Merging to release-5.8: [TT-17507] Move jira-linter into github-actions mono-repo (#8366)

[probelabs]

User description

TT-17507 Move jira-linter into github-actions mono-repo (#8366)

Follow up PR for
TykTechnologies/github-actions#138

Ticket Details

TT-17507

Status	In Code Review
Summary	Move jira-linter to github-actions

Generated at: 2026-07-02 14:14:48

---

PR Type

Enhancement

---

Description

• Switch Jira validator to monorepo action

• Replace direct linter SHA reference

• Use shared Jira secret inputs

---

Diagram Walkthrough

flowchart LR
  wf["PR validation workflow"]
  act["github-actions/jira-linter@production"]
  sec["Shared Jira auth secrets"]
  wf -- "runs" --> act
  sec -- "provided as inputs" --> act

Loading

File Walkthrough

	Relevant files
Configuration changes	jira-pr-validator.yaml Migrate Jira PR validation action source                                  .github/workflows/jira-pr-validator.yaml Replace TykTechnologies/jira-linter SHA-pinned usage with TykTechnologies/github-actions/jira-linter@production Swap explicit Jira email/token inputs for jira-read-auth Read Jira base URL from secrets.JIRA_BASE_URL +3/-4

---

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis ✅ 8366 - Fully compliant Compliant requirements: Move jira-linter usage from the standalone TykTechnologies/jira-linter action to the TykTechnologies/github-actions mono-repo. Apply the follow-up changes needed for the new action location/interface in the repository workflow.

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Unpinned GitHub Action reference: The workflow now uses TykTechnologies/github-actions/jira-linter@production, which is a mutable ref rather than an immutable commit SHA. This allows the executed code to change without any update in this repository and increases supply-chain risk if that branch/tag is modified or compromised. Pinning to a specific commit SHA would avoid this.

⚡ Recommended focus areas for review Unpinned action Switching the workflow to TykTechnologies/github-actions/jira-linter@production introduces a supply-chain and stability risk because production is a mutable ref. Any later change to that branch/tag will silently change how PR validation runs here, including for old branches, and could execute unintended code if the referenced repository is compromised. Pin this action to an immutable commit SHA instead. uses: TykTechnologies/github-actions/jira-linter@production

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Pin action to commit Pin this reusable action to an immutable commit SHA instead of the floating production ref. Using a mutable ref lets unreviewed upstream changes alter or break release validation unexpectedly, and also weakens your workflow supply-chain guarantees. .github/workflows/jira-pr-validator.yaml [17] -uses: TykTechnologies/github-actions/jira-linter@production +uses: TykTechnologies/github-actions/jira-linter@<pinned-commit-sha> Suggestion importance[1-10]: 8 __ Why: Pinning uses: to a commit SHA is a strong GitHub Actions security and reproducibility improvement, and the suggestion correctly targets the newly introduced @production ref. It reduces supply-chain risk from mutable upstream changes in .github/workflows/jira-pr-validator.yaml.	Medium

[github-actions]

🚨 Jira Linter Failed

Commit: 563fc25
Failed at: 2026-07-08 08:40:03 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details

failed to get Jira issue: Jira issue RELEASE-5 not found (HTTP 404). The issue may exist but the API token may lack permission to access it. Verify that the token owner has access to the project and that JL_JIRA_BASEURL (https://api.atlassian.com/ex/jira/c25a3295-62f6-4d5a-8ddd-58122b144a37) is correct

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

---

This comment will be automatically deleted once the linter passes.

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[sonarqubecloud]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)
17.8% Duplication on New Code (required ≤ 3%)
D Security Rating on New Code (required ≥ A)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!