Merge remote-tracking branch 'upstream/master' into test-staging

# Conflicts:
#	.github/workflows/core-build-nopch.yml
#	.github/workflows/core-build-pch.yml
#	.github/workflows/macos_build.yml
#	.github/workflows/windows_build.yml
#	src/server/game/DataStores/DBCStores.cpp
#	src/server/game/Guilds/Guild.h
#	src/server/game/Scripting/ScriptDefines/DatabaseScript.cpp
#	src/server/game/Server/WorldSession.h

.github/workflows/cancel-pr-runs-on-close.yml

@@ -0,0 +1,48 @@
+name: cancel-pr-runs-on-close
+on:
+  # pull_request_target, not pull_request: for a PR from a fork the GITHUB_TOKEN
+  # of a pull_request run is read-only, so the cancel would 403. This workflow
+  # never checks out or runs PR code, so the elevated token is not exposed to it.
+  pull_request_target:
+    types:
+      - closed
+
+permissions:
+  actions: write
+
+jobs:
+  cancel:
+    runs-on: ubuntu-latest
+    name: cancel CI still running for the closed PR
+    if: github.repository == 'azerothcore/azerothcore-wotlk'
+    steps:
+      - name: Cancel workflow runs for this PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          PR_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+        run: |
+          set -euo pipefail
+
+          # head_sha alone would let anyone cancel another PR's CI: push that
+          # PR's head commit to your own fork, open a PR and close it, and every
+          # run for the commit matches. So the run must also come from this PR's
+          # head repository. `gh run list` exposes neither head_repository nor
+          # the (fork-empty) pull_requests field, hence the raw API call.
+          gh api "repos/${GH_REPO}/actions/runs?event=pull_request&head_sha=${PR_SHA}&per_page=100" \
+            --jq '.workflow_runs[]
+                  | select(.head_repository.full_name == env.PR_REPO and .status != "completed")
+                  | .id' \
+          | while read -r id; do
+              # gh has no bulk cancel. A run that finishes between the listing
+              # and the cancel returns 409, which is not worth failing over.
+              if ! err=$(gh run cancel "$id" 2>&1); then
+                if echo "$err" | grep -Fq "HTTP 409"; then
+                  echo "::warning::run $id was already finished"
+                else
+                  echo "::error::Failed to cancel run $id: $err"
+                  exit 1
+                fi
+              fi
+            done

.github/workflows/cleanup-pr-caches.yml

@@ -0,0 +1,29 @@
+name: cleanup-pr-caches
+on:
+  # pull_request_target, not pull_request: for a PR from a fork the GITHUB_TOKEN
+  # of a pull_request run is read-only, so the delete would 403. This workflow
+  # never checks out or runs PR code, so the elevated token is not exposed to it.
+  pull_request_target:
+    types:
+      - closed
+
+permissions:
+  actions: write
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    name: delete caches of the closed PR
+    if: github.repository == 'azerothcore/azerothcore-wotlk'
+    steps:
+      - name: Delete caches created by this PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          # Caches written during a PR run are scoped to the merge ref and are
+          # unreachable from any other branch, so once the PR is closed they can
+          # only occupy space. Deleting by this ref cannot touch master's caches.
+          PR_REF: refs/pull/${{ github.event.pull_request.number }}/merge
+        # --succeed-on-no-caches: without it gh exits 1 when the PR has no
+        # caches, which is the normal case for a PR that never ran CI.
+        run: gh cache delete --all --ref "$PR_REF" --succeed-on-no-caches

.github/workflows/codestyle.yml

@@ -10,15 +10,21 @@ on:
       - "!README.md"
       - "!docs/**"
 
+concurrency:
+  # New commits on a PR cancel the still-running codestyle check on the old
+  # commit. github.ref is refs/pull/<N>/merge, so the group is stable per PR.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   triage:
     runs-on: ubuntu-latest
     name: C++
     if: github.repository == 'mod-playerbots/azerothcore-wotlk' && !github.event.pull_request.draft
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Setup python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: '3.10'
       - name: AzerothCore codestyle

.github/workflows/core-build-nopch.yml

@@ -10,8 +10,22 @@ on:
       - opened
       - reopened
       - synchronize
+    # A PR that only touches data/ (SQL) leaves the C++ untouched, so there is
+    # nothing to compile. Dashboard CI runs on every PR unfiltered and already
+    # imports the SQL and starts a real worldserver, so coverage is unaffected.
+    # Pushes to master are not filtered and always build.
+    paths-ignore:
+      - 'data/**'
 
 concurrency:
+  # One concurrency group per workflow + ref.
+  #
+  # - PRs use `refs/pull/<PR_NUMBER>/merge`, so new commits cancel older
+  #   in-progress runs for the same PR.
+  # - A merge does NOT cancel the PR's own runs: this group is keyed on
+  #   refs/pull/<N>/merge and the master push on refs/heads/master, so they
+  #   never share a group. See the cancel-pr-runs-on-close workflow.
+  # - Branch pushes are isolated by ref.
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
@@ -41,7 +55,7 @@ jobs:
     name: ${{ matrix.os }}-${{ matrix.compiler.CC }}-nopch
     if: github.repository == 'mod-playerbots/azerothcore-wotlk' && !github.event.pull_request.draft
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/linux-build
         with:
           CC: ${{ matrix.compiler.CC }}

.github/workflows/core-build-pch.yml

@@ -10,8 +10,22 @@ on:
       - opened
       - reopened
       - synchronize
+    # A PR that only touches data/ (SQL) leaves the C++ untouched, so there is
+    # nothing to compile. Dashboard CI runs on every PR unfiltered and already
+    # imports the SQL and starts a real worldserver, so coverage is unaffected.
+    # Pushes to master are not filtered and always build.
+    paths-ignore:
+      - 'data/**'
 
 concurrency:
+  # One concurrency group per workflow + ref.
+  #
+  # - PRs use `refs/pull/<PR_NUMBER>/merge`, so new commits cancel older
+  #   in-progress runs for the same PR.
+  # - A merge does NOT cancel the PR's own runs: this group is keyed on
+  #   refs/pull/<N>/merge and the master push on refs/heads/master, so they
+  #   never share a group. See the cancel-pr-runs-on-close workflow.
+  # - Branch pushes are isolated by ref.
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
@@ -37,7 +51,7 @@ jobs:
     name: ${{ matrix.os }}-${{ matrix.compiler.CC }}-pch
     if: github.repository == 'mod-playerbots/azerothcore-wotlk' && !github.event.pull_request.draft
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/linux-build
         with:
           CC: ${{ matrix.compiler.CC }}

.github/workflows/core_modules_build.yml

@@ -29,8 +29,9 @@ concurrency:
   #
   # - PRs use `refs/pull/<PR_NUMBER>/merge`, so new commits cancel older
   #   in-progress runs for the same PR.
-  # - When a PR is merged, a push to the target branch starts a new group,
-  #   canceling any still-running PR CI.
+  # - A merge does NOT cancel the PR's own runs: this group is keyed on
+  #   refs/pull/<N>/merge and the master push on refs/heads/master, so they
+  #   never share a group. See the cancel-pr-runs-on-close workflow.
   # - Branch pushes are isolated by ref.
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -49,7 +50,7 @@ jobs:
     name: ${{ matrix.os }}-${{ matrix.compiler.CC }}-nopch-modules
     if: github.repository == 'mod-playerbots/azerothcore-wotlk' && !github.event.pull_request.draft
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         # This script installs a general list of modules to compile with
         # azerothcore. This is useful for ensuring that module compilation
         # functionality works.

.github/workflows/dashboard-ci.yml

@@ -21,8 +21,9 @@ concurrency:
   #
   # - PRs use `refs/pull/<PR_NUMBER>/merge`, so new commits cancel older
   #   in-progress runs for the same PR.
-  # - When a PR is merged, a push to the target branch starts a new group,
-  #   canceling any still-running PR CI.
+  # - A merge does NOT cancel the PR's own runs: this group is keyed on
+  #   refs/pull/<N>/merge and the master push on refs/heads/master, so they
+  #   never share a group.
   # - Branch pushes are isolated by ref.
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -138,15 +139,29 @@ jobs:
 
       - name: Echo cache key
         shell: bash
-        run: echo "Cache key -> ccache:${{ runner.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:${{ github.ref_name }}"
+        run: echo "Cache key -> ccache:${{ matrix.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:${{ github.ref_name }}-${{ github.run_id }}"
 
+      # The primary key must be unique per run. A static key hits on itself from
+      # the second run onward and the save is then skipped, freezing the cache
+      # at its first-run contents. It is keyed on matrix.os rather than
+      # runner.os because both legs report Linux and share a run_id, so only the
+      # detected compiler would separate them. The first restore-key picks up
+      # the most recent cache for this leg on this ref; the second the most
+      # recent on any ref the run can reach, which is its own and the base
+      # branch, and is how a first run inherits master's. Both must use
+      # matrix.os to stay in the key's namespace.
+      # The runner.os entries below reach the linux-build action's caches, but
+      # only on the 24.04 leg: on 26.04 this workflow detects clang-21 while
+      # linux-build is passed clang-20, so nothing there lines up.
       - name: Restore ccache
         id: restore_ccache
         uses: actions/cache/restore@v4
         with:
           path: ${{ github.workspace }}/var/ccache
-          key: ccache:${{ runner.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:${{ github.ref_name }}
+          key: ccache:${{ matrix.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:${{ github.ref_name }}-${{ github.run_id }}
           restore-keys: |
+            ccache:${{ matrix.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:${{ github.ref_name }}-
+            ccache:${{ matrix.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:
             ccache:${{ runner.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:true:pch=false:
             ccache:${{ runner.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:false:pch=false:
             ccache:${{ runner.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:true:pch=true:
@@ -168,7 +183,7 @@ jobs:
           CCACHE_MAXSIZE=5G
           CCACHE_SLOPPINESS=pch_defines,time_macros,include_file_mtime
           CCACHE_COMPRESS=1
-          CCACHE_COMPRESSLEVEL=9
+          CCACHE_COMPRESSLEVEL=3
           CCACHE_COMPILERCHECK=content
           CCACHE_LOGFILE=${{ github.workspace }}/var/ccache/cache.debug
           CMAKE_C_COMPILER_LAUNCHER=ccache
@@ -274,13 +289,19 @@ jobs:
         timeout-minutes: 30
         continue-on-error: false
 
-      # save only if we didn't hit the cache
+      # The old "only save on a cache miss" guard is dropped: the per-run key
+      # only ever collides on a re-run, since github.run_id is stable across
+      # attempts, and there the save is a no-op anyway.
+      # A failed build still compiled most of the tree and that work is worth
+      # keeping. A cancelled one is skipped so a superseded run cannot publish
+      # a half-populated cache as the newest for the ref, and a run that died
+      # before the restore has no compiler id and no ccache dir to save.
       - name: Save ccache
-        if: steps.restore_ccache.outputs.cache-hit != 'true'
+        if: ${{ !cancelled() && steps.restore_ccache.outcome == 'success' }}
         uses: actions/cache/save@v4
         with:
           path: ${{ github.workspace }}/var/ccache
-          key: ccache:${{ runner.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:${{ github.ref_name }}
+          key: ccache:${{ matrix.os }}:${{ steps.detect.outputs.cc_id }}_${{ steps.detect.outputs.cxx_id }}:${{ github.ref_name }}-${{ github.run_id }}
 
       - name: ccache stats (after)
         shell: bash

.github/workflows/docker_build.yml

@@ -13,8 +13,9 @@ concurrency:
   #
   # - PRs use `refs/pull/<PR_NUMBER>/merge`, so new commits cancel older
   #   in-progress runs for the same PR.
-  # - When a PR is merged, a push to the target branch starts a new group,
-  #   canceling any still-running PR CI.
+  # - A merge does NOT cancel the PR's own runs: this group is keyed on
+  #   refs/pull/<N>/merge and the master push on refs/heads/master, so they
+  #   never share a group. See the cancel-pr-runs-on-close workflow.
   # - Branch pushes are isolated by ref.
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -40,7 +41,7 @@ jobs:
           sudo rm -rf /opt/ghc
           sudo rm -rf "$AGENT_TOOLSDIRECTORY"
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # The containers created in this workflow are used by
       # acore-docker, which has a dependency on mod-ale.
@@ -49,14 +50,14 @@ jobs:
       # build them locally (such as with `docker compose build`)
       - name: Download Eluna
         if: github.repository == 'azerothcore/azerothcore-wotlk' && github.ref_name == 'master'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: azerothcore/mod-ale
           path: modules/mod-ale
 
       - name: Login to Docker Hub
         if: github.repository == 'azerothcore/azerothcore-wotlk' && github.ref_name == 'master'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -115,7 +116,7 @@ jobs:
 
       - name: Trigger acore-docker CI
         if: github.repository == 'azerothcore/azerothcore-wotlk' && github.ref_name == 'master'
-        uses: peter-evans/repository-dispatch@v2
+        uses: peter-evans/repository-dispatch@v3
         with:
           token: ${{ secrets.ACORE_DOCKER_REPO_ACCESS_TOKEN }}
           repository: azerothcore/acore-docker

.github/workflows/import_pending.yml

@@ -14,7 +14,7 @@ jobs:
       contents: write  # 'write-all' is not a valid permission, should specify what is needed
     if: github.repository == 'azerothcore/azerothcore-wotlk' && !github.event.pull_request.draft
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/macos_build.yml

@@ -11,6 +11,8 @@ on:
       - "test-staging"
 
 concurrency:
+  # One concurrency group per workflow + ref (matches the other build workflows).
+  # PRs cancel superseded runs; branch pushes are isolated by ref.
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
@@ -29,22 +31,24 @@ jobs:
     name: ${{ matrix.os }}
     steps:
       - name: Checkout AzerothCore
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Checkout Playerbot Module
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: mod-playerbots/mod-playerbots
           ref: ${{ github.ref_name == 'Playerbot' && 'master' || 'test-staging' }}
           path: modules/mod-playerbots
 
       - name: Cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/Library/Caches/ccache
-          key: ccache:${{ matrix.os }}:${{ github.ref_name }}
+          # Unique per run so the cache is re-saved every run instead of
+          # freezing on the first (a static key hits itself and skips upload).
+          key: ccache:${{ matrix.os }}:${{ github.ref_name }}-${{ github.run_id }}
           restore-keys: |
-            ccache:${{ matrix.os }}:${{ github.ref_name }}
+            ccache:${{ matrix.os }}:${{ github.ref_name }}-
             ccache:${{ matrix.os }}
 
       - name: reset ccache stats

.github/workflows/pr_labeler.yml

@@ -9,10 +9,10 @@ jobs:
     permissions: write-all
     if: github.repository == 'azerothcore/azerothcore-wotlk' && !github.event.pull_request.draft
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: true
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v7
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler.yml

.github/workflows/sql-codestyle.yml

@@ -10,15 +10,21 @@ on:
       - "!README.md"
       - "!docs/**"
 
+concurrency:
+  # New commits on a PR cancel the still-running codestyle check on the old
+  # commit. github.ref is refs/pull/<N>/merge, so the group is stable per PR.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   triage:
     runs-on: ubuntu-latest
     name: SQL
     if: github.repository == 'azerothcore/azerothcore-wotlk' && !github.event.pull_request.draft
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Setup python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: '3.10'
       - name: AzerothCore codestyle

.github/workflows/tools_build.yml

@@ -13,8 +13,9 @@ concurrency:
   #
   # - PRs use `refs/pull/<PR_NUMBER>/merge`, so new commits cancel older
   #   in-progress runs for the same PR.
-  # - When a PR is merged, a push to the target branch starts a new group,
-  #   canceling any still-running PR CI.
+  # - A merge does NOT cancel the PR's own runs: this group is keyed on
+  #   refs/pull/<N>/merge and the master push on refs/heads/master, so they
+  #   never share a group. See the cancel-pr-runs-on-close workflow.
   # - Branch pushes are isolated by ref.
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -38,7 +39,7 @@ jobs:
         || github.event.label.name == 'run-build'
       )
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/linux-build
         with:
           CC: ${{ matrix.compiler.CC }}

.github/workflows/windows_build.yml

@@ -7,6 +7,14 @@ on:
     branches: [ "Playerbot", "test-staging" ]
 
 concurrency:
+  # One concurrency group per workflow + ref.
+  #
+  # - PRs use `refs/pull/<PR_NUMBER>/merge`, so new commits cancel older
+  #   in-progress runs for the same PR.
+  # - A merge does NOT cancel the PR's own runs: this group is keyed on
+  #   refs/pull/<N>/merge and the master push on refs/heads/master, so they
+  #   never share a group. See the cancel-pr-runs-on-close workflow.
+  # - Branch pushes are isolated by ref.
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
@@ -22,28 +30,22 @@ jobs:
       BOOST_ROOT: C:\local\boost_1_87_0
     steps:
       - name: Checkout AzerothCore
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Checkout Playerbot Module
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: mod-playerbots/mod-playerbots
           ref: ${{ github.ref_name == 'Playerbot' && 'master' || 'test-staging' }}
           path: modules/mod-playerbots
 
-      - name: Move repo to short path
-        shell: bash
-        run: |
-          mkdir C:/ac
-          cp -r . C:/ac/
-
       - name: ccache
         uses: hendrikmuhs/ccache-action@v1.2.13
       # Cache the fetched Boost + MySQL client so we don't re-download ~350 MB
       # and re-run the Boost installer on every run. The Test-Path guards in
       # "Configure OS" short-circuit the install work when these are restored.
       - name: Cache Boost & MySQL
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             C:\local\boost_1_87_0
@@ -109,6 +111,5 @@ jobs:
       - name: Build
         shell: bash
         run: |
-          cd C:/ac
           export CTOOLS_BUILD=all
           ./acore.sh compiler build