🤖 backported "Reject impersonation role equal to the driver default-r…

…ole sentinel" (#80661)

Reject impersonation role equal to the driver default-role sentinel (#80616)

Reject impersonation role attribute equal to the driver default-role sentinel

connection-impersonation-role now rejects a role attribute that (case-insensitively)
equals the driver's default-database-role sentinel (e.g. NONE / DEFAULT), which would
otherwise emit SET ROLE NONE and drop the connection to the base warehouse credential.

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>

🤖 backported "Reject impersonation role equal to the driver default-r…

…ole sentinel" (#80661)

Reject impersonation role equal to the driver default-role sentinel (#80616)

Reject impersonation role attribute equal to the driver default-role sentinel

connection-impersonation-role now rejects a role attribute that (case-insensitively)
equals the driver's default-database-role sentinel (e.g. NONE / DEFAULT), which would
otherwise emit SET ROLE NONE and drop the connection to the base warehouse credential.

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>

🤖 backported "Reject impersonation role equal to the driver default-r…

…ole sentinel" (#80661)

Reject impersonation role equal to the driver default-role sentinel (#80616)

Reject impersonation role attribute equal to the driver default-role sentinel

connection-impersonation-role now rejects a role attribute that (case-insensitively)
equals the driver's default-database-role sentinel (e.g. NONE / DEFAULT), which would
otherwise emit SET ROLE NONE and drop the connection to the base warehouse credential.

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>

🤖 backported "Reject impersonation role equal to the driver default-r…

…ole sentinel" (#80659)

Reject impersonation role equal to the driver default-role sentinel (#80616)

Reject impersonation role attribute equal to the driver default-role sentinel

connection-impersonation-role now rejects a role attribute that (case-insensitively)
equals the driver's default-database-role sentinel (e.g. NONE / DEFAULT), which would
otherwise emit SET ROLE NONE and drop the connection to the base warehouse credential.

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>

🤖 backported "Reject impersonation role equal to the driver default-r…

…ole sentinel" (#80659)

Reject impersonation role equal to the driver default-role sentinel (#80616)

Reject impersonation role attribute equal to the driver default-role sentinel

connection-impersonation-role now rejects a role attribute that (case-insensitively)
equals the driver's default-database-role sentinel (e.g. NONE / DEFAULT), which would
otherwise emit SET ROLE NONE and drop the connection to the base warehouse credential.

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>

🤖 backported "Reject impersonation role equal to the driver default-r…

…ole sentinel" (#80659)

Reject impersonation role equal to the driver default-role sentinel (#80616)

Reject impersonation role attribute equal to the driver default-role sentinel

connection-impersonation-role now rejects a role attribute that (case-insensitively)
equals the driver's default-database-role sentinel (e.g. NONE / DEFAULT), which would
otherwise emit SET ROLE NONE and drop the connection to the base warehouse credential.

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>

🤖 backported "Reject impersonation role equal to the driver default-r…

…ole sentinel" (#80661)

Reject impersonation role equal to the driver default-role sentinel (#80616)

Reject impersonation role attribute equal to the driver default-role sentinel

connection-impersonation-role now rejects a role attribute that (case-insensitively)
equals the driver's default-database-role sentinel (e.g. NONE / DEFAULT), which would
otherwise emit SET ROLE NONE and drop the connection to the base warehouse credential.

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>

🤖 backported "Reject impersonation role equal to the driver default-r…

…ole sentinel" (#80661)

Reject impersonation role equal to the driver default-role sentinel (#80616)

Reject impersonation role attribute equal to the driver default-role sentinel

connection-impersonation-role now rejects a role attribute that (case-insensitively)
equals the driver's default-database-role sentinel (e.g. NONE / DEFAULT), which would
otherwise emit SET ROLE NONE and drop the connection to the base warehouse credential.

