Merge branch 'dev' of https://github.com/tgstation/tgstation-server into IOptionsSnapshot

.github/workflows/ci-pipeline.yml

@@ -10,7 +10,8 @@
 # - Checks commit tags for deployment intents
 # - Deploys DreamMaker API zip [DMDeploy] (dev/master)
 # - Deploys Nuget Packages [NugetDeploy] (dev/master)
-# - Deploys HTTP API swagger.json [APIDeploy] (dev/master)
+# - Deploys HTTP API swagger.json [RESTDeploy] (dev/master)
+# - Deploys GraphQL API schema.graphql [GQLDeploy] (dev/master)
 # - Deploys tgstation-server [TGSDeploy] (master)
 #   - GitHub Releases: https://github.com/tgstation/tgstation-server/releases
 #   - Docker: https://hub.docker.com/r/tgstation/server
@@ -40,7 +41,6 @@ env:
   TGS_WEBPANEL_NODE_VERSION: 20.x
   TGS_TEST_GITHUB_TOKEN: ${{ secrets.LIVE_TESTS_TOKEN }}
   PACKAGING_PRIVATE_KEY_PASSPHRASE: ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }}
-  Internal__EnableGraphQL: true
 
 concurrency:
   group: "ci-${{ (github.event_name != 'push' && github.event_name != 'schedule' && github.event.inputs.pull_request_number) || github.run_id }}-${{ github.event_name }}"
@@ -51,6 +51,11 @@ jobs:
     name: Build ReleaseNotes for Other Jobs
     runs-on: ubuntu-latest
     steps:
+      - name: Install Native Dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgdiplus
+
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
         with:
@@ -84,6 +89,11 @@ jobs:
     env:
       TGS_TELEMETRY_KEY_FILE: /tmp/tgs_telemetry_key.txt
     steps:
+      - name: Install Native Dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgdiplus
+
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
         with:
@@ -578,7 +588,6 @@ jobs:
         configuration: ["Debug", "Release"]
     env:
       TGS_TELEMETRY_KEY_FILE: C:/tgs_telemetry_key.txt
-      TGS_TEST_GRAPHQL: true
     runs-on: windows-latest
     steps:
       - name: Setup dotnet
@@ -627,6 +636,7 @@ jobs:
         run: |
           echo "TGS_TEST_DATABASE_TYPE=PostgresSql" >> $GITHUB_ENV
           echo "TGS_TEST_CONNECTION_STRING=Application Name=tgstation-server;Host=127.0.0.1;Username=$USER;Database=TGS__${{ matrix.watchdog-type }}_${{ matrix.configuration }}" >> $GITHUB_ENV
+          echo "TGS_TEST_GRAPHQL=true" >> $GITHUB_ENV
 
       - name: Setup MariaDB
         uses: ankane/setup-mariadb@v1
@@ -638,6 +648,7 @@ jobs:
         run: |
           echo "TGS_TEST_DATABASE_TYPE=MariaDB" >> $GITHUB_ENV
           echo "TGS_TEST_CONNECTION_STRING=Server=127.0.0.1;uid=root;database=tgs__${{ matrix.watchdog-type }}_${{ matrix.configuration }}" >> $GITHUB_ENV
+          echo "TGS_TEST_GRAPHQL=true" >> $GITHUB_ENV
 
       - name: Setup MySQL
         uses: ankane/setup-mysql@v1
@@ -657,6 +668,7 @@ jobs:
           TGS_CONNSTRING_VALUE="Server=(localdb)\MSSQLLocalDB;Encrypt=false;Integrated Security=true;Initial Catalog=TGS_${{ matrix.watchdog-type }}_${{ matrix.configuration }};Application Name=tgstation-server"
           echo "TGS_TEST_CONNECTION_STRING=$(echo $TGS_CONNSTRING_VALUE)" >> $GITHUB_ENV
           echo "TGS_TEST_DATABASE_TYPE=SqlServer" >> $GITHUB_ENV
+          echo "TGS_TEST_GRAPHQL=true" >> $GITHUB_ENV
 
       - name: Checkout (Branch)
         uses: actions/checkout@v4
@@ -739,6 +751,13 @@ jobs:
           name: openapi-spec
           path: C:/tgs_api.json
 
+      - name: Store GraphQL Schema
+        if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Advanced' && matrix.database-type == 'SqlServer' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: graphql-schema
+          path: ./artifacts/tgs-api.graphql
+
       - name: Package Server Service
         if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' && matrix.database-type == 'PostgresSql' }}
         run: |
@@ -855,6 +874,7 @@ jobs:
         run: |
           echo "TGS_TEST_DATABASE_TYPE=Sqlite" >> $GITHUB_ENV
           echo "TGS_TEST_CONNECTION_STRING=Data Source=TGS_${{ matrix.watchdog-type }}_${{ matrix.configuration }}.sqlite3;Mode=ReadWriteCreate" >> $GITHUB_ENV
+          echo "TGS_TEST_GRAPHQL=true" >> $GITHUB_ENV
 
       - name: Set PostgresSql Connection Info
         if: ${{ matrix.database-type == 'PostgresSql' }}
@@ -874,6 +894,7 @@ jobs:
           echo "TGS_TEST_DATABASE_TYPE=MySql" >> $GITHUB_ENV
           echo "TGS_TEST_CONNECTION_STRING=Server=127.0.0.1;Port=3307;uid=root;pwd=mysql;database=tgs__${{ matrix.watchdog-type }}_${{ matrix.configuration }}" >> $GITHUB_ENV
           echo "Database__ServerVersion=5.7.31" >> $GITHUB_ENV
+          echo "TGS_TEST_GRAPHQL=true" >> $GITHUB_ENV
 
       - name: Set General__UseBasicWatchdog
         if: ${{ matrix.watchdog-type == 'Basic' }}
@@ -1348,7 +1369,7 @@ jobs:
       - name: Test Install
         run: |
           sudo mkdir /etc/tgstation-server
-          sudo cp build/package/appsettings.GitHub.yml /etc/tgstation-server/appsettings.Production.yml
+          sudo cp build/package/deb/appsettings.GitHub.yml /etc/tgstation-server/appsettings.Production.yml
           sudo apt-get install -y ./tgstation-server_${{ env.TGS_VERSION }}-1_amd64.deb
           sudo ls -al /etc/tgstation-server
           sudo cat /etc/tgstation-server/appsettings.Production.yml
@@ -1358,8 +1379,32 @@ jobs:
           cat /usr/bin/tgs-configure
 
       - name: Test Service
+        id: test-service
         run: |
+          set +e
           systemctl status tgstation-server
+          retval=$?
+          set -e
+          if [[ $retval -ne 0 ]]; then
+            echo "succeeded=NO" >> $GITHUB_OUTPUT
+          else
+            echo "succeeded=YES" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Chown Errored Service Logs
+        if: ${{ steps.test-service.outputs.succeeded == 'NO' }}
+        run: sudo chown -R runner /var/log/tgstation-server
+
+      - name: Store Errored Service Logs
+        if: ${{ steps.test-service.outputs.succeeded == 'NO' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: systemd-service-logs
+          path: /var/log/tgstation-server/**/*
+
+      - name: Fail if Service Errored
+        if: ${{ steps.test-service.outputs.succeeded == 'NO' }}
+        run: exit 1
 
