Skip to content

[TT-17507] Update jira-linter to use github-actions/jira-linter #490

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
buraksezer merged 1 commit into from
Jul 6, 2026
Merged

[TT-17507] Update jira-linter to use github-actions/jira-linter #490

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions .github/workflows/jira-pr-validator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,7 @@
runs-on: ubuntu-latest
steps:
- name: Validate Jira ticket
uses: TykTechnologies/jira-linter@38a9cabef56171c4e52ea698fa7be3db5fca3a49 # main
uses: TykTechnologies/github-actions/jira-linter@production

Check warning on line 17 in .github/workflows/jira-pr-validator.yaml

View check run for this annotation

probelabs / Visor: performance

performance Issue 

The GitHub Action `TykTechnologies/github-actions/jira-linter` is pinned to a floating tag `production`. The previous implementation used a specific commit hash, which ensures deterministic and reproducible builds. Using a floating tag like `production` can introduce unexpected changes in CI execution time and behavior, potentially causing performance regressions or failures without any changes to this repository.
Raw output 
To ensure predictable performance and prevent unexpected breakages, pin the action to a specific commit SHA. If the `production` tag is intended to always point to the latest stable release, find the corresponding commit SHA for the desired version and use that instead.

Check failure on line 17 in .github/workflows/jira-pr-validator.yaml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=TykTechnologies_tyk-identity-broker&issues=AZ8n2lAK00wtKe1XQhWq&open=AZ8n2lAK00wtKe1XQhWq&pullRequest=490
with:

Check warning on line 18 in .github/workflows/jira-pr-validator.yaml

View check run for this annotation

probelabs / Visor: architecture

architecture Issue 

The workflow uses a floating tag (`@production`) to reference the `jira-linter` GitHub Action. While this simplifies updates, it can introduce instability if breaking changes are pushed to the `production` tag, causing builds to fail unexpectedly without any changes in this repository.
Raw output 
For improved stability and build reproducibility, consider pinning the action to a specific, immutable version tag (e.g., `@v1` or `@v1.2.3`) or a commit SHA. This prevents unexpected failures due to upstream changes in the shared action.

Check warning on line 18 in .github/workflows/jira-pr-validator.yaml

View check run for this annotation

probelabs / Visor: security

security Issue 

The GitHub Action `TykTechnologies/github-actions/jira-linter` is pinned to a mutable tag `@production`. For enhanced security and to ensure workflow reproducibility, it is best practice to pin actions to a specific, immutable commit SHA. This prevents the workflow from unexpectedly breaking or executing malicious code if the `production` tag is updated.
Raw output 
Replace the `@production` tag with the full commit SHA of the desired version of the action. You can find the commit SHA on the action's repository page. For example: `uses: TykTechnologies/github-actions/jira-linter@<full-commit-sha>`.

Check warning on line 18 in .github/workflows/jira-pr-validator.yaml

View check run for this annotation

probelabs / Visor: quality

architecture Issue 

The GitHub Action is pinned to a branch (`production`) instead of a specific version tag or commit SHA. Using a branch can introduce unexpected changes or break the workflow if the branch is updated with breaking changes. It also harms build reproducibility, as the previously used action was pinned to a specific commit hash.
Raw output 
For improved stability and security, pin the action to a specific immutable version, such as a release tag (e.g., `v1.0.0`) or a full commit SHA. This ensures that the workflow uses the exact same version of the action for every run, which was the practice before this change.
jira-base-url: 'https://tyktech.atlassian.net'
jira-user-email: ${{ secrets.JIRA_USER_EMAIL }}
jira-api-token: ${{ secrets.JIRA_TOKEN }}
jira-base-url: ${{ secrets.JIRA_BASE_URL }}
jira-read-auth: ${{ secrets.JIRA_READ_AUTH }}
Loading