TT-16964 - remove sbom job from release workflow (#962)

* fix: remove sbom job from release workflow

The sbom job was requesting 'id-token: write' permission but the
workflow-level permissions only grant 'id-token: none', causing
the workflow validation to fail with:

  Error calling workflow '...sbom.yaml': The nested job 'sbom' is
  requesting 'id-token: write', but is only allowed 'id-token: none'.

Removing the sbom job resolves the validation error.

Refs: TT-16964
Signed-off-by: bsten-tyk <221599321+bsten-tyk@users.noreply.github.com>

* fix: use go install instead of go run for goimports in ci-test

The security hardening commit 339740c changed 'go install' to 'go run'
for goimports, which only executes it once without installing the
binary. This caused ci-test.sh to fail with 'goimports: command not
found' since the binary was never placed on PATH.

Using 'go install' with a pinned version (@v0.33.0) satisfies both
the security requirement (pinned, not @latest) and the functional
requirement (binary available for ci-test.sh).

Refs: TT-16964
Signed-off-by: bsten-tyk <221599321+bsten-tyk@users.noreply.github.com>

* fix: upgrade gotestsum to v1.13.0 for Go 1.25 compatibility

gotestsum@v1.12.1 depends on golang.org/x/tools@v0.24.0 which is
incompatible with Go 1.25 (invalid array length -delta * delta in
tokeninternal.go:64). Upgrading to gotestsum@v1.13.0 pulls in
golang.org/x/tools@v0.36.0 which compiles cleanly.

Refs: TT-16964
Signed-off-by: bsten-tyk <221599321+bsten-tyk@users.noreply.github.com>

* fix: use multi-platform manifest list digests in Dockerfile.distroless

The security hardening commit 339740c pinned base images to SHA256
digests, but used single-platform (amd64-only) digests instead of
multi-platform manifest list digests. This breaks multi-arch Docker
builds because arm64/s390x build stages pull the amd64-only base image.

Replace with manifest list digests that cover all required platforms:
- debian:trixie-slim: amd64, arm64, s390x, and others
- gcr.io/distroless/static-debian12:nonroot: amd64, arm64, s390x, ppc64le

Verified via: docker buildx imagetools inspect <image>

Refs: TT-16964
Signed-off-by: bsten-tyk <221599321+bsten-tyk@users.noreply.github.com>

* fix: use unpinned tags in Dockerfile.distroless per code review

SHA pinning base images prevents automatic Debian security patch
updates from flowing through. Without automated digest bumping
(dependabot/digestabot), pinned digests will fall behind on CVE
fixes. Revert to unpinned tags matching the tyk gateway project
and gromit-generated templates.

Refs: TT-16964
Signed-off-by: bsten-tyk <221599321+bsten-tyk@users.noreply.github.com>

---------

Signed-off-by: bsten-tyk <221599321+bsten-tyk@users.noreply.github.com>

Author: bsten-tyk

.github/workflows/ci-test.yml

@@ -64,7 +64,7 @@ jobs:
       - name: Install Dependencies and basic hygiene test
         id: hygiene
         run: |
-          go run golang.org/x/tools/cmd/goimports@v0.33.0 -l .
+          go install golang.org/x/tools/cmd/goimports@v0.33.0
 
       - name: Fetch base branch
         if: ${{ github.event_name == 'pull_request' }}

.github/workflows/linter.yaml

@@ -61,7 +61,7 @@ jobs:
         run: |
           PKGS="$(go list ./...)"
           OPTS="-count=1 -failfast -v"
-          GOTESTSUM="go run gotest.tools/gotestsum@v1.12.1"
+          GOTESTSUM="go run gotest.tools/gotestsum@v1.13.0"
 
           for pkg in ${PKGS}; do
               tags=""

.github/workflows/release.yml

@@ -515,10 +515,3 @@ jobs:
           cache-to: type=gha,mode=max
           file: Dockerfile
           push: false
-  sbom:
-    needs: goreleaser
-    uses: TykTechnologies/github-actions/.github/workflows/sbom.yaml@d3fa20888fa2878e877e22bb7702141217290e7c # main
-    secrets:
-      DEPDASH_URL: ${{ secrets.DEPDASH_URL }}
-      DEPDASH_KEY: ${{ secrets.DEPDASH_KEY }}
-      ORG_GH_TOKEN: ${{ secrets.ORG_GH_TOKEN }}

ci/Dockerfile.distroless

@@ -1,6 +1,6 @@
 # Generated by: gromit policy
 
-FROM debian:trixie-slim@sha256:edc9450a9fe37d30b508808052f8d0564e3ed9eaf565e043c6f5632957f7381e AS deb
+FROM debian:trixie-slim AS deb
 ARG TARGETARCH
 ARG BUILD_PACKAGE_NAME
 
@@ -10,7 +10,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 COPY ${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb /
 RUN dpkg -i /${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb && rm /*.deb
 
-FROM gcr.io/distroless/static-debian12:nonroot@sha256:5074667eecabac8ac5c5d395100a153a7b4e8426181cca36181cd019530f00c8
+FROM gcr.io/distroless/static-debian12:nonroot
 
 COPY --from=deb /opt/tyk-pump /opt/tyk-pump