       - name: Test Uninstall # Wait 10s for service to initialize
         shell: bash
@@ -1469,7 +1514,7 @@ jobs:
         shell: powershell # If it's missing, I found that <PrivateAssets> in <PackageReference> elements were the problem
         run: |
           mkdir C:/ProgramData/tgstation-server
-          cp build/package/appsettings.GitHub.yml C:/ProgramData/tgstation-server/appsettings.Production.yml
+          cp build/package/winget/appsettings.GitHub.yml C:/ProgramData/tgstation-server/appsettings.Production.yml
           $file = [System.IO.Path]::GetFullPath("build/package/winget/test-installer.exe")
           $log = [System.IO.Path]::GetFullPath("install.log")
           $procMain = Start-Process -FilePath $file "/install /silent /log `"$log`"" -NoNewWindow -PassThru -Wait
@@ -1577,6 +1622,7 @@ jobs:
         run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --winget-template-check ${{ steps.get-sha.outputs.pr_template_sha }}
 
   ci-completion-gate:
+    if: always() && !cancelled()
     name: CI Completion Gate
     needs:
       [
@@ -1592,8 +1638,10 @@ jobs:
       ]
     runs-on: ubuntu-latest
     steps:
-      - name: Mandatory Empty Step
-        run: exit 0
+      - name: Decide whether the needed jobs succeeded or failed
+        uses: re-actors/alls-green@223e4bb7a751b91f43eda76992bcfbf23b8b0302
+        with:
+          jobs: ${{ toJSON(needs) }}
 
   deployment-gate:
     name: Deployment Start Gate
@@ -1604,11 +1652,11 @@ jobs:
       - name: GitHub Requires at Least One Step for a Job
         run: exit 0
 
-  deploy-http:
-    name: Deploy HTTP API
+  deploy-rest:
+    name: Deploy REST API
     needs: deployment-gate
     runs-on: windows-latest
-    if: contains(github.event.head_commit.message, '[APIDeploy]')
+    if: contains(github.event.head_commit.message, '[RESTDeploy]')
     steps:
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
@@ -1623,7 +1671,7 @@ jobs:
         shell: powershell
         run: |
           [XML]$versionXML = Get-Content build/Version.props
-          $apiVersion = $versionXML.Project.PropertyGroup.TgsApiVersion
+          $apiVersion = $versionXML.Project.PropertyGroup.TgsRestVersion
           echo "TGS_API_VERSION=$apiVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
 
       - name: Retrieve OpenAPI Spec
@@ -1654,7 +1702,7 @@ jobs:
       - name: Generate Release Notes
         env:
           TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
-        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_API_VERSION }} --httpapi
+        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_API_VERSION }} --restapi
 
       - name: Create GitHub Release
         uses: actions/create-release@v1
@@ -1663,7 +1711,7 @@ jobs:
           GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
         with:
           tag_name: api-v${{ env.TGS_API_VERSION }}
-          release_name: tgstation-server API v${{ env.TGS_API_VERSION }}
+          release_name: tgstation-server REST API v${{ env.TGS_API_VERSION }}
           body_path: release_notes.md
           commitish: ${{ github.event.head_commit.id }}
 
@@ -1677,6 +1725,86 @@ jobs:
           asset_name: swagger.json
           asset_content_type: application/json
 
