Merging to release-5.14: [TT-17507] Move jira-linter into github-actions mono-repo (#8366)

[probelabs]

TT-17507 Move jira-linter into github-actions mono-repo (#8366)

Follow up PR for
TykTechnologies/github-actions#138

Ticket Details

TT-17507

Status	In Code Review
Summary	Move jira-linter to github-actions

Generated at: 2026-07-02 14:14:48

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[github-actions]

🚨 Jira Linter Failed

Commit: fac4977
Failed at: 2026-07-09 11:24:07 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details

failed to get Jira issue: Jira issue RELEASE-5 not found (HTTP 404). The issue may exist but the API token may lack permission to access it. Verify that the token owner has access to the project and that JL_JIRA_BASEURL (https://api.atlassian.com/ex/jira/c25a3295-62f6-4d5a-8ddd-58122b144a37) is correct

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

---

This comment will be automatically deleted once the linter passes.

[probelabs]

This PR updates the CI/CD workflow for Jira ticket validation to align with the recent migration of the jira-linter tool into the TykTechnologies/github-actions monorepo.

Files Changed Analysis

• File Modified: .github/workflows/jira-pr-validator.yaml
• Changes: 3 additions, 4 deletions.
• Summary: The change is confined to the Jira validation workflow file. It updates the GitHub Action being used, switching from the old, standalone TykTechnologies/jira-linter repository to the new, centralized action located at TykTechnologies/github-actions/jira-linter. The input parameters for the action have also been updated to use new repository secrets (JIRA_BASE_URL, JIRA_READ_AUTH) for authentication, improving security and configuration management.

Architecture & Impact Assessment

• What this PR accomplishes: It finalizes the migration of the jira-linter dependency, ensuring this repository's CI pipeline uses the standardized and centrally managed version of the action. This simplifies maintenance and dependency management for shared CI/CD tooling.

• Key technical changes introduced:

  1. The uses clause in the workflow is changed from TykTechnologies/jira-linter@<commit_hash> to TykTechnologies/github-actions/jira-linter@production.
  2. The authentication method is updated. The previous jira-user-email and jira-api-token secrets are replaced with a single jira-read-auth secret.
  3. The hardcoded jira-base-url is replaced with a value from the JIRA_BASE_URL secret.

• Affected system components: The primary impact is on the repository's CI/CD pipeline, specifically the automated check that validates PR titles against Jira tickets. There is no impact on the application's runtime code.

• Workflow Dependency Change:

  graph TD
      subgraph Before
          A[PR Event] --> B(jira-pr-validator.yaml);
          B -- uses --> C[Repo: TykTechnologies/jira-linter];
          C -- auth via --> D[secrets.JIRA_USER_EMAIL & secrets.JIRA_TOKEN];
      end
  
      subgraph After
          E[PR Event] --> F(jira-pr-validator.yaml);
          F -- uses --> G[Monorepo: TykTechnologies/github-actions/jira-linter];
          G -- auth via --> H[secrets.JIRA_READ_AUTH];
      end
  

  Loading

Scope Discovery & Context Expansion

• Broader Context: This change is part of a wider initiative to consolidate shared GitHub Actions into a single monorepo. This effort aims to streamline tooling maintenance, versioning, and security across multiple repositories in the organization.

• Further Investigation: To fully assess the impact, a reviewer should:

  1. Verify that the new secrets (JIRA_BASE_URL and JIRA_READ_AUTH) have been configured correctly in this repository's settings.
  2. Check the TykTechnologies/github-actions repository to understand the implementation of the new jira-linter action and the expected format for the JIRA_READ_AUTH secret.
  3. Confirm if other workflows in this repository use the old jira-linter action and may also need updating.

Metadata

• Review Effort: 1 / 5
• Primary Label: chore

---

Powered by Visor from Probelabs

Last updated: 2026-07-09T11:25:07.338Z | Triggered by: pr_opened | Commit: fac4977

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:17	The GitHub Action is pinned to a mutable reference ('production') instead of an immutable commit SHA. This makes the CI/CD pipeline vulnerable to supply chain attacks if the 'production' tag/branch in the source repository is compromised and updated to point to malicious code. The previous version of this workflow correctly used a specific commit SHA, which is the recommended security practice. 💡 Suggestion To ensure the integrity and security of the CI/CD pipeline, replace the mutable 'production' tag with the full-length commit SHA of the desired action version. This ensures that the workflow always executes the same verified code.

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:17	The GitHub Action is pinned to a mutable reference ('production') instead of an immutable commit SHA. This makes the CI/CD pipeline vulnerable to supply chain attacks if the 'production' tag/branch in the source repository is compromised and updated to point to malicious code. The previous version of this workflow correctly used a specific commit SHA, which is the recommended security practice. 💡 Suggestion To ensure the integrity and security of the CI/CD pipeline, replace the mutable 'production' tag with the full-length commit SHA of the desired action version. This ensures that the workflow always executes the same verified code.

\n\n ### Architecture Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:17	The workflow has been changed from using a pinned commit hash to a mutable 'production' tag for the `jira-linter` action. While using a floating tag simplifies receiving updates, it introduces a risk of workflow instability if breaking changes are pushed to that tag. The previous method of pinning to a specific commit hash provides stronger guarantees of stability and security. 💡 Suggestion For critical workflows, consider pinning to an immutable reference like a specific commit hash or a semantic version tag (e.g., `v1.2.3`). This prevents unexpected changes in the action's behavior from affecting the workflow.

Quality Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/jira-pr-validator.yaml:17	The GitHub action `TykTechnologies/github-actions/jira-linter` is pinned to a mutable tag `production`. This can cause the workflow to break unexpectedly if a new, incompatible version is pushed to the tag. It also presents a security risk, as the tag could be updated to point to malicious code. 💡 Suggestion For better security and workflow stability, pin the action to a specific, immutable commit SHA. Alternatively, use a specific version tag (e.g., `v1.2.3`) if the action follows semantic versioning.

---

Powered by Visor from Probelabs

Last updated: 2026-07-09T11:24:59.767Z | Triggered by: pr_opened | Commit: fac4977

💡 TIP: You can chat with Visor using /visor ask <your question>

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud