Skip to content

[TT-17339 master] Implement Floating tags in github actions#8270

Merged
lghiur merged 3 commits into
masterfrom
releng/master
Jun 5, 2026
Merged

[TT-17339 master] Implement Floating tags in github actions#8270
lghiur merged 3 commits into
masterfrom
releng/master

Conversation

@konrad-sol

@konrad-sol konrad-sol commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

Maintain a mutable tag (e.g. production) in the GitHub Actions repo, moved to the latest commit. Product repos reference @production and pick up updates automatically.
This is a follow up of the Spike ticket: https://tyktech.atlassian.net/jira/software/c/projects/TT/boards/451?assignee=5ed4afcb53ec400c2c067d80&selectedIssue=TT-17303

@konrad-sol
konrad-sol requested a review from a team as a code owner June 3, 2026 09:50
@konrad-sol
konrad-sol enabled auto-merge (squash) June 3, 2026 09:50
@probelabs

probelabs Bot commented Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR updates the CI/CD workflow to use a floating production tag for shared GitHub Actions, moving away from pinned commit SHAs. This change is intended to streamline the adoption of updates from the central actions repository. The PR also introduces several optimizations, such as conditional multi-platform builds to speed up pull request checks, and other refactorings.

Files Changed Analysis

  • .github/workflows/release.yml (+25, -40): The sole file modified. The changes involve replacing pinned action versions with a floating tag, optimizing Docker build steps, and refining workflow logic.

Architecture & Impact Assessment

What this PR accomplishes

It transitions the CI pipeline's dependency on shared GitHub Actions from static, pinned commit hashes to a dynamic, mutable production tag. This allows the repository to automatically use the latest version of shared actions, simplifying maintenance.

Key technical changes introduced

  1. Floating Tag for Actions: All uses: TykTechnologies/github-actions/...@<commit-sha> have been replaced with uses: TykTechnologies/github-actions/...@production.
  2. Optimized Docker Builds: Docker builds for pull requests are now limited to the linux/amd64 platform, while full multi-platform builds are reserved for release (tag) events.
  3. SBOM Generation Disabled: The sbom: true parameter has been removed from all docker/build-push-action steps.
  4. Flexible Runner Selection: The workflow now uses vars.BUILD_RUNNER if available, falling back to vars.DEFAULT_RUNNER.
  5. Token Usage Change: The resolve-dashboard-image job now uses secrets.ORG_GH_TOKEN instead of a short-lived token generated by a GitHub App.

Affected system components

The entire CI/CD pipeline defined in .github/workflows/release.yml is affected, including dependency checks, building, Docker image creation, and testing.

Dependency Flow Visualization

Before: Pinned Dependencies

graph TD
    subgraph Tyk Repository
        A[release.yml]
    end
    subgraph "TykTechnologies/github-actions"
        B[".../dependency-guard.yml@d3fa208"]
        C[".../test-controller@42304ed"]
        D[".../env-up@42304ed"]
    end
    A --> B
    A --> C
    A --> D
Loading

After: Floating Tag

graph TD
    subgraph Tyk Repository
        A[release.yml]
    end
    subgraph "TykTechnologies/github-actions"
        B["... @production"]
    end
    A -- uses --> B
Loading

Scope Discovery & Context Expansion

  • Broader Impact: This change establishes a consumer-side contract for a new release strategy in the TykTechnologies/github-actions repository, which is now responsible for managing the production tag.
  • Potential Risks: Using a floating tag introduces a stability risk. A breaking change in the github-actions repository could immediately disrupt this repository's CI pipeline. This approach prioritizes ease of updates over the build reproducibility and stability offered by version pinning.
  • Review Focus: Reviewers should critically assess the trade-offs of using a floating tag. The removal of SBOM generation and the switch to a potentially long-lived ORG_GH_TOKEN are significant changes with security implications that warrant careful consideration and validation against organizational policies.
Metadata
  • Review Effort: 3 / 5
  • Primary Label: enhancement

Powered by Visor from Probelabs

Last updated: 2026-06-03T20:07:14.721Z | Triggered by: pr_updated | Commit: 72b5180

