diff --git a/.github/workflows/autowiki.yml b/.github/workflows/autowiki.yml
index 677a1c55e9f..b782d52ba66 100644
--- a/.github/workflows/autowiki.yml
+++ b/.github/workflows/autowiki.yml
@@ -3,6 +3,9 @@ on:
   schedule:
   - cron: "5 4 * * *"
   workflow_dispatch:
+permissions:
+  contents: read
+
 jobs:
   autowiki:
     runs-on: ubuntu-latest
@@ -17,10 +20,10 @@ jobs:
         echo "::set-output name=SECRETS_ENABLED::$SECRET_EXISTS"
     - name: Checkout
       if: steps.secrets_set.outputs.SECRETS_ENABLED
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
     - name: Restore BYOND cache
       if: steps.secrets_set.outputs.SECRETS_ENABLED
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/BYOND
         key: ${{ runner.os }}-byond-${{ secrets.CACHE_PURGE_KEY }}
diff --git a/.github/workflows/ci_suite.yml b/.github/workflows/ci_suite.yml
index 36d2c3fcde7..36e9c21740d 100644
--- a/.github/workflows/ci_suite.yml
+++ b/.github/workflows/ci_suite.yml
@@ -11,8 +11,11 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     name: Run Linters
     runs-on: ubuntu-20.04
+    concurrency:
+      group: run_linters-${{ github.ref }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Restore SpacemanDMM cache
         uses: actions/cache@v3
         with:
@@ -45,7 +48,7 @@ jobs:
           tools/bootstrap/python -m mapmerge2.dmm_test
           ~/dreamchecker > ${GITHUB_WORKSPACE}/output-annotations.txt 2>&1
       - name: Annotate Lints
-        uses: yogstation13/DreamAnnotate@v1
+        uses: yogstation13/DreamAnnotate@v2
         if: always()
         with:
           outputFile: output-annotations.txt
@@ -54,8 +57,11 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     name: Compile Maps
     runs-on: ubuntu-20.04
+    concurrency:
+      group: compile_all_maps-${{ github.ref }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Restore BYOND cache
         uses: actions/cache@v3
         with:
@@ -73,8 +79,11 @@ jobs:
     runs-on: ubuntu-20.04
     outputs:
       maps: ${{ steps.map_finder.outputs.maps }}
+    concurrency:
+      group: find_all_maps-${{ github.ref }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Find Maps
         id: map_finder
         run: |
@@ -101,10 +110,10 @@ jobs:
           - 3306
         options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
     concurrency:
-      group: ci-${{ github.ref }}-${{ matrix.map }}
+      group: run_all_tests-${{ github.ref }}-${{ matrix.map }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Restore BYOND cache
         uses: actions/cache@v3
         with:
@@ -149,7 +158,7 @@ jobs:
     name: Compare Screenshot Tests
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       # If we ever add more artifacts, this is going to break, but it'll be obvious.
       - name: Download screenshot tests
         uses: actions/download-artifact@v3
@@ -182,8 +191,11 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     name: Windows Build
     runs-on: windows-latest
+    concurrency:
+      group: test_windows-${{ github.ref }}
+      cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Restore Yarn cache
         uses: actions/cache@v3
         with:
@@ -202,7 +214,7 @@ jobs:
           md deploy
           bash tools/deploy.sh ./deploy
       - name: Deploy artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: deploy
           path: deploy
diff --git a/.github/workflows/codeowner_reviews.yml b/.github/workflows/codeowner_reviews.yml
new file mode 100644
index 00000000000..a461a96d931
--- /dev/null
+++ b/.github/workflows/codeowner_reviews.yml
@@ -0,0 +1,26 @@
+name: Codeowner Reviews
+
+# Controls when the workflow will run
+on: pull_request_target
+
+jobs:
+  assign-users:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so the job can access it
+      - uses: actions/checkout@v3
+
+      #Parse the Codeowner file
+      - name: CodeOwnersParser
+        id: CodeOwnersParser
+        uses: tgstation/CodeOwnersParser@v1
+
+      #Request reviews
+      - name: Request reviews
+        if: steps.CodeOwnersParser.outputs.owners != ''
+        uses: tgstation/RequestReviewFromUser@v1
+        with:
+          separator: ' '
+          users: ${{ steps.CodeOwnersParser.outputs.owners }}
diff --git a/.github/workflows/compile_changelogs.yml b/.github/workflows/compile_changelogs.yml
index 6dd3c7a46b7..de9a661df21 100644
--- a/.github/workflows/compile_changelogs.yml
+++ b/.github/workflows/compile_changelogs.yml
@@ -3,6 +3,7 @@ name: Compile changelogs
 on:
   schedule:
   - cron: "0 0 * * *"
+  workflow_dispatch:
 
 jobs:
   compile:
@@ -30,9 +31,10 @@ jobs:
           sudo apt-get install  dos2unix
       - name: "Checkout"
         if: steps.value_holder.outputs.ACTIONS_ENABLED
-        uses: actions/checkout@v1
+        uses: actions/checkout@v3
         with:
           fetch-depth: 25
+          persist-credentials: false
       - name: "Compile"
         if: steps.value_holder.outputs.ACTIONS_ENABLED
         run: |
diff --git a/.github/workflows/docker_publish.yml b/.github/workflows/docker_publish.yml
index 695f2f027e8..c6ae68fdfd9 100644
--- a/.github/workflows/docker_publish.yml
+++ b/.github/workflows/docker_publish.yml
@@ -10,7 +10,7 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Build and Publish Docker Image to Registry
         uses: elgohr/Publish-Docker-Github-Action@master
diff --git a/.github/workflows/docker_publish.yml.disabled b/.github/workflows/docker_publish.yml.disabled
deleted file mode 100644
index 695f2f027e8..00000000000
--- a/.github/workflows/docker_publish.yml.disabled
+++ /dev/null
@@ -1,22 +0,0 @@
-name: Docker Build
-
-on:
-  push:
-    branches:
-      - master
-
-jobs:
-  publish:
-    if: "!contains(github.event.head_commit.message, '[ci skip]')"
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Build and Publish Docker Image to Registry
-        uses: elgohr/Publish-Docker-Github-Action@master
-        with:
-          name: tgstation/tgstation
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-          dockerfile: Dockerfile
-          tags: "latest"
diff --git a/.github/workflows/gbp.yml b/.github/workflows/gbp.yml
index 453533a3dde..9c92e5f379d 100644
--- a/.github/workflows/gbp.yml
+++ b/.github/workflows/gbp.yml
@@ -16,7 +16,7 @@ jobs:
         echo "::set-output name=ACTIONS_ENABLED::$SECRET_EXISTS"
     - name: Checkout
       if: steps.value_holder.outputs.ACTIONS_ENABLED
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
     - name: Setup git
       if: steps.value_holder.outputs.ACTIONS_ENABLED
       run: |
@@ -24,7 +24,7 @@ jobs:
         git config --global user.email "<>"
     - name: Checkout alternate branch
       if: steps.value_holder.outputs.ACTIONS_ENABLED
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
       with:
         ref: "gbp-balances" # The branch name
         path: gbp-balances
diff --git a/.github/workflows/gbp_collect.yml b/.github/workflows/gbp_collect.yml
index 1636c028a95..dc2af17a12d 100644
--- a/.github/workflows/gbp_collect.yml
+++ b/.github/workflows/gbp_collect.yml
@@ -18,7 +18,7 @@ jobs:
         echo "::set-output name=ACTIONS_ENABLED::$SECRET_EXISTS"
     - name: Checkout
       if: steps.value_holder.outputs.ACTIONS_ENABLED
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
     - name: Setup git
       if: steps.value_holder.outputs.ACTIONS_ENABLED
       run: |
@@ -26,7 +26,7 @@ jobs:
         git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
     - name: Checkout alternate branch
       if: steps.value_holder.outputs.ACTIONS_ENABLED
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
       with:
         ref: "gbp-balances" # The branch name
         path: gbp-balances
@@ -37,7 +37,7 @@ jobs:
       run: cp ./.github/gbp.toml ./gbp-balances/.github/gbp.toml
     - name: GBP action
       if: steps.value_holder.outputs.ACTIONS_ENABLED
-      uses: Mothblocks/gbp-action@collate-changes
+      uses: tgstation/gbp-action@master
       with:
         collect: "true"
         directory: ./gbp-balances
diff --git a/.github/workflows/generate_documentation.yml b/.github/workflows/generate_documentation.yml
index bb19c92e3b7..23ce6b1b5df 100644
--- a/.github/workflows/generate_documentation.yml
+++ b/.github/workflows/generate_documentation.yml
@@ -3,14 +3,20 @@ on:
   push:
     branches:
     - master
+permissions:
+  contents: read
+
 jobs:
   generate_documentation:
+    permissions:
+      contents: write  # for JamesIves/github-pages-deploy-action to push changes in repo
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     runs-on: ubuntu-20.04
+    concurrency: gen-docs
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Setup cache
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ~/SpacemanDMM
           key: ${{ runner.os }}-spacemandmm-${{ secrets.CACHE_PURGE_KEY }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 4736c9345ff..26999ca629b 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -4,20 +4,27 @@ on:
   schedule:
   - cron: "0 0 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   stale:
 
+    permissions:
+      issues: write  # for actions/stale to close stale issues
+      pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-20.04
 
     steps:
     - uses: actions/stale@v4
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
-        stale-pr-message: "This PR has been inactive for long enough to be automatically marked as stale. This means it is at risk of being auto closed in ~ 5 days, please address any outstanding review items and ensure your PR is finished, if these are all true and you are auto-staled anyway, you need to actively ask maintainers if your PR will be merged. Once you have done any of the previous actions then you should request a maintainer remove the stale label on your PR, to reset the stale timer. If you feel no maintainer will respond in that time, you may wish to close this PR youself, while you seek maintainer comment, as you will then be able to reopen the PR yourself."
+        stale-pr-message: "This PR has been inactive for long enough to be automatically marked as stale. This means it is at risk of being auto closed in ~ 7 days, please address any outstanding review items and ensure your PR is finished, if these are all true and you are auto-staled anyway, you need to actively ask maintainers if your PR will be merged. Once you have done any of the previous actions then you should request a maintainer remove the stale label on your PR, to reset the stale timer. If you feel no maintainer will respond in that time, you may wish to close this PR youself, while you seek maintainer comment, as you will then be able to reopen the PR yourself."
         days-before-stale: 7
-        days-before-close: 5
-        days-before-issue-stale: -1
-        days-before-issue-close: -1
+        days-before-close: 7
         stale-pr-label: 'Stale'
+        days-before-issue-stale: -1
+        stale-issue-label: 'Cleanup Flagged'
+        remove-issue-stale-when-updated: false
         exempt-pr-labels: 'Good First PR,Upstream PR Merged,Stale-b-gone,Test Merged'
         operations-per-run: 300
diff --git a/.github/workflows/test_merge_bot.yml b/.github/workflows/test_merge_bot.yml
new file mode 100644
index 00000000000..57634ae1f0a
--- /dev/null
+++ b/.github/workflows/test_merge_bot.yml
@@ -0,0 +1,41 @@
+# On a cron, will comment on any PRs that have been test merged.
+# Expects secret GET_TEST_MERGES_URL, a URL that, on GET, will return an array of objects with the schema
+# { round_id, datetime, test_merges, server, url }
+# You can see the moth.fans implementation in Rust here: https://github.com/Mothblocks/mothbus/blob/41fec056824edba0ffdfa39882b67739bf475d83/src/routes/recent_test_merges.rs#L30
+# This is hosted on https://bus.moth.fans/recent-test-merges.json.
+name: Test Merge Detector
+on:
+  schedule:
+  - cron: "*/30 * * * *"
+  workflow_dispatch:
+jobs:
+  test_merge_bot:
+      name: Test Merge Detector
+      runs-on: ubuntu-20.04
+      steps:
+        - name: Check for GET_TEST_MERGES_URL
+          id: secrets_set
+          env:
+            ENABLER_SECRET: ${{ secrets.GET_TEST_MERGES_URL }}
+          run: |
+            unset SECRET_EXISTS
+            if [ -n "$ENABLER_SECRET" ]; then SECRET_EXISTS=true ; fi
+            echo "::set-output name=GET_TEST_MERGES_URL::$SECRET_EXISTS"
+        - name: Checkout
+          if: steps.secrets_set.outputs.GET_TEST_MERGES_URL
+          uses: actions/checkout@v3
+        - name: Prepare module
+          if: steps.secrets_set.outputs.GET_TEST_MERGES_URL
+          run: |
+            # This is needed because node-fetch needs import and doesn't work with require :/
+            echo "{\"type\": \"module\"}" > package.json
+            npm install node-fetch
+        - name: Check for test merges
+          if: steps.secrets_set.outputs.GET_TEST_MERGES_URL
+          uses: actions/github-script@v6
+          env:
+            GET_TEST_MERGES_URL: ${{ secrets.GET_TEST_MERGES_URL }}
+          with:
+            script: |
+              const { processTestMerges } = await import('${{ github.workspace }}/tools/test_merge_bot/main.js')
+              await processTestMerges({ github, context })
diff --git a/.github/workflows/update_tgs_dmapi.yml b/.github/workflows/update_tgs_dmapi.yml
index 43c7a5ce650..32856d199b0 100644
--- a/.github/workflows/update_tgs_dmapi.yml
+++ b/.github/workflows/update_tgs_dmapi.yml
@@ -11,7 +11,7 @@ jobs:
     name: Update the TGS DMAPI
     steps:
     - name: Clone
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - name: Branch
       run: |
diff --git a/tools/test_merge_bot/main.js b/tools/test_merge_bot/main.js
new file mode 100644
index 00000000000..0d4c16b5a4a
--- /dev/null
+++ b/tools/test_merge_bot/main.js
@@ -0,0 +1,138 @@
+import fetch from "node-fetch";
+
+const TEST_MERGE_COMMENT_HEADER = "<!-- test_merge_bot:";
+
+const { GET_TEST_MERGES_URL } = process.env;
+
+if (!GET_TEST_MERGES_URL) {
+	console.error("GET_TEST_MERGES_URL was not set.");
+	process.exit(1);
+}
+
+export async function processTestMerges({ github, context }) {
+	const rounds = await fetch(GET_TEST_MERGES_URL)
+		.then(async (response) => {
+			if (response.status !== 200) {
+				return Promise.reject(
+					`Failed to fetch test merges: ${
+						response.status
+					} ${await response.text()}`
+				);
+			}
+
+			return response;
+		})
+		.then((response) => response.json())
+		.catch((error) => {
+			console.error(error);
+			process.exit(1);
+		});
+
+	// PR # -> server name -> test merge struct
+	const testMergesPerPr = {};
+
+	for (const round of rounds) {
+		const { server, test_merges } = round;
+
+		for (const testMerge of test_merges) {
+			if (!testMergesPerPr[testMerge]) {
+				testMergesPerPr[testMerge] = {};
+			}
+
+			if (!testMergesPerPr[testMerge][server]) {
+				testMergesPerPr[testMerge][server] = [];
+			}
+
+			testMergesPerPr[testMerge][server].push(round);
+		}
+	}
+
+	for (const [prNumber, servers] of Object.entries(testMergesPerPr)) {
+		const comments = await github.graphql(
+			`
+		query($owner:String!, $repo:String!, $prNumber:Int!) {
+			repository(owner: $owner, name: $repo) {
+				pullRequest(number: $prNumber) {
+					comments(last: 100) {
+						nodes {
+							body
+							databaseId
+							author {
+								login
+							}
+						}
+					}
+				}
+			}
+		}`,
+			{
+				owner: context.repo.owner,
+				repo: context.repo.repo,
+				prNumber: parseInt(prNumber, 10),
+			}
+		);
+
+		const existingComment =
+			comments.repository.pullRequest.comments.nodes.find(
+				(comment) =>
+					comment.author.login === "github-actions" &&
+					comment.body.startsWith(TEST_MERGE_COMMENT_HEADER)
+			);
+
+		const roundIds = Object.values(servers)
+			.flat()
+			.map(({ round_id }) => round_id)
+			.sort()
+			.join(", ");
+
+		const newHeader = `<!-- test_merge_bot: ${roundIds} -->`;
+
+		if (existingComment && existingComment.body.startsWith(newHeader)) {
+			console.log(`Comment is up to date for #${prNumber}`);
+			continue;
+		}
+
+		let totalRounds = 0;
+		let listOfRounds = "";
+
+		for (const [server, rounds] of Object.entries(servers).sort(
+			([a], [b]) => b - a
+		)) {
+			totalRounds += rounds.length;
+
+			listOfRounds += `${"\n"}### ${server}`;
+
+			for (const { datetime, round_id, url } of rounds.sort(
+				(a, b) => b.round_id - a.round_id
+			)) {
+				listOfRounds += `${"\n"}- [${round_id} @ ${datetime}](${url})`;
+			}
+
+			listOfRounds += "\n";
+		}
+
+		const newBody =
+			newHeader +
+			`\nThis pull request was test merged in ${totalRounds} round(s).` +
+			"\n" +
+			"<details><summary>Round list</summary>\n\n" +
+			listOfRounds +
+			"\n</details>\n";
+
+		if (existingComment === undefined) {
+			await github.rest.issues.createComment({
+				owner: context.repo.owner,
+				repo: context.repo.repo,
+				issue_number: prNumber,
+				body: newBody,
+			});
+		} else {
+			await github.rest.issues.updateComment({
+				owner: context.repo.owner,
+				repo: context.repo.repo,
+				comment_id: existingComment.databaseId,
+				body: newBody,
+			});
+		}
+	}
+}