metabase - Moses Yebei

The Problem

Organizations need a self‑service analytics layer that lets non‑technical users explore data while giving developers the ability to embed charts, run complex SQL, and extend the platform. Managing separate BI tools, custom dashboards, and ad‑hoc query pipelines creates operational overhead and inconsistent governance.

What This Does

The repository is a fork of Metabase, an open‑source BI and embedded‑analytics server written primarily in Clojure with a React/TypeScript frontend. Core server code lives under src/ (not listed but implied by the Clojure linter files) and is exercised by the extensive test suite in .clj-kondo/test/ and the 58 test files detected.

The Dockerfile in .devcontainer/Dockerfile builds a development container that installs the Clojure toolchain, Node, and all runtime dependencies. CI pipelines are defined in .github/workflows/ (e.g., backend.yml, e2e-download-uberjar.yml), which compile the Clojure code, run unit tests, and produce an Uberjar for deployment. Configuration examples are provided in .env.example, and the project ships a ready‑to‑run Docker image (metabase/metabase) referenced in the README badges.

How To Use It

Clone the fork git clone https://github.com/<your‑org>/metabase.git cd metabase Build the Docker image (the devcontainer Dockerfile works for local builds) docker build -f .devcontainer/Dockerfile -t metabase-fork:latest . Create a runtime environment file cp .env.example .env Edit .env to set at least: MBDBFILE=/metabase-data/metabase.db MBJETTYHOST=0.0.0.0 MBJETTYPORT=3000 Run the container docker run -d \ -p 3000:3000 \ --env-file .env \ -v $(pwd)/metabase-data:/metabase-data \ metabase-fork:latest

The official README points to the same Docker workflow; the repo does not contain a custom docker-compose.yml, so the docker run command is the only documented entry point.*

Real‑World Use

A SaaS product can embed Metabase dashboards by configuring the Embedding API (see docs/embedding/introduction.md in the upstream repo). After the container is running, the product calls POST /api/session to obtain a JWT, then loads a signed embed URL in an iframe. The same instance can serve internal users via the web UI at http://localhost:3000.

Example: create an embed token (requires Metabase admin API key) curl -X POST http://localhost:3000/api/session \ -H "Content-Type: application/json" \ -d '{"username":"admin@company.com","password":"<pwd>"}'

Code Health & Issues

Medium – Missing LICENSE – No LICENSE file; downstream users lack clear redistribution rights. Low – Large Clojure codebase without explicit project.clj in the view – Build relies on hidden Leiningen/CLI config; newcomers may struggle to locate the entry point. Low – Secrets in CI – .github/workflows/ reference actions that may require tokens; no .env sample for production secrets, only a placeholder .env.example. Low – Test coverage – 58 test files and CI workflows (backend-cloverage.yml) suggest good coverage, but no coverage badge in the fork’s README. Low – Dockerfile only for devcontainer – No production‑oriented Dockerfile; the devcontainer image is repurposed for runtime builds, which may include unnecessary dev tools.

Overall the repository shows a mature CI pipeline, extensive linting (.clj-kondo/), and a clear Docker entry point, but the missing license and lack of production Dockerfile are the primary concerns.

The Bottom Line

The fork provides a fully functional Metabase server that can be built and run via Docker, with a solid test suite and CI automation. It is ready for teams that need an on‑premise or self‑hosted analytics stack, provided they add a proper license file and may create a leaner production Dockerfile. Organizations comfortable with Clojure/Java ecosystems will find it straightforward to extend; other teams should evaluate the licensing gap before adoption.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

18,651 files

TypeScript5205
TSX4836
YAML849
CSS695
JavaScript523
Markdown475

ReactNext.jsAngularExpressDockerTransformersVector store

Dependencies

16 of 22 declared dependencies are a major version behind. Resolved 22 of 22 against the registry.

Package	Declared	Latest	Behind
`@types/node`	^20	26.2.0	6 major
`@ngx-env/builder`	19.0.4	22.0.0	3 major
`@angular/common`	^20.0.0	22.1.2	2 major
`@angular/compiler`	^20.0.0	22.1.2	2 major
`@angular/core`	^20.0.0	22.1.2	2 major
`@angular/platform-browser`	^20.0.0	22.1.2	2 major
`@angular/router`	^20.0.0	22.1.2	2 major
`@angular-devkit/build-angular`	^20.0.0	22.1.4	2 major

Findings

LowSecret-shaped paths present; the code-health audit confirms or clears them bin/docker/DigiCertGlobalRootG2.crt.pem, e2e/test/scenarios/maildev-keys/cert.pem, e2e/test/scenarios/maildev-keys/key.pem

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium7

Remove the committed database dumphigh

resources/sample-database.db.mv.db

A dump is the one artefact that leaks other people's data rather than the owner's, which turns a hygiene problem into a notification obligation.

Fix: Remove and purge from history; if it held personal data, assess it as a disclosure.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/build-for-release.yml

1 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

8 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium

.devcontainer/Dockerfile

mcr.microsoft.com/vscode/devcontainers/java:21

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium

docs/questions/images/map-tiles.png

1 blobs over 5MB: map-tiles.png 9.0MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Remove generated build output from version controlmedium70 occurrences

bin

70 generated files committed

The reviewer reads src, production runs dist, and a stale bundle means the fix that was reviewed is not the code that executes.

Fix: Gitignore the output directory and build in CI.

Review the install lifecycle script and disable scripts in CImedium2 occurrences

package.json

preinstall, postinstall (fetches from the network)

Install scripts are the execution vector for every npm compromise from event-stream onward, and a postinstall that fetches a binary makes the build depend on a URL nobody reviews.

Fix: Move the work into an explicit build step, or set ignore-scripts in CI and run it by name.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.