+  deploy-gql:
+    name: Deploy GraphQL API
+    needs: deployment-gate
+    runs-on: windows-latest
+    if: contains(github.event.head_commit.message, '[GQLDeploy]')
+    steps:
+      - name: Setup dotnet
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.TGS_DOTNET_VERSION }}.0.x
+          dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }}
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Parse API version
+        shell: powershell
+        run: |
+          [XML]$versionXML = Get-Content build/Version.props
+          $apiVersion = $versionXML.Project.PropertyGroup.TgsGraphQLVersion
+          echo "TGS_API_VERSION=$apiVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
+          [Version]$parsedVersion = $apiVersion
+          if ($parsedVersion.Major -eq 0) {
+            echo "TGS_GRAPHQL_PRERELEASE=true" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
+          } else {
+            echo "TGS_GRAPHQL_PRERELEASE=false" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
+          }
+
+      - name: Retrieve GraphQL Schema
+        uses: actions/download-artifact@v4
+        with:
+          name: graphql-schema
+          path: schema
+
+      - name: Grab Most Recent Changelog
+        shell: powershell
+        run: |
+          $ProgressPreference = 'SilentlyContinue'
+          Invoke-WebRequest -Uri https://raw.githubusercontent.com/tgstation/tgstation-server/gh-pages/changelog.yml -OutFile changelog.yml
+
+      - name: Retrieve ReleaseNotes Binaries
+        uses: actions/download-artifact@v4
+        with:
+          name: release_notes_bins
+          path: release_notes_bins
+
+      - name: Generate App Token
+        id: app-token-generation
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Generate Release Notes
+        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
+        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_API_VERSION }} --graphqlapi
+
+      - name: Create GitHub Release
+        uses: actions/create-release@v1
+        id: create_release
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
+        with:
+          tag_name: graphql-v${{ env.TGS_API_VERSION }}
+          release_name: tgstation-server GraphQL API v${{ env.TGS_API_VERSION }}
+          body_path: release_notes.md
+          commitish: ${{ github.event.head_commit.id }}
+          prerelease: ${{ env.TGS_GRAPHQL_PRERELEASE }}
+
+      - name: Upload GraphQL Schema
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
+        with:
+          upload_url: ${{ steps.create_release.outputs.upload_url }}
+          asset_path: ./schema/tgs-api.graphql
+          asset_name: tgs-api.graphql
+          asset_content_type: text/plain
+
   deploy-dm:
     name: Deploy DreamMaker API
     needs: deployment-gate
@@ -1811,9 +1939,9 @@ jobs:
 
   ensure-release:
     name: Ensure TGS Release is Latest GitHub Release
-    needs: [deploy-dm, deploy-http]
+    needs: [deploy-dm, deploy-rest, deploy-gql]
     runs-on: ubuntu-latest
-    if: (!(cancelled() || failure())) && (!contains(github.event.head_commit.message, '[TGSDeploy]')) && (needs.deploy-dm.result == 'success' || needs.deploy-http.result == 'success')
+    if: (!(cancelled() || failure())) && (!contains(github.event.head_commit.message, '[TGSDeploy]')) && (needs.deploy-dm.result == 'success' || needs.deploy-rest.result == 'success' || needs.deploy-gql.result == 'success')
     steps:
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
@@ -1841,7 +1969,7 @@ jobs:
 
   deploy-tgs:
     name: Deploy TGS
-    needs: [deploy-dm, deploy-http, deployment-gate]
+    needs: [deploy-dm, deploy-rest, deploy-gql, deployment-gate]
     runs-on: windows-latest
     if: (!(cancelled() || failure())) && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]') && needs.deployment-gate.result == 'success'
     env:
@@ -1933,6 +2061,12 @@ jobs:
           name: openapi-spec
           path: swagger
 
+      - name: Retrieve GraphQL Schema
+        uses: actions/download-artifact@v4
+        with:
+          name: graphql-schema
+          path: schema
+
       - name: Retrieve Debian Packaging Archive
         uses: actions/download-artifact@v4
         with:
@@ -2028,7 +2162,7 @@ jobs:
           asset_name: DMAPI.zip
           asset_content_type: application/zip
 
-      - name: Upload OpenApi Spec Artifact
+      - name: Upload REST API Artifact
         uses: actions/upload-release-asset@v1
         env:
           GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
@@ -2038,6 +2172,16 @@ jobs:
           asset_name: swagger.json
           asset_content_type: application/json
 
+      - name: Upload GraphQL API Artifact
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
+        with:
+          upload_url: ${{ steps.create_release.outputs.upload_url }}
+          asset_path: ./schema/tgs-api.graphql
+          asset_name: tgs-api.graphql
+          asset_content_type: text/plain
+
       - name: Upload Server Update Package Artifact
         uses: actions/upload-release-asset@v1
         env:
@@ -2141,7 +2285,7 @@ jobs:
         run: echo "TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuild/2003" --template --value-of /X:Project/X:PropertyGroup/X:TgsCoreVersion build/Version.props)" >> $GITHUB_ENV
 
       - name: Docker Build and Push
-        uses: elgohr/Publish-Docker-Github-Action@b77434333350079774b58dfdf2ebd57f10b31bef # v5
+        uses: elgohr/Publish-Docker-Github-Action@8a77ff7e106a82f06cefb2670b851ff562c53079 # v5
         with:
           name: tgstation/server
           username: ${{ secrets.DOCKER_USERNAME }}

.github/workflows/ci-security.yml

@@ -32,20 +32,6 @@ jobs:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
-      - name: Comment on new Fork PR
-        if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared') && github.event.pull_request.user.id != 49699333
-        uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6
-        with:
-          message: Thank you for contributing to ${{ github.event.pull_request.base.repo.name }}! The workflow '${{ github.workflow }}' requires repository secrets and will not run without approval. Maintainers can add the `CI Cleared` label to allow it to run. Note that any changes to ci-security.yml and ci-pipeline.yml will not be reflected.
-          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
-
-      - name: Comment on dependabot PR
-        if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared') && github.event.pull_request.user.id == 49699333
-        uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6
-        with:
-          message: Set the milestone to the next ${{ (github.head_ref == 'master' && 'patch') || 'minor' }} version, check for supply chain attacks, and then add the `CI Cleared` label to allow CI to run.
-          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
-
       - name: "Remove Stale 'CI Cleared' Label"
         if: github.event.action == 'synchronize' || github.event.action == 'reopened'
         uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0

.github/workflows/new-pr-comments.yml

@@ -0,0 +1,36 @@
+name: CI Gated PR Comments
+
+on:
+  pull_request_target:
+    types:
+      - opened
+    branches:
+      - dev
+      - master
+
+jobs:
+  comment-on-new-pr:
+    name: Comment New PR
+    if: github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id || github.event.pull_request.user.id == 49699333
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate App Token
+        id: app-token-generation
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Comment on new Fork PR
+        if: github.event.pull_request.user.id != 49699333
+        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9
+        with:
+          message: Thank you for contributing to ${{ github.event.pull_request.base.repo.name }}! The workflow '${{ github.workflow }}' requires repository secrets and will not run without approval. Maintainers can add the `CI Cleared` label to allow it to run. Note that any changes to ci-security.yml and ci-pipeline.yml will not be reflected.
+          github-token: ${{ steps.app-token-generation.outputs.token }}
+
+      - name: Comment on dependabot PR
+        if: github.event.pull_request.user.id == 49699333
+        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9
+        with:
+          message: Set the milestone to the next ${{ (github.head_ref == 'master' && 'patch') || 'minor' }} version, check for supply chain attacks, and then add the `CI Cleared` label to allow CI to run.
+          github-token: ${{ steps.app-token-generation.outputs.token }}

.github/workflows/scripts/rerunFlakyTests.js

@@ -10,7 +10,8 @@ const CONSIDERED_STEP_PREFIXES = [
 const CONSIDERED_JOBS = [
 	"Windows Live Tests",
 	"Linux Live Tests",
-	"Build .deb Package"
+	"Build .deb Package",
+	"CI Completion Gate"
 ];
 
 async function getFailedJobsForRun(github, context, workflowRunId, runAttempt) {
@@ -38,7 +39,7 @@ export async function rerunFlakyTests({ github, context }) {
 		context.payload.workflow_run.run_attempt
 	);
 
-	if (failingJobs.length > 3) {
+	if (failingJobs.length > 4) {
 		console.log("Many jobs failing. PROBABLY not flaky, Will not re-run.");
 		return;
 	}

.github/workflows/size-label.yml

@@ -2,8 +2,7 @@ name: Size Labelling
 on:
   pull_request_target:
     types:
-      - reopened
-      - labeled
+      - opened
       - synchronize
 
 concurrency: