tgstation-server/.github/workflows/ci-pipeline.yml

# THE MAIN BIG CHUNGUS
# Does CI on push/PR/cron. Deployments on push when triggered
# - Validates Documentation
# - Builds C# and DMAPI
# - Tests everything on massive matrix
# - Packages
# - Tests package installs/services/uninstalls
# - Properly versions everything based on build/Version.props
# - Checks commit tags for deployment intents
# - Deploys DreamMaker API zip [DMDeploy] (dev/master)
# - Deploys Nuget Packages [NugetDeploy] (dev/master)
# - Deploys HTTP API swagger.json [APIDeploy] (dev/master)
# - Deploys tgstation-server [TGSDeploy] (master)
#   - GitHub Releases: https://github.com/tgstation/tgstation-server/releases
#   - Docker: https://hub.docker.com/r/tgstation/server
#   - apt repo: https://github.com/tgstation/tgstation-ppa
#   - winget: https://github.com/microsoft/winget-pkgs/tree/master/manifests/t/Tgstation/Server
name: 'CI Pipeline'

on:
  schedule:
    - cron: 0 23 * * *
  push:
    branches:
    - dev
    - master
    - V6
  pull_request:
    branches:
    - dev
    - master
    - V6
  pull_request_target:
    types: [ opened, reopened, labeled, synchronize ]
    branches:
    - dev
    - master
    - V6

env:
  TGS_DOTNET_VERSION: 6.0.x
  TGS_TEST_GITHUB_TOKEN: ${{ secrets.LIVE_TESTS_TOKEN }}
  TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
  WINGET_PUSH_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
  PACKAGING_PRIVATE_KEY_PASSPHRASE: ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }}
  CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

concurrency:
  group: "ci-${{ github.head_ref || github.run_id }}-${{ github.event_name }}"
  cancel-in-progress: true

jobs:
  security-checkpoint:
    name: Check CI Clearance
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id && github.event.pull_request.state == 'open'
    steps:
    - name: Comment on new Fork PR
      if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared')
      uses: thollander/actions-comment-pull-request@v2
      with:
        message: Thank you for contributing to tgstation-server! As this pull request is from a fork, we can't allow the CI actions which require repository secrets to run on it without approval. After a brief review to make sure you're not misusing those secrets, a maintainer will add the `CI Cleared` label to allow the CI suite to run. Maintainers, please note that any changes to workflow files will not be reflected in the CI run.

    - name: "Remove Stale 'CI Cleared' Label"
      if: github.event.action == 'synchronize' || github.event.action == 'reopened'
      uses: actions-ecosystem/action-remove-labels@v1
      with:
        labels: CI Cleared

    - name: Fail Clearance Check if PR has Unlabeled new Commits from Fork
      if: (github.event.action == 'synchronize' || github.event.action == 'reopened') || ((github.event.action == 'opened' || github.event.action == 'labeled') && !contains(github.event.pull_request.labels.*.name, 'CI Cleared'))
      run: exit 1

  start-ci-run-gate:
    name: CI Start Gate
    needs: security-checkpoint
    runs-on: ubuntu-latest
    if: "!(cancelled() || failure()) && (needs.security-checkpoint.result == 'success' || (needs.security-checkpoint.result == 'skipped' && (github.event_name == 'push' || github.event_name == 'schedule' || (github.event.pull_request.head.repo.id == github.event.pull_request.base.repo.id && github.event_name != 'pull_request_target'))))"
    steps:
    - name: GitHub Requires at Least One Step for a Job
      run: exit 0

  dmapi-build:
    name: Build DMAPI
    needs: start-ci-run-gate
    if: "!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success'"
    strategy:
      fail-fast: false
      matrix:
        byond: [ '510.1346', '511.1385', '512.1488', '513.1542', '514.1589', 'EDGE' ]
    runs-on: ubuntu-latest
    steps:
    - name: Install x86 libc Dependencies
      run: |
        sudo dpkg --add-architecture i386
        sudo apt-get update
        sudo apt-get install -y -o APT::Immediate-Configure=0 libc6-i386 libstdc++6:i386 libgcc-s1:i386

    - name: Cache BYOND .zips
      uses: actions/cache@v3
      id: cache-byond
      with:
        path: ~/byond-zips-cache
        key: byond-zips

    - name: Build BYOND Cache if Necessary and Install
      run: |
        echo "Setting up BYOND."
        FULL_VERSION=${{ matrix.byond }}
        if [[ "$FULL_VERSION" = "EDGE" ]] ; then
            VERSIONS=$(curl https://www.byond.com/download/version.txt)
            FULL_VERSION=$(echo "$VERSIONS" | tail -n1)
            echo "EDGE version evaluated to $FULL_VERSION"
        fi
        if [[ ! -f $HOME/byond-zips-cache/linux/$FULL_VERSION.zip ]] ; then
            BYOND_MAJOR=${FULL_VERSION%.*}
            mkdir -p $HOME/byond-zips-cache/linux
            curl "https://www.byond.com/download/build/$BYOND_MAJOR/${FULL_VERSION}_byond_linux.zip" -o $HOME/byond-zips-cache/linux/$FULL_VERSION.zip
        fi
        mkdir -p "$HOME/BYOND"
        cd "$HOME/BYOND"
        cp $HOME/byond-zips-cache/linux/$FULL_VERSION.zip byond.zip
        unzip byond.zip
        cd byond
        make here
        exit 0

    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Build DMAPI Test Project
      run: |
        set -e
        retval=1
        source $HOME/BYOND/byond/bin/byondsetup

        if hash DreamMaker 2>/dev/null
        then
          DreamMaker tests/DMAPI/BasicOperation/basic_operation_test.dme 2>&1 | tee result.log
          retval=$?
          if ! grep '\- 0 errors, 0 warnings' result.log
          then
            retval=1
          fi
        else
          echo "Couldn't find the DreamMaker executable, aborting."
          retval=2
        fi
        exit $retval

  dox-build:
    name: Build Doxygen Site
    runs-on: ubuntu-latest
    needs: start-ci-run-gate
    if: "!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success'"
    steps:
    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Patch Doxyfile
      run: |
        VERSION=$(cat "build/Version.props" | grep -oPm1 "(?<=<TgsCoreVersion>)[^<]+")
        echo -e "\nPROJECT_NUMBER = $VERSION\nINPUT = .\nOUTPUT_DIRECTORY = ./doxout\nPROJECT_LOGO = ./build/tgs.ico\nHAVE_DOT=YES" >> "docs/Doxyfile"

    - name: Doxygen Build
      uses: mattnotmitt/doxygen-action@v1
      with:
        doxyfile-path: 'docs/Doxyfile'

    - name: gh-pages push
      if: github.event_name == 'push' && github.event.ref == 'refs/heads/dev' && env.TGS_RELEASE_NOTES_TOKEN != ''
      run: |
        git clone -b gh-pages --single-branch "https://git@github.com/tgstation/tgstation-server" $HOME/tgsdox
        pushd $HOME/tgsdox
        rm -r *
        popd
        echo ./doxout/* | xargs -n 10 sudo mv -t $HOME/tgsdox
        cd $HOME/tgsdox
        git config --global push.default simple
        git config user.name "tgstation-server"
        git config user.email "tgstation-server@tgstation13.org"
        echo '# THIS BRANCH IS AUTO GENERATED BY GITHUB ACTIONS' > README.md

        # Need to create a .nojekyll file to allow filenames starting with an underscore
        # to be seen on the gh-pages site. Therefore creating an empty .nojekyll file.
        echo "" > .nojekyll
        echo "Adding files..."
        git add --all
        echo "Committing..."
        git diff-index --quiet HEAD || git commit -m "Deploy code docs to GitHub Pages for workflow run ${{ github.run_number }}" -m "Commit: ${{ github.event.head_commit.id }}"
        echo "Pushing..."
        git push -f "https://${{ secrets.DEV_PUSH_TOKEN }}@github.com/tgstation/tgstation-server" 2>&1

  docker-build:
    name: Build Docker Image
    runs-on: ubuntu-latest
    needs: start-ci-run-gate
    if: "!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success'"
    steps:
    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Build Docker Image
      run: docker build . -f build/Dockerfile

  linux-unit-tests:
    name: Linux Tests
    needs: start-ci-run-gate
    if: "!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success'"
    strategy:
      fail-fast: false
      matrix:
        configuration: [ 'Debug', 'Release' ]
    env:
      TGS_TEST_DISCORD_TOKEN: ${{ secrets.DISCORD_TOKEN }}
      TGS_TEST_IRC_CONNECTION_STRING: ${{ secrets.IRC_CONNECTION_STRING }}
    runs-on: ubuntu-latest
    steps:
    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Restore
      run: dotnet restore

    - name: Build
      run: dotnet build -c ${{ matrix.configuration }}NoWindows

    - name: Run Unit Tests
      run: sudo dotnet test --no-build --logger "GitHubActions;summary.includePassedTests=true;summary.includeSkippedTests=true" --filter TestCategory!=RequiresDatabase -c ${{ matrix.configuration }}NoWindows --collect:"XPlat Code Coverage" --settings build/ci.runsettings --results-directory ./TestResults tgstation-server.sln

    - name: Store Code Coverage
      uses: actions/upload-artifact@v3
      with:
        name: linux-unit-test-coverage-${{ matrix.configuration }}
        path: ./TestResults/

  windows-unit-tests:
    name: Windows Tests
    needs: start-ci-run-gate
    if: "!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success'"
    strategy:
      fail-fast: false
      matrix:
        configuration: [ 'Debug', 'Release' ]
    env:
      TGS_TEST_DISCORD_TOKEN: ${{ secrets.DISCORD_TOKEN }}
      TGS_TEST_IRC_CONNECTION_STRING: ${{ secrets.IRC_CONNECTION_STRING }}
    runs-on: windows-latest
    steps:
    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Restore
      run: dotnet restore

    - name: Build
      run: dotnet build -c ${{ matrix.configuration }}NoWix

    - name: Run Unit Tests
      run: dotnet test --no-build --logger "GitHubActions;summary.includePassedTests=true;summary.includeSkippedTests=true" --filter TestCategory!=RequiresDatabase -c ${{ matrix.configuration }}NoWix --collect:"XPlat Code Coverage" --settings build/ci.runsettings --results-directory ./TestResults tgstation-server.sln

    - name: Store Code Coverage
      uses: actions/upload-artifact@v3
      with:
        name: windows-unit-test-coverage-${{ matrix.configuration }}
        path: ./TestResults/

  windows-integration-test:
    name: Windows Live Tests
    needs: dmapi-build
    if: "!(cancelled() || failure()) && needs.dmapi-build.result == 'success'"
    strategy:
      fail-fast: false
      matrix:
        database-type: [ 'SqlServer', 'Sqlite', 'PostgresSql', 'MariaDB', 'MySql' ]
        watchdog-type: [ 'Basic', 'System' ]
        configuration: [ 'Debug', 'Release' ]
    runs-on: windows-latest
    steps:
    - name: Wait for LocalDB Connection # Do this first because we don't want to find out it's failing later
      shell: powershell
      if: ${{ matrix.database-type == 'SqlServer' }}
      run: |
        Write-Host "Checking"
        sqlcmd -l 600 -S "(localdb)\MSSQLLocalDB" -Q "SELECT @@VERSION;"

    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Set TGS_TEST_DUMP_API_SPEC
      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'System' && matrix.database-type == 'SqlServer' }}
      run: echo "TGS_TEST_DUMP_API_SPEC=yes" >> $Env:GITHUB_ENV

    - name: Set General__UseBasicWatchdog
      if: ${{ matrix.watchdog-type == 'Basic' }}
      run: echo "General__UseBasicWatchdog=true" >> $Env:GITHUB_ENV

    - name: Set Sqlite Connection Info
      if: ${{ matrix.database-type == 'Sqlite' }}
      shell: bash
      run: |
        echo "TGS_TEST_DATABASE_TYPE=Sqlite" >> $GITHUB_ENV
        echo "TGS_TEST_CONNECTION_STRING=Data Source=TGS_${{ matrix.watchdog-type }}_${{ matrix.configuration }}.sqlite3;Mode=ReadWriteCreate" >> $GITHUB_ENV

    - name: Setup Postgres
      uses: ankane/setup-postgres@v1
      if: ${{ matrix.database-type == 'PostgresSql' }}

    - name: Set PostgresSql Connection Info
      if: ${{ matrix.database-type == 'PostgresSql' }}
      shell: bash
      run: |
        echo "TGS_TEST_DATABASE_TYPE=PostgresSql" >> $GITHUB_ENV
        echo "TGS_TEST_CONNECTION_STRING=Application Name=tgstation-server;Host=127.0.0.1;Username=$USER;Database=TGS__${{ matrix.watchdog-type }}_${{ matrix.configuration }}" >> $GITHUB_ENV

    - name: Setup MariaDB
      uses: ankane/setup-mariadb@v1
      if: ${{ matrix.database-type == 'MariaDB' }}

    - name: Set MariaDB Connection Info
      if: ${{ matrix.database-type == 'MariaDB' }}
      shell: bash
      run: |
        echo "TGS_TEST_DATABASE_TYPE=MariaDB" >> $GITHUB_ENV
        echo "TGS_TEST_CONNECTION_STRING=Server=127.0.0.1;uid=root;database=tgs__${{ matrix.watchdog-type }}_${{ matrix.configuration }}" >> $GITHUB_ENV

    - name: Setup MySQL
      uses: ankane/setup-mysql@v1
      if: ${{ matrix.database-type == 'MySql' }}

    - name: Set MySQL Connection Info
      if: ${{ matrix.database-type == 'MySql' }}
      shell: bash
      run: |
        echo "TGS_TEST_DATABASE_TYPE=MySql" >> $GITHUB_ENV
        echo "TGS_TEST_CONNECTION_STRING=Server=127.0.0.1;uid=root;database=tgs__${{ matrix.watchdog-type }}_${{ matrix.configuration }}" >> $GITHUB_ENV

    - name: Set SqlServer Connection Info
      if: ${{ matrix.database-type == 'SqlServer' }}
      shell: bash
      run: |
        TGS_CONNSTRING_VALUE="Server=(localdb)\MSSQLLocalDB;Integrated Security=true;Initial Catalog=TGS_${{ matrix.watchdog-type }}_${{ matrix.configuration }};Application Name=tgstation-server"
        echo "TGS_TEST_CONNECTION_STRING=$(echo $TGS_CONNSTRING_VALUE)" >> $GITHUB_ENV
        echo "TGS_TEST_DATABASE_TYPE=SqlServer" >> $GITHUB_ENV

    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Restore
      run: dotnet restore

    - name: Build
      run: dotnet build -c ${{ matrix.configuration }} tests/Tgstation.Server.Tests/Tgstation.Server.Tests.csproj

    - name: Cache BYOND .zips
      uses: actions/cache@v3
      id: cache-byond
      with:
        path: ~/byond-zips-cache
        key: byond-zips

    - name: Run Live Tests
      run: |
        cd tests/Tgstation.Server.Tests
        Start-Sleep -Seconds 10
        dotnet test -c ${{ matrix.configuration }} --no-build --filter TestCategory=RequiresDatabase --logger "GitHubActions;summary.includePassedTests=true;summary.includeSkippedTests=true" --collect:"XPlat Code Coverage" --settings ../../build/ci.runsettings --results-directory ../../TestResults

    - name: Store Code Coverage
      uses: actions/upload-artifact@v3
      with:
        name: windows-integration-test-coverage-${{ matrix.configuration }}-${{ matrix.watchdog-type }}-${{ matrix.database-type }}
        path: ./TestResults/

    - name: Store OpenAPI Spec
      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'System' && matrix.database-type == 'SqlServer' }}
      uses: actions/upload-artifact@v3
      with:
        name: openapi-spec
        path: C:/swagger.json

    - name: Package Server Service
      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }}
      run: |
        cd src/Tgstation.Server.Host.Service
        dotnet publish -c ${{ matrix.configuration }} -o ../../Artifacts/Service
        cd ../Tgstation.Server.Host
        dotnet publish -c ${{ matrix.configuration }} --no-build -o ../../Artifacts/Service/lib/Default
        mv ../../Artifacts/Service/lib/Default/appsettings.yml ../../Artifacts/Service/appsettings.yml

    - name: Store Server Service
      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }}
      uses: actions/upload-artifact@v3
      with:
        name: ServerService
        path: Artifacts/Service/

    - name: Install Code Signing Certificate
      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }}
      shell: powershell
      run: |
        $pfxBytes = [convert]::FromBase64String("${{ secrets.CODE_SIGNING_BASE64 }}")
        [IO.File]::WriteAllBytes("tg_codesigning.pfx", $pfxBytes)
        $certPassword = ConvertTo-SecureString -String "${{ secrets.CODE_SIGNING_PASSWORD }}" -Force -AsPlainText
        Import-PfxCertificate -FilePath tg_codesigning.pfx -Cert Cert:\CurrentUser\My -Password $certPassword
        rm tg_codesigning.pfx

    - name: Test Sign Service .exe
      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }}
      shell: powershell
      run: Set-AuthenticodeSignature Artifacts/Service/Tgstation.Server.Host.Service.exe -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq "${{ vars.CODE_SIGNING_THUMBPRINT }}" }) -TimestampServer "http://timestamp.digicert.com"

  linux-integration-tests:
    name: Linux Live Tests
    needs: dmapi-build
    if: "!(cancelled() || failure()) && needs.dmapi-build.result == 'success'"
    services: # We start all dbs here so we can just code the stuff once
      mssql:
        image: mcr.microsoft.com/mssql/server:2019-latest
        env:
          SA_PASSWORD: myPassword
          ACCEPT_EULA: 'Y'
        ports:
        - 1433:1433
      postgres:
        image: cyberboss/postgres-max-connections # Fork of _/postgres:latest with max_connections=500 becuase GitHub actions service containers have no way to set command lines. Rebuilds with updates.
        ports:
          - 5432:5432
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      mariadb:
        image: mariadb
        ports:
          - 3306:3306
        env:
          MYSQL_ROOT_PASSWORD: mariadb
        options: >-
          --health-cmd="mariadb-admin ping"
          --health-interval=5s
          --health-timeout=2s
          --health-retries=3
      mysql:
        image: mysql:5.7.31
        ports:
          - 3307:3306
        env:
          MYSQL_ROOT_PASSWORD: mysql
        options: >-
          --health-cmd="mysqladmin ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=3
    strategy:
      fail-fast: false
      matrix:
        database-type: [ 'Sqlite', 'PostgresSql', 'MariaDB', 'MySql' ]
        watchdog-type: [ 'Basic', 'System' ]
        configuration: [ 'Debug', 'Release' ]
    runs-on: ubuntu-latest
    steps:
    - name: Disable ptrace_scope
      run: echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope

    - name: Install Native Dependencies
      run: |
        sudo dpkg --add-architecture i386
        sudo apt-get update
        sudo apt-get install -y -o APT::Immediate-Configure=0 libc6-i386 libstdc++6:i386 gdb libgcc-s1:i386

    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Set Sqlite Connection Info
      if: ${{ matrix.database-type == 'Sqlite' }}
      run: |
        echo "TGS_TEST_DATABASE_TYPE=Sqlite" >> $GITHUB_ENV
        echo "TGS_TEST_CONNECTION_STRING=Data Source=TGS_${{ matrix.watchdog-type }}_${{ matrix.configuration }}.sqlite3;Mode=ReadWriteCreate" >> $GITHUB_ENV

    - name: Set PostgresSql Connection Info
      if: ${{ matrix.database-type == 'PostgresSql' }}
      run: |
        echo "TGS_TEST_DATABASE_TYPE=PostgresSql" >> $GITHUB_ENV
        echo "TGS_TEST_CONNECTION_STRING=Application Name=tgstation-server;Host=127.0.0.1;Username=postgres;Password=postgres;Database=TGS__${{ matrix.watchdog-type }}_${{ matrix.configuration }}" >> $GITHUB_ENV

    - name: Set MariaDB Connection Info
      if: ${{ matrix.database-type == 'MariaDB' }}
      run: |
        echo "TGS_TEST_DATABASE_TYPE=MariaDB" >> $GITHUB_ENV
        echo "TGS_TEST_CONNECTION_STRING=Server=127.0.0.1;uid=root;pwd=mariadb;database=tgs__${{ matrix.watchdog-type }}_${{ matrix.configuration }}" >> $GITHUB_ENV

    - name: Set MySQL Connection Info
      if: ${{ matrix.database-type == 'MySql' }}
      run: |
        echo "TGS_TEST_DATABASE_TYPE=MySql" >> $GITHUB_ENV
        echo "TGS_TEST_CONNECTION_STRING=Server=127.0.0.1;Port=3307;uid=root;pwd=mysql;database=tgs__${{ matrix.watchdog-type }}_${{ matrix.configuration }}" >> $GITHUB_ENV
        echo "Database__ServerVersion=5.7.31" >> $GITHUB_ENV

    - name: Set General__UseBasicWatchdog
      if: ${{ matrix.watchdog-type == 'Basic' }}
      run: echo "General__UseBasicWatchdog=true" >> $GITHUB_ENV

    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Restore
      run: dotnet restore

    - name: Build
      run: dotnet build -c ${{ matrix.configuration }}NoWindows tests/Tgstation.Server.Tests/Tgstation.Server.Tests.csproj

    - name: Cache BYOND .zips
      uses: actions/cache@v3
      id: cache-byond
      with:
        path: ~/byond-zips-cache
        key: byond-zips

    - name: Run Live Tests
      run: |
        cd tests/Tgstation.Server.Tests
        sleep 10
        dotnet test -c ${{ matrix.configuration }}NoWindows --filter TestCategory=RequiresDatabase --logger "GitHubActions;summary.includePassedTests=true;summary.includeSkippedTests=true" --no-build --collect:"XPlat Code Coverage" --settings ../../build/ci.runsettings --results-directory ../../TestResults

    - name: Store Code Coverage
      uses: actions/upload-artifact@v3
      with:
        name: linux-integration-test-coverage-${{ matrix.configuration }}-${{ matrix.watchdog-type }}-${{ matrix.database-type }}
        path: ./TestResults/

    - name: Package Server Console
      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'System' && matrix.database-type == 'MariaDB' }}
      run: |
        cd src/Tgstation.Server.Host.Console
        dotnet publish -c ${{ matrix.configuration }} -o ../../Artifacts/Console
        cd ../Tgstation.Server.Host
        dotnet publish -c ${{ matrix.configuration }}NoWindows --no-build -o ../../Artifacts/Console/lib/Default
        mv ../../Artifacts/Console/lib/Default/appsettings.yml ../../Artifacts/Console/appsettings.yml

    - name: Package Server Update Package
      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'System' && matrix.database-type == 'PostgresSql' }}
      run: |
        cd src/Tgstation.Server.Host
        dotnet publish -c ${{ matrix.configuration }}NoWindows --no-build -o ../../Artifacts/ServerUpdate
        rm ../../Artifacts/ServerUpdate/appsettings.yml

    - name: Store Server Console
      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'System' && matrix.database-type == 'MariaDB' }}
      uses: actions/upload-artifact@v3
      with:
        name: ServerConsole
        path: Artifacts/Console/

    - name: Store Server Update Package
      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'System' && matrix.database-type == 'PostgresSql' }}
      uses: actions/upload-artifact@v3
      with:
        name: ServerUpdatePackage
        path: Artifacts/ServerUpdate/

  validate-openapi-spec:
    name: OpenAPI Spec Validation
    needs: windows-integration-test
    if: "!(cancelled() || failure()) && needs.windows-integration-test.result == 'success'"
    runs-on: ubuntu-latest
    steps:
    - name: Install IBM OpenAPI Validator
      run: npm i -g ibm-openapi-validator@0.51.3

    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Retrieve OpenAPI Spec
      uses: actions/download-artifact@v3
      with:
        name: openapi-spec
        path: ./swagger

    - name: Lint OpenAPI Spec
      run: npx lint-openapi -v -p -c build/OpenApiValidationSettings.json ./swagger/swagger.json

  upload-code-coverage:
    name: Upload Code Coverage
    needs: [linux-unit-tests, linux-integration-tests, windows-unit-tests, windows-integration-test]
    if: "!(cancelled() || failure()) && needs.linux-unit-tests.result == 'success' && needs.linux-integration-tests.result == 'success' && needs.windows-unit-tests.result == 'success' && needs.windows-integration-test.result == 'success'"
    runs-on: ubuntu-latest
    steps:
    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Retrieve Linux Unit Test Coverage (Debug)
      uses: actions/download-artifact@v3
      with:
        name: linux-unit-test-coverage-Debug
        path: ./code_coverage/unit_tests/linux_unit_tests_debug

    - name: Retrieve Linux Unit Test Coverage (Release)
      uses: actions/download-artifact@v3
      with:
        name: linux-unit-test-coverage-Release
        path: ./code_coverage/unit_tests/linux_unit_tests_release

    - name: Retrieve Linux Integration Test Coverage (Release, System, Sqlite)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Release-System-Sqlite
        path: ./code_coverage/integration_tests/linux_integration_tests_release_system_sqlite

    - name: Retrieve Linux Integration Test Coverage (Release, System, PostgresSql)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Release-System-PostgresSql
        path: ./code_coverage/integration_tests/linux_integration_tests_release_system_mariadb

    - name: Retrieve Linux Integration Test Coverage (Release, System, MariaDB)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Release-System-MariaDB
        path: ./code_coverage/integration_tests/linux_integration_tests_release_system_mysql

    - name: Retrieve Linux Integration Test Coverage (Release, System, MySql)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Release-System-MySql
        path: ./code_coverage/integration_tests/linux_integration_tests_release_system_mysql

    - name: Retrieve Linux Integration Test Coverage (Release, Basic, Sqlite)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Release-System-Sqlite
        path: ./code_coverage/integration_tests/linux_integration_tests_release_basic_sqlite

    - name: Retrieve Linux Integration Test Coverage (Release, Basic, PostgresSql)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Release-System-PostgresSql
        path: ./code_coverage/integration_tests/linux_integration_tests_release_basic_mariadb

    - name: Retrieve Linux Integration Test Coverage (Release, Basic, MariaDB)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Release-System-MariaDB
        path: ./code_coverage/integration_tests/linux_integration_tests_release_basic_mysql

    - name: Retrieve Linux Integration Test Coverage (Release, Basic, MySql)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Release-System-MySql
        path: ./code_coverage/integration_tests/linux_integration_tests_release_basic_mysql

    - name: Retrieve Linux Integration Test Coverage (Debug, System, Sqlite)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Debug-System-Sqlite
        path: ./code_coverage/integration_tests/linux_integration_tests_debug_system_sqlite

    - name: Retrieve Linux Integration Test Coverage (Debug, System, PostgresSql)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Debug-System-PostgresSql
        path: ./code_coverage/integration_tests/linux_integration_tests_debug_system_mariadb

    - name: Retrieve Linux Integration Test Coverage (Debug, System, MariaDB)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Debug-System-MariaDB
        path: ./code_coverage/integration_tests/linux_integration_tests_debug_system_mysql

    - name: Retrieve Linux Integration Test Coverage (Debug, System, MySql)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Debug-System-MySql
        path: ./code_coverage/integration_tests/linux_integration_tests_debug_system_mysql

    - name: Retrieve Linux Integration Test Coverage (Debug, Basic, Sqlite)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Debug-System-Sqlite
        path: ./code_coverage/integration_tests/linux_integration_tests_debug_basic_sqlite

    - name: Retrieve Linux Integration Test Coverage (Debug, Basic, PostgresSql)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Debug-System-PostgresSql
        path: ./code_coverage/integration_tests/linux_integration_tests_debug_basic_mariadb

    - name: Retrieve Linux Integration Test Coverage (Debug, Basic, MariaDB)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Debug-System-MariaDB
        path: ./code_coverage/integration_tests/linux_integration_tests_debug_basic_mysql

    - name: Retrieve Linux Integration Test Coverage (Debug, Basic, MySql)
      uses: actions/download-artifact@v3
      with:
        name: linux-integration-test-coverage-Debug-System-MySql
        path: ./code_coverage/integration_tests/linux_integration_tests_debug_basic_mysql

    - name: Retrieve Windows Unit Test Coverage (Release)
      uses: actions/download-artifact@v3
      with:
        name: windows-unit-test-coverage-Release
        path: ./code_coverage/unit_tests/windows_unit_tests_release

    - name: Retrieve Windows Integration Test Coverage (Debug, Basic, SqlServer)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Debug-Basic-SqlServer
        path: ./code_coverage/integration_tests/windows_integration_tests_debug_basic_sqlserver

    - name: Retrieve Windows Integration Test Coverage (Release, Basic, SqlServer)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Release-Basic-SqlServer
        path: ./code_coverage/integration_tests/windows_integration_tests_release_basic_sqlserver

    - name: Retrieve Windows Integration Test Coverage (Debug, System, SqlServer)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Debug-System-SqlServer
        path: ./code_coverage/integration_tests/windows_integration_tests_debug_system_sqlserver

    - name: Retrieve Windows Integration Test Coverage (Release, System, SqlServer)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Release-System-SqlServer
        path: ./code_coverage/integration_tests/windows_integration_tests_release_system_sqlserver

    - name: Retrieve Windows Integration Test Coverage (Debug, Basic, MariaDB)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Debug-Basic-MariaDB
        path: ./code_coverage/integration_tests/windows_integration_tests_debug_basic_mariadb

    - name: Retrieve Windows Integration Test Coverage (Release, Basic, MariaDB)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Release-Basic-MariaDB
        path: ./code_coverage/integration_tests/windows_integration_tests_release_basic_mariadb

    - name: Retrieve Windows Integration Test Coverage (Debug, System, MariaDB)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Debug-System-MariaDB
        path: ./code_coverage/integration_tests/windows_integration_tests_debug_system_mariadb

    - name: Retrieve Windows Integration Test Coverage (Release, System, MariaDB)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Release-System-MariaDB
        path: ./code_coverage/integration_tests/windows_integration_tests_release_system_mariadb

    - name: Retrieve Windows Integration Test Coverage (Debug, Basic, MySql)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Debug-Basic-MySql
        path: ./code_coverage/integration_tests/windows_integration_tests_debug_basic_mysql

    - name: Retrieve Windows Integration Test Coverage (Release, Basic, MySql)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Release-Basic-MySql
        path: ./code_coverage/integration_tests/windows_integration_tests_release_basic_mysql

    - name: Retrieve Windows Integration Test Coverage (Debug, System, MySql)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Debug-System-MySql
        path: ./code_coverage/integration_tests/windows_integration_tests_debug_system_mysql

    - name: Retrieve Windows Integration Test Coverage (Release, System, MySql)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Release-System-MySql
        path: ./code_coverage/integration_tests/windows_integration_tests_release_system_mysql

    - name: Retrieve Windows Integration Test Coverage (Debug, Basic, PostgresSql)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Debug-Basic-PostgresSql
        path: ./code_coverage/integration_tests/windows_integration_tests_debug_basic_postgressql

    - name: Retrieve Windows Integration Test Coverage (Release, Basic, PostgresSql)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Release-Basic-PostgresSql
        path: ./code_coverage/integration_tests/windows_integration_tests_release_basic_postgressql

    - name: Retrieve Windows Integration Test Coverage (Debug, System, PostgresSql)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Debug-System-PostgresSql
        path: ./code_coverage/integration_tests/windows_integration_tests_debug_system_postgressql

    - name: Retrieve Windows Integration Test Coverage (Release, System, PostgresSql)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Release-System-PostgresSql
        path: ./code_coverage/integration_tests/windows_integration_tests_release_system_postgressql

    - name: Retrieve Windows Integration Test Coverage (Debug, Basic, Sqlite)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Debug-Basic-Sqlite
        path: ./code_coverage/integration_tests/windows_integration_tests_debug_basic_sqlite

    - name: Retrieve Windows Integration Test Coverage (Release, Basic, Sqlite)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Release-Basic-Sqlite
        path: ./code_coverage/integration_tests/windows_integration_tests_release_basic_sqlite

    - name: Retrieve Windows Integration Test Coverage (Debug, System, Sqlite)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Debug-System-Sqlite
        path: ./code_coverage/integration_tests/windows_integration_tests_debug_system_sqlite

    - name: Retrieve Windows Integration Test Coverage (Release, System, Sqlite)
      uses: actions/download-artifact@v3
      with:
        name: windows-integration-test-coverage-Release-System-Sqlite
        path: ./code_coverage/integration_tests/windows_integration_tests_release_system_sqlite

    - name: Upload Coverage to CodeCov
      uses: codecov/codecov-action@v3
      with:
        directory: ./code_coverage
        fail_ci_if_error: true

  build-deb:
    name: Build .deb Package # Can't do i386 due to https://github.com/dotnet/core/issues/4595
    needs: start-ci-run-gate
    runs-on: ubuntu-latest
    if: "!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success'"
    steps:
    - name: Install Native Dependencies
      run: |
        sudo dpkg --add-architecture i386
        sudo apt-get update
        sudo apt-get install -y -o APT::Immediate-Configure=0 libstdc++6:i386 libgcc-s1:i386 gnupg2 xmlstarlet

    - name: Import GPG Key
      if: "github.event_name == 'push' && contains(github.event.head_commit.message, '[TGSDeploy]') && (github.event.ref == 'refs/heads/master' || github.event.ref == 'refs/heads/dev')"
      run: |
        echo "${{ secrets.PACKAGING_PRIVATE_KEY }}" > private.pgp
        echo ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }} | gpg --batch --yes --passphrase-fd 0 --import private.pgp
        rm private.pgp

    - name: Install dotnet-sdk-6.0
      run: |
        sudo apt-get update
        sudo apt-get install -y dotnet-sdk-6.0

    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Override /usr/bin/dotnet
      run: |
        DOTNET_PATH=$(which dotnet)
        sudo rm /usr/bin/dotnet
        sudo ln -s $DOTNET_PATH /usr/bin/dotnet
        echo "New dotnet path should be $DOTNET_PATH"

    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Parse TGS version
      run: |
        echo "TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuild/2003" --template --value-of /X:Project/X:PropertyGroup/X:TgsCoreVersion build/Version.props)" >> $GITHUB_ENV

    - name: Execute Build Script (Unsigned)
      if: "!(github.event_name == 'push' && contains(github.event.head_commit.message, '[TGSDeploy]') && (github.event.ref == 'refs/heads/master' || github.event.ref == 'refs/heads/dev'))"
      run: sudo build/package/deb/build_package.sh

    - name: Execute Build Script (Signed)
      if: "github.event_name == 'push' && contains(github.event.head_commit.message, '[TGSDeploy]') && (github.event.ref == 'refs/heads/master' || github.event.ref == 'refs/heads/dev')"
      env:
        PACKAGING_KEYGRIP: ${{ vars.PACKAGING_KEYGRIP }}
      run: |
        sudo -E build/package/deb/build_package.sh
        gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1.dsc
        gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1_amd64.changes
        gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1_amd64.buildinfo

    - name: Test Install
      run: |
        sudo mkdir /etc/tgstation-server
        sudo cp build/package/appsettings.GitHub.yml /etc/tgstation-server/appsettings.Production.yml
        sudo apt-get install -y ./tgstation-server_${{ env.TGS_VERSION }}-1_amd64.deb
        sudo ls -al /etc/tgstation-server
        sudo cat /etc/tgstation-server/appsettings.Production.yml
        sudo cat /etc/tgstation-server/appsettings.yml
        ls -al /opt/tgstation-server
        cat /opt/tgstation-server/lib/Default/Tgstation.Server.Host.deps.json
        cat /usr/bin/tgs-configure

    - name: Test Service
      run: |
        systemctl status tgstation-server

    - name: Test Uninstall # Wait 10s for service to initialize
      shell: bash
      run: |
        sleep 10
        sudo apt-get remove -y tgstation-server
        if [[ -d "/opt/tgstation-server" ]]; then
          ls -al /opt/tgstation-server
          exit 2
        fi

    - name: Create Packaging Archive
      run: tar cfJ tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz tgstation-server_*

    - name: Upload Packaging Archive
      uses: actions/upload-artifact@v3
      with:
        name: packaging-debian
        path: tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz

  build-msi:
    name: Build Windows Installer .exe
    needs: start-ci-run-gate
    runs-on: windows-latest
    if: "!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success'"
    steps:
    - name: Install winget
      uses: Cyberboss/install-winget@v1
      with:
        GITHUB_TOKEN: ${{ env.WINGET_PUSH_TOKEN }}

    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Restore Wix dotnet Tool
      run: |
        cd build/package/winget
        dotnet tool restore

    - name: Validate winget Manifest
      run: winget validate --manifest build/package/winget/manifest

    - name: Restore
      run: dotnet restore

    - name: Build Host
      run: dotnet build -c Release src/Tgstation.Server.Host/Tgstation.Server.Host.csproj

    - name: Build Service
      run: dotnet build -c Release src/Tgstation.Server.Host.Service/Tgstation.Server.Host.Service.csproj

    - name: Prepare Artifacts
      shell: powershell
      run: build/package/winget/prepare_installer_input_artifacts.ps1

    - name: Build Installer .exe
      run: |
        cd build/package/winget/Tgstation.Server.Host.Service.Wix.Bundle
        dotnet build -c Release

    - name: Install Code Signing Certificate
      shell: powershell
      run: |
        $pfxBytes = [convert]::FromBase64String("${{ secrets.CODE_SIGNING_BASE64 }}")
        [IO.File]::WriteAllBytes("tg_codesigning.pfx", $pfxBytes)
        $certPassword = ConvertTo-SecureString -String "${{ secrets.CODE_SIGNING_PASSWORD }}" -Force -AsPlainText
        Import-PfxCertificate -FilePath tg_codesigning.pfx -Cert Cert:\CurrentUser\My -Password $certPassword
        rm tg_codesigning.pfx

    - name: Sign Installer .exe for Testing # https://wixtoolset.org/docs/tools/signing/
      shell: powershell
      run: |
        cd build/package/winget
        dotnet wix burn detach Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/tgstation-server-installer.exe -engine burnengine.exe
        Set-AuthenticodeSignature burnengine.exe -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq "${{ vars.CODE_SIGNING_THUMBPRINT }}" }) -TimestampServer "http://timestamp.digicert.com"
        dotnet wix burn reattach Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/tgstation-server-installer.exe -engine burnengine.exe -o test-installer.exe
        Set-AuthenticodeSignature test-installer.exe -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq "${{ vars.CODE_SIGNING_THUMBPRINT }}" }) -TimestampServer "http://timestamp.digicert.com"

    - name: Test Install # Sanity checks the .deps.json exists, which the installation is broken without
      shell: powershell  # If it's missing, I found that <PrivateAssets> in <PackageReference> elements were the problem
      run: |
        mkdir C:/ProgramData/tgstation-server
        cp build/package/appsettings.GitHub.yml C:/ProgramData/tgstation-server/appsettings.Production.yml
        $file = [System.IO.Path]::GetFullPath("build/package/winget/test-installer.exe")
        $log = [System.IO.Path]::GetFullPath("install.log")
        $procMain = Start-Process -FilePath $file "/install /silent /log `"$log`"" -NoNewWindow -PassThru -Wait
        if (Test-Path -Path $log -PathType Leaf) {
          Get-Content $log
        }
        $installCode = $procMain.ExitCode
        if($installCode -ne 0) {
          Write-Host "ERROR INSTALLER EXIT CODE $installCode"
          exit 3
        }
        if (-Not (Test-Path -Path "C:/Program Files (x86)/tgstation-server/lib/Default/Tgstation.Server.Host.deps.json" -PathType Leaf)) {
          exit 2
        }
        if (-Not (Test-Path -Path "C:/ProgramData/tgstation-server/appsettings.yml" -PathType Leaf)) {
          exit 4
        }

    - name: Test Service
      shell: powershell
      run: |
        $service=Get-Service -Name tgstation-server -ErrorAction SilentlyContinue
        if ($service.Length -eq 0) {
          exit 3
        }
        if ($service[0].Status -ne "Running") {
          exit 4
        }

    - name: Test Uninstall # Sanity checks the .deps.json exists, which the installation is broken without
      shell: powershell
      run: |
        $file = [System.IO.Path]::GetFullPath("build/package/winget/test-installer.exe")
        $log = [System.IO.Path]::GetFullPath("uninstall.log")
        $procMain = Start-Process -FilePath $file "/uninstall /silent /log `"$log`"" -NoNewWindow -PassThru -Wait
        if (Test-Path -Path $log -PathType Leaf) {
          Get-Content $log
        }
        $installCode = $procMain.ExitCode
        if($installCode -ne 0) {
          Write-Host "ERROR INSTALLER EXIT CODE $installCode"
          exit 3
        }
        $service=Get-Service -Name tgstation-server -ErrorAction SilentlyContinue
        if ($service.Length -gt 0) {
          echo $service
          exit 2
        }

    - name: Upload Unsigned Installer .exe
      uses: actions/upload-artifact@v3
      with:
        name: packaging-preview-windows
        path: build/package/winget/Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/tgstation-server-installer.exe

  check-winget-pr-template:
    name: Check winget-pkgs Pull Request Template is up to date
    needs: start-ci-run-gate
    if: "!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success'"
    runs-on: ubuntu-latest
    steps:
    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Retrieve Latest winget-pkgs PULL_REQUEST_TEMPLATE commit SHA from GitHub API
      id: get-sha
      run: |
        curl -L -u "${{ vars.DEV_PUSH_USERNAME }}:${{ secrets.DEV_PUSH_TOKEN }}" -H "Accept: application/vnd.github.everest-preview+json" -H "Content-Type: application/json" -o commits.json https://api.github.com/repos/microsoft/winget-pkgs/commits?path=.github/PULL_REQUEST_TEMPLATE.md
        echo "pr_template_sha=$(cat commits.json | jq '.[0].sha')" >> $GITHUB_OUTPUT

    - name: Checkout (Branch)
      uses: actions/checkout@v3
      if: github.event_name == 'push' || github.event_name == 'schedule'

    - name: Checkout (PR Merge)
      uses: actions/checkout@v3
      if: github.event_name != 'push' && github.event_name != 'schedule'
      with:
        ref: "refs/pull/${{ github.event.number }}/merge"

    - name: Restore
      run: dotnet restore

    - name: Build ReleaseNotes
      run: dotnet build -c Release tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj

    - name: Run ReleaseNotes Check
      run: dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --winget-template-check ${{ steps.get-sha.outputs.pr_template_sha }}

  ci-completion-gate: # This job exists so there isn't a moving target for branch protections
    name: CI Completion Gate
    needs: [ dox-build, docker-build, build-deb, build-msi, validate-openapi-spec, upload-code-coverage, check-winget-pr-template ]
    runs-on: ubuntu-latest
    if: "!(cancelled() || failure()) && needs.dox-build.result == 'success' && needs.docker-build.result == 'success' && needs.build-deb.result == 'success' && needs.build-msi.result == 'success' && needs.validate-openapi-spec.result == 'success' && needs.upload-code-coverage.result == 'success' && needs.check-winget-pr-template.result == 'success'"
    steps:
    - name: GitHub Requires at Least One Step for a Job
      run: exit 0

  deployment-gate:
    name: Deployment Start Gate
    needs: ci-completion-gate
    runs-on: ubuntu-latest
    if: "!(cancelled() || failure()) && needs.ci-completion-gate.result == 'success' && github.event_name == 'push' && (github.event.ref == 'refs/heads/master' || github.event.ref == 'refs/heads/dev')"
    steps:
    - name: GitHub Requires at Least One Step for a Job
      run: exit 0

  deploy-http:
    name: Deploy HTTP API
    needs: deployment-gate
    runs-on: windows-latest
    if: "!(cancelled() || failure()) && needs.deployment-gate.result == 'success' && github.event_name == 'push' && contains(github.event.head_commit.message, '[APIDeploy]')"
    steps:
    - name: Checkout
      uses: actions/checkout@v3

    - name: Parse API version
      shell: powershell
      run: |
        [XML]$versionXML = Get-Content build/Version.props
        $apiVersion = $versionXML.Project.PropertyGroup.TgsApiVersion
        echo "TGS_API_VERSION=$apiVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append

    - name: Retrieve OpenAPI Spec
      uses: actions/download-artifact@v3
      with:
        name: openapi-spec
        path: swagger

    - name: Create GitHub Release
      uses: juitnow/github-action-create-release@80dc88a9d09c0ee394a4a31b0450e8cbe62996ef # v1
      id: create_release
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        tag_name: api-v${{ env.TGS_API_VERSION }}
        release_name: tgstation-server API v${{ env.TGS_API_VERSION }}
        body: The TGS HTTP API
        commitish: ${{ github.event.head_commit.id }}

    - name: Upload OpenApi Spec
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./swagger/swagger.json
        asset_name: swagger.json
        asset_content_type: application/json

  deploy-dm:
    name: Deploy DreamMaker API
    needs: deployment-gate
    runs-on: windows-latest
    if: "!(cancelled() || failure()) && needs.deployment-gate.result == 'success' && github.event_name == 'push' && contains(github.event.head_commit.message, '[DMDeploy]')"
    steps:
    - name: Checkout
      uses: actions/checkout@v3

    - name: Parse DMAPI version
      shell: powershell
      run: |
        [XML]$versionXML = Get-Content build/Version.props
        $dmVersion = $versionXML.Project.PropertyGroup.TgsDmapiVersion
        echo "TGS_DM_VERSION=$dmVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append

    - name: Zip DMAPI
      shell: powershell
      run: |
        &"C:/Program Files/7-Zip/7z.exe" a DMAPI.zip ./src/DMAPI/* -tzip

    - name: Create GitHub Release
      uses: juitnow/github-action-create-release@v1
      id: create_release
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        tag_name: dmapi-v${{ env.TGS_DM_VERSION }}
        release_name: tgstation-server DMAPI v${{ env.TGS_DM_VERSION }}
        body: The TGS DMAPI \#tgs-dmapi-release
        commitish: ${{ github.event.head_commit.id }}

    - name: Upload DMAPI Artifact
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./DMAPI.zip
        asset_name: DMAPI.zip
        asset_content_type: application/zip

  deploy-client:
    name: Deploy Nuget Packages
    needs: deployment-gate
    runs-on: ubuntu-latest
    if: "!(cancelled() || failure()) && needs.upload-code-coverage.result == 'success' && needs.validate-openapi-spec.result == 'success' && github.event_name == 'push' && contains(github.event.head_commit.message, '[NugetDeploy]')"
    steps:
    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Checkout
      uses: actions/checkout@v3

    - name: Publish Tgstation.Server.Common to NuGet
      uses: alirezanet/publish-nuget@e276c40afeb2a154046f0997820f2a9ea74832d9 # v3.1.0
      with:
        PROJECT_FILE_PATH: src/Tgstation.Server.Common/Tgstation.Server.Common.csproj
        TAG_COMMIT: false
        INCLUDE_SYMBOLS: true
        NUGET_KEY: ${{ secrets.NUGET_API_KEY }}

    - name: Publish Tgstation.Server.Api to NuGet
      uses: alirezanet/publish-nuget@e276c40afeb2a154046f0997820f2a9ea74832d9 # v3.1.0
      with:
        PROJECT_FILE_PATH: src/Tgstation.Server.Api/Tgstation.Server.Api.csproj
        TAG_COMMIT: false
        INCLUDE_SYMBOLS: true
        NUGET_KEY: ${{ secrets.NUGET_API_KEY }}

    - name: Publish Tgstation.Server.Client to NuGet
      uses: alirezanet/publish-nuget@e276c40afeb2a154046f0997820f2a9ea74832d9 # v3.1.0
      with:
        PROJECT_FILE_PATH: src/Tgstation.Server.Client/Tgstation.Server.Client.csproj
        TAG_COMMIT: false
        INCLUDE_SYMBOLS: true
        NUGET_KEY: ${{ secrets.NUGET_API_KEY }}

  ensure-release:
    name: Ensure TGS Release is Latest GitHub Release
    needs: [deploy-dm, deploy-http]
    runs-on: ubuntu-latest
    if: "!(cancelled() || failure()) && (needs.deploy-dm.result == 'success' || needs.deploy-http.result == 'success') && !contains(github.event.head_commit.message, '[TGSDeploy]')"
    steps:
    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Checkout
      uses: actions/checkout@v3

    - name: Restore
      run: dotnet restore

    - name: Build ReleaseNotes
      run: dotnet build -c Release tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj

    - name: Run ReleaseNotes with --ensure-release
      run: dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --ensure-release

  deploy-tgs:
    name: Deploy TGS
    needs: [deploy-dm, deploy-http, deployment-gate]
    runs-on: windows-latest
    if: "!(cancelled() || failure()) && needs.deployment-gate.result == 'success' && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]')"
    steps:
    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Checkout
      uses: actions/checkout@v3

    - name: Restore
      run: dotnet restore

    - name: Restore Wix dotnet Tool
      run: |
        cd build/package/winget
        dotnet tool restore

    - name: Build ReleaseNotes
      run: dotnet build -c Release tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj

# We need to rebuild the installer.exe so it can be properly signed
    - name: Restore
      run: dotnet restore

    - name: Build Host
      run: dotnet build -c Release src/Tgstation.Server.Host/Tgstation.Server.Host.csproj

    - name: Build Service
      run: dotnet build -c Release src/Tgstation.Server.Host.Service/Tgstation.Server.Host.Service.csproj

    - name: Prepare Artifacts
      shell: powershell
      run: build/package/winget/prepare_installer_input_artifacts.ps1

    - name: Build Installer .exe
      run: |
        cd build/package/winget/Tgstation.Server.Host.Service.Wix.Bundle
        dotnet build -c Release

    - name: Parse TGS version
      shell: powershell
      run: |
        [XML]$versionXML = Get-Content build/Version.props
        $tgsVersion = $versionXML.Project.PropertyGroup.TgsCoreVersion
        echo "TGS_VERSION=$tgsVersion" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append

    - name: Retrieve Server Service
      uses: actions/download-artifact@v3
      with:
        name: ServerService
        path: ServerService

    - name: Retrieve Server Console
      uses: actions/download-artifact@v3
      with:
        name: ServerConsole
        path: ServerConsole

    - name: Retrieve Server Update Package
      uses: actions/download-artifact@v3
      with:
        name: ServerUpdatePackage
        path: ServerUpdatePackage

    - name: Retrieve OpenAPI Spec
      uses: actions/download-artifact@v3
      with:
        name: openapi-spec
        path: swagger

    - name: Retrieve Debian Packaging Archive
      uses: actions/download-artifact@v3
      with:
        name: packaging-debian
        path: packaging-debian

    - name: Install Code Signing Certificate
      shell: powershell
      run: |
        $pfxBytes = [convert]::FromBase64String("${{ secrets.CODE_SIGNING_BASE64 }}")
        [IO.File]::WriteAllBytes("tg_codesigning.pfx", $pfxBytes)
        $certPassword = ConvertTo-SecureString -String "${{ secrets.CODE_SIGNING_PASSWORD }}" -Force -AsPlainText
        Import-PfxCertificate -FilePath tg_codesigning.pfx -Cert Cert:\CurrentUser\My -Password $certPassword
        rm tg_codesigning.pfx

    - name: Sign Installer .exe # https://wixtoolset.org/docs/tools/signing/
      shell: powershell
      run: |
        cd build/package/winget
        dotnet wix burn detach Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/tgstation-server-installer.exe -engine burnengine.exe
        Set-AuthenticodeSignature burnengine.exe -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq "${{ vars.CODE_SIGNING_THUMBPRINT }}" }) -TimestampServer "http://timestamp.digicert.com"
        dotnet wix burn reattach Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/tgstation-server-installer.exe -engine burnengine.exe -o tgstation-server-installer.exe
        Set-AuthenticodeSignature tgstation-server-installer.exe -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq "${{ vars.CODE_SIGNING_THUMBPRINT }}" }) -TimestampServer "http://timestamp.digicert.com"

    - name: Sign Service .exe
      shell: powershell
      run: Set-AuthenticodeSignature ServerService/Tgstation.Server.Host.Service.exe -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq "${{ vars.CODE_SIGNING_THUMBPRINT }}" }) -TimestampServer "http://timestamp.digicert.com"

    - name: Zip Artifacts
      shell: powershell
      run: |
        &"C:/Program Files/7-Zip/7z.exe" a DMAPI.zip ./src/DMAPI/* -tzip
        &"C:/Program Files/7-Zip/7z.exe" a ServerService.zip ./ServerService/* -tzip
        &"C:/Program Files/7-Zip/7z.exe" a ServerConsole.zip ./ServerConsole/* -tzip
        &"C:/Program Files/7-Zip/7z.exe" a ServerUpdatePackage.zip ./ServerUpdatePackage/* -tzip

    - name: Generate Release Notes
      run: dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes ${{ env.TGS_VERSION }}

    - name: Create GitHub Release
      uses: actions/create-release@v1
      id: create_release
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        tag_name: tgstation-server-v${{ env.TGS_VERSION }}
        release_name: tgstation-server-v${{ env.TGS_VERSION }}
        body_path: release_notes.md
        commitish: ${{ github.event.head_commit.id }}

    - name: Upload Server Console Artifact
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./ServerConsole.zip
        asset_name: ServerConsole.zip
        asset_content_type: application/zip

    - name: Upload Server Service Artifact
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./ServerService.zip
        asset_name: ServerService.zip
        asset_content_type: application/zip

    - name: Upload DMAPI Artifact
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./DMAPI.zip
        asset_name: DMAPI.zip
        asset_content_type: application/zip

    - name: Upload OpenApi Spec Artifact
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./swagger/swagger.json
        asset_name: swagger.json
        asset_content_type: application/json

    - name: Upload Server Update Package Artifact
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./ServerUpdatePackage.zip
        asset_name: ServerUpdatePackage.zip
        asset_content_type: application/zip

    - name: Upload Debian Pacakaging Artifact
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./packaging-debian/tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz
        asset_name: tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz
        asset_content_type: application/x-tar

    - name: Upload Installer .exe
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./build/package/winget/tgstation-server-installer.exe
        asset_name: tgstation-server-installer.exe
        asset_content_type: application/octet-stream

  deploy-docker:
    name: Deploy TGS (Docker)
    needs: deploy-tgs
    if: "!(cancelled() || failure()) && needs.deploy-tgs.result == 'success'"
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v3

    - name: Parse TGS version
      run: |
        sudo apt-get update
        sudo apt-get install -y xmlstarlet
        echo "TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuild/2003" --template --value-of /X:Project/X:PropertyGroup/X:TgsCoreVersion build/Version.props)" >> $GITHUB_ENV

    - name: Docker Build and Push
      uses: elgohr/Publish-Docker-Github-Action@43dc228e327224b2eda11c8883232afd5b34943b # v5
      with:
        name: tgstation/server
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
        dockerfile: build/Dockerfile
        tags: "latest,v${{ env.TGS_VERSION }}"

  deploy-ppa:
    name: Deploy TGS (PPA)
    needs: deploy-tgs
    if: "!(cancelled() || failure()) && needs.deploy-tgs.result == 'success'"
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v3

    - name: Parse TGS version
      run: |
        sudo apt-get update
        sudo apt-get install -y xmlstarlet
        echo "TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuild/2003" --template --value-of /X:Project/X:PropertyGroup/X:TgsCoreVersion build/Version.props)" >> $GITHUB_ENV

    - name: Trigger tgstation-ppa workflow
      run: |
        curl -XPOST -u "${{ vars.DEV_PUSH_USERNAME }}:${{ secrets.DEV_PUSH_TOKEN }}" -H "Accept: application/vnd.github.everest-preview+json" -H "Content-Type: application/json" https://api.github.com/repos/tgstation/tgstation-ppa/actions/workflows/add_tgs_version.yml/dispatches --data '{"ref":"main","inputs":{"tgs_semver": "${{ env.TGS_VERSION }}"}

  deploy-winget:
    name: Deploy TGS (winget)
    needs: deploy-tgs
    if: "!(cancelled() || failure()) && needs.deploy-tgs.result == 'success'"
    runs-on: windows-latest
    steps:
    - name: Setup dotnet
      uses: actions/setup-dotnet@v2
      with:
        dotnet-version: ${{ env.TGS_DOTNET_VERSION }}

    - name: Install winget
      uses: Cyberboss/install-winget@v1
      with:
        GITHUB_TOKEN: ${{ env.WINGET_PUSH_TOKEN }}

    - name: Install wingetcreate
      run: winget install wingetcreate --disable-interactivity --accept-source-agreements

    - name: Checkout
      uses: actions/checkout@v3

    - name: Build ReleaseNotes
      run: dotnet build -c Release tools/Tgstation.Server.ReleaseNotes

    - name: Execute Push Script
      shell: powershell
      run: build/package/winget/push_manifest.ps1

    - name: Run ReleaseNotes with --link-winget
      shell: powershell
      run: |
        Sleep 15
        dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --link-winget ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}