Merge pull request #1468 from tgstation/1107-ExperimentingWithPullRequestTarget

Allow CI to run with repo secrets on pull requests after maintainer approval

.github/workflows/ci-suite.yml

@@ -9,6 +9,11 @@ on:
     branches:
     - dev
     - master
+  pull_request_target:
+    types: [opened, reopened, labeled, synchronize]
+    branches:
+    - dev
+    - master
 
 env:
   TGS_DOTNET_VERSION: 6.0.x
@@ -19,9 +24,45 @@ env:
   TGS_TEST_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
 
+concurrency:
+  group: "ci-${{ github.event.number || github.head_ref }}-${{ github.event_name }}"
+  cancel-in-progress: true
+
 jobs:
+  security-checkpoint:
+    name: Check CI Clearance
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request_target' && github.pull_request.head.repo.id != github.repository.id
+    steps:
+    - name: Comment on new Fork PR
+      if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared')
+      uses: thollander/actions-comment-pull-request@v2
+      with:
+        message: Thank you for contributing to tgstation-server! As this pull request is from a fork, we can't allow the CI actions which require repository secrets to run on it without approval. After a brief review to make sure you're not misusing those secrets, a maintainer will add the `CI Cleared` label to allow the CI suite to run. Maintainers, please note that any changes to workflow files will not be reflected in the CI run.
+
+    - name: "Remove Stale 'CI Cleared' Label"
+      if: github.event.action == 'synchronize' || github.event.action == 'reopened'
+      uses: actions-ecosystem/action-remove-labels@v1
+      with:
+        labels: CI Cleared
+
+    - name: Fail Clearance Check if PR has Unlabeled new Commits from Fork
+      if: (github.event.action == 'synchronize' || github.event.action == 'reopened') && !contains(github.event.pull_request.labels.*.name, 'CI Cleared')
+      run: exit 1
+
+  start-ci-run-gate:
+    name: Start CI Run Gate
+    needs: security-checkpoint
+    runs-on: ubuntu-latest
+    if: always() && (needs.security-checkpoint.result == 'success' || (needs.security-checkpoint.result == 'skipped' && (github.event_name == 'push' || github.pull_request.head.repo.id == github.repository.id)))
+    steps:
+    - name: GitHub Requires at Least One Step for a Job
+      run: exit 0
+
   analyze:
     name: Code Scanning
+    needs: start-ci-run-gate
+    if: always() && needs.start-ci-run-gate.result == 'success'
     runs-on: ubuntu-latest
     steps:
     - name: Install Node 12.X
@@ -32,11 +73,19 @@ jobs:
     - name: Upgrade NPM
       run: npm install -g npm
 
-    - name: Checkout repository
+    - name: Checkout (Branch Push)
       uses: actions/checkout@v3
+      if: github.event_name == 'push'
       with:
         fetch-depth: 2
 
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        fetch-depth: 2
+        ref: "refs/pull/${{ github.event.number }}/merge"
+
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v2
       with:
@@ -50,6 +99,8 @@ jobs:
 
   dmapi-build:
     name: Build DMAPI
+    needs: start-ci-run-gate
+    if: always() && needs.start-ci-run-gate.result == 'success'
     env:
       BYOND_MAJOR: 515
       BYOND_MINOR: 1592
@@ -73,8 +124,15 @@ jobs:
         make here
         exit 0
 
-    - name: Checkout
+    - name: Checkout (Branch Push)
       uses: actions/checkout@v3
+      if: github.event_name == 'push'
+
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
     - name: Build DMAPI Test Project
       run: |
@@ -99,59 +157,76 @@ jobs:
   dox-build:
     name: Build Doxygen Site
     runs-on: ubuntu-latest
+    needs: start-ci-run-gate
+    if: always() && needs.start-ci-run-gate.result == 'success'
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+    - name: Checkout (Branch Push)
+      uses: actions/checkout@v3
+      if: github.event_name == 'push'
 
-      - name: Patch Doxyfile
-        run: |
-          VERSION=$(cat "build/Version.props" | grep -oPm1 "(?<=<TgsCoreVersion>)[^<]+")
-          echo -e "\nPROJECT_NUMBER = $VERSION\nINPUT = .\nOUTPUT_DIRECTORY = ./doxout\nPROJECT_LOGO = ./build/tgs.ico\nHAVE_DOT=YES" >> "docs/Doxyfile"
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
-      - name: Doxygen Build
-        uses: mattnotmitt/doxygen-action@v1
-        with:
-          doxyfile-path: 'docs/Doxyfile'
+    - name: Patch Doxyfile
+      run: |
+        VERSION=$(cat "build/Version.props" | grep -oPm1 "(?<=<TgsCoreVersion>)[^<]+")
+        echo -e "\nPROJECT_NUMBER = $VERSION\nINPUT = .\nOUTPUT_DIRECTORY = ./doxout\nPROJECT_LOGO = ./build/tgs.ico\nHAVE_DOT=YES" >> "docs/Doxyfile"
 
-      - name: gh-pages push
-        if: github.event_name == 'push' && github.event.ref == 'refs/heads/dev'
-        run: |
-          git clone -b gh-pages --single-branch "https://git@github.com/tgstation/tgstation-server" $HOME/tgsdox
-          pushd $HOME/tgsdox
-          rm -r *
-          popd
-          echo ./doxout/* | xargs -n 10 sudo mv -t $HOME/tgsdox
-          cd $HOME/tgsdox
-          git config --global push.default simple
-          git config user.name "tgstation-server"
-          git config user.email "tgstation-server@tgstation13.org"
-          echo '# THIS BRANCH IS AUTO GENERATED BY GITHUB ACTIONS' > README.md
+    - name: Doxygen Build
+      uses: mattnotmitt/doxygen-action@v1
+      with:
+        doxyfile-path: 'docs/Doxyfile'
 
-          # Need to create a .nojekyll file to allow filenames starting with an underscore
-          # to be seen on the gh-pages site. Therefore creating an empty .nojekyll file.
-          echo "" > .nojekyll
-          echo "Adding files..."
-          git add --all
-          echo "Committing..."
-          git diff-index --quiet HEAD || git commit -m "Deploy code docs to GitHub Pages for workflow run ${{ github.run_number }}" -m "Commit: ${{ github.event.head_commit.id }}"
-          echo "Pushing..."
-          git push -f "https://${{ secrets.DEV_PUSH_TOKEN }}@github.com/tgstation/tgstation-server" 2>&1
+    - name: gh-pages push
+      if: github.event_name == 'push' && github.event.ref == 'refs/heads/dev'
+      run: |
+        git clone -b gh-pages --single-branch "https://git@github.com/tgstation/tgstation-server" $HOME/tgsdox
+        pushd $HOME/tgsdox
+        rm -r *
+        popd
+        echo ./doxout/* | xargs -n 10 sudo mv -t $HOME/tgsdox
+        cd $HOME/tgsdox
+        git config --global push.default simple
+        git config user.name "tgstation-server"
+        git config user.email "tgstation-server@tgstation13.org"
+        echo '# THIS BRANCH IS AUTO GENERATED BY GITHUB ACTIONS' > README.md
+
+        # Need to create a .nojekyll file to allow filenames starting with an underscore
+        # to be seen on the gh-pages site. Therefore creating an empty .nojekyll file.
+        echo "" > .nojekyll
+        echo "Adding files..."
+        git add --all
+        echo "Committing..."
+        git diff-index --quiet HEAD || git commit -m "Deploy code docs to GitHub Pages for workflow run ${{ github.run_number }}" -m "Commit: ${{ github.event.head_commit.id }}"
+        echo "Pushing..."
+        git push -f "https://${{ secrets.DEV_PUSH_TOKEN }}@github.com/tgstation/tgstation-server" 2>&1
 
   docker-build:
     name: Build Docker Image
     runs-on: ubuntu-latest
+    needs: start-ci-run-gate
+    if: always() && needs.start-ci-run-gate.result == 'success'
     steps:
-    - name: Checkout
+    - name: Checkout (Branch Push)
       uses: actions/checkout@v3
+      if: github.event_name == 'push'
 
-    - name: Upgrade NPM
-      run: sudo npm install -g npm
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
     - name: Build Docker Image
       run: docker build . -f build/Dockerfile
 
   linux-unit-tests:
     name: Linux Tests
+    needs: start-ci-run-gate
+    if: always() && needs.start-ci-run-gate.result == 'success'
     strategy:
       fail-fast: false
       matrix:
@@ -163,8 +238,15 @@ jobs:
       with:
         dotnet-version: ${{ env.TGS_DOTNET_VERSION }}
 
-    - name: Checkout
+    - name: Checkout (Branch Push)
       uses: actions/checkout@v3
+      if: github.event_name == 'push'
+
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
     - name: Upgrade NPM
       run: sudo npm install -g npm
@@ -183,6 +265,8 @@ jobs:
 
   windows-unit-tests:
     name: Windows Tests
+    needs: start-ci-run-gate
+    if: always() && needs.start-ci-run-gate.result == 'success'
     strategy:
       fail-fast: false
       matrix:
@@ -194,8 +278,15 @@ jobs:
       with:
         dotnet-version: ${{ env.TGS_DOTNET_VERSION }}
 
-    - name: Checkout
+    - name: Checkout (Branch Push)
       uses: actions/checkout@v3
+      if: github.event_name == 'push'
+
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
     - name: Upgrade NPM
       run: npm install -g npm
@@ -215,6 +306,7 @@ jobs:
   windows-integration-test:
     name: Windows Live Tests
     needs: dmapi-build
+    if: always() && needs.dmapi-build.result == 'success'
     env:
       TGS_TEST_DATABASE_TYPE: SqlServer
       TGS_TEST_DUMP_API_SPEC: yes
@@ -243,17 +335,24 @@ jobs:
         TGS_CONNSTRING_VALUE="Server=(localdb)\MSSQLLocalDB;Integrated Security=true;Initial Catalog=TGS_${{ matrix.watchdog-type }}_${{ matrix.configuration }};Application Name=tgstation-server"
         echo "TGS_TEST_CONNECTION_STRING=$(echo $TGS_CONNSTRING_VALUE)" >> $GITHUB_ENV
 
-    - name: Checkout
+    - name: Checkout (Branch Push)
       uses: actions/checkout@v3
+      if: github.event_name == 'push'
+
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
     - name: Build
       run: dotnet build -c ${{ matrix.configuration }} tests/Tgstation.Server.Tests/Tgstation.Server.Tests.csproj
 
-    - name: Run Integration Test
+    - name: Run Live Tests
       run: |
         cd tests/Tgstation.Server.Tests
         Start-Sleep -Seconds 10
-        dotnet test -c ${{ matrix.configuration }} --no-build --logger GitHubActions --collect:"XPlat Code Coverage" --settings ../../build/coverlet.runsettings --results-directory ../../TestResults
+        dotnet test -c ${{ matrix.configuration }} --no-build --filter FullyQualifiedName~TestLiveServer --logger GitHubActions --collect:"XPlat Code Coverage" --settings ../../build/coverlet.runsettings --results-directory ../../TestResults
 
     - name: Store Code Coverage
       uses: actions/upload-artifact@v3
@@ -287,6 +386,7 @@ jobs:
   linux-integration-tests:
     name: Linux Live Tests
     needs: dmapi-build
+    if: always() && needs.dmapi-build.result == 'success'
     services: # We start all dbs here so we can just code the stuff once
       postgres:
         image: cyberboss/postgres-max-connections # Fork of _/postgres:latest with max_connections=500 becuase GitHub actions service containers have no way to set command lines. Rebuilds with updates.
@@ -380,17 +480,24 @@ jobs:
       if: ${{ matrix.watchdog-type == 'Basic' }}
       run: echo "General__UseBasicWatchdog=true" >> $GITHUB_ENV
 
-    - name: Checkout
+    - name: Checkout (Branch Push)
       uses: actions/checkout@v3
+      if: github.event_name == 'push'
+
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
     - name: Build
       run: dotnet build -c ${{ matrix.configuration }}NoService tests/Tgstation.Server.Tests/Tgstation.Server.Tests.csproj
 
-    - name: Run Integration Test
+    - name: Run Live Tests
       run: |
         cd tests/Tgstation.Server.Tests
         sleep 10
-        dotnet test -c ${{ matrix.configuration }}NoService --logger GitHubActions --no-build --collect:"XPlat Code Coverage" --settings ../../build/coverlet.runsettings --results-directory ../../TestResults
+        dotnet test -c ${{ matrix.configuration }}NoService --filter FullyQualifiedName~TestLiveServer --logger GitHubActions --no-build --collect:"XPlat Code Coverage" --settings ../../build/coverlet.runsettings --results-directory ../../TestResults
 
     - name: Store Code Coverage
       uses: actions/upload-artifact@v3
@@ -431,6 +538,7 @@ jobs:
   validate-openapi-spec:
     name: OpenAPI Spec Validation
     needs: windows-integration-test
+    if: always() && needs.windows-integration-test.result == 'success'
     runs-on: ubuntu-latest
     steps:
     - name: Install Node 12.X
@@ -441,8 +549,15 @@ jobs:
     - name: Install IBM OpenAPI Validator
       run: npm i -g ibm-openapi-validator@0.51.3
 
-    - name: Checkout
+    - name: Checkout (Branch Push)
       uses: actions/checkout@v3
+      if: github.event_name == 'push'
+
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
     - name: Retrieve OpenAPI Spec
       uses: actions/download-artifact@v3
@@ -456,10 +571,18 @@ jobs:
   upload-code-coverage:
     name: Upload Code Coverage
     needs: [linux-unit-tests, linux-integration-tests, windows-unit-tests, windows-integration-test]
+    if: always() && needs.linux-unit-tests.result == 'success' && needs.linux-integration-tests.result == 'success' && needs.windows-unit-tests.result == 'success' && needs.windows-integration-test.result == 'success'
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout for .codecov.yml
+    - name: Checkout (Branch Push)
       uses: actions/checkout@v3
+      if: github.event_name == 'push'
+
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
     - name: Retrieve Linux Unit Test Coverage (Debug)
       uses: actions/download-artifact@v3
@@ -538,271 +661,313 @@ jobs:
     name: Deploy HTTP API
     needs: [upload-code-coverage, validate-openapi-spec]
     runs-on: windows-latest
-    if: github.event_name == 'push' && contains(github.event.head_commit.message, '[APIDeploy]')
+    if: always() && needs.upload-code-coverage.result == 'success' && needs.validate-openapi-spec.result == 'success' && github.event_name == 'push' && contains(github.event.head_commit.message, '[APIDeploy]')
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+    - name: Checkout (Branch Push)
+      uses: actions/checkout@v3
+      if: github.event_name == 'push'
 
-      - name: Parse API version
-        shell: powershell
-        run: |
-          [XML]$versionXML = Get-Content build/Version.props
-          $apiVersion = $versionXML.Project.PropertyGroup.TgsApiVersion
-          echo "TGS_API_VERSION=$apiVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
-      - name: Retrieve OpenAPI Spec
-        uses: actions/download-artifact@v3
-        with:
-          name: openapi-spec
-          path: swagger
+    - name: Parse API version
+      shell: powershell
+      run: |
+        [XML]$versionXML = Get-Content build/Version.props
+        $apiVersion = $versionXML.Project.PropertyGroup.TgsApiVersion
+        echo "TGS_API_VERSION=$apiVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
 
-      - name: Create GitHub Release
-        uses: juitnow/github-action-create-release@v1
-        id: create_release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: api-v${{ env.TGS_API_VERSION }}
-          release_name: tgstation-server API v${{ env.TGS_API_VERSION }}
-          body: The TGS HTTP API
-          commitish: ${{ github.event.head_commit.id }}
+    - name: Retrieve OpenAPI Spec
+      uses: actions/download-artifact@v3
+      with:
+        name: openapi-spec
+        path: swagger
 
-      - name: Upload OpenApi Spec
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./swagger/swagger.json
-          asset_name: swagger.json
-          asset_content_type: application/json
+    - name: Create GitHub Release
+      uses: juitnow/github-action-create-release@v1
+      id: create_release
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        tag_name: api-v${{ env.TGS_API_VERSION }}
+        release_name: tgstation-server API v${{ env.TGS_API_VERSION }}
+        body: The TGS HTTP API
+        commitish: ${{ github.event.head_commit.id }}
+
+    - name: Upload OpenApi Spec
+      uses: actions/upload-release-asset@v1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.create_release.outputs.upload_url }}
+        asset_path: ./swagger/swagger.json
+        asset_name: swagger.json
+        asset_content_type: application/json
 
   deploy-dm:
     name: Deploy DreamMaker API
     needs: [upload-code-coverage, validate-openapi-spec]
     runs-on: windows-latest
-    if: github.event_name == 'push' && contains(github.event.head_commit.message, '[DMDeploy]')
+    if: always() && needs.upload-code-coverage.result == 'success' && needs.validate-openapi-spec.result == 'success' && github.event_name == 'push' && contains(github.event.head_commit.message, '[DMDeploy]')
     steps:
+    - name: Checkout (Branch Push)
+      uses: actions/checkout@v3
+      if: github.event_name == 'push'
 
-      - name: Checkout
-        uses: actions/checkout@v3
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
-      - name: Parse DMAPI version
-        shell: powershell
-        run: |
-          [XML]$versionXML = Get-Content build/Version.props
-          $dmVersion = $versionXML.Project.PropertyGroup.TgsDmapiVersion
-          echo "TGS_DM_VERSION=$dmVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
+    - name: Parse DMAPI version
+      shell: powershell
+      run: |
+        [XML]$versionXML = Get-Content build/Version.props
+        $dmVersion = $versionXML.Project.PropertyGroup.TgsDmapiVersion
+        echo "TGS_DM_VERSION=$dmVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
 
-      - name: Zip DMAPI
-        shell: powershell
-        run: |
-          &"C:/Program Files/7-Zip/7z.exe" a DMAPI.zip ./src/DMAPI/* -tzip
+    - name: Zip DMAPI
+      shell: powershell
+      run: |
+        &"C:/Program Files/7-Zip/7z.exe" a DMAPI.zip ./src/DMAPI/* -tzip
 
-      - name: Create GitHub Release
-        uses: juitnow/github-action-create-release@v1
-        id: create_release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: dmapi-v${{ env.TGS_DM_VERSION }}
-          release_name: tgstation-server DMAPI v${{ env.TGS_DM_VERSION }}
-          body: The TGS DMAPI \#tgs-dmapi-release
-          commitish: ${{ github.event.head_commit.id }}
+    - name: Create GitHub Release
+      uses: juitnow/github-action-create-release@v1
+      id: create_release
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        tag_name: dmapi-v${{ env.TGS_DM_VERSION }}
+        release_name: tgstation-server DMAPI v${{ env.TGS_DM_VERSION }}
+        body: The TGS DMAPI \#tgs-dmapi-release
+        commitish: ${{ github.event.head_commit.id }}
 
-      - name: Upload DMAPI Artifact
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./DMAPI.zip
-          asset_name: DMAPI.zip
-          asset_content_type: application/zip
+    - name: Upload DMAPI Artifact
+      uses: actions/upload-release-asset@v1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.create_release.outputs.upload_url }}
+        asset_path: ./DMAPI.zip
+        asset_name: DMAPI.zip
+        asset_content_type: application/zip
 
   deploy-client:
     name: Deploy Nuget Packages
     needs: [upload-code-coverage, validate-openapi-spec]
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && contains(github.event.head_commit.message, '[NugetDeploy]')
+    if: always() && needs.upload-code-coverage.result == 'success' && needs.validate-openapi-spec.result == 'success' && github.event_name == 'push' && contains(github.event.head_commit.message, '[NugetDeploy]')
     steps:
-      - name: Setup dotnet
-        uses: actions/setup-dotnet@v2
-        with:
-          dotnet-version: ${{ env.TGS_DOTNET_VERSION }}
+    - name: Setup dotnet
+      uses: actions/setup-dotnet@v2
+      with:
+        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}
 
-      - name: Checkout
-        uses: actions/checkout@v3
+    - name: Checkout (Branch Push)
+      uses: actions/checkout@v3
+      if: github.event_name == 'push'
 
-      - name: Publish API to NuGet
-        uses: alirezanet/publish-nuget@v3.0.0
-        with:
-          PROJECT_FILE_PATH: src/Tgstation.Server.Api/Tgstation.Server.Api.csproj
-          TAG_COMMIT: false
-          INCLUDE_SYMBOLS: true
-          NUGET_KEY: ${{ secrets.NUGET_API_KEY }}
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
-      - name: Publish Client to NuGet
-        uses: alirezanet/publish-nuget@v3.0.0
-        with:
-          PROJECT_FILE_PATH: src/Tgstation.Server.Client/Tgstation.Server.Client.csproj
-          TAG_COMMIT: false
-          INCLUDE_SYMBOLS: true
-          NUGET_KEY: ${{ secrets.NUGET_API_KEY }}
+    - name: Publish API to NuGet
+      uses: alirezanet/publish-nuget@v3.0.0
+      with:
+        PROJECT_FILE_PATH: src/Tgstation.Server.Api/Tgstation.Server.Api.csproj
+        TAG_COMMIT: false
+        INCLUDE_SYMBOLS: true
+        NUGET_KEY: ${{ secrets.NUGET_API_KEY }}
+
+    - name: Publish Client to NuGet
+      uses: alirezanet/publish-nuget@v3.0.0
+      with:
+        PROJECT_FILE_PATH: src/Tgstation.Server.Client/Tgstation.Server.Client.csproj
+        TAG_COMMIT: false
+        INCLUDE_SYMBOLS: true
+        NUGET_KEY: ${{ secrets.NUGET_API_KEY }}
 
   ensure-release:
     name: Ensure TGS Release is Latest GitHub Release
     needs: [deploy-dm, deploy-http]
     runs-on: ubuntu-latest
-    if: always() && github.event_name == 'push' && !contains(github.event.head_commit.message, '[TGSDeploy]') && (contains(github.event.head_commit.message, '[APIDeploy]') || contains(github.event.head_commit.message, '[DMDeploy]'))
+    if: always() && (needs.deploy-dm.result == 'success' || needs.deploy-http.result == 'success') && !contains(github.event.head_commit.message, '[TGSDeploy]')
     steps:
-      - name: Setup dotnet
-        uses: actions/setup-dotnet@v2
-        with:
-          dotnet-version: ${{ env.TGS_DOTNET_VERSION }}
+    - name: Setup dotnet
+      uses: actions/setup-dotnet@v2
+      with:
+        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}
 
-      - name: Checkout
-        uses: actions/checkout@v3
+    - name: Checkout (Branch Push)
+      uses: actions/checkout@v3
+      if: github.event_name == 'push'
 
-      - name: Run ReleaseNotes with --ensure-release
-        run: dotnet run -c Release --project tools/ReleaseNotes --ensure-release
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
+
+    - name: Run ReleaseNotes with --ensure-release
+      run: dotnet run -c Release --project tools/ReleaseNotes --ensure-release
 
   deploy-tgs:
     name: Deploy TGS
-    needs: [upload-code-coverage, validate-openapi-spec]
+    needs: [deploy-dm, deploy-http, upload-code-coverage, validate-openapi-spec]
     runs-on: windows-latest
-    if: github.event_name == 'push' && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]')
+    if: always() && (needs.upload-code-coverage.result == 'success' || needs.validate-openapi-spec.result == 'success') && github.event_name == 'push' && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]')
     steps:
-      - name: Setup dotnet
-        uses: actions/setup-dotnet@v2
-        with:
-          dotnet-version: ${{ env.TGS_DOTNET_VERSION }}
+    - name: Setup dotnet
+      uses: actions/setup-dotnet@v2
+      with:
+        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}
 
-      - name: Checkout
-        uses: actions/checkout@v3
+    - name: Checkout (Branch Push)
+      uses: actions/checkout@v3
+      if: github.event_name == 'push'
 
-      - name: Parse TGS version
-        shell: powershell
-        run: |
-          [XML]$versionXML = Get-Content build/Version.props
-          $tgsVersion = $versionXML.Project.PropertyGroup.TgsCoreVersion
-          echo "TGS_VERSION=$tgsVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
-      - name: Retrieve Server Service
-        uses: actions/download-artifact@v3
-        with:
-          name: ServerService
-          path: ServerService
+    - name: Parse TGS version
+      shell: powershell
+      run: |
+        [XML]$versionXML = Get-Content build/Version.props
+        $tgsVersion = $versionXML.Project.PropertyGroup.TgsCoreVersion
+        echo "TGS_VERSION=$tgsVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
 
-      - name: Retrieve Server Console
-        uses: actions/download-artifact@v3
-        with:
-          name: ServerConsole
-          path: ServerConsole
+    - name: Retrieve Server Service
+      uses: actions/download-artifact@v3
+      with:
+        name: ServerService
+        path: ServerService
 
-      - name: Retrieve Server Update Package
-        uses: actions/download-artifact@v3
-        with:
-          name: ServerUpdatePackage
-          path: ServerUpdatePackage
+    - name: Retrieve Server Console
+      uses: actions/download-artifact@v3
+      with:
+        name: ServerConsole
+        path: ServerConsole
 
-      - name: Retrieve OpenAPI Spec
-        uses: actions/download-artifact@v3
-        with:
-          name: openapi-spec
-          path: swagger
+    - name: Retrieve Server Update Package
+      uses: actions/download-artifact@v3
+      with:
+        name: ServerUpdatePackage
+        path: ServerUpdatePackage
 
-      - name: Zip Artifacts
-        shell: powershell
-        run: |
-          &"C:/Program Files/7-Zip/7z.exe" a DMAPI.zip ./src/DMAPI/* -tzip
-          &"C:/Program Files/7-Zip/7z.exe" a ServerService.zip ./ServerService/* -tzip
-          &"C:/Program Files/7-Zip/7z.exe" a ServerConsole.zip ./ServerConsole/* -tzip
-          &"C:/Program Files/7-Zip/7z.exe" a ServerUpdatePackage.zip ./ServerUpdatePackage/* -tzip
+    - name: Retrieve OpenAPI Spec
+      uses: actions/download-artifact@v3
+      with:
+        name: openapi-spec
+        path: swagger
 
-      - name: Generate Release Notes
-        run: dotnet run -c Release --project tools/ReleaseNotes ${{ env.TGS_VERSION }}
+    - name: Zip Artifacts
+      shell: powershell
+      run: |
+        &"C:/Program Files/7-Zip/7z.exe" a DMAPI.zip ./src/DMAPI/* -tzip
+        &"C:/Program Files/7-Zip/7z.exe" a ServerService.zip ./ServerService/* -tzip
+        &"C:/Program Files/7-Zip/7z.exe" a ServerConsole.zip ./ServerConsole/* -tzip
+        &"C:/Program Files/7-Zip/7z.exe" a ServerUpdatePackage.zip ./ServerUpdatePackage/* -tzip
 
-      - name: Create GitHub Release
-        uses: actions/create-release@v1
-        id: create_release
-        env:
-          GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
-        with:
-          tag_name: tgstation-server-v${{ env.TGS_VERSION }}
-          release_name: tgstation-server-v${{ env.TGS_VERSION }}
-          body_path: release_notes.md
-          commitish: ${{ github.event.head_commit.id }}
+    - name: Generate Release Notes
+      run: dotnet run -c Release --project tools/ReleaseNotes ${{ env.TGS_VERSION }}
 
-      - name: Upload Server Console Artifact
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./ServerConsole.zip
-          asset_name: ServerConsole.zip
-          asset_content_type: application/zip
+    - name: Create GitHub Release
+      uses: actions/create-release@v1
+      id: create_release
+      env:
+        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+      with:
+        tag_name: tgstation-server-v${{ env.TGS_VERSION }}
+        release_name: tgstation-server-v${{ env.TGS_VERSION }}
+        body_path: release_notes.md
+        commitish: ${{ github.event.head_commit.id }}
 
-      - name: Upload Server Service Artifact
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./ServerService.zip
-          asset_name: ServerService.zip
-          asset_content_type: application/zip
+    - name: Upload Server Console Artifact
+      uses: actions/upload-release-asset@v1
+      env:
+        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+      with:
+        upload_url: ${{ steps.create_release.outputs.upload_url }}
+        asset_path: ./ServerConsole.zip
+        asset_name: ServerConsole.zip
+        asset_content_type: application/zip
 
-      - name: Upload DMAPI Artifact
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./DMAPI.zip
-          asset_name: DMAPI.zip
-          asset_content_type: application/zip
+    - name: Upload Server Service Artifact
+      uses: actions/upload-release-asset@v1
+      env:
+        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+      with:
+        upload_url: ${{ steps.create_release.outputs.upload_url }}
+        asset_path: ./ServerService.zip
+        asset_name: ServerService.zip
+        asset_content_type: application/zip
 
-      - name: Upload OpenApi Spec Artifact
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./swagger/swagger.json
-          asset_name: swagger.json
-          asset_content_type: application/json
+    - name: Upload DMAPI Artifact
+      uses: actions/upload-release-asset@v1
+      env:
+        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+      with:
+        upload_url: ${{ steps.create_release.outputs.upload_url }}
+        asset_path: ./DMAPI.zip
+        asset_name: DMAPI.zip
+        asset_content_type: application/zip
 
-      - name: Upload Server Update Package Artifact
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./ServerUpdatePackage.zip
-          asset_name: ServerUpdatePackage.zip
-          asset_content_type: application/zip
+    - name: Upload OpenApi Spec Artifact
+      uses: actions/upload-release-asset@v1
+      env:
+        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+      with:
+        upload_url: ${{ steps.create_release.outputs.upload_url }}
+        asset_path: ./swagger/swagger.json
+        asset_name: swagger.json
+        asset_content_type: application/json
+
+    - name: Upload Server Update Package Artifact
+      uses: actions/upload-release-asset@v1
+      env:
+        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+      with:
+        upload_url: ${{ steps.create_release.outputs.upload_url }}
+        asset_path: ./ServerUpdatePackage.zip
+        asset_name: ServerUpdatePackage.zip
+        asset_content_type: application/zip
 
   deploy-docker:
     name: Deploy TGS (Docker)
     needs: [deploy-tgs]
+    if: always() && needs.deploy-tgs.result == 'success'
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+    - name: Checkout (Branch Push)
+      uses: actions/checkout@v3
+      if: github.event_name == 'push'
 
-      - name: Parse TGS version
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y xmlstarlet
-          echo "TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuild/2003" --template --value-of /X:Project/X:PropertyGroup/X:TgsCoreVersion build/Version.props)" >> $GITHUB_ENV
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v3
+      if: github.event_name != 'push'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
-      - name: Docker Build and Push
-        uses: elgohr/Publish-Docker-Github-Action@v5
-        with:
-          name: tgstation/server
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-          dockerfile: build/Dockerfile
-          tags: "latest,v${{ env.TGS_VERSION }}"
+    - name: Parse TGS version
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y xmlstarlet
+        echo "TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuild/2003" --template --value-of /X:Project/X:PropertyGroup/X:TgsCoreVersion build/Version.props)" >> $GITHUB_ENV
+
+    - name: Docker Build and Push
+      uses: elgohr/Publish-Docker-Github-Action@v5
+      with:
+        name: tgstation/server
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+        dockerfile: build/Dockerfile
+        tags: "latest,v${{ env.TGS_VERSION }}"

.github/workflows/stable-merge.yml

@@ -1,9 +1,9 @@
 name: 'Master Merge'
 
 on:
-    push:
-      branches:
-        - master
+  push:
+    branches:
+    - master
 
 jobs:
   master-merge: