[releng release-1.14] gromit: sync templates

[probelabs]

Auto-generated from gromit templates by policy sync.

[probelabs]

This pull request, generated automatically by the gromit policy sync tool, overhauls the CI/CD pipeline to align with updated organizational standards. The changes focus on enhancing security, improving build reliability, and increasing maintainability by adopting centralized, reusable GitHub Actions workflows.

Files Changed Analysis

• New Workflows:
  • .github/workflows/drift-check.yml: A new workflow to detect and prevent configuration drift from repository standards.
  • .github/workflows/zizmor.yml: A new workflow for security scanning using zizmor.
• New Configuration:
  • .github/zizmor.yml: A configuration file for the zizmor security tool.
• Major Workflow Update (.github/workflows/release.yml):
  • Go Version: Upgraded the build environment from Go 1.25 to 1.26.
  • Authentication: Replaced the static ORG_GH_TOKEN with a more secure, short-lived GitHub App token for authentication in CI jobs.
  • Build Hardening: Added new validation steps to ensure the Go version is the latest patch release and to verify that all Docker image layers are consistently gzip-compressed.
  • CI Refactoring: The upgrade-deb and upgrade-rpm jobs have been removed and replaced by a single, reusable workflow (upgrade-tests.yml), significantly reducing boilerplate and centralizing logic. The standalone sbom job has also been removed.
  • Docker Build Process: The docker/build-push-action steps were updated to enforce gzip compression. The sbom: true parameter was removed.
  • Action Pinning: All shared GitHub Actions are now pinned to the @production channel instead of specific commit hashes, ensuring continuous alignment with central standards.
• Dockerfile Improvements (ci/Dockerfile.distroless, ci/Dockerfile.std):
  • Added quotes to the dpkg command arguments to handle package names more robustly.

Architecture & Impact Assessment

• What this PR accomplishes: It standardizes the repository's CI/CD pipeline, bringing it into compliance with centrally managed templates. This enhances security posture, increases the reliability of build artifacts, and simplifies future maintenance.

• Key technical changes introduced:

  1. Secure Authentication: Shifted from static Personal Access Tokens to dynamic, short-lived GitHub App tokens.
  2. Workflow Modularization: Replaced ~120 lines of inline package upgrade test logic with a single call to a reusable workflow.
  3. Enhanced Validation: Introduced proactive checks for Go patch versions and Docker image layer compression to catch inconsistencies early.
  4. Policy Enforcement: Added new workflows for drift detection and security scanning.

• Affected system components: The changes are confined to the CI/CD pipeline. The application's runtime code is not affected, but the process for building, testing, and releasing binaries, packages, and Docker images is significantly updated.

CI/CD Pipeline Evolution

The diagram below illustrates the transition from a monolithic release workflow to a more modular, secure, and maintainable system that leverages centralized components.

graph TD
    subgraph "Old Pipeline"
        A[release.yml]
        A --> B(Auth with PAT);
        B --> C(Inline DEB/RPM Tests);
        C --> D(Separate SBOM Job);
    end

    subgraph "New Pipeline"
        E[release.yml]
        E --> F(Auth with GitHub App);
        F --> G[Reusable `upgrade-tests.yml`];
        F --> H(Go Version & Image Compression Validation);
    end

    subgraph "New Supporting Workflows"
        I[drift-check.yml]
        J[zizmor.yml]
    end

Loading

Scope Discovery & Context Expansion

This PR is part of a broader, organization-wide initiative to standardize CI/CD practices, enforced by the gromit policy tool. The reliance on reusable workflows from TykTechnologies/github-actions@production means this repository will automatically inherit future updates and security patches applied to the central actions. The removal of the sbom job and the sbom: true flag from Docker builds is a notable change, potentially impacting how software supply chain vulnerabilities are tracked; this may have been superseded by a different, centralized process.

Metadata

• Review Effort: 3 / 5
• Primary Label: chore

---

Powered by Visor from Probelabs

Last updated: 2026-08-11T14:45:51.784Z | Triggered by: pr_updated | Commit: 9013e44

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

✅ Security Check Passed

No security issues found – changes LGTM.

Architecture Issues (2)

Severity	Location	Issue
🟡 Warning	.github/workflows/release.yml:185-224	The shell script logic to verify Docker image layer compression is duplicated four times within the `goreleaser` job (for fips CI, fips prod, std CI, and std prod images). This violates the DRY (Don't Repeat Yourself) principle and introduces a maintenance burden. Any future changes to the verification logic will need to be applied in all four locations, increasing the risk of inconsistency. 💡 Suggestion To improve maintainability and align with the PR's goal of using reusable components (as was done with the `upgrade-tests` job), this verification script should be extracted into a reusable composite action within this repository or moved to the centralized `TykTechnologies/github-actions` repository if it's intended for organization-wide use.
🟡 Warning	.github/workflows/release.yml:170	The SBOM (Software Bill of Materials) generation has been removed from the Docker build process. The `sbom: true` parameter was removed from all `docker/build-push-action` steps, and the dedicated `sbom` job that ran at the end of the workflow was also deleted. While this change is likely part of a centrally-managed policy update, it removes a critical software supply chain security mechanism from this workflow's observable steps. Without SBOMs, tracking and responding to vulnerabilities in third-party dependencies becomes more difficult. 💡 Suggestion Confirm that SBOM generation and analysis are now handled by a different, centralized process (e.g., a scanner in the container registry or a separate, organization-wide security workflow). If no replacement exists, consider reintroducing SBOM generation to maintain supply chain visibility.

Performance Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/release.yml:118-145	The 'Validate Go version' step makes a network request to `go.dev` on every CI run to fetch the latest Go patch versions. This introduces a dependency on an external service, which can add latency to the build and make it less reliable if the service is slow or down. 💡 Suggestion Cache the downloaded list of Go versions for a period of time (e.g., 24 hours). Since Go patch versions are not released frequently, fetching this data on every run is inefficient. Using a caching mechanism like `actions/cache` with a date-based key would significantly speed up this step for most runs and improve the pipeline's resilience.

Quality Issues (2)

Severity	Location	Issue
🔴 Critical	ci/Dockerfile.distroless:14	The shell command for `dpkg -i` contains incorrect quoting which will cause the build to fail. The path `dpkg -i /"${BUILD_PACKAGE_NAME}"_*"${TARGETARCH}".deb` will be interpreted literally by the shell, including the double quotes, causing the command to fail as no such file will be found. The glob character `*` is intended to match the package version, but the invalid quoting breaks the path matching. 💡 Suggestion Remove the erroneous double quotes around the shell variables to allow for correct glob expansion of the file path. The original unquoted version was correct. 🔧 Suggested Fix RUN dpkg -i /${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb && rm /*.deb \
🔴 Critical	ci/Dockerfile.std:18	The shell command for `dpkg -i` contains incorrect quoting which will cause the build to fail. The path `dpkg -i /"${BUILD_PACKAGE_NAME}"_*_"${TARGETARCH}".deb` will be interpreted literally by the shell, including the double quotes, causing the command to fail as no such file will be found. The glob character `*` is intended to match the package version, but the invalid quoting breaks the path matching. 💡 Suggestion Remove the erroneous double quotes around the shell variables to allow for correct glob expansion of the file path. The original unquoted version was correct. 🔧 Suggested Fix RUN dpkg -i /${BUILD_PACKAGE_NAME}_*_${TARGETARCH}.deb && find / -maxdepth 1 -name "*.deb" -delete

---

Powered by Visor from Probelabs

Last updated: 2026-08-11T14:45:37.051Z | Triggered by: pr_updated | Commit: 9013e44

💡 TIP: You can chat with Visor using /visor ask <your question>

[github-actions]

🚨 Jira Linter Failed

Commit: 9013e44
Failed at: 2026-08-11 14:43:49 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details

configuration error: Jira user email is required for API authentication

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

---

This comment will be automatically deleted once the linter passes.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE