            --context-ref "$RELEASE" \
+            --extra-flags "--build-arg INCLUDE_CHROMIUM=false"
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -144,140 +204,141 @@ jobs:
         env:
           ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
           ECR_REPOSITORY: superset-ci
-          IMAGE_TAG: apache/superset:${{ steps.get-sha.outputs.sha }}-ci
+          IMAGE_TAG: apache/superset:${{ needs.ephemeral-env-label.outputs.sha }}-ci
+          PR_NUMBER: ${{ github.event.inputs.issue_number || github.event.pull_request.number }}
         run: |
-          docker tag $IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:pr-${{ github.event.issue.number }}-ci
+          docker tag $IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:pr-$PR_NUMBER-ci
           docker push -a $ECR_REGISTRY/$ECR_REPOSITORY
 
   ephemeral-env-up:
-    needs: [ephemeral-env-comment, ephemeral-docker-build]
-    if: needs.ephemeral-env-comment.outputs.slash-command == 'up'
+    needs: [ephemeral-env-label, ephemeral-docker-build]
+    if: needs.ephemeral-env-label.outputs.slash-command == 'up'
     name: Spin up an ephemeral environment
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: write
 
     steps:
-    - uses: actions/checkout@v4
-      with:
-        persist-credentials: false
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v4
-      with:
-        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        aws-region: us-west-2
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-west-2
 
-    - name: Login to Amazon ECR
-      id: login-ecr
-      uses: aws-actions/amazon-ecr-login@v2
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
 
-    - name: Check target image exists in ECR
-      id: check-image
-      continue-on-error: true
-      run: |
-        aws ecr describe-images \
-        --registry-id $(echo "${{ steps.login-ecr.outputs.registry }}" | grep -Eo "^[0-9]+") \
-        --repository-name superset-ci \
-        --image-ids imageTag=pr-${{ github.event.issue.number }}-ci
+      - name: Check target image exists in ECR
+        id: check-image
+        continue-on-error: true
+        env:
+          PR_NUMBER: ${{ github.event.inputs.issue_number || github.event.pull_request.number }}
+        run: |
+          aws ecr describe-images \
+          --registry-id $(echo "${{ steps.login-ecr.outputs.registry }}" | grep -Eo "^[0-9]+") \
+          --repository-name superset-ci \
+          --image-ids imageTag=pr-$PR_NUMBER-ci
 
-    - name: Fail on missing container image
-      if: steps.check-image.outcome == 'failure'
-      uses: actions/github-script@v7
-      with:
-        github-token: ${{github.token}}
-        script: |
-          const errMsg = '@${{ github.event.comment.user.login }} Container image not yet published for this PR. Please try again when build is complete.'
-          github.rest.issues.createComment({
-            issue_number: ${{ github.event.issue.number }},
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: errMsg
-          })
-          core.setFailed(errMsg)
+      - name: Fail on missing container image
+        if: steps.check-image.outcome == 'failure'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ github.token }}
+          script: |
+            const errMsg = '@${{ github.event.comment.user.login }} Container image not yet published for this PR. Please try again when build is complete.';
+            github.rest.issues.createComment({
+              issue_number: ${{ github.event.inputs.issue_number || github.event.pull_request.number }},
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: errMsg
+            });
+            core.setFailed(errMsg);
 
-    - name: Fill in the new image ID in the Amazon ECS task definition
-      id: task-def
-      uses: aws-actions/amazon-ecs-render-task-definition@v1
-      with:
-        task-definition: .github/workflows/ecs-task-definition.json
-        container-name: superset-ci
-        image: ${{ steps.login-ecr.outputs.registry }}/superset-ci:pr-${{ github.event.issue.number }}-ci
+      - name: Fill in the new image ID in the Amazon ECS task definition
+        id: task-def
+        uses: aws-actions/amazon-ecs-render-task-definition@v1
+        with:
+          task-definition: .github/workflows/ecs-task-definition.json
+          container-name: superset-ci
+          image: ${{ steps.login-ecr.outputs.registry }}/superset-ci:pr-${{ github.event.inputs.issue_number || github.event.pull_request.number }}-ci
 
-    - name: Update env vars in the Amazon ECS task definition
-      run: |
-        cat <<< "$(jq '.containerDefinitions[0].environment += ${{ needs.ephemeral-env-comment.outputs.feature-flags }}' < ${{ steps.task-def.outputs.task-definition }})" > ${{ steps.task-def.outputs.task-definition }}
+      - name: Update env vars in the Amazon ECS task definition
+        run: |
+          cat <<< "$(jq '.containerDefinitions[0].environment += ${{ needs.ephemeral-env-label.outputs.feature-flags }}' < ${{ steps.task-def.outputs.task-definition }})" > ${{ steps.task-def.outputs.task-definition }}
 
-    - name: Describe ECS service
-      id: describe-services
-      run: |
-        echo "active=$(aws ecs describe-services --cluster superset-ci --services pr-${{ github.event.issue.number }}-service | jq '.services[] | select(.status == "ACTIVE") | any')" >> $GITHUB_OUTPUT
-    - name: Create ECS service
-      if: steps.describe-services.outputs.active != 'true'
-      id: create-service
-      env:
-        ECR_SUBNETS: subnet-0e15a5034b4121710,subnet-0e8efef4a72224974
-        ECR_SECURITY_GROUP: sg-092ff3a6ae0574d91
-      run: |
-        aws ecs create-service \
-        --cluster superset-ci \
-        --service-name pr-${{ github.event.issue.number }}-service \
-        --task-definition superset-ci \
-        --launch-type FARGATE \
-        --desired-count 1 \
-        --platform-version LATEST \
-        --network-configuration "awsvpcConfiguration={subnets=[$ECR_SUBNETS],securityGroups=[$ECR_SECURITY_GROUP],assignPublicIp=ENABLED}" \
-        --tags key=pr,value=${{ github.event.issue.number }} key=github_user,value=${{ github.actor }}
+      - name: Describe ECS service
+        id: describe-services
+        run: |
+          echo "active=$(aws ecs describe-services --cluster superset-ci --services pr-${{ github.event.inputs.issue_number || github.event.pull_request.number }}-service | jq '.services[] | select(.status == "ACTIVE") | any')" >> $GITHUB_OUTPUT
+      - name: Create ECS service
+        id: create-service
+        if: steps.describe-services.outputs.active != 'true'
+        env:
+          ECR_SUBNETS: subnet-0e15a5034b4121710,subnet-0e8efef4a72224974
+          ECR_SECURITY_GROUP: sg-092ff3a6ae0574d91
+          PR_NUMBER: ${{ github.event.inputs.issue_number || github.event.pull_request.number }}
+        run: |
+          aws ecs create-service \
+          --cluster superset-ci \
+          --service-name pr-$PR_NUMBER-service \
+          --task-definition superset-ci \
+          --launch-type FARGATE \
+          --desired-count 1 \
+          --platform-version LATEST \
+          --network-configuration "awsvpcConfiguration={subnets=[$ECR_SUBNETS],securityGroups=[$ECR_SECURITY_GROUP],assignPublicIp=ENABLED}" \
+          --tags key=pr,value=$PR_NUMBER key=github_user,value=${{ github.actor }}
+      - name: Deploy Amazon ECS task definition
+        id: deploy-task
+        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
+        with:
+          task-definition: ${{ steps.task-def.outputs.task-definition }}
+          service: pr-${{ github.event.inputs.issue_number || github.event.pull_request.number }}-service
+          cluster: superset-ci
+          wait-for-service-stability: true
+          wait-for-minutes: 10
 
-    - name: Deploy Amazon ECS task definition
-      id: deploy-task
-      uses: aws-actions/amazon-ecs-deploy-task-definition@v1
-      with:
-        task-definition: ${{ steps.task-def.outputs.task-definition }}
-        service: pr-${{ github.event.issue.number }}-service
-        cluster: superset-ci
-        wait-for-service-stability: true
-        wait-for-minutes: 10
-
-    - name: List tasks
-      id: list-tasks
-      run: |
-        echo "task=$(aws ecs list-tasks --cluster superset-ci --service-name pr-${{ github.event.issue.number }}-service | jq '.taskArns | first')" >> $GITHUB_OUTPUT
-
-    - name: Get network interface
-      id: get-eni
-      run: |
-        echo "eni=$(aws ecs describe-tasks --cluster superset-ci --tasks ${{ steps.list-tasks.outputs.task }} | jq '.tasks | .[0] | .attachments | .[0] | .details | map(select(.name=="networkInterfaceId")) | .[0] | .value')" >> $GITHUB_OUTPUT
-
-    - name: Get public IP
-      id: get-ip
-      run: |
-        echo "ip=$(aws ec2 describe-network-interfaces --network-interface-ids ${{ steps.get-eni.outputs.eni }} | jq -r '.NetworkInterfaces | first | .Association.PublicIp')" >> $GITHUB_OUTPUT
-
-    - name: Comment (success)
-      if: ${{ success() }}
-      uses: actions/github-script@v7
-      with:
-        github-token: ${{github.token}}
-        script: |
-          github.rest.issues.createComment({
-            issue_number: ${{ github.event.issue.number }},
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: '@${{ github.event.comment.user.login }} Ephemeral environment spinning up at http://${{ steps.get-ip.outputs.ip }}:8080. Credentials are `admin`/`admin`. Please allow several minutes for bootstrapping and startup.'
-          })
-
-    - name: Comment (failure)
-      if: ${{ failure() }}
-      uses: actions/github-script@v7
-      with:
-        github-token: ${{github.token}}
-        script: |
-          github.rest.issues.createComment({
-            issue_number: ${{ github.event.issue.number }},
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: '@${{ github.event.comment.user.login }} Ephemeral environment creation failed. Please check the Actions logs for details.'
-          })
+      - name: List tasks
+        id: list-tasks
+        run: |
+          echo "task=$(aws ecs list-tasks --cluster superset-ci --service-name pr-${{ github.event.inputs.issue_number || github.event.pull_request.number }}-service | jq '.taskArns | first')" >> $GITHUB_OUTPUT
+      - name: Get network interface
+        id: get-eni
+        run: |
+          echo "eni=$(aws ecs describe-tasks --cluster superset-ci --tasks ${{ steps.list-tasks.outputs.task }} | jq '.tasks[0].attachments[0].details | map(select(.name=="networkInterfaceId"))[0].value')" >> $GITHUB_OUTPUT
+      - name: Get public IP
+        id: get-ip
+        run: |
+          echo "ip=$(aws ec2 describe-network-interfaces --network-interface-ids ${{ steps.get-eni.outputs.eni }} | jq -r '.NetworkInterfaces | first | .Association.PublicIp')" >> $GITHUB_OUTPUT
+      - name: Comment (success)
+        if: ${{ success() }}
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{github.token}}
+          script: |
+            const issue_number = context.payload.inputs?.issue_number || context.issue.number;
+            github.rest.issues.createComment({
+              issue_number: issue_number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `@${{ github.actor }} Ephemeral environment spinning up at http://${{ steps.get-ip.outputs.ip }}:8080. Credentials are 'admin'/'admin'. Please allow several minutes for bootstrapping and startup.`
+            });
+      - name: Comment (failure)
+        if: ${{ failure() }}
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{github.token}}
+          script: |
+            const issue_number = context.payload.inputs?.issue_number || context.issue.number;
+            github.rest.issues.createComment({
+              issue_number: issue_number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: '@${{ github.event.inputs.user_login || github.event.comment.user.login }} Ephemeral environment creation failed. Please check the Actions logs for details.'
+            })

.github/workflows/generate-FOSSA-report.yml

@@ -4,11 +4,11 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
 
 jobs:
   config:
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-24.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -24,15 +24,15 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: Generate Report
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "11"

.github/workflows/github-action-validator.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Inspired from https://github.com/mpalmer/action-validator?tab=readme-ov-file#pre-commit-hook-example
+echo "Running pre-commit hook for GitHub Actions: https://github.com/mpalmer/action-validator"
+	for action in $(git ls-files .github/ | grep -E '^\.github/(workflows|actions)/.*\.ya?ml$'); do
+  if action-validator "$action"; then
+	echo "✅ $action"
+  else
+	echo "❌ $action"
+	exit 1
+  fi
+done

.github/workflows/github-action-validator.yml

@@ -0,0 +1,28 @@
+name: Validate All GitHub Actions
+
+on:
+  push:
+    branches:
+      - "master"
+      - "[0-9].[0-9]*"
+  pull_request:
+    types: [synchronize, opened, reopened, ready_for_review]
+
+jobs:
+
+  validate-all-ghas:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v5
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install Dependencies
+        run: npm install -g @action-validator/core @action-validator/cli --save-dev
+
+      - name: Run Script
+        run: bash .github/workflows/github-action-validator.sh

.github/workflows/issue_creation.yml

@@ -0,0 +1,34 @@
+name: supersetbot orglabel based on author
+
+on:
+  issues:
+    types: [created, edited]
+
+  pull_request:
+    types: [created, edited]
+
+jobs:
+  superbot-orglabel:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+    steps:
+
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Setup supersetbot
+        uses: ./.github/actions/setup-supersetbot/
+
+      - name: Execute supersetbot orglabel command
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Label the issue with the appropriate org using supersetbot
+          # - this requires for the author to be publicly associated with their org
+          # - and for the org to be listed in `supersetbot/src/metadata.js`
+          supersetbot orglabel --issue ${{ github.event.number }} --repo ${{ github.repository }} || true

.github/workflows/labeler.yml

@@ -7,7 +7,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/labeler@v5
       with:

.github/workflows/latest-release-tag.yml

@@ -6,13 +6,13 @@ on:
 jobs:
   latest-release:
     name: Add/update tag to new release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
 
     steps:
     - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
         submodules: recursive

.github/workflows/license-check.yml

@@ -12,15 +12,15 @@ concurrency:
 jobs:
   license_check:
     name: License Check
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '11'

.github/workflows/no-hold-label.yml

@@ -11,7 +11,7 @@ concurrency:
 
 jobs:
   check-hold-label:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Check for 'hold' label
       uses: actions/github-script@v7

.github/workflows/no-op.yml

@@ -1,54 +0,0 @@
-# no-op.yml
-#
-# Purpose:
-# This workflow provides a workaround for the "required status checks" feature in GitHub Actions
-# when using path-specific conditions in other workflows. Required checks might remain in a "Pending"
-# state if the conditions are not met, thus blocking pull requests from being merged.
-# This no-op (no operation) workflow provides dummy success statuses for these required jobs when
-# the real jobs do not run due to path-specific conditions.
-#
-# How it works:
-# - It defines jobs with the same names as the required jobs in the main workflows.
-# - These jobs simply execute a command (`exit 0`) to succeed immediately.
-# - When a pull request is created or updated, both this no-op workflow and the main workflows are triggered.
-# - If the main workflows' jobs don't run (due to path conditions), these no-op jobs provide successful statuses.
-# - If the main workflows' jobs do run and fail, their failure statuses take precedence,
-#   ensuring that pull requests are not merged with failing checks.
-#
-# Usage:
-# - Ensure that the job names in this workflow match exactly the names of the corresponding jobs in the main workflows.
-# - This workflow should be kept as-is, without path-specific conditions.
-
-name: no-op Checks
-on: pull_request
-
-jobs:
-  frontend-build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: No-op for frontend-build
-        run: |
-          echo "This is a no-op step for frontend-build to ensure a successful status."
-          exit 0
-
-  pre-commit:
-    strategy:
-      matrix:
-        python-version: ["3.9"]
-    runs-on: ubuntu-latest
-    steps:
-      - name: No-op for pre-commit
-        run: |
-          echo "This is a no-op step for pre-commit to ensure a successful status."
-          exit 0
-
-  python-lint:
-    strategy:
-      matrix:
-        python-version: ["3.9"]
-    runs-on: ubuntu-latest
-    steps:
-      - name: No-op for python-lint
-        run: |
-          echo "This is a no-op step for python-lint to ensure a successful status."
-          exit 0

.github/workflows/pr-lint.yml

@@ -10,13 +10,13 @@ on:
 
 jobs:
   lint-check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/pre-commit.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
 
@@ -15,18 +15,20 @@ concurrency:
 
 jobs:
   pre-commit:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
-        python-version: ["3.9"]
+        python-version: ["current", "previous", "next"]
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
+        with:
+          python-version: ${{ matrix.python-version }}
       - name: Enable brew and helm-docs
         # Add brew to the path - see https://github.com/actions/runner-images/issues/6283
         run: |
@@ -36,10 +38,48 @@ jobs:
           echo "HOMEBREW_CELLAR=$HOMEBREW_CELLAR" >>"${GITHUB_ENV}"
           echo "HOMEBREW_REPOSITORY=$HOMEBREW_REPOSITORY" >>"${GITHUB_ENV}"
           brew install norwoodj/tap/helm-docs
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install Frontend Dependencies
+        run: |
+          cd superset-frontend
+          npm ci
+
+      - name: Install Docs Dependencies
+        run: |
+          cd docs
+          yarn install --immutable
+
+      - name: Cache pre-commit environments
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-v2-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('.pre-commit-config.yaml') }}
+          restore-keys: |
+            pre-commit-v2-${{ runner.os }}-py${{ matrix.python-version }}-
+
       - name: pre-commit
         run: |
-          if ! pre-commit run --all-files; then
-            git status
-            git diff
+          set +e  # Don't exit immediately on failure
+          export SKIP=eslint-frontend,type-checking-frontend
+          pre-commit run --all-files
+          PRE_COMMIT_EXIT_CODE=$?
+          git diff --quiet --exit-code
+          GIT_DIFF_EXIT_CODE=$?
+          if [ "${PRE_COMMIT_EXIT_CODE}" -ne 0 ] || [ "${GIT_DIFF_EXIT_CODE}" -ne 0 ]; then
+            if [ "${PRE_COMMIT_EXIT_CODE}" -ne 0 ]; then
+              echo "❌ Pre-commit check failed (exit code: ${EXIT_CODE})."
+            else
+              echo "❌ Git working directory is dirty."
+              echo "📌 This likely means that pre-commit made changes that were not committed."
+              echo "🔍 Modified files:"
+              git diff --name-only
+            fi
+
+            echo "🚒 To prevent/address this CI issue, please install/use pre-commit locally."
+            echo "📖 More details here: https://superset.apache.org/docs/contributing/development#git-hooks"
             exit 1
           fi

.github/workflows/prefer-typescript.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
     paths:
       - "superset-frontend/src/**"
   pull_request:
@@ -21,13 +21,13 @@ jobs:
   prefer_typescript:
     if: github.ref == 'ref/heads/master' && github.event_name == 'pull_request'
     name: Prefer TypeScript
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: write
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/release.yml

@@ -4,11 +4,11 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
 
 jobs:
   config:
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-24.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -24,15 +24,9 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: Bump version and publish package(s)
-
-    runs-on: ubuntu-20.04
-
-    strategy:
-      matrix:
-        node-version: [16]
-
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           # pulls all commits (needed for lerna / semantic release to correctly version)
           fetch-depth: 0
@@ -46,11 +40,11 @@ jobs:
           git fetch --prune --unshallow
           git tag -d `git tag | grep -E '^trigger-'`
 
-      - name: Use Node.js ${{ matrix.node-version }}
+      - name: Install Node.js
         if: env.HAS_TAGS
         uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version-file: './superset-frontend/.nvmrc'
 
       - name: Cache npm
         if: env.HAS_TAGS

.github/workflows/showtime-cleanup.yml

@@ -0,0 +1,50 @@
+name: 🎪 Showtime Cleanup
+
+# Scheduled cleanup of expired environments
+on:
+  schedule:
+    - cron: '0 */6 * * *'  # Every 6 hours
+
+  # Manual trigger for testing
+  workflow_dispatch:
+    inputs:
+      max_age_hours:
+        description: 'Maximum age in hours before cleanup'
+        required: false
+        default: '48'
+        type: string
+
+# Common environment variables
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  AWS_REGION: ${{ vars.AWS_REGION || 'us-west-2' }}
+  GITHUB_ORG: ${{ github.repository_owner }}
+  GITHUB_REPO: ${{ github.event.repository.name }}
+
+jobs:
+  cleanup-expired:
+    name: Clean up expired showtime environments
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Install Superset Showtime
+        run: pip install superset-showtime
+
+      - name: Cleanup expired environments
+        run: |
+          MAX_AGE="${{ github.event.inputs.max_age_hours || '48' }}"
+
+          # Validate max_age is numeric
+          if [[ ! "$MAX_AGE" =~ ^[0-9]+$ ]]; then
+            echo "❌ Invalid max_age_hours format: $MAX_AGE (must be numeric)"
+            exit 1
+          fi
+
+          echo "Cleaning up environments older than ${MAX_AGE}h"
+          python -m showtime cleanup --older-than "${MAX_AGE}h"

.github/workflows/showtime-trigger.yml

@@ -0,0 +1,179 @@
+name: 🎪 Superset Showtime
+
+# Ultra-simple: just sync on any PR state change
+on:
+  pull_request_target:
+    types: [labeled, unlabeled, synchronize, closed]
+
+  # Manual testing
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to sync'
+        required: true
+        type: number
+      sha:
+        description: 'Specific SHA to deploy (optional, defaults to latest)'
+        required: false
+        type: string
+
+# Common environment variables for all jobs (non-sensitive only)
+env:
+  AWS_REGION: us-west-2
+  GITHUB_ORG: ${{ github.repository_owner }}
+  GITHUB_REPO: ${{ github.event.repository.name }}
+  GITHUB_ACTOR: ${{ github.actor }}
+
+jobs:
+  sync:
+    name: 🎪 Sync PR to desired state
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Security Check - Authorize Maintainers Only
+        id: auth
+        uses: actions/github-script@v7
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          script: |
+            const actor = context.actor;
+            console.log(`🔍 Checking authorization for ${actor}`);
+
+            // Early exit for workflow_dispatch - assume authorized since it's manually triggered
+            if (context.eventName === 'workflow_dispatch') {
+              console.log(`✅ Workflow dispatch event - assuming authorized for ${actor}`);
+              core.setOutput('authorized', 'true');
+              return;
+            }
+
+            const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              username: actor
+            });
+
+            console.log(`📊 Permission level for ${actor}: ${permission.permission}`);
+            const authorized = ['write', 'admin'].includes(permission.permission);
+
+            // If this is a synchronize event from unauthorized user, check if Showtime is active and set blocked label
+            if (!authorized && context.eventName === 'pull_request_target' && context.payload.action === 'synchronize') {
+              console.log(`🔒 Synchronize event detected - checking if Showtime is active`);
+
+              // Check if PR has any circus tent labels (Showtime is in use)
+              const { data: issue } = await github.rest.issues.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number
+              });
+
+              const hasCircusLabels = issue.labels.some(label => label.name.startsWith('🎪 '));
+
+              if (hasCircusLabels) {
+                console.log(`🎪 Circus labels found - setting blocked label to prevent auto-deployment`);
+
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.payload.pull_request.number,
+                  labels: ['🎪 🔒 showtime-blocked']
+                });
+
+                console.log(`✅ Blocked label set - Showtime will detect and skip operations`);
+              } else {
+                console.log(`ℹ️ No circus labels found - Showtime not in use, skipping block`);
+              }
+            }
+
+            if (!authorized) {
+              console.log(`🚨 Unauthorized user ${actor} - skipping all operations`);
+              core.setOutput('authorized', 'false');
+              return;
+            }
+
+            console.log(`✅ Authorized maintainer: ${actor}`);
+            core.setOutput('authorized', 'true');
+
+      - name: Install Superset Showtime
+        if: steps.auth.outputs.authorized == 'true'
+        run: |
+          echo "::notice::Maintainer ${{ github.actor }} triggered deploy for PR ${{ github.event.pull_request.number || github.event.inputs.pr_number }}"
+          pip install --upgrade superset-showtime
+          showtime version
+
+      - name: Check what actions are needed
+        if: steps.auth.outputs.authorized == 'true'
+        id: check
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Bulletproof PR number extraction
+          if [[ -n "${{ github.event.pull_request.number }}" ]]; then
+            PR_NUM="${{ github.event.pull_request.number }}"
+          elif [[ -n "${{ github.event.inputs.pr_number }}" ]]; then
+            PR_NUM="${{ github.event.inputs.pr_number }}"
+          else
+            echo "❌ No PR number found in event or inputs"
+            exit 1
+          fi
+
+          echo "Using PR number: $PR_NUM"
+
+          # Run sync check-only with optional SHA override
+          if [[ -n "${{ github.event.inputs.sha }}" ]]; then
+            OUTPUT=$(python -m showtime sync $PR_NUM --check-only --sha "${{ github.event.inputs.sha }}")
+          else
+            OUTPUT=$(python -m showtime sync $PR_NUM --check-only)
+          fi
+          echo "$OUTPUT"
+
+          # Extract the outputs we need for conditional steps
+          BUILD=$(echo "$OUTPUT" | grep "build_needed=" | cut -d'=' -f2)
+          SYNC=$(echo "$OUTPUT" | grep "sync_needed=" | cut -d'=' -f2)
+          PR_NUM_OUT=$(echo "$OUTPUT" | grep "pr_number=" | cut -d'=' -f2)
+          TARGET_SHA=$(echo "$OUTPUT" | grep "target_sha=" | cut -d'=' -f2)
+
+          echo "build_needed=$BUILD" >> $GITHUB_OUTPUT
+          echo "sync_needed=$SYNC" >> $GITHUB_OUTPUT
+          echo "pr_number=$PR_NUM_OUT" >> $GITHUB_OUTPUT
+          echo "target_sha=$TARGET_SHA" >> $GITHUB_OUTPUT
+
+      - name: Checkout PR code (only if build needed)
+        if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.build_needed == 'true'
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ steps.check.outputs.target_sha }}
+          persist-credentials: false
+
+      - name: Setup Docker Environment (only if build needed)
+        if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.build_needed == 'true'
+        uses: ./.github/actions/setup-docker
+        with:
+          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          build: "true"
+          install-docker-compose: "false"
+
+      - name: Execute sync (handles everything)
+        if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.sync_needed == 'true'
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          PR_NUM="${{ steps.check.outputs.pr_number }}"
+          TARGET_SHA="${{ steps.check.outputs.target_sha }}"
+          if [[ -n "$TARGET_SHA" ]]; then
+            python -m showtime sync $PR_NUM --sha "$TARGET_SHA"
+          else
+            python -m showtime sync $PR_NUM
+          fi

.github/workflows/superset-app-cli.yml

@@ -0,0 +1,67 @@
+name: Superset App CLI tests
+
+on:
+  push:
+    branches:
+      - "master"
+      - "[0-9].[0-9]*"
+  pull_request:
+    types: [synchronize, opened, reopened, ready_for_review]
+
+# cancel previous workflow jobs for PRs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  test-load-examples:
+    runs-on: ubuntu-24.04
+    env:
+      PYTHONPATH: ${{ github.workspace }}
+      SUPERSET_CONFIG: tests.integration_tests.superset_test_config
+      REDIS_PORT: 16379
+      SUPERSET__SQLALCHEMY_DATABASE_URI: postgresql+psycopg2://superset:superset@127.0.0.1:15432/superset
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: superset
+          POSTGRES_PASSWORD: superset
+        ports:
+          # Use custom ports for services to avoid accidentally connecting to
+          # GitHub action runner's default installations
+          - 15432:5432
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 16379:6379
+    steps:
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup Python
+        if: steps.check.outputs.python
+        uses: ./.github/actions/setup-backend/
+      - name: Setup Postgres
+        if: steps.check.outputs.python
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: setup-postgres
+      - name: superset init
+        if: steps.check.outputs.python
+        run: |
+          pip install -e .
+          superset db upgrade
+          superset load_test_users
+      - name: superset load_examples
+        if: steps.check.outputs.python
+        run: |
+          # load examples without test data
+          superset load_examples --load-big-data

.github/workflows/superset-applitool-cypress.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   config:
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-24.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -21,12 +21,11 @@ jobs:
   cypress-applitools:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
         browser: ["chrome"]
-        node: [16]
     env:
       SUPERSET_ENV: development
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -40,7 +39,7 @@ jobs:
       APPLITOOLS_BATCH_NAME: Superset Cypress
     services:
       postgres:
-        image: postgres:15-alpine
+        image: postgres:16-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -52,7 +51,7 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
@@ -66,7 +65,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node }}
+          node-version-file: './superset-frontend/.nvmrc'
       - name: Install npm dependencies
         uses: ./.github/actions/cached-dependencies
         with:

.github/workflows/superset-applitools-storybook.yml

@@ -12,7 +12,7 @@ env:
 
 jobs:
   config:
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-24.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -27,13 +27,10 @@ jobs:
   cron:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        node: [16]
+    runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
@@ -41,7 +38,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node }}
+          node-version-file: './superset-frontend/.nvmrc'
       - name: Install eyes-storybook dependencies
         uses: ./.github/actions/cached-dependencies
         with:

.github/workflows/superset-cli.yml

@@ -1,72 +0,0 @@
-name: Superset CLI tests
-
-on:
-  push:
-    branches:
-      - "master"
-      - "[0-9].[0-9]"
-  pull_request:
-    types: [synchronize, opened, reopened, ready_for_review]
-
-# cancel previous workflow jobs for PRs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  test-load-examples:
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: ["3.9"]
-    env:
-      PYTHONPATH: ${{ github.workspace }}
-      SUPERSET_CONFIG: tests.integration_tests.superset_test_config
-      REDIS_PORT: 16379
-      SUPERSET__SQLALCHEMY_DATABASE_URI: postgresql+psycopg2://superset:superset@127.0.0.1:15432/superset
-    services:
-      postgres:
-        image: postgres:15-alpine
-        env:
-          POSTGRES_USER: superset
-          POSTGRES_PASSWORD: superset
-        ports:
-          # Use custom ports for services to avoid accidentally connecting to
-          # GitHub action runner's default installations
-          - 15432:5432
-      redis:
-        image: redis:7-alpine
-        ports:
-          - 16379:6379
-    steps:
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-          submodules: recursive
-      - name: Check if python changes are present
-        id: check
-        env:
-          GITHUB_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        continue-on-error: true
-        run: ./scripts/ci_check_no_file_changes.sh python
-      - name: Setup Python
-        uses: ./.github/actions/setup-backend/
-        if: steps.check.outcome == 'failure'
-      - name: Setup Postgres
-        if: steps.check.outcome == 'failure'
-        uses: ./.github/actions/cached-dependencies
-        with:
-          run: setup-postgres
-      - name: superset init
-        if: steps.check.outcome == 'failure'
-        run: |
-          pip install -e .
-          superset db upgrade
-          superset load_test_users
-      - name: superset load_examples
-        if: steps.check.outcome == 'failure'
-        run: |
-          # load examples without test data
-          superset load_examples --load-big-data

.github/workflows/superset-docs-deploy.yml

@@ -4,13 +4,15 @@ on:
   push:
     paths:
       - "docs/**"
+      - "README.md"
     branches:
       - "master"
-      - "[0-9].[0-9]"
+
+  workflow_dispatch: {}
 
 jobs:
   config:
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-24.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -26,28 +28,41 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: Build & Deploy
-    runs-on: "ubuntu-latest"
-    defaults:
-      run:
-        working-directory: docs
+    runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Set up Node.js 16
+      - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "16"
+          node-version-file: './docs/.nvmrc'
+      - name: Setup Python
+        uses: ./.github/actions/setup-backend/
+      - uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+      - name: Install Graphviz
+        run: sudo apt-get install -y graphviz
+      - name: Compute Entity Relationship diagram (ERD)
+        env:
+          SUPERSET_SECRET_KEY: not-a-secret
+        run: |
+          python scripts/erd/erd.py
+          curl -L http://sourceforge.net/projects/plantuml/files/1.2023.7/plantuml.1.2023.7.jar/download > ~/plantuml.jar
+          java -jar ~/plantuml.jar -v -tsvg -r -o "${{ github.workspace }}/docs/static/img/" "${{ github.workspace }}/scripts/erd/erd.puml"
       - name: yarn install
+        working-directory: docs
         run: |
           yarn install --check-cache
       - name: yarn build
+        working-directory: docs
         run: |
           yarn build
       - name: deploy docs
-        if: github.ref == 'refs/heads/master'
         uses: ./.github/actions/github-action-push-to-another-repository
         env:
           API_TOKEN_GITHUB: ${{ secrets.SUPERSET_SITE_BUILD }}

.github/workflows/superset-docs-verify.yml

@@ -4,6 +4,7 @@ on:
   pull_request:
     paths:
       - "docs/**"
+      - ".github/workflows/superset-docs-verify.yml"
     types: [synchronize, opened, reopened, ready_for_review]
 
 # cancel previous workflow jobs for PRs
@@ -12,22 +13,57 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  linkinator:
+    # See docs here: https://github.com/marketplace/actions/linkinator
+    name: Link Checking
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      # Do not bump this linkinator-action version without opening
+      # an ASF Infra ticket to allow the new version first!
+      - uses: JustinBeckwith/linkinator-action@v1.11.0
+        continue-on-error: true # This will make the job advisory (non-blocking, no red X)
+        with:
+          paths: "**/*.md, **/*.mdx, !superset-frontend/CHANGELOG.md"
+          linksToSkip: >-
+            ^https://github.com/apache/(superset|incubator-superset)/(pull|issue)/\d+,
+            http://localhost:8088/,
+            http://127.0.0.1:3000/,
+            http://localhost:9001/,
+            https://charts.bitnami.com/bitnami,
+            https://www.li.me/,
+            https://www.fanatics.com/,
+            https://tails.com/gb/,
+            https://www.techaudit.info/,
+            https://avetilearning.com/,
+            https://www.udemy.com/,
+            https://trustmedis.com/,
+            http://theiconic.com.au/,
+            https://dev.mysql.com/doc/refman/5.7/en/innodb-limits.html,
+            ^https://img\.shields\.io/.*,
+            https://vkusvill.ru/
+            https://www.linkedin.com/in/mark-thomas-b16751158/
+            https://theiconic.com.au/
+            https://wattbewerb.de/
+            https://timbr.ai/
+            https://opensource.org/license/apache-2-0
+            https://www.plaidcloud.com/
   build-deploy:
     name: Build & Deploy
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     defaults:
       run:
         working-directory: docs
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Set up Node.js 16
+      - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '16'
+          node-version-file: './docs/.nvmrc'
       - name: yarn install
         run: |
           yarn install --check-cache

.github/workflows/superset-e2e.yml

@@ -4,9 +4,23 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
+  workflow_dispatch:
+    inputs:
+      use_dashboard:
+        description: 'Use Cypress Dashboard (true/false) [paid service - trigger manually when needed]. You MUST provide a branch and/or PR number below for this to work.'
+        required: false
+        default: 'false'
+      ref:
+        description: 'The branch or tag to checkout'
+        required: false
+        default: ''
+      pr_id:
+        description: 'The pull request ID to checkout'
+        required: false
+        default: ''
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
@@ -14,19 +28,21 @@ concurrency:
 
 jobs:
   cypress-matrix:
-    runs-on: ubuntu-20.04
+    # Somehow one test flakes on 24.04 for unknown reasons, this is the only GHA left on 22.04
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       pull-requests: read
     strategy:
       # when one test fails, DO NOT cancel the other
-      # containers, because this will kill Cypress processes
+      # parallel_id, because this will kill Cypress processes
       # leaving the Dashboard hanging ...
       # https://github.com/cypress-io/github-action/issues/48
       fail-fast: false
       matrix:
-        containers: [1, 2, 3]
+        parallel_id: [0, 1, 2, 3, 4, 5]
         browser: ["chrome"]
+        app_root: ["", "/app/prefix"]
     env:
       SUPERSET_ENV: development
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -34,9 +50,11 @@ jobs:
       PYTHONPATH: ${{ github.workspace }}
       REDIS_PORT: 16379
       GITHUB_TOKEN: ${{ github.token }}
+      # Only use dashboard when explicitly requested via workflow_dispatch
+      USE_DASHBOARD: ${{ github.event.inputs.use_dashboard == 'true' || 'false' }}
     services:
       postgres:
-        image: postgres:15-alpine
+        image: postgres:16-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -47,77 +65,89 @@ jobs:
         ports:
           - 16379:6379
     steps:
-      - name: "Checkout (pull) ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
-        if: github.event_name == 'push'
+      # -------------------------------------------------------
+      # Conditional checkout based on context
+      - name: Checkout for push or pull_request event
+        if: github.event_name == 'push' || github.event_name == 'pull_request'
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
-      - name: "Checkout (pull_request) ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
-        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      - name: Checkout using ref (workflow_dispatch)
+        if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
+        uses: actions/checkout@v5
         with:
-          ref: "refs/pull/${{ github.event.number }}/merge"
           persist-credentials: false
+          ref: ${{ github.event.inputs.ref }}
           submodules: recursive
-      - name: Check if python or frontend changes are present
+      - name: Checkout using PR ID (workflow_dispatch)
+        if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          ref: refs/pull/${{ github.event.inputs.pr_id }}/merge
+          submodules: recursive
+      # -------------------------------------------------------
+      - name: Check for file changes
         id: check
-        env:
-          GITHUB_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        continue-on-error: true
-        run: ./scripts/ci_check_no_file_changes.sh python frontend
-      - name: Setup Python
-        if: steps.check.outcome == 'failure'
-        uses: ./.github/actions/setup-backend/
-      - name: OS dependencies
-        if: steps.check.outcome == 'failure'
-        uses: ./.github/actions/cached-dependencies
+        uses: ./.github/actions/change-detector/
         with:
-          run: apt-get-install
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python || steps.check.outputs.frontend
       - name: Setup postgres
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: setup-postgres
       - name: Import test data
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: testdata
       - name: Setup Node.js
+        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: actions/setup-node@v4
         with:
-          node-version: "16"
+          node-version-file: './superset-frontend/.nvmrc'
       - name: Install npm dependencies
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: npm-install
       - name: Build javascript packages
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: build-instrumented-assets
       - name: Install cypress
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: cypress-install
       - name: Run Cypress
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python || steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         env:
           CYPRESS_BROWSER: ${{ matrix.browser }}
-          CYPRESS_KEY: YjljODE2MzAtODcwOC00NTA3LWE4NmMtMTU3YmFmMjIzOTRhCg==
+          PARALLEL_ID: ${{ matrix.parallel_id }}
+          PARALLELISM: 6
+          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}
+          NODE_OPTIONS: "--max-old-space-size=4096"
         with:
-          run: cypress-run-all
+          run: cypress-run-all ${{ env.USE_DASHBOARD }} ${{ matrix.app_root }}
+      - name: Set safe app root
+        if: failure()
+        id: set-safe-app-root
+        run: |
+          APP_ROOT="${{ matrix.app_root }}"
+          SAFE_APP_ROOT=${APP_ROOT//\//_}
+          echo "safe_app_root=$SAFE_APP_ROOT" >> $GITHUB_OUTPUT
       - name: Upload Artifacts
         uses: actions/upload-artifact@v4
         if: failure()
         with:
-          name: screenshots
           path: ${{ github.workspace }}/superset-frontend/cypress-base/cypress/screenshots
+          name: cypress-artifact-${{ github.run_id }}-${{ github.job }}-${{ matrix.browser }}-${{ matrix.parallel_id }}--${{ steps.set-safe-app-root.outputs.safe_app_root }}

.github/workflows/superset-extensions-cli.yml

@@ -0,0 +1,64 @@
+name: Superset Extensions CLI Package Tests
+
+on:
+  push:
+    branches:
+      - "master"
+      - "[0-9].[0-9]*"
+  pull_request:
+    types: [synchronize, opened, reopened, ready_for_review]
+
+# cancel previous workflow jobs for PRs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  test-superset-extensions-cli-package:
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        python-version: ["previous", "current", "next"]
+    defaults:
+      run:
+        working-directory: superset-extensions-cli
+    steps:
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Python
+        if: steps.check.outputs.superset-extensions-cli
+        uses: ./.github/actions/setup-backend/
+        with:
+          python-version: ${{ matrix.python-version }}
+          requirements-type: dev
+
+      - name: Run pytest with coverage
+        if: steps.check.outputs.superset-extensions-cli
+        run: |
+          pytest --cov=superset_extensions_cli --cov-report=xml --cov-report=term-missing --cov-report=html -v --tb=short
+
+      - name: Upload coverage reports to Codecov
+        if: steps.check.outputs.superset-extensions-cli
+        uses: codecov/codecov-action@v5
+        with:
+          file: ./coverage.xml
+          flags: superset-extensions-cli
+          name: superset-extensions-cli-coverage
+          fail_ci_if_error: false
+
+      - name: Upload HTML coverage report
+        if: steps.check.outputs.superset-extensions-cli
+        uses: actions/upload-artifact@v4
+        with:
+          name: superset-extensions-cli-coverage-html
+          path: htmlcov/

.github/workflows/superset-frontend.yml

@@ -1,89 +1,169 @@
-name: Frontend
+name: "Frontend Build CI (unit tests, linting & sanity checks)"
 
 on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
-    paths:
-      - "superset-frontend/**"
+      - "[0-9].[0-9]*"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
-    paths:
-      - "superset-frontend/**"
 
 # cancel previous workflow jobs for PRs
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+env:
+  TAG: apache/superset:GHA-${{ github.run_id }}
+
 jobs:
   frontend-build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    outputs:
+      should-run: ${{ steps.check.outputs.frontend }}
     steps:
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+      - name: Checkout Code
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
-          submodules: recursive
-      - name: Check npm lock file version
-        run: ./scripts/ci_check_npm_lock_version.sh ./superset-frontend/package-lock.json
-      - name: Check if frontend changes are present
+          fetch-depth: 0
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+
+      - name: Check for File Changes
         id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build Docker Image
+        if: steps.check.outputs.frontend
+        shell: bash
         env:
-          GITHUB_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        continue-on-error: true
-        run: ./scripts/ci_check_no_file_changes.sh frontend
-      - name: Setup Node.js
-        if: steps.check.outcome == 'failure'
-        uses: actions/setup-node@v4
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "git rev-parse --short HEAD"
+          git rev-parse --short HEAD
+          echo "git show -s --format=raw HEAD"
+          git show -s --format=raw HEAD
+          docker buildx build \
+            -t $TAG \
+            --cache-from=type=registry,ref=apache/superset-cache:3.10-slim-trixie \
+            --target superset-node-ci \
+            .
+
+      - name: Save Docker Image as Artifact
+        if: steps.check.outputs.frontend
+        run: |
+          docker save $TAG | gzip > docker-image.tar.gz
+
+      - name: Upload Docker Image Artifact
+        if: steps.check.outputs.frontend
+        uses: actions/upload-artifact@v4
         with:
-          node-version: "16"
-      - name: Install dependencies
-        if: steps.check.outcome == 'failure'
-        uses: ./.github/actions/cached-dependencies
+          name: docker-image
+          path: docker-image.tar.gz
+
+  sharded-jest-tests:
+    needs: frontend-build
+    if: needs.frontend-build.outputs.should-run == 'true'
+    strategy:
+      matrix:
+        shard: [1, 2, 3, 4, 5, 6, 7, 8]
+      fail-fast: false
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Download Docker Image Artifact
+        uses: actions/download-artifact@v5
         with:
-          run: npm-install
+          name: docker-image
+
+      - name: Load Docker Image
+        run: docker load < docker-image.tar.gz
+
+      - name: npm run test with coverage
+        run: |
+          mkdir -p ${{ github.workspace }}/superset-frontend/coverage
+          docker run \
+          -v ${{ github.workspace }}/superset-frontend/coverage:/app/superset-frontend/coverage \
+          --rm $TAG \
+          bash -c \
+          "npm run test -- --coverage --shard=${{ matrix.shard }}/8 --coverageReporters=json-summary"
+
+      - name: Upload Coverage Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-artifacts-${{ matrix.shard }}
+          path: superset-frontend/coverage
+
+  report-coverage:
+    needs: [sharded-jest-tests]
+    if: needs.frontend-build.outputs.should-run == 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Download Coverage Artifacts
+        uses: actions/download-artifact@v5
+        with:
+          pattern: coverage-artifacts-*
+          path: coverage/
+
+      - name: Show Files
+        run: find coverage/
+
+      - name: Merge Code Coverage
+        run: npx nyc merge coverage/ merged-output/coverage-summary.json
+
+      - name: Upload Code Coverage
+        uses: codecov/codecov-action@v5
+        with:
+          flags: javascript
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
+          files: merged-output/coverage-summary.json
+          slug: apache/superset
+
+  lint-frontend:
+    needs: frontend-build
+    if: needs.frontend-build.outputs.should-run == 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Download Docker Image Artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: docker-image
+
+      - name: Load Docker Image
+        run: |
+          docker load < docker-image.tar.gz
+
       - name: eslint
-        if: steps.check.outcome == 'failure'
-        working-directory: ./superset-frontend
         run: |
-          npm run eslint -- . --quiet
+          docker run --rm $TAG bash -c \
+          "npm i && npm run eslint -- . --quiet"
+
       - name: tsc
-        if: steps.check.outcome == 'failure'
-        working-directory: ./superset-frontend
         run: |
-          npm run type
-      - name: prettier
-        if: steps.check.outcome == 'failure'
-        working-directory: ./superset-frontend
+          docker run --rm $TAG bash -c \
+          "npm run plugins:build && npm run type"
+
+  validate-frontend:
+    needs: frontend-build
+    if: needs.frontend-build.outputs.should-run == 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Download Docker Image Artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: docker-image
+
+      - name: Load Docker Image
+        run: docker load < docker-image.tar.gz
+
+      - name: Build Plugins Packages
         run: |
-          npm run prettier-check
-      - name: Build plugins packages
-        if: steps.check.outcome == 'failure'
-        working-directory: ./superset-frontend
-        run: npm run plugins:build
-      - name: Build plugins Storybook
-        if: steps.check.outcome == 'failure'
-        working-directory: ./superset-frontend
-        run: npm run plugins:build-storybook
-      - name: superset-ui/core coverage
-        if: steps.check.outcome == 'failure'
-        working-directory: ./superset-frontend
+          docker run --rm $TAG bash -c \
+          "npm run plugins:build"
+
+      - name: Build Plugins Storybook
         run: |
-          npm run core:cover
-      - name: unit tests
-        if: steps.check.outcome == 'failure'
-        working-directory: ./superset-frontend
-        run: |
-          npm run test -- --coverage --silent
-      # todo: remove this step when fix generator as a project in root jest.config.js
-      - name: generator-superset unit tests
-        if: steps.check.outcome == 'failure'
-        working-directory: ./superset-frontend/packages/generator-superset
-        run: npx jest
-      - name: Upload code coverage
-        if: steps.check.outcome == 'failure'
-        working-directory: ./superset-frontend
-        run: ../.github/workflows/codecov.sh -c -F javascript
+          docker run --rm $TAG bash -c \
+          "npm run plugins:build-storybook"

.github/workflows/superset-helm-lint.yml

@@ -1,4 +1,4 @@
-name: Lint and Test Charts
+name: "Helm: lint and test charts"
 
 on:
   pull_request:
@@ -13,23 +13,24 @@ concurrency:
 
 jobs:
   lint-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v4
         with:
-          version: v3.5.4
+          version: v3.16.4
 
-      - uses: actions/setup-python@v5
+      - name: Setup Python
+        uses: ./.github/actions/setup-backend/
         with:
-          python-version: "3.9"
+          install-superset: 'false'
 
       - name: Set up chart-testing
         uses: ./.github/actions/chart-testing-action

.github/workflows/superset-helm-release.yml

@@ -1,24 +1,38 @@
-name: Release Charts
+# This workflow automates the release process for Helm charts.
+# The workflow creates a new branch for the release and opens a pull request against the 'gh-pages' branch,
+# allowing the changes to be reviewed and merged manually.
+
+name: "Helm: release charts"
 
 on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
     paths:
       - "helm/**"
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "The branch, tag, or commit SHA to check out"
+        required: false
+        default: "master"
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
+      pull-requests: write
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+      - name: Checkout code
+        uses: actions/checkout@v5
         with:
-          persist-credentials: false
+          ref: ${{ inputs.ref || github.ref_name }}
+          persist-credentials: true
           submodules: recursive
           fetch-depth: 0
 
@@ -28,18 +42,84 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Install Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v4
         with:
           version: v3.5.4
 
       - name: Add bitnami repo dependency
         run: helm repo add bitnami https://charts.bitnami.com/bitnami
 
+      - name: Fetch/list all tags
+        run: |
+          # Debugging tags
+          git fetch --tags --force
+          git tag -d superset-helm-chart-0.13.4 || true
+          echo "DEBUG TAGS"
+          git show-ref --tags
+
+      - name: Create unique pages branch name
+        id: vars
+        run: echo "branch_name=helm-publish-${GITHUB_SHA:0:7}" >> $GITHUB_ENV
+
+      - name: Force recreate branch from gh-pages
+        run: |
+          # Ensure a clean working directory
+          git reset --hard
+          git clean -fdx
+          git checkout -b local_gha_temp
+          git submodule update
+
+          # Fetch the latest gh-pages branch
+          git fetch origin gh-pages
+
+          # Check out and reset the target branch based on gh-pages
+          git checkout -B ${{ env.branch_name }} origin/gh-pages
+
+          # Remove submodules from the branch
+          git submodule deinit -f --all
+
+          # Force push to the remote branch
+          git push origin ${{ env.branch_name }} --force
+
+          # Return to the original branch
+          git checkout local_gha_temp
+
+      - name: Fetch/list all tags
+        run: |
+          git submodule update
+          cat .github/actions/chart-releaser-action/action.yml
+
       - name: Run chart-releaser
         uses: ./.github/actions/chart-releaser-action
         with:
+          version: v1.6.0
           charts_dir: helm
           mark_as_latest: false
+          pages_branch: ${{ env.branch_name }}
         env:
           CR_TOKEN: "${{ github.token }}"
           CR_RELEASE_NAME_TEMPLATE: "superset-helm-chart-{{ .Version }}"
+
+      - name: Open Pull Request
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const branchName = '${{ env.branch_name }}';
+            const [owner, repo] = process.env.GITHUB_REPOSITORY.split('/');
+
+            if (!branchName) {
+              throw new Error("Branch name is not defined.");
+            }
+
+            const pr = await github.rest.pulls.create({
+              owner,
+              repo,
+              title: `Helm chart release for ${branchName}`,
+              head: branchName,
+              base: "gh-pages", // Adjust if the target branch is different
+              body: `This PR releases Helm charts to the gh-pages branch.`,
+            });
+
+            core.info(`Pull request created: ${pr.data.html_url}`);
+        env:
+          BRANCH_NAME: ${{ env.branch_name }}

.github/workflows/superset-playwright.yml

@@ -0,0 +1,141 @@
+name: Playwright E2E Tests
+
+on:
+  push:
+    branches:
+      - "master"
+      - "[0-9].[0-9]*"
+  pull_request:
+    types: [synchronize, opened, reopened, ready_for_review]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'The branch or tag to checkout'
+        required: false
+        default: ''
+      pr_id:
+        description: 'The pull request ID to checkout'
+        required: false
+        default: ''
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  playwright-tests:
+    runs-on: ubuntu-22.04
+    # Allow workflow to succeed even if tests fail during shadow mode
+    continue-on-error: true
+    permissions:
+      contents: read
+      pull-requests: read
+    strategy:
+      fail-fast: false
+      matrix:
+        browser: ["chromium"]
+        app_root: ["", "/app/prefix"]
+    env:
+      SUPERSET_ENV: development
+      SUPERSET_CONFIG: tests.integration_tests.superset_test_config
+      SUPERSET__SQLALCHEMY_DATABASE_URI: postgresql+psycopg2://superset:superset@127.0.0.1:15432/superset
+      PYTHONPATH: ${{ github.workspace }}
+      REDIS_PORT: 16379
+      GITHUB_TOKEN: ${{ github.token }}
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: superset
+          POSTGRES_PASSWORD: superset
+        ports:
+          - 15432:5432
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 16379:6379
+    steps:
+      # -------------------------------------------------------
+      # Conditional checkout based on context (same as Cypress workflow)
+      - name: Checkout for push or pull_request event
+        if: github.event_name == 'push' || github.event_name == 'pull_request'
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          submodules: recursive
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      - name: Checkout using ref (workflow_dispatch)
+        if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.inputs.ref }}
+          submodules: recursive
+      - name: Checkout using PR ID (workflow_dispatch)
+        if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          ref: refs/pull/${{ github.event.inputs.pr_id }}/merge
+          submodules: recursive
+      # -------------------------------------------------------
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup Python
+        uses: ./.github/actions/setup-backend/
+        if: steps.check.outputs.python || steps.check.outputs.frontend
+      - name: Setup postgres
+        if: steps.check.outputs.python || steps.check.outputs.frontend
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: setup-postgres
+      - name: Import test data
+        if: steps.check.outputs.python || steps.check.outputs.frontend
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: testdata
+      - name: Setup Node.js
+        if: steps.check.outputs.python || steps.check.outputs.frontend
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: './superset-frontend/.nvmrc'
+      - name: Install npm dependencies
+        if: steps.check.outputs.python || steps.check.outputs.frontend
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: npm-install
+      - name: Build javascript packages
+        if: steps.check.outputs.python || steps.check.outputs.frontend
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: build-instrumented-assets
+      - name: Install Playwright
+        if: steps.check.outputs.python || steps.check.outputs.frontend
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: playwright-install
+      - name: Run Playwright
+        if: steps.check.outputs.python || steps.check.outputs.frontend
+        uses: ./.github/actions/cached-dependencies
+        env:
+          NODE_OPTIONS: "--max-old-space-size=4096"
+        with:
+          run: playwright-run ${{ matrix.app_root }}
+      - name: Set safe app root
+        if: failure()
+        id: set-safe-app-root
+        run: |
+          APP_ROOT="${{ matrix.app_root }}"
+          SAFE_APP_ROOT=${APP_ROOT//\//_}
+          echo "safe_app_root=$SAFE_APP_ROOT" >> $GITHUB_OUTPUT
+      - name: Upload Playwright Artifacts
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          path: |
+            ${{ github.workspace }}/superset-frontend/playwright-results/
+            ${{ github.workspace }}/superset-frontend/test-results/
+          name: playwright-artifact-${{ github.run_id }}-${{ github.job }}-${{ matrix.browser }}--${{ steps.set-safe-app-root.outputs.safe_app_root }}

.github/workflows/superset-python-integrationtest.yml

@@ -5,7 +5,7 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
 
@@ -15,10 +15,7 @@ concurrency:
 
 jobs:
   test-mysql:
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: ["3.9"]
+    runs-on: ubuntu-24.04
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -27,11 +24,16 @@ jobs:
         mysql+mysqldb://superset:superset@127.0.0.1:13306/superset?charset=utf8mb4&binary_prefix=true
     services:
       mysql:
-        image: mysql:5.7
+        image: mysql:8.0
         env:
           MYSQL_ROOT_PASSWORD: root
         ports:
           - 13306:3306
+        options: >-
+          --health-cmd="mysqladmin ping --silent"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
       redis:
         image: redis:7-alpine
         options: --entrypoint redis-server
@@ -39,44 +41,43 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check if python changes are present
+      - name: Check for file changes
         id: check
-        env:
-          GITHUB_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        continue-on-error: true
-        run: ./scripts/ci_check_no_file_changes.sh python
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outcome == 'failure'
-        with:
-          python-version: ${{ matrix.python-version }}
+        if: steps.check.outputs.python
       - name: Setup MySQL
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
-          run: |
-            setup-mysql
-      - name: Run celery
-        if: steps.check.outcome == 'failure'
-        run: celery --app=superset.tasks.celery_app:app worker -Ofair -c 2 &
+          run: setup-mysql
+      - name: Start Celery worker
+        if: steps.check.outputs.python
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: celery-worker
       - name: Python integration tests (MySQL)
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        if: steps.check.outcome == 'failure'
-        run: |
-          bash .github/workflows/codecov.sh -c -F python -F mysql
+        uses: codecov/codecov-action@v5
+        with:
+          flags: python,mysql
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
   test-postgres:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
-        python-version: ["3.9", "3.10"]
+        python-version: ["current", "previous", "next"]
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -84,7 +85,7 @@ jobs:
       SUPERSET__SQLALCHEMY_DATABASE_URI: postgresql+psycopg2://superset:superset@127.0.0.1:15432/superset
     services:
       postgres:
-        image: postgres:15-alpine
+        image: postgres:16-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -98,45 +99,44 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check if python changes are present
+      - name: Check for file changes
         id: check
-        env:
-          GITHUB_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        continue-on-error: true
-        run: ./scripts/ci_check_no_file_changes.sh python
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         with:
           python-version: ${{ matrix.python-version }}
       - name: Setup Postgres
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: |
             setup-postgres
-      - name: Run celery
-        if: steps.check.outcome == 'failure'
-        run: celery --app=superset.tasks.celery_app:app worker -Ofair -c 2 &
+      - name: Start Celery worker
+        if: steps.check.outputs.python
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: celery-worker
       - name: Python integration tests (PostgreSQL)
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        if: steps.check.outcome == 'failure'
-        run: |
-          bash .github/workflows/codecov.sh -c -F python -F postgres
+        uses: codecov/codecov-action@v5
+        with:
+          flags: python,postgres
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
 
   test-sqlite:
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: ["3.9"]
+    runs-on: ubuntu-24.04
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -152,37 +152,37 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check if python changes are present
+      - name: Check for file changes
         id: check
-        env:
-          GITHUB_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        continue-on-error: true
-        run: ./scripts/ci_check_no_file_changes.sh python
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outcome == 'failure'
-        with:
-          python-version: ${{ matrix.python-version }}
+        if: steps.check.outputs.python
       - name: Install dependencies
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: |
             # sqlite needs this working directory
             mkdir ${{ github.workspace }}/.temp
-      - name: Run celery
-        if: steps.check.outcome == 'failure'
-        run: celery --app=superset.tasks.celery_app:app worker -Ofair -c 2 &
+      - name: Start Celery worker
+        if: steps.check.outputs.python
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: celery-worker
       - name: Python integration tests (SQLite)
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         run: |
           ./scripts/python_tests.sh
       - name: Upload code coverage
-        if: steps.check.outcome == 'failure'
-        run: |
-          bash .github/workflows/codecov.sh -c -F python -F sqlite
+        uses: codecov/codecov-action@v5
+        with:
+          flags: python,sqlite
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true

.github/workflows/superset-python-misc.yml

@@ -1,66 +0,0 @@
-# Python Misc unit tests
-name: Python Misc
-
-on:
-  push:
-    branches:
-      - "master"
-      - "[0-9].[0-9]"
-    paths:
-      - "superset/**"
-  pull_request:
-    types: [synchronize, opened, reopened, ready_for_review]
-    paths:
-      - "superset/**"
-
-# cancel previous workflow jobs for PRs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  python-lint:
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: ["3.9"]
-    steps:
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-          submodules: recursive
-      - name: Check if python changes are present
-        id: check
-        env:
-          GITHUB_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        continue-on-error: true
-        run: ./scripts/ci_check_no_file_changes.sh python
-      - name: Setup Python
-        uses: ./.github/actions/setup-backend/
-        if: steps.check.outcome == 'failure'
-        with:
-          python-version: ${{ matrix.python-version }}
-      - name: pylint
-        if: steps.check.outcome == 'failure'
-        # `-j 0` run Pylint in parallel
-        run: pylint -j 0 superset
-
-  babel-extract:
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: ["3.9"]
-    steps:
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-          submodules: recursive
-      - name: Setup Python
-        uses: ./.github/actions/setup-backend/
-        with:
-          python-version: ${{ matrix.python-version }}
-      - name: Test babel extraction
-        run: flask fab babel-extract --target superset/translations --output superset/translations/messages.pot --config superset/translations/babel.cfg -k _,__,t,tn,tct

.github/workflows/superset-python-presto-hive.yml

@@ -5,13 +5,9 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
-    paths:
-      - "superset/**"
+      - "[0-9].[0-9]*"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
-    paths:
-      - "superset/**"
 
 # cancel previous workflow jobs for PRs
 concurrency:
@@ -20,10 +16,7 @@ concurrency:
 
 jobs:
   test-postgres-presto:
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: ["3.9"]
+    runs-on: ubuntu-24.04
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -32,7 +25,7 @@ jobs:
       SUPERSET__SQLALCHEMY_EXAMPLES_URI: presto://localhost:15433/memory/default
     services:
       postgres:
-        image: postgres:15-alpine
+        image: postgres:16-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -55,42 +48,43 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check if python changes are present
+      - name: Check for file changes
         id: check
-        env:
-          GITHUB_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        continue-on-error: true
-        run: ./scripts/ci_check_no_file_changes.sh python
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python == 'true'
       - name: Setup Postgres
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
-          run: setup-postgres
-      - name: Run celery
-        if: steps.check.outcome == 'failure'
-        run: celery --app=superset.tasks.celery_app:app worker -Ofair -c 2 &
+          run: |
+            echo "${{ steps.check.outputs.python }}"
+            setup-postgres
+      - name: Start Celery worker
+        if: steps.check.outputs.python
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: celery-worker
       - name: Python unit tests (PostgreSQL)
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         run: |
           ./scripts/python_tests.sh -m 'chart_data_flow or sql_json_flow'
       - name: Upload code coverage
-        if: steps.check.outcome == 'failure'
-        run: |
-          bash .github/workflows/codecov.sh -c -F python -F presto
+        uses: codecov/codecov-action@v5
+        with:
+          flags: python,presto
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
 
   test-postgres-hive:
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: ["3.9"]
+    runs-on: ubuntu-24.04
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -100,7 +94,7 @@ jobs:
       UPLOAD_FOLDER: /tmp/.superset/uploads/
     services:
       postgres:
-        image: postgres:15-alpine
+        image: postgres:16-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -114,42 +108,45 @@ jobs:
           - 16379:6379
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check if python changes are present
+      - name: Check for file changes
         id: check
-        env:
-          GITHUB_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        continue-on-error: true
-        run: ./scripts/ci_check_no_file_changes.sh python
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Create csv upload directory
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         run: sudo mkdir -p /tmp/.superset/uploads
       - name: Give write access to the csv upload directory
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         run: sudo chown -R $USER:$USER /tmp/.superset
       - name: Start hadoop and hive
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         run: docker compose -f scripts/databases/hive/docker-compose.yml up -d
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
       - name: Setup Postgres
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         uses: ./.github/actions/cached-dependencies
         with:
           run: setup-postgres
-      - name: Run celery
-        if: steps.check.outcome == 'failure'
-        run: celery --app=superset.tasks.celery_app:app worker -Ofair -c 2 &
+      - name: Start Celery worker
+        if: steps.check.outputs.python
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: celery-worker
       - name: Python unit tests (PostgreSQL)
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         run: |
+          pip install -e .[hive]
           ./scripts/python_tests.sh -m 'chart_data_flow or sql_json_flow'
       - name: Upload code coverage
-        if: steps.check.outcome == 'failure'
-        run: |
-          bash .github/workflows/codecov.sh -c -F python -F hive
+        uses: codecov/codecov-action@v5
+        with:
+          flags: python,hive
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true

.github/workflows/superset-python-unittest.yml

@@ -5,19 +5,9 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
-    paths:
-      - "superset/**"
-      - "requirements/**"
-      - "tests/unit_tests/**"
-      - "scripts/**"
+      - "[0-9].[0-9]*"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
-    paths:
-      - "superset/**"
-      - "requirements/**"
-      - "tests/unit_tests/**"
-      - "scripts/**"
 
 # cancel previous workflow jobs for PRs
 concurrency:
@@ -26,38 +16,45 @@ concurrency:
 
 jobs:
   unit-tests:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
-        python-version: ["3.9", "3.10"]
+        python-version: ["previous", "current", "next"]
     env:
       PYTHONPATH: ${{ github.workspace }}
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
-      - name: Check if python changes are present
+      - name: Check for file changes
         id: check
-        env:
-          GITHUB_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        continue-on-error: true
-        run: ./scripts/ci_check_no_file_changes.sh python
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         with:
           python-version: ${{ matrix.python-version }}
       - name: Python unit tests
-        if: steps.check.outcome == 'failure'
+        if: steps.check.outputs.python
         env:
           SUPERSET_TESTENV: true
           SUPERSET_SECRET_KEY: not-a-secret
         run: |
-          pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear
-      - name: Upload code coverage
-        if: steps.check.outcome == 'failure'
+          pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50
+      - name: Python 100% coverage unit tests
+        if: steps.check.outputs.python
+        env:
+          SUPERSET_TESTENV: true
+          SUPERSET_SECRET_KEY: not-a-secret
         run: |
-          bash .github/workflows/codecov.sh -c -F python -F unit
+          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100
+      - name: Upload code coverage
+        uses: codecov/codecov-action@v5
+        with:
+          flags: python,unit
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true

.github/workflows/superset-translations.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
 
@@ -14,48 +14,54 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  frontend-check:
-    runs-on: ubuntu-20.04
+  frontend-check-translations:
+    runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
+
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Setup Node.js
+        if: steps.check.outputs.frontend
         uses: actions/setup-node@v4
         with:
-          node-version: "16"
+          node-version-file:  './superset-frontend/.nvmrc'
       - name: Install dependencies
+        if: steps.check.outputs.frontend
         uses: ./.github/actions/cached-dependencies
         with:
           run: npm-install
       - name: lint
+        if: steps.check.outputs.frontend
         working-directory: ./superset-frontend
         run: |
-          npm run check-translation
+          npm run build-translation
 
   babel-extract:
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: ["3.9"]
+    runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           submodules: recursive
+      - name: Check for file changes
+        id: check
+        uses: ./.github/actions/change-detector/
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Setup Python
+        if: steps.check.outputs.python
         uses: ./.github/actions/setup-backend/
-        with:
-          python-version: ${{ matrix.python-version }}
-      - name: Install dependencies
-        uses: ./.github/actions/cached-dependencies
-        with:
-          run: |
-            apt-get-install
-            pip-upgrade
-            pip install -r requirements/base.txt
       - name: Test babel extraction
-        run: ./scripts/babel_update.sh
+        if: steps.check.outputs.python
+        run: ./scripts/translations/babel_update.sh

.github/workflows/superset-websocket.yml

@@ -3,7 +3,7 @@ on:
   push:
     branches:
       - "master"
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
     paths:
       - "superset-websocket/**"
   pull_request:
@@ -18,10 +18,10 @@ concurrency:
 
 jobs:
   app-checks:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
       - name: Install dependencies

.github/workflows/supersetbot.yml

@@ -15,43 +15,42 @@ on:
 
 jobs:
   supersetbot:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: >
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@supersetbot'))
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
     steps:
       - name: Quickly add thumbs up!
-        uses: actions/github-script@v5
+        if: github.event_name == 'issue_comment' && contains(github.event.comment.body, '@supersetbot')
+        uses: actions/github-script@v7
         with:
           script: |
             const [owner, repo] = process.env.GITHUB_REPOSITORY.split('/')
             await github.rest.reactions.createForIssueComment({
               owner,
               repo,
-              comment_id: ${{ github.event.comment.id }},
+              comment_id: context.payload.comment.id,
               content: '+1'
             });
-      - name: Execute SupersetBot Command
-        uses: actions/setup-node@v4
+
+      - name: "Checkout ( ${{ github.sha }} )"
+        uses: actions/checkout@v5
         with:
-          node-version: '20'
-      - run: npm install supersetbot
+          persist-credentials: false
+
+      - name: Setup supersetbot
+        uses: ./.github/actions/setup-supersetbot/
+
       - name: Execute custom Node.js script
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_ACTOR: ${{ github.actor }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_ISSUE_NUMBER: ${{ github.event.issue.number }}
-          COMMENT_BODY: ${{ github.event.comment.body }}
-          INPUT_COMMENT_BODY: ${{ github.event.inputs.comment_body }}
+          COMMENT_BODY: ${{ github.event.comment.body }}${{ github.event.inputs.comment_body }}
         run: |
-          cat <<EOF > script.js
-          const run = async () => {
-            const { runCommandFromGithubAction } = await import('supersetbot');
-            const cmd = process.env.COMMENT_BODY || process.env.INPUT_COMMENT_BODY;
-            console.log("Executing: ", cmd);
-            await runCommandFromGithubAction(cmd);
-          };
-          run().catch(console.error);
-          EOF
-          node script.js
+          supersetbot run "$COMMENT_BODY"

.github/workflows/tag-release.yml

@@ -0,0 +1,134 @@
+name: Publish a Release
+
+on:
+  release:
+    types: [published, edited]
+
+  # Can be triggered manually
+  workflow_dispatch:
+    inputs:
+      release:
+        required: true
+        description: The version to generate
+      git-ref:
+        required: true
+        description: The git reference to checkout prior to running the docker build
+      force-latest:
+        required: true
+        type: choice
+        default: 'false'
+        description: Whether to force a latest tag on the release
+        options:
+          - 'true'
+          - 'false'
+jobs:
+  config:
+    runs-on: ubuntu-24.04
+    outputs:
+      has-secrets: ${{ steps.check.outputs.has-secrets }}
+    steps:
+      - name: "Check for secrets"
+        id: check
+        shell: bash
+        run: |
+          if [ -n "${{ (secrets.DOCKERHUB_USER != '' && secrets.DOCKERHUB_TOKEN != '') || '' }}" ]; then
+            echo "has-secrets=1" >> "$GITHUB_OUTPUT"
+          fi
+
+  docker-release:
+    needs: config
+    if: needs.config.outputs.has-secrets
+    name: docker-release
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        build_preset: ["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]
+      fail-fast: false
+    steps:
+
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Setup Docker Environment
+        uses: ./.github/actions/setup-docker
+        with:
+          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          install-docker-compose: "false"
+          build: "true"
+
+      - name: Use Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Setup supersetbot
+        uses: ./.github/actions/setup-supersetbot/
+
+      - name: Execute custom Node.js script
+        env:
+          DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          RELEASE="${{ github.event.release.tag_name }}"
+          FORCE_LATEST=""
+          EVENT="${{github.event_name}}"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            # in the case of a manually-triggered run, read release from input
+            RELEASE="${{ github.event.inputs.release }}"
+            if [ "${{ github.event.inputs.force-latest }}" = "true" ]; then
+              FORCE_LATEST="--force-latest"
+            fi
+            git checkout "${{ github.event.inputs.git-ref }}"
+            EVENT="release"
+          fi
+
+          supersetbot docker \
+            --push \
+            --preset ${{ matrix.build_preset }} \
+            --context "$EVENT" \
+            --context-ref "$RELEASE" $FORCE_LATEST \
+            --platform "linux/arm64" \
+            --platform "linux/amd64"
+
+          # Returning to master to support closing setup-supersetbot
+          git checkout master
+
+  update-prs-with-release-info:
+    needs: config
+    if: needs.config.outputs.has-secrets
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Use Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Setup supersetbot
+        uses: ./.github/actions/setup-supersetbot/
+
+      - name: Label the PRs with the right release-related labels
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          export GITHUB_ACTOR=""
+          git fetch --all --tags
+          git checkout master
+          RELEASE="${{ github.event.release.tag_name }}"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            # in the case of a manually-triggered run, read release from input
+            RELEASE="${{ github.event.inputs.release }}"
+          fi
+          supersetbot release-label $RELEASE

.github/workflows/tech-debt.yml

@@ -4,11 +4,11 @@ on:
   push:
     branches:
       - master
-      - "[0-9].[0-9]"
+      - "[0-9].[0-9]*"
 
 jobs:
   config:
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-24.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -23,19 +23,19 @@ jobs:
   process-and-upload:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Generate Reports
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "16"
+          node-version-file: './superset-frontend/.nvmrc'
 
       - name: Install Dependencies
-        run: npm install
+        run: npm ci
         working-directory: ./superset-frontend
 
       - name: Run Script

.github/workflows/update-monorepo-lockfiles.yml

@@ -1,47 +0,0 @@
-name: Update Lockfiles for Dependabot Monorepo PRs
-
-on:
-  pull_request:
-    paths:
-      - 'superset-frontend/packages/**/package.json'
-      - 'superset-frontend/plugins/**/package.json'
-    types: [opened, synchronize, reopened]
-  issue_comment:
-    types: [created]
-
-# cancel previous workflow jobs for PRs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  update-lock-file:
-    runs-on: ubuntu-latest
-    if: >
-      (github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]') ||
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@supersetbot trigger-dependabot-lockfile') && github.event.issue.pull_request)
-    defaults:
-      run:
-        working-directory: superset-frontend
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.ref || github.head_ref }} # Checkout the branch that made the PR or the comment's PR branch
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '16'
-
-      - name: Install Dependencies and Update Lock File
-        run: |
-          npm install
-
-      - name: Commit and Push Changes
-        run: |
-          git config user.name "GitHub-Actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add package-lock.json
-          # Push the changes back to the branch if they exist, and pass if there are no changes
-          git diff --staged --quiet || (git commit -m "Update lock file for Dependabot PR" -a && git push https://${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }} ${{ github.event.pull_request.head.ref || github.head_ref }})

.github/workflows/welcome-new-users.yml

@@ -6,13 +6,13 @@ on:
 
 jobs:
   welcome:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       pull-requests: write
 
     steps:
       - name: Welcome Message
-        uses: actions/first-interaction@v1
+        uses: actions/first-interaction@v3
         continue-on-error: true
         with:
           repo-token: ${{ github.token }}

.gitignore

@@ -21,6 +21,7 @@
 *.swp
 __pycache__
 
+.aider*
 .local
 .cache
 .bento*
@@ -42,7 +43,7 @@ _modules
 _static
 build
 app.db
-apache_superset.egg-info/
+*.egg-info/
 changelog.sh
 dist
 dump.rdb
@@ -50,7 +51,6 @@ env
 venv*
 env_py3
 envpy3
-env36
 local_config.py
 /superset_config.py
 /superset_text.yml
@@ -66,7 +66,10 @@ superset-websocket/config.json
 *.js.map
 node_modules
 npm-debug.log*
-superset/static/assets
+superset/static/assets/*
+!superset/static/assets/.gitkeep
+superset/static/uploads/*
+!superset/static/uploads/.gitkeep
 superset/static/version_info.json
 superset-frontend/**/esm/*
 superset-frontend/**/lib/*
@@ -89,6 +92,7 @@ scripts/*.zip
 # IntelliJ
 *.iml
 venv
+.venv
 @eaDir/
 
 # PyCharm
@@ -104,11 +108,29 @@ ghostdriver.log
 testCSV.csv
 .terser-plugin-cache/
 apache-superset-*.tar.gz*
+apache_superset-*.tar.gz*
 release.json
 
-# Translation binaries
-messages.mo
+# Translation-related files
+# these json files are generated by ./scripts/po2json.sh
+superset/translations/**/messages.json
+# these mo binary files are generated by `pybabel compile`
+superset/translations/**/messages.mo
 
 docker/requirements-local.txt
 
 cache/
+docker/*local*
+
+.temp_cache
+
+# Jest test report
+test-report.html
+superset/static/stats/statistics.html
+
+# LLM-related
+CLAUDE.local.md
+PROJECT.md
+.aider*
+.claude_rc*
+.env.local

.pre-commit-config.yaml

@@ -16,32 +16,16 @@
 #
 repos:
   - repo: https://github.com/MarcoGorelli/auto-walrus
-    rev: v0.2.2
+    rev: 0.3.4
     hooks:
       - id: auto-walrus
-  - repo: https://github.com/asottile/pyupgrade
-    rev: v3.4.0
-    hooks:
-      - id: pyupgrade
-        args:
-          - --py39-plus
-  - repo: https://github.com/hadialqattan/pycln
-    rev: v2.1.2
-    hooks:
-      - id: pycln
-        args:
-          - --disable-all-dunder-policy
-          - --exclude=superset/config.py
-          - --extend-exclude=tests/integration_tests/superset_test_config.*.py
-  - repo: https://github.com/PyCQA/isort
-    rev: 5.12.0
-    hooks:
-      - id: isort
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.3.0
+    rev: v1.15.0
     hooks:
       - id: mypy
+        name: mypy (main)
         args: [--check-untyped-defs]
+        exclude: ^superset-extensions-cli/
         additional_dependencies: [
             types-simplejson,
             types-python-dateutil,
@@ -56,33 +40,45 @@ repos:
             types-paramiko,
             types-Markdown,
           ]
-  - repo: https://github.com/peterdemin/pip-compile-multi
-    rev: v2.6.2
-    hooks:
-      - id: pip-compile-multi-verify
+      - id: mypy
+        name: mypy (superset-extensions-cli)
+        args: [--check-untyped-defs]
+        files: ^superset-extensions-cli/
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
+    rev: v5.0.0
     hooks:
       - id: check-docstring-first
       - id: check-added-large-files
-        exclude: \.(geojson)$
+        exclude: ^.*\.(geojson)$|^docs/static/img/screenshots/.*|^superset-frontend/CHANGELOG\.md$
       - id: check-yaml
         exclude: ^helm/superset/templates/
       - id: debug-statements
       - id: end-of-file-fixer
+        exclude: .*/lerna\.json$
       - id: trailing-whitespace
+        exclude: ^.*\.(snap)
         args: ["--markdown-linebreak-ext=md"]
-  - repo: https://github.com/psf/black
-    rev: 23.1.0
+  - repo: local
     hooks:
-      - id: black
-        language_version: python3
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v3.1.0 # Use the sha or tag you want to point at
-    hooks:
-      - id: prettier
-        args: ["--ignore-path=./superset-frontend/.prettierignore"]
-        files: "superset-frontend"
+      - id: eslint-frontend
+        name: eslint (frontend)
+        entry: ./scripts/eslint.sh
+        language: system
+        pass_filenames: true
+        files: ^superset-frontend/.*\.(js|jsx|ts|tsx)$
+      - id: eslint-docs
+        name: eslint (docs)
+        entry: bash -c 'cd docs && FILES=$(echo "$@" | sed "s|docs/||g") && yarn eslint --fix --ext .js,.jsx,.ts,.tsx --quiet $FILES'
+        language: system
+        pass_filenames: true
+        files: ^docs/.*\.(js|jsx|ts|tsx)$
+      - id: type-checking-frontend
+        name: Type-Checking (Frontend)
+        entry: ./scripts/check-type.js package=superset-frontend excludeDeclarationDir=cypress-base
+        language: system
+        files: ^superset-frontend\/.*\.(js|jsx|ts|tsx)$
+        exclude: ^superset-frontend/cypress-base\/
+        require_serial: true
   # blacklist unsafe functions like make_url (see #19526)
   - repo: https://github.com/skorokithakis/blacklist-pre-commit-hook
     rev: e2f070289d8eddcaec0b580d3bde29437e7c8221
@@ -90,7 +86,35 @@ repos:
       - id: blacklist
         args: ["--blacklisted-names=make_url", "--ignore=tests/"]
   - repo: https://github.com/norwoodj/helm-docs
-    rev: v1.11.0
+    rev: v1.14.2
     hooks:
       - id: helm-docs
         files: helm
+        verbose: false
+        args: ["--log-level", "error"]
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.9.7
+    hooks:
+      - id: ruff-format
+      - id: ruff
+        args: [--fix]
+  - repo: local
+    hooks:
+      - id: pylint
+        name: pylint with custom Superset plugins
+        entry: bash
+        language: system
+        types: [python]
+        exclude: ^(tests/|superset/migrations/|scripts/|RELEASING/|docker/)
+        args:
+          - -c
+          - |
+            TARGET_BRANCH=${GITHUB_BASE_REF:-master}
+            git fetch origin "$TARGET_BRANCH"
+            BASE=$(git merge-base origin/"$TARGET_BRANCH" HEAD)
+            files=$(git diff --name-only --diff-filter=ACM "$BASE"..HEAD | grep '^superset/.*\.py$' || true)
+            if [ -n "$files" ]; then
+              pylint --rcfile=.pylintrc --load-plugins=superset.extensions.pylint --reports=no $files
+            else
+              echo "No Python files to lint."
+            fi

.pylintrc

@@ -36,7 +36,7 @@ persistent=yes
 
 # List of plugins (as comma separated values of python modules names) to load,
 # usually to register additional checkers.
-load-plugins=
+load-plugins=superset.extensions.pylint
 
 # Use multiple processes to speed up Pylint.
 jobs=2
@@ -52,33 +52,9 @@ extension-pkg-whitelist=pyarrow
 
 
 [MESSAGES CONTROL]
+disable=all
+enable=disallowed-json-import,disallowed-sql-import,consider-using-transaction
 
-# Only show warnings with the listed confidence levels. Leave empty to show
-# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED
-confidence=
-
-# Enable the message, report, category or checker with the given id(s). You can
-# either give multiple identifier separated by comma (,) or put this option
-# multiple time (only on the command line, not in the configuration file where
-# it should appear only once). See also the "--disable" option for examples.
-enable=
-    useless-suppression,
-
-# Disable the message, report, category or checker with the given id(s). You
-# can either give multiple identifiers separated by comma (,) or put this
-# option multiple times (only on the command line, not in the configuration
-# file where it should appear only once).You can also use "--disable=all" to
-# disable everything first and then reenable specific checks. For example, if
-# you want to run only the similarities checker, you can use "--disable=all
-# --enable=similarities". If you want to run only the classes checker, but have
-# no Warning level messages displayed, use"--disable=all --enable=classes
-# --disable=W"
-disable=
-    cyclic-import,  # re-enable once this no longer raises false positives
-    missing-docstring,
-    duplicate-code,
-    unspecified-encoding,
-    too-many-instance-attributes  # re-enable once this no longer raises false positives
 
 [REPORTS]
 
@@ -171,7 +147,7 @@ max-nested-blocks=5
 [FORMAT]
 
 # Maximum number of characters on a single line.
-max-line-length=90
+max-line-length=100
 
 # Regexp for a line that is allowed to be longer than the limit.
 ignore-long-lines=^\s*(# )?<?https?://\S+>?$