update various versions & workflows

sdmm 1.7 -> 1.9
- Also updated sdmm config for future strictness changes

rust_g 0.46.x -> 3.9.0
- Ships the 3.9.0 windows dll for easy desktop dev. Removed the .so
because new versions are a large binary blob; instead these are fetched
from tgstation release build artifacts for tests, and can be collected
or preferably built locally for linux hosting.

Workflow OS targets updated from ubuntu-20 -> ubuntu-24

stefanzweifel/git-auto-commit-action v5 -> v6 to satisfy dependabot

Mislabeled actions/checkout 3 -> 4

Added cancel-in-progress concurrency rule to CI & label workflows
- Causes new runs of the workflows to cancel older runs still in
progress for a given ref (branch, pr, etc)

Where not using an official action, uses commit hash targets instead of
tags

Added permissions strictness to CI & labels workflows

Made workflows manually runnable

Added preflight change checks to CI workflow
- Only changes to byond sources, byond source validation, or version
definitions should trigger a full test of that matter
- Only changes to tgui sources or version definitions should trigger
a full test of that matter

.github/workflows/autochangelog.yml

@@ -3,8 +3,8 @@ name: Autochangelog
 on:
   pull_request_target:
     types: closed
-    branches:
-      - master
+    branches: [ "master" ]
+  workflow_dispatch: # manual trigger
 
 env:
   BASENAME: "polaris"
@@ -12,19 +12,22 @@ env:
 jobs:
   autochangelog:
     name: Autochangelog
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     if: github.event.pull_request.merged == true
     permissions:
       contents: write
     steps:
-      - uses: /actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: master
+
       - name: Update repository to master
         run: git pull "origin" master
+
       - name: Ensure +x on CI directory
         run: |
           chmod -R +x ./tools/ci
+
       - name: Generate Changelog
         run: |
           pip install pyyaml
@@ -36,7 +39,8 @@ jobs:
           python tools/GenerateChangelog/ss13_genchangelog.py \
             html/changelog.html \
             html/changelogs
-      - uses: stefanzweifel/git-auto-commit-action@v5
+
+      - uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0
         with:
           commit_message: Automatic changelog generation for ${{ github.events.pull_request.number }}
           branch: ${{ github.events.pull_request.base }}

.github/workflows/ci.yml

@@ -1,32 +1,57 @@
 name: CI
+
+permissions:
+  contents: read
+
 on:
-  pull_request:
-    branches:
-      - master
+  push: # any push (direct, merge, etc)
+  pull_request: # any pull request open / update
+  workflow_dispatch: # manual trigger
 
 env:
   BASENAME: "polaris"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
+  pre_flight:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: paths-filter
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
+        id: filter
+        with:
+          filters: .github/workflow-config/preflight-filters.yml
+    outputs:
+      dm: ${{ steps.filter.outputs.dm }}
+      tgui: ${{ steps.filter.outputs.tgui }}
+
   file_tests:
     name: Run Linters
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    needs: pre_flight
     steps:
       - uses: actions/checkout@v4
       - name: Ensure +x on CI directory
-        run: |
-          chmod -R +x ./tools/ci
+        run: chmod -R +x ./tools/ci
       - name: Install Tools
-        run: |
-          bash tools/ci/install_build_deps.sh
-      - name: Run Tests
-        run: |
-          tools/ci/validate_files.sh
-          tools/ci/build_tgui.sh
+        run: bash tools/ci/install_build_deps.sh
+      - name: Run DM Tests
+        if: needs.pre_flight.outputs.dm == 'true'
+        run: tools/ci/validate_files.sh
+      - name: Run TGUI Tests
+        if: needs.pre_flight.outputs.tgui == 'true'
+        run: tools/ci/build_tgui.sh
 
   dreamchecker:
     name: DreamChecker
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    needs: pre_flight
+    if: needs.pre_flight.outputs.dm == 'true'
     steps:
       - uses: actions/checkout@v4
 
@@ -47,29 +72,36 @@ jobs:
           ~/dreamchecker > ${GITHUB_WORKSPACE}/output-annotations.txt 2>&1
 
       - name: Annotate Linter
-        uses: yogstation13/DreamAnnotate@v2
+        uses: yogstation13/DreamAnnotate@8ef04ef7fbb4ac63ee2daca222af91599e0af5e1
         if: always()
         with:
           outputFile: output-annotations.txt
 
   unit_tests:
     name: Integration Tests
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    needs: pre_flight
+    if: needs.pre_flight.outputs.dm == 'true'
     steps:
       - uses: actions/checkout@v4
+
       - name: Ensure +x on CI directory
         run: |
           chmod -R +x ./tools/ci
+
       - name: Setup Cache
         uses: actions/cache@v4
         with:
           path: $HOME/BYOND
           key: ${{ runner.os }}-byond
-      - name: Install RUST_G Dependencies
+
+      - name: Install RUST_G
         run: |
+          ./tools/ci/install_rustg.sh
           sudo dpkg --add-architecture i386
           sudo apt update || true
-          sudo apt install libc6:i386 libgcc1:i386 libstdc++6:i386 libssl1.1:i386 zlib1g:i386
+          sudo apt install zlib1g-dev:i386
+
       - name: Unit Tests
         run: |
           tools/ci/install_byond.sh
@@ -78,6 +110,7 @@ jobs:
           TEST_DEFINE: "UNIT_TEST"
           TEST_FILE: "code/_unit_tests.dm"
           RUN: "1"
+
       - name: Compile POIs (no run)
         run: |
           tools/ci/install_byond.sh
@@ -86,6 +119,7 @@ jobs:
           TEST_DEFINE: "MAP_TEST"
           TEST_FILE: "code/_map_tests.dm"
           RUN: "0"
+
       - name: Compile away missions (no run)
         run: |
           tools/ci/install_byond.sh

.github/workflows/enforce_lables.yml

@@ -1,11 +1,21 @@
 name: Enforce PR labels
+
+permissions:
+  contents: read
+
 on:
   pull_request:
     types: [labeled, unlabeled, opened, edited, synchronize]
+  workflow_dispatch: # manual trigger
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   enforce-label:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
-    - uses: yogevbd/enforce-label-action@2.2.2
+    - uses: yogevbd/enforce-label-action@a3c219da6b8fa73f6ba62b68ff09c469b3a1c024
       with:
         BANNED_LABELS: "Input: Staff,Input: Author,Needs Announcement,Needs Changelog,Needs Documentation,Stale"