Update GH action versions (#16847)

* Update ci_suite.yml

* Update autowiki.yml

* Update ci_suite.yml

* codeowner_reviews didn't exist

* Update docker_publish.yml

* Update gbp.yml

* Update gbp_collect.yml

* Update generate_documentation.yml

* Update update_tgs_dmapi.yml

* resets the folder

* token update

* label readd

* Update .github/workflows/stale.yml

Co-authored-by: GoldenAlpharex <58045821+GoldenAlpharex@users.noreply.github.com>

.github/workflows/autowiki.yml

@@ -3,6 +3,9 @@ on:
   schedule:
   - cron: "5 4 * * *"
   workflow_dispatch:
+permissions:
+  contents: read
+
 jobs:
   autowiki:
     runs-on: ubuntu-latest
@@ -17,10 +20,10 @@ jobs:
         echo "::set-output name=SECRETS_ENABLED::$SECRET_EXISTS"
     - name: Checkout
       if: steps.secrets_set.outputs.SECRETS_ENABLED
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
     - name: Restore BYOND cache
       if: steps.secrets_set.outputs.SECRETS_ENABLED
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/BYOND
         key: ${{ runner.os }}-byond-${{ secrets.CACHE_PURGE_KEY }}

.github/workflows/ci_suite.yml

@@ -11,8 +11,11 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     name: Run Linters
     runs-on: ubuntu-20.04
+    concurrency:
+      group: run_linters-${{ github.ref }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Restore SpacemanDMM cache
         uses: actions/cache@v3
         with:
@@ -45,7 +48,7 @@ jobs:
           tools/bootstrap/python -m mapmerge2.dmm_test
           ~/dreamchecker > ${GITHUB_WORKSPACE}/output-annotations.txt 2>&1
       - name: Annotate Lints
-        uses: yogstation13/DreamAnnotate@v1
+        uses: yogstation13/DreamAnnotate@v2
         if: always()
         with:
           outputFile: output-annotations.txt
@@ -54,8 +57,11 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     name: Compile Maps
     runs-on: ubuntu-20.04
+    concurrency:
+      group: compile_all_maps-${{ github.ref }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Restore BYOND cache
         uses: actions/cache@v3
         with:
@@ -73,8 +79,11 @@ jobs:
     runs-on: ubuntu-20.04
     outputs:
       maps: ${{ steps.map_finder.outputs.maps }}
+    concurrency:
+      group: find_all_maps-${{ github.ref }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Find Maps
         id: map_finder
         run: |
@@ -101,10 +110,10 @@ jobs:
           - 3306
         options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
     concurrency:
-      group: ci-${{ github.ref }}-${{ matrix.map }}
+      group: run_all_tests-${{ github.ref }}-${{ matrix.map }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Restore BYOND cache
         uses: actions/cache@v3
         with:
@@ -149,7 +158,7 @@ jobs:
     name: Compare Screenshot Tests
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       # If we ever add more artifacts, this is going to break, but it'll be obvious.
       - name: Download screenshot tests
         uses: actions/download-artifact@v3
@@ -182,8 +191,11 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     name: Windows Build
     runs-on: windows-latest
+    concurrency:
+      group: test_windows-${{ github.ref }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Restore Yarn cache
         uses: actions/cache@v3
         with:
@@ -202,7 +214,7 @@ jobs:
           md deploy
           bash tools/deploy.sh ./deploy
       - name: Deploy artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: deploy
           path: deploy

.github/workflows/codeowner_reviews.yml

@@ -0,0 +1,26 @@
+name: Codeowner Reviews
+
+# Controls when the workflow will run
+on: pull_request_target
+
+jobs:
+  assign-users:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so the job can access it
+      - uses: actions/checkout@v3
+
+      #Parse the Codeowner file
+      - name: CodeOwnersParser
+        id: CodeOwnersParser
+        uses: tgstation/CodeOwnersParser@v1
+
+      #Request reviews
+      - name: Request reviews
+        if: steps.CodeOwnersParser.outputs.owners != ''
+        uses: tgstation/RequestReviewFromUser@v1
+        with:
+          separator: ' '
+          users: ${{ steps.CodeOwnersParser.outputs.owners }}

.github/workflows/compile_changelogs.yml

@@ -3,6 +3,7 @@ name: Compile changelogs
 on:
   schedule:
   - cron: "0 0 * * *"
+  workflow_dispatch:
 
 jobs:
   compile:
@@ -30,9 +31,10 @@ jobs:
           sudo apt-get install  dos2unix
       - name: "Checkout"
         if: steps.value_holder.outputs.ACTIONS_ENABLED
-        uses: actions/checkout@v1
+        uses: actions/checkout@v3
         with:
           fetch-depth: 25
+          persist-credentials: false
       - name: "Compile"
         if: steps.value_holder.outputs.ACTIONS_ENABLED
         run: |

.github/workflows/docker_publish.yml

@@ -10,7 +10,7 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Build and Publish Docker Image to Registry
         uses: elgohr/Publish-Docker-Github-Action@master

.github/workflows/docker_publish.yml.disabled

@@ -1,22 +0,0 @@
-name: Docker Build
-
-on:
-  push:
-    branches:
-      - master
-
-jobs:
-  publish:
-    if: "!contains(github.event.head_commit.message, '[ci skip]')"
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Build and Publish Docker Image to Registry
-        uses: elgohr/Publish-Docker-Github-Action@master
-        with:
-          name: tgstation/tgstation
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-          dockerfile: Dockerfile
-          tags: "latest"

.github/workflows/gbp.yml

@@ -16,7 +16,7 @@ jobs:
         echo "::set-output name=ACTIONS_ENABLED::$SECRET_EXISTS"
     - name: Checkout
       if: steps.value_holder.outputs.ACTIONS_ENABLED
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
     - name: Setup git
       if: steps.value_holder.outputs.ACTIONS_ENABLED
       run: |
@@ -24,7 +24,7 @@ jobs:
         git config --global user.email "<>"
     - name: Checkout alternate branch
       if: steps.value_holder.outputs.ACTIONS_ENABLED
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
       with:
         ref: "gbp-balances" # The branch name
         path: gbp-balances

.github/workflows/gbp_collect.yml

@@ -18,7 +18,7 @@ jobs:
         echo "::set-output name=ACTIONS_ENABLED::$SECRET_EXISTS"
     - name: Checkout
       if: steps.value_holder.outputs.ACTIONS_ENABLED
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
     - name: Setup git
       if: steps.value_holder.outputs.ACTIONS_ENABLED
       run: |
@@ -26,7 +26,7 @@ jobs:
         git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
     - name: Checkout alternate branch
       if: steps.value_holder.outputs.ACTIONS_ENABLED
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
       with:
         ref: "gbp-balances" # The branch name
         path: gbp-balances
@@ -37,7 +37,7 @@ jobs:
       run: cp ./.github/gbp.toml ./gbp-balances/.github/gbp.toml
     - name: GBP action
       if: steps.value_holder.outputs.ACTIONS_ENABLED
-      uses: Mothblocks/gbp-action@collate-changes
+      uses: tgstation/gbp-action@master
       with:
         collect: "true"
         directory: ./gbp-balances

.github/workflows/generate_documentation.yml

@@ -3,14 +3,20 @@ on:
   push:
     branches:
     - master
+permissions:
+  contents: read
+
 jobs:
   generate_documentation:
+    permissions:
+      contents: write  # for JamesIves/github-pages-deploy-action to push changes in repo
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     runs-on: ubuntu-20.04
+    concurrency: gen-docs
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Setup cache
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ~/SpacemanDMM
           key: ${{ runner.os }}-spacemandmm-${{ secrets.CACHE_PURGE_KEY }}

.github/workflows/stale.yml

@@ -4,20 +4,27 @@ on:
   schedule:
   - cron: "0 0 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   stale:
 
+    permissions:
+      issues: write  # for actions/stale to close stale issues
+      pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-20.04
 
     steps:
     - uses: actions/stale@v4
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
-        stale-pr-message: "This PR has been inactive for long enough to be automatically marked as stale. This means it is at risk of being auto closed in ~ 5 days, please address any outstanding review items and ensure your PR is finished, if these are all true and you are auto-staled anyway, you need to actively ask maintainers if your PR will be merged. Once you have done any of the previous actions then you should request a maintainer remove the stale label on your PR, to reset the stale timer. If you feel no maintainer will respond in that time, you may wish to close this PR youself, while you seek maintainer comment, as you will then be able to reopen the PR yourself."
+        stale-pr-message: "This PR has been inactive for long enough to be automatically marked as stale. This means it is at risk of being auto closed in ~ 7 days, please address any outstanding review items and ensure your PR is finished, if these are all true and you are auto-staled anyway, you need to actively ask maintainers if your PR will be merged. Once you have done any of the previous actions then you should request a maintainer remove the stale label on your PR, to reset the stale timer. If you feel no maintainer will respond in that time, you may wish to close this PR youself, while you seek maintainer comment, as you will then be able to reopen the PR yourself."
         days-before-stale: 7
-        days-before-close: 5
-        days-before-issue-stale: -1
-        days-before-issue-close: -1
+        days-before-close: 7
         stale-pr-label: 'Stale'
+        days-before-issue-stale: -1
+        stale-issue-label: 'Cleanup Flagged'
+        remove-issue-stale-when-updated: false
         exempt-pr-labels: 'Good First PR,Upstream PR Merged,Stale-b-gone,Test Merged'
         operations-per-run: 300

.github/workflows/test_merge_bot.yml

@@ -0,0 +1,41 @@
+# On a cron, will comment on any PRs that have been test merged.
+# Expects secret GET_TEST_MERGES_URL, a URL that, on GET, will return an array of objects with the schema
+# { round_id, datetime, test_merges, server, url }
+# You can see the moth.fans implementation in Rust here: https://github.com/Mothblocks/mothbus/blob/41fec056824edba0ffdfa39882b67739bf475d83/src/routes/recent_test_merges.rs#L30
+# This is hosted on https://bus.moth.fans/recent-test-merges.json.
+name: Test Merge Detector
+on:
+  schedule:
+  - cron: "*/30 * * * *"
+  workflow_dispatch:
+jobs:
+  test_merge_bot:
+      name: Test Merge Detector
+      runs-on: ubuntu-20.04
+      steps:
+        - name: Check for GET_TEST_MERGES_URL
+          id: secrets_set
+          env:
+            ENABLER_SECRET: ${{ secrets.GET_TEST_MERGES_URL }}
+          run: |
+            unset SECRET_EXISTS
+            if [ -n "$ENABLER_SECRET" ]; then SECRET_EXISTS=true ; fi
+            echo "::set-output name=GET_TEST_MERGES_URL::$SECRET_EXISTS"
+        - name: Checkout
+          if: steps.secrets_set.outputs.GET_TEST_MERGES_URL
+          uses: actions/checkout@v3
+        - name: Prepare module
+          if: steps.secrets_set.outputs.GET_TEST_MERGES_URL
+          run: |
+            # This is needed because node-fetch needs import and doesn't work with require :/
+            echo "{\"type\": \"module\"}" > package.json
+            npm install node-fetch
+        - name: Check for test merges
+          if: steps.secrets_set.outputs.GET_TEST_MERGES_URL
+          uses: actions/github-script@v6
+          env:
+            GET_TEST_MERGES_URL: ${{ secrets.GET_TEST_MERGES_URL }}
+          with:
+            script: |
+              const { processTestMerges } = await import('${{ github.workspace }}/tools/test_merge_bot/main.js')
+              await processTestMerges({ github, context })

.github/workflows/update_tgs_dmapi.yml

@@ -11,7 +11,7 @@ jobs:
     name: Update the TGS DMAPI
     steps:
     - name: Clone
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - name: Branch
       run: |

tools/test_merge_bot/main.js

@@ -0,0 +1,138 @@
+import fetch from "node-fetch";
+
+const TEST_MERGE_COMMENT_HEADER = "<!-- test_merge_bot:";
+
+const { GET_TEST_MERGES_URL } = process.env;
+
+if (!GET_TEST_MERGES_URL) {
+	console.error("GET_TEST_MERGES_URL was not set.");
+	process.exit(1);
+}
+
+export async function processTestMerges({ github, context }) {
+	const rounds = await fetch(GET_TEST_MERGES_URL)
+		.then(async (response) => {
+			if (response.status !== 200) {
+				return Promise.reject(
+					`Failed to fetch test merges: ${
+						response.status
+					} ${await response.text()}`
+				);
+			}
+
+			return response;
+		})
+		.then((response) => response.json())
+		.catch((error) => {
+			console.error(error);
+			process.exit(1);
+		});
+
+	// PR # -> server name -> test merge struct
+	const testMergesPerPr = {};
+
+	for (const round of rounds) {
+		const { server, test_merges } = round;
+
+		for (const testMerge of test_merges) {
+			if (!testMergesPerPr[testMerge]) {
+				testMergesPerPr[testMerge] = {};
+			}
+
+			if (!testMergesPerPr[testMerge][server]) {
+				testMergesPerPr[testMerge][server] = [];
+			}
+
+			testMergesPerPr[testMerge][server].push(round);
+		}
+	}
+
+	for (const [prNumber, servers] of Object.entries(testMergesPerPr)) {
+		const comments = await github.graphql(
+			`
+		query($owner:String!, $repo:String!, $prNumber:Int!) {
+			repository(owner: $owner, name: $repo) {
+				pullRequest(number: $prNumber) {
+					comments(last: 100) {
+						nodes {
+							body
+							databaseId
+							author {
+								login
+							}
+						}
+					}
+				}
+			}
+		}`,
+			{
+				owner: context.repo.owner,
+				repo: context.repo.repo,
+				prNumber: parseInt(prNumber, 10),
+			}
+		);
+
+		const existingComment =
+			comments.repository.pullRequest.comments.nodes.find(
+				(comment) =>
+					comment.author.login === "github-actions" &&
+					comment.body.startsWith(TEST_MERGE_COMMENT_HEADER)
+			);
+
+		const roundIds = Object.values(servers)
+			.flat()
+			.map(({ round_id }) => round_id)
+			.sort()
+			.join(", ");
+
+		const newHeader = `<!-- test_merge_bot: ${roundIds} -->`;
+
+		if (existingComment && existingComment.body.startsWith(newHeader)) {
+			console.log(`Comment is up to date for #${prNumber}`);
+			continue;
+		}
+
+		let totalRounds = 0;
+		let listOfRounds = "";
+
+		for (const [server, rounds] of Object.entries(servers).sort(
+			([a], [b]) => b - a
+		)) {
+			totalRounds += rounds.length;
+
+			listOfRounds += `${"\n"}### ${server}`;
+
+			for (const { datetime, round_id, url } of rounds.sort(
+				(a, b) => b.round_id - a.round_id
+			)) {
+				listOfRounds += `${"\n"}- [${round_id} @ ${datetime}](${url})`;
+			}
+
+			listOfRounds += "\n";
+		}
+
+		const newBody =
+			newHeader +
+			`\nThis pull request was test merged in ${totalRounds} round(s).` +
+			"\n" +
+			"<details><summary>Round list</summary>\n\n" +
+			listOfRounds +
+			"\n</details>\n";
+
+		if (existingComment === undefined) {
+			await github.rest.issues.createComment({
+				owner: context.repo.owner,
+				repo: context.repo.repo,
+				issue_number: prNumber,
+				body: newBody,
+			});
+		} else {
+			await github.rest.issues.updateComment({
+				owner: context.repo.owner,
+				repo: context.repo.repo,
+				comment_id: existingComment.databaseId,
+				body: newBody,
+			});
+		}
+	}
+}