TT-17317: cherry-pick branch suggestion changes

[olamilekan000]

Description

change updates branch suggestion workflow

Related Issue

https://tyktech.atlassian.net/browse/TT-17317
TykTechnologies/github-actions@c0d4c3d

Motivation and Context

How This Has Been Tested

Screenshots (if appropriate)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• Make sure you are requesting to pull a topic/feature/bugfix branch (right side). If pulling from your own
  fork, don't request your master!
• Make sure you are making a pull request against the master branch (left side). Also, you should start
  your branch off our latest master.
• My change requires a change to the documentation.
  • If you've changed APIs, describe what needs to be updated in the documentation.
• I have updated the documentation accordingly.
• Modules and vendor dependencies have been updated; run go mod tidy && go mod vendor
• I have added tests to cover my changes.
• All new and existing tests passed.
• Check your code additions will not fail linting checks:
  • go fmt -s
  • go vet

[probelabs]

This PR updates the .github/workflows/intelligent-branch-recomendations.yml workflow to align with the latest standards from the central TykTechnologies/github-actions repository.

Files Changed Analysis

• .github/workflows/intelligent-branch-recomendations.yml: The only file changed. It updates the reference for the reusable workflow and modifies the secrets passed to it.

Architecture & Impact Assessment

• What this PR accomplishes: It standardizes the branch suggestion CI workflow by updating its source and authentication method. The reusable workflow reference is changed from a pinned commit hash to the production branch, ensuring this repository automatically uses the latest stable version. The Jira authentication method is updated from a single JIRA_TOKEN to JIRA_READ_AUTH and JIRA_BASE_URL.

• Key technical changes introduced:

  1. The uses directive for the branch-suggestion.yml workflow is updated from ...@d3fa208... to ...@production.
  2. The secrets passed to the workflow are changed from JIRA_TOKEN to JIRA_READ_AUTH and JIRA_BASE_URL.

• Affected system components: This change impacts the repository's CI/CD pipeline, specifically the developer tooling that suggests the correct base branch for pull requests. It has no effect on the application's runtime code.

  graph TD
      A[Pull Request Event] --> B{intelligent-branch-recomendations.yml};
      B --> C{uses: TykTechnologies/github-actions/branch-suggestion.yml@production};
      C --> D[Connect to Jira];
      D -- Authenticates with --> E[secrets.JIRA_READ_AUTH & secrets.JIRA_BASE_URL];
      C --> F[Suggests Base Branch];
  

  Loading

Scope Discovery & Context Expansion

• This change is part of a broader, organization-wide effort to standardize CI processes and secret management, driven by updates in the central TykTechnologies/github-actions repository.
• Switching from a pinned commit to the @production branch indicates a move towards continuous, automatic updates for this workflow, trading the stability of a fixed version for reduced maintenance overhead.
• To fully understand the context, a reviewer should examine the branch-suggestion.yml workflow in the TykTechnologies/github-actions repository to see the underlying changes that necessitated this update.

Metadata

• Review Effort: 1 / 5
• Primary Label: chore

---

Powered by Visor from Probelabs

Last updated: 2026-08-04T15:20:45.979Z | Triggered by: pr_updated | Commit: 3ace50c

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/intelligent-branch-recomendations.yml:16	The reusable workflow is referenced using a mutable branch name ('production'). This practice can introduce a security risk, as the code executed by the workflow can change if the target branch is updated with malicious code. This could potentially lead to the compromise of the build environment or the exfiltration of secrets. 💡 Suggestion Pin the reusable workflow to a specific commit SHA instead of a branch name to ensure that you are always running a known and trusted version of the workflow. This improves the security and determinism of your CI/CD pipeline. Dependabot can be configured to automatically create pull requests for updating the pinned SHA.

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/intelligent-branch-recomendations.yml:16	The reusable workflow is referenced using a mutable branch name ('production'). This practice can introduce a security risk, as the code executed by the workflow can change if the target branch is updated with malicious code. This could potentially lead to the compromise of the build environment or the exfiltration of secrets. 💡 Suggestion Pin the reusable workflow to a specific commit SHA instead of a branch name to ensure that you are always running a known and trusted version of the workflow. This improves the security and determinism of your CI/CD pipeline. Dependabot can be configured to automatically create pull requests for updating the pinned SHA.

\n\n ### Architecture Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/intelligent-branch-recomendations.yml:15	The reusable workflow is now referenced using the `production` tag/branch, which is a mutable reference. The previous implementation used a specific commit hash (`d3fa208...`), which guarantees that the workflow is deterministic and secure against unexpected changes in the source repository. Using a floating reference like a branch name can lead to unexpected failures or behavior changes if the underlying branch is updated with a breaking change. 💡 Suggestion For improved security and build reproducibility, it is recommended to pin the action to a specific commit SHA. If using a tag is desired for easier updates, consider using immutable version tags (e.g., `@v1.2.3`) instead of a branch name like `production`.

✅ Performance Check Passed

No performance issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-08-04T15:20:39.875Z | Triggered by: pr_updated | Commit: 3ace50c

💡 TIP: You can chat with Visor using /visor ask <your question>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE