Skip to content

[TT-17507] Merging to release-5.13: Move jira-linter into github-actions mono-repo (#8366) #8471

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ilijabojanovic merged 2 commits into from
Jul 14, 2026
+3 −4
Merged

[TT-17507] Merging to release-5.13: Move jira-linter into github-actions mono-repo (#8366) #8471

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e46f58a
[TT-17507] Move jira-linter into github-actions mono-repo (#8366)
buraksezer Jul 3, 2026
bd11ee7
Merge branch 'release-5.13' into merge/release-5.13/f20ba226415b6ffd3…
alienor Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions .github/workflows/jira-pr-validator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,7 @@
runs-on: ubuntu-latest
steps:
- name: Validate Jira ticket
uses: TykTechnologies/jira-linter@38a9cabef56171c4e52ea698fa7be3db5fca3a49 # main
uses: TykTechnologies/github-actions/jira-linter@production

Check warning on line 17 in .github/workflows/jira-pr-validator.yaml

View check run for this annotation

probelabs / Visor: security

security Issue 

The GitHub Action is pinned to a mutable tag (`@production`) instead of an immutable commit SHA. This exposes the CI/CD pipeline to supply chain attacks if the `production` tag in the source repository is compromised and updated to point to a malicious commit. The previous version of this workflow correctly used a full commit SHA, and this change represents a security regression.
Raw output 
To ensure the integrity and predictability of the workflow, replace the mutable `@production` tag with the full, immutable commit SHA of the desired action version from the `TykTechnologies/github-actions` repository. For example: `uses: TykTechnologies/github-actions/jira-linter@f20ba226415b6ffd37e1872c4e6d92bd83c002f0` (using a hypothetical SHA).

Check warning on line 17 in .github/workflows/jira-pr-validator.yaml

View check run for this annotation

probelabs / Visor: performance

performance Issue 

The workflow uses the mutable tag `@production` to reference the `jira-linter` action. This can lead to unpredictable performance and stability issues, as the underlying code for the action can change at any time. A new version pushed to the `production` branch could be slower or introduce breaking changes, affecting CI pipeline execution time and reliability. The previous implementation used a specific commit hash, which is a best practice for deterministic builds.
Raw output 
For predictable performance and build reproducibility, pin the action to an immutable version, such as a specific release tag (e.g., `@v1.2.3`) or a full commit SHA.

Check warning on line 17 in .github/workflows/jira-pr-validator.yaml

View check run for this annotation

probelabs / Visor: architecture

architecture Issue 

The workflow action is pinned to the `production` branch. Using a mutable reference like a branch name for a shared GitHub Action can introduce instability. If breaking changes are pushed to the `production` branch, this workflow could fail unexpectedly. The previous implementation was pinned to a specific commit hash, which is a more robust practice for ensuring CI/CD stability and reproducibility.
Raw output 
To ensure the stability and predictability of the CI pipeline, consider pinning the action to an immutable reference like a specific version tag (e.g., `@v1.2.3`) or a commit SHA instead of a branch name.

Check warning on line 17 in .github/workflows/jira-pr-validator.yaml

View check run for this annotation

probelabs / Visor: quality

architecture Issue 

The GitHub Action is pinned to a mutable tag `@production`. This practice can introduce unexpected behavior or break the workflow if the underlying action is updated with breaking changes. It also presents a security risk, as the code executed can change without any modification to this repository's code.
Raw output 
For improved reliability and security, pin the action to a specific commit SHA. This ensures that the workflow runs against a specific, immutable version of the action. The previous implementation correctly used a commit hash (`@38a9cabef561...`), and reverting to that practice is recommended.

Check failure on line 17 in .github/workflows/jira-pr-validator.yaml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=TykTechnologies_tyk&issues=AZ9Gv9Mg_I5eP23SIZlT&open=AZ9Gv9Mg_I5eP23SIZlT&pullRequest=8471
with:
jira-base-url: 'https://tyktech.atlassian.net'
jira-user-email: ${{ secrets.JIRA_USER_EMAIL }}
jira-api-token: ${{ secrets.JIRA_TOKEN }}
jira-base-url: ${{ secrets.JIRA_BASE_URL }}
jira-read-auth: ${{ secrets.JIRA_READ_AUTH }}
Loading