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>

Backport "should run" CI decision family of PRs to v63 (#80330)

* Compile e2e CLJS in parallel with the uberjar build (backport #78017)

Add an `e2e-cljs` job that compiles CLJS alongside the uberjar and hands the
result to each e2e group as an artifact.

This branch keeps its `static-viz-files-changed` job; the two share a step
prefix, so both are spelled out in full.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Warn on PRs that grow the main app's initial bundle (backport #78652)

Generalize the SDK bundle-size check into a shared `bundle-size-check`
action and a `bundle-size` workflow that also covers the main app bundle.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Only run latest app db variants on PRs (backport #78755)

Add an `app-db-matrix` job that selects which app DB versions to test:
every version under force-run, latest-only otherwise.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Remove the redundant `skip` input from bundle-size step (backport #80070)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Decide whether jobs run at all before hitting the test-plan (#80091)

Add a `should-run` job whose verdict (force-run / force-skip / defer) gates
each test workflow before the test plan is consulted, and pass `force-run`
down to app-db, backend and drivers.

`drivers.yml` now takes `FORCE_RUN` from that input instead of computing it
from the ref, so a `ci:run-all` label reaches `mage driver-decisions`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Decide whether to build uberjar based on files changed (#80129)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Explicitly exclude `old-migrations-test` tag (#80214)

* Fix SDK test concurrency collision (#78898)

* Compare a PR's bundle size against the base ref its uberjar was merged with (#79858)

* Record video on e2e re-run attempts (#79279)

* Match description from master

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Nicolò Pretto <info@npretto.com>
Co-authored-by: Romeo Van Snick <romeo@romeovansnick.be>
Co-authored-by: Fraser <fraser@metabase.com>

🤖 backported "Add validation and permission checks for content endpoi…

…nts" (#80474)

* Add validation and permission checks for content endpoints (#80277)

* Run full query-permission checks when compiling a native form (SEC-822)

POST /api/dataset/native compiled and returned the query after checking only
database-level native perms, so a referenced source card or card template tag
was resolved without a read check. Preprocess the query once (with inline
parameter compilation enabled), run the same check-query-permissions* checks
the run path uses (surfacing a permission failure as a 403), then compile the
preprocessed query. Also trim the response to :query and :params.

* Validate link-card entity ids on write for dashboard cards (SEC-836, SEC-832)

DashboardCard validated the link-card entity id only when building the read
query; nothing checked it on write, so a non-integer id could be stored and
would then break every hydration of the dashboard. Add a write-side check in
define-before-insert and a new define-before-update, and wrap the notification
link-card renderer in try/catch so one bad card degrades to a missing part
instead of failing the whole subscription. Adds regression tests.

* Require positive-integer entity ids in dependency backfill (SEC-830)

replace-dependencies! placed to_entity_id directly in the insert, and the
dashboard click_behavior extraction forwarded targetId with no type check. Add
an explicit pos-int? check at the insert where to-add is built (a runtime
check, not an mu/defn schema, which is stripped from prod builds), and filter
targetId to positive integers during extraction so bad ids drop rather than
making the backfill job throw. Adds regression tests.

* Validate click-behavior target ids on write for dashboard cards (SEC-830)

Review follow-up: the entity ids the dependency backfill consumes come from
dashcard click_behavior targetIds, so validate them at the write boundary as
well, keeping the deep guard in replace-dependencies! as defense in depth.
Covers both the top-level click_behavior and per-column column_settings ones,
on insert and update. Adds regression tests.

* Require positive-integer ids in document-deps extraction

The backported test asserts document smartLinks/card embeds with
non-integer ids are dropped, but the pos-int? guards landed on master
via #73244 which is not on this release branch. Port just the guards.

* Use metabase.util.performance/select-keys in qp api ns

Fixes the kondo discouraged-var warning on the backported select-keys
call; master's ns already refers the perf variant.

---------

Co-authored-by: Nicola Mometto <nicola.mometto@metabase.com>