[TT-16342] fix: align plugin compiler Go version with gateway (1.25)

[buger]

Summary

• The gateway goreleaser uses golang-cross:1.25-bullseye but the plugin compiler was still on 1.24-bullseye
• This causes plugin.Open failures due to Go version mismatch (internal/goarch)
• Updated both plugin-compiler-build.yml and the plugin compiler Dockerfile to use 1.25-bullseye

Test plan

• Verify plugin compiler CI builds successfully with the new Go version
• Build a test plugin and confirm plugin.Open works against a gateway built with 1.25

🤖 Generated with Claude Code

[github-actions]

🚨 Jira Linter Failed

Commit: 40fe604
Failed at: 2026-04-16 14:54:39 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details

failed to validate branch and PR title rules: branch name 'fix/plugin-compiler-go125-5.12' must contain a valid Jira ticket ID (e.g., ABC-123)

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

---

This comment will be automatically deleted once the linter passes.

[probelabs]

This pull request aligns the Go version used for compiling plugins with the version used for building the Tyk Gateway, resolving a critical runtime incompatibility.

Files Changed Analysis

The change is confined to two configuration files, updating the specified Go version from 1.24-bullseye to 1.25-bullseye:

• .github/workflows/plugin-compiler-build.yml: The GOLANG_CROSS environment variable in the GitHub Actions workflow is updated. This ensures the CI process for building the plugin compiler uses the correct Go version.
• ci/images/plugin-compiler/Dockerfile: The BASE_IMAGE argument for the plugin compiler's Dockerfile is updated. This affects developers who use the official Docker image to build their custom Go plugins.

Architecture & Impact Assessment

• What this PR accomplishes: It fixes plugin.Open failures that occur when a plugin compiled with an older Go version (1.24) is loaded by a gateway built with a newer version (1.25). This change ensures version consistency between the gateway and its plugins.

• Key technical changes introduced: The Go version is updated in the plugin compiler's build environment (both CI workflow and Docker image) to match the gateway's build environment.

• Affected system components: This change primarily impacts the Go plugin development and build pipeline. Developers building custom plugins and the CI system that produces the official plugin compiler image are the main stakeholders.

• Component Interaction:

graph TD
subgraph Build Time
A["Gateway Build Pipeline
(Go 1.25)"] --> GW(Tyk Gateway Binary)
B["Plugin Compiler Environment
(Go 1.25)"] -- Compiles --> Plugin(CustomPlugin.so)
end

  subgraph Run Time
      GW --|Loads plugin via plugin.Open|--> Plugin
  end

  linkStyle 0,1 stroke-width:2px,stroke:green,color:green
  style B fill:#cce5ff,stroke:#333,stroke-width:2px

### Scope Discovery & Context Expansion

The core issue is a dependency mismatch between the main gateway application and its dynamically loaded plugins. Go's plugin system requires that both the main program and the plugins be compiled with the same Go version. This PR correctly identifies and fixes the inconsistency in the build tooling provided for plugin authors.

The impact extends to all developers using the `tykio/golang-cross` image for plugin development. Without this fix, they would be unable to create plugins compatible with the latest gateway version. This change is essential for maintaining the health of the Tyk plugin ecosystem.


<details>
  <summary>Metadata</summary>

  - Review Effort: 1 / 5
  - Primary Label: bug


</details>
<!-- visor:section-end id="overview" -->

<!-- visor:thread-end key="TykTechnologies/tyk#8039@40fe604" -->

---

*Powered by [Visor](https://probelabs.com/visor) from [Probelabs](https://probelabs.com)*

*Last updated: 2026-04-16T14:56:34.701Z | Triggered by: pr_opened | Commit: 40fe604*

💡 **TIP:** You can chat with Visor using `/visor ask <your question>`
<!-- /visor-comment-id:visor-thread-overview-TykTechnologies/tyk#8039 -->

[probelabs]

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

✅ Security Check Passed

No security issues found – changes LGTM.

\n\n \n\n

✅ Performance Check Passed

No performance issues found – changes LGTM.

\n\n

✅ Quality Check Passed

No quality issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-04-16T14:55:31.423Z | Triggered by: pr_opened | Commit: 40fe604

💡 TIP: You can chat with Visor using /visor ask <your question>

[github-actions]

API Changes

no api changes detected

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE