[TT-17507] Merging to release-5.13: Move jira-linter into github-actions mono-repo (#8366)

[probelabs]

TT-17507 Move jira-linter into github-actions mono-repo (#8366)

Follow up PR for
TykTechnologies/github-actions#138

Ticket Details

TT-17507

Status	In Code Review
Summary	Move jira-linter to github-actions

Generated at: 2026-07-02 14:14:48

[probelabs]

This pull request updates the jira-pr-validator GitHub Actions workflow to use a centralized jira-linter from the TykTechnologies/github-actions monorepo, replacing the previous standalone action. This change is part of an effort to consolidate and standardize CI tooling.

The update also changes the action's configuration, switching from jira-user-email and jira-api-token to new secrets: jira-base-url and jira-read-auth.

Files Changed Analysis

• .github/workflows/jira-pr-validator.yaml: The sole file changed. The modification involves updating the uses clause to point to the new action in the monorepo and adjusting the with block to pass the new authentication secrets. The change is minimal, with 3 additions and 4 deletions.

Architecture & Impact Assessment

• What this PR accomplishes: It standardizes the Jira validation process by migrating from a dedicated repository (TykTechnologies/jira-linter) to a shared action within a monorepo (TykTechnologies/github-actions).
• Key technical changes introduced:
  1. The action source is changed from TykTechnologies/jira-linter@<commit_hash> to TykTechnologies/github-actions/jira-linter@production.
  2. The authentication method is updated, replacing JIRA_TOKEN and JIRA_USER_EMAIL with a single JIRA_READ_AUTH secret.
  3. The action is now pinned to a mutable tag (production) instead of an immutable commit hash, which has been flagged as a potential security and stability risk in the PR comments.
• Affected system components: The change impacts only the CI/CD pipeline, specifically the pull request validation step. It has no effect on the application's runtime code.

graph TD
    subgraph "CI Workflow on PR"
        A[Pull Request Event] --> B{jira-pr-validator.yaml};
    end

    subgraph "Before (Standalone Repo)"
        B --> C_Old["uses: TykTechnologies/jira-linter@hash"];
        C_Old --> D_Old[Auth with JIRA_USER_EMAIL / JIRA_TOKEN];
    end

    subgraph "After (Mono-repo)"
        B --> C_New["uses: TykTechnologies/github-actions/jira-linter@production"];
        C_New --> D_New[Auth with JIRA_BASE_URL / JIRA_READ_AUTH];
    end

    style C_Old fill:#ffcccb,stroke:#333
    style C_New fill:#d4edda,stroke:#333

Loading

Scope Discovery & Context Expansion

• The immediate scope is limited to this repository's CI workflow. However, this is likely part of a broader, organization-wide migration to consolidate shared GitHub Actions.
• The PR comments indicate that the new action is currently failing. The error Jira issue RELEASE-5 not found suggests a potential issue with how the new action parses the branch name or a permissions problem with the new JIRA_READ_AUTH secret.
• To fully assess the impact, further investigation would be needed into:
  1. The implementation of the new jira-linter in the TykTechnologies/github-actions repository to understand its expected inputs and behavior.
  2. The configuration of the JIRA_BASE_URL and JIRA_READ_AUTH secrets in this repository's settings.
  3. Other repositories within the organization that may still be using the old, standalone jira-linter action.

Metadata

• Review Effort: 1 / 5
• Primary Label: chore

---

Powered by Visor from Probelabs

Last updated: 2026-07-14T09:44:41.709Z | Triggered by: pr_updated | Commit: bd11ee7

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:17	The GitHub Action is pinned to a mutable tag (`@production`) instead of an immutable commit SHA. This exposes the CI/CD pipeline to supply chain attacks if the `production` tag in the source repository is compromised and updated to point to a malicious commit. The previous version of this workflow correctly used a full commit SHA, and this change represents a security regression. 💡 Suggestion To ensure the integrity and predictability of the workflow, replace the mutable `@production` tag with the full, immutable commit SHA of the desired action version from the `TykTechnologies/github-actions` repository. For example: `uses: TykTechnologies/github-actions@f20ba22` (using a hypothetical SHA).

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:17	The GitHub Action is pinned to a mutable tag (`@production`) instead of an immutable commit SHA. This exposes the CI/CD pipeline to supply chain attacks if the `production` tag in the source repository is compromised and updated to point to a malicious commit. The previous version of this workflow correctly used a full commit SHA, and this change represents a security regression. 💡 Suggestion To ensure the integrity and predictability of the workflow, replace the mutable `@production` tag with the full, immutable commit SHA of the desired action version from the `TykTechnologies/github-actions` repository. For example: `uses: TykTechnologies/github-actions@f20ba22` (using a hypothetical SHA).

\n\n ### Architecture Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:17	The workflow action is pinned to the `production` branch. Using a mutable reference like a branch name for a shared GitHub Action can introduce instability. If breaking changes are pushed to the `production` branch, this workflow could fail unexpectedly. The previous implementation was pinned to a specific commit hash, which is a more robust practice for ensuring CI/CD stability and reproducibility. 💡 Suggestion To ensure the stability and predictability of the CI pipeline, consider pinning the action to an immutable reference like a specific version tag (e.g., `@v1.2.3`) or a commit SHA instead of a branch name.

Performance Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:17	The workflow uses the mutable tag `@production` to reference the `jira-linter` action. This can lead to unpredictable performance and stability issues, as the underlying code for the action can change at any time. A new version pushed to the `production` branch could be slower or introduce breaking changes, affecting CI pipeline execution time and reliability. The previous implementation used a specific commit hash, which is a best practice for deterministic builds. 💡 Suggestion For predictable performance and build reproducibility, pin the action to an immutable version, such as a specific release tag (e.g., `@v1.2.3`) or a full commit SHA.

---

Powered by Visor from Probelabs

Last updated: 2026-07-14T09:44:33.175Z | Triggered by: pr_updated | Commit: bd11ee7

💡 TIP: You can chat with Visor using /visor ask <your question>

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[github-actions]

🚨 Jira Linter Failed

Commit: bd11ee7
Failed at: 2026-07-14 09:43:54 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details

failed to get Jira issue: Jira issue RELEASE-5 not found (HTTP 404). The issue may exist but the API token may lack permission to access it. Verify that the token owner has access to the project and that JL_JIRA_BASEURL (https://api.atlassian.com/ex/jira/c25a3295-62f6-4d5a-8ddd-58122b144a37) is correct

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

---

This comment will be automatically deleted once the linter passes.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!