[TT-17507] Update jira-linter to use github-actions/jira-linter

[buraksezer]

PR for https://tyktech.atlassian.net/browse/TT-17507

Ticket Details

TT-17507

Status	In Code Review
Summary	Move jira-linter to github-actions

Generated at: 2026-07-03 11:57:33

[probelabs]

This pull request updates the jira-pr-validator.yaml GitHub Actions workflow to use a centralized, reusable linter action. The workflow now points to TykTechnologies/github-actions/jira-linter@production instead of a specific commit hash of the deprecated TykTechnologies/jira-linter action.

This change standardizes the CI process and improves maintainability. The authentication method has also been updated, replacing jira-user-email and jira-api-token with a single jira-read-auth secret. Additionally, the Jira base URL is now sourced from secrets.JIRA_BASE_URL instead of being hardcoded.

Files Changed Analysis

• File: .github/workflows/jira-pr-validator.yaml
• Changes: 3 additions, 4 deletions.
• Summary: The changes consist of updating the uses directive to point to the new action and modifying the input parameters (with block) to align with the new action's requirements for authentication and configuration.

Architecture & Impact Assessment

• What this PR accomplishes: It migrates the repository's Jira validation CI check to a standardized, centrally managed GitHub Action. This improves consistency and simplifies future updates to the linting logic.

• Key technical changes introduced:

  1. The GitHub Action used for Jira validation is changed from TykTechnologies/jira-linter@<commit_hash> to TykTechnologies/github-actions/jira-linter@production.
  2. Authentication secrets are consolidated from JIRA_USER_EMAIL and JIRA_TOKEN into a single JIRA_READ_AUTH secret.
  3. The hardcoded Jira URL is replaced with a JIRA_BASE_URL secret.

• Affected system components: This change affects the repository's Continuous Integration (CI) pipeline, specifically the validation step for pull requests. It has no impact on the application's runtime behavior.

• Visualization:

graph TD
subgraph "Before"
A[PR] --> B(Workflow: jira-pr-validator.yaml);
B --> C{uses: TykTechnologies/jira-linter@hash};
C --> D[secrets.JIRA_USER_EMAIL];
C --> E[secrets.JIRA_TOKEN];
end

subgraph "After"
    F[PR] --> G(Workflow: jira-pr-validator.yaml);
    G --> H{uses: TykTechnologies/github-actions/jira-linter@production};
    H --> I[secrets.JIRA_READ_AUTH];
    H --> J[secrets.JIRA_BASE_URL];
end

## Scope Discovery & Context Expansion

- **Broader Scope:** This change is likely part of a wider initiative within the organization to standardize CI/CD tooling by consolidating common workflows into a central `github-actions` repository. Other repositories using the old `TykTechnologies/jira-linter` action will likely need a similar update.

- **Further Exploration:** To understand the full context, one could inspect the `TykTechnologies/github-actions` repository to see the implementation of the new `jira-linter` and discover other available reusable actions. A codebase search for other instances of `uses: TykTechnologies/jira-linter` across the organization's repositories would identify the full scope of this migration effort.


<details>
  <summary>Metadata</summary>

  - Review Effort: 1 / 5
  - Primary Label: chore


</details>
<!-- visor:section-end id="overview" -->

<!-- visor:thread-end key="TykTechnologies/tyk-identity-broker#490@bcb0826" -->

---

*Powered by [Visor](https://probelabs.com/visor) from [Probelabs](https://probelabs.com)*

*Last updated: 2026-07-03T11:58:38.002Z | Triggered by: pr_opened | Commit: bcb0826*

💡 **TIP:** You can chat with Visor using `/visor ask <your question>`
<!-- /visor-comment-id:visor-thread-overview-TykTechnologies/tyk-identity-broker#490 -->

[probelabs]

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:17-18	The GitHub Action `TykTechnologies/github-actions/jira-linter` is pinned to a mutable tag `@production`. For enhanced security and to ensure workflow reproducibility, it is best practice to pin actions to a specific, immutable commit SHA. This prevents the workflow from unexpectedly breaking or executing malicious code if the `production` tag is updated. 💡 Suggestion Replace the `@production` tag with the full commit SHA of the desired version of the action. You can find the commit SHA on the action's repository page. For example: `uses: TykTechnologies/github-actions/jira-linter@<full-commit-sha>`.

Architecture Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:18	The workflow uses a floating tag (`@production`) to reference the `jira-linter` GitHub Action. While this simplifies updates, it can introduce instability if breaking changes are pushed to the `production` tag, causing builds to fail unexpectedly without any changes in this repository. 💡 Suggestion For improved stability and build reproducibility, consider pinning the action to a specific, immutable version tag (e.g., `@v1` or `@v1.2.3`) or a commit SHA. This prevents unexpected failures due to upstream changes in the shared action.

Performance Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:17	The GitHub Action `TykTechnologies/github-actions/jira-linter` is pinned to a floating tag `production`. The previous implementation used a specific commit hash, which ensures deterministic and reproducible builds. Using a floating tag like `production` can introduce unexpected changes in CI execution time and behavior, potentially causing performance regressions or failures without any changes to this repository. 💡 Suggestion To ensure predictable performance and prevent unexpected breakages, pin the action to a specific commit SHA. If the `production` tag is intended to always point to the latest stable release, find the corresponding commit SHA for the desired version and use that instead.

---

Powered by Visor from Probelabs

Last updated: 2026-07-03T11:58:24.884Z | Triggered by: pr_opened | Commit: bcb0826

💡 TIP: You can chat with Visor using /visor ask <your question>

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[probelabs]

Approved

[buraksezer]

/release to release-1.7

[buraksezer]

/release to release-1.7.1

[buraksezer]

/release to release-1.7.2

[probelabs]

⚠️ Cherry-pick encountered conflicts. A draft PR was created: #492

[probelabs]

⚠️ Cherry-pick encountered conflicts. A draft PR was created: #493

[probelabs]

✅ Cherry-pick successful. A PR was created: #494