💡 TIP: You can chat with Visor using /visor ask <your question>

@probelabs

probelabs Bot commented Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Architecture Issues (2)

Severity Location Issue
🟠 Error .github/workflows/release.yml:36
The workflow has been updated to use a floating tag (`@production`) for referencing shared GitHub Actions, replacing pinned commit SHAs. While this simplifies maintenance by automatically adopting updates, it introduces a significant risk of pipeline instability. A breaking change in the `TykTechnologies/github-actions` repository's `production` tag could immediately and unexpectedly break CI/CD across all consuming repositories.
💡 SuggestionTo mitigate the risk of unexpected failures, consider a more controlled update strategy. Options include: 1) Using major version tags (e.g., `@v1`) which offer stability within a major version. 2) Reverting to pinned commit SHAs and using a dependency management tool like Dependabot to create pull requests for updates, allowing for testing before merging. This provides a balance between stability and ease of maintenance.
🟠 Error .github/workflows/release.yml:177
The generation of a Software Bill of Materials (SBOM) has been disabled by removing the `sbom: true` parameter from multiple `docker/build-push-action` steps. SBOMs are a critical component for software supply chain security, providing essential visibility into dependencies. Disabling this feature weakens the security posture of the build artifacts and may conflict with compliance requirements.
💡 SuggestionRe-enable SBOM generation by adding `sbom: true` back to the `docker/build-push-action` steps, particularly for the final images that are pushed to production registries (lines 199, 289, 367). If this removal was intentional due to performance or other concerns, the decision and its rationale should be documented.
\n\n

Architecture Issues (2)

Severity Location Issue
🟠 Error .github/workflows/release.yml:36
The workflow has been updated to use a floating tag (`@production`) for referencing shared GitHub Actions, replacing pinned commit SHAs. While this simplifies maintenance by automatically adopting updates, it introduces a significant risk of pipeline instability. A breaking change in the `TykTechnologies/github-actions` repository's `production` tag could immediately and unexpectedly break CI/CD across all consuming repositories.
💡 SuggestionTo mitigate the risk of unexpected failures, consider a more controlled update strategy. Options include: 1) Using major version tags (e.g., `@v1`) which offer stability within a major version. 2) Reverting to pinned commit SHAs and using a dependency management tool like Dependabot to create pull requests for updates, allowing for testing before merging. This provides a balance between stability and ease of maintenance.
🟠 Error .github/workflows/release.yml:177
The generation of a Software Bill of Materials (SBOM) has been disabled by removing the `sbom: true` parameter from multiple `docker/build-push-action` steps. SBOMs are a critical component for software supply chain security, providing essential visibility into dependencies. Disabling this feature weakens the security posture of the build artifacts and may conflict with compliance requirements.
💡 SuggestionRe-enable SBOM generation by adding `sbom: true` back to the `docker/build-push-action` steps, particularly for the final images that are pushed to production registries (lines 199, 289, 367). If this removal was intentional due to performance or other concerns, the decision and its rationale should be documented.
\n\n ### Performance Issues (1)
Severity Location Issue
🟡 Warning .github/workflows/release.yml:36
Using a floating tag (`@production`) for shared GitHub Actions introduces performance unpredictability. While this simplifies maintenance, any performance degradation in the underlying action will immediately affect this workflow, leading to slower CI builds. This makes build times less stable and harder to reason about over time. Pinning to a specific, known-good commit SHA ensures reproducible performance.
💡 SuggestionFor better performance stability and reproducibility, pin the action to a specific commit SHA. For example: `uses: TykTechnologies/github-actions@d3fa208`. Use a dependency update tool like Dependabot to manage updates to these pinned versions via pull requests, allowing for performance testing before merging.

Quality Issues (4)

Severity Location Issue
🟠 Error .github/workflows/release.yml:544
The `resolve-dashboard-image` job has been changed to use `secrets.ORG_GH_TOKEN`, which is likely a long-lived Personal Access Token (PAT). This is a security anti-pattern compared to the previous method of using a short-lived token generated via `steps.app-token.outputs.token`. Long-lived credentials increase the security risk if compromised.
💡 SuggestionRevert this change to use the short-lived, automatically-generated token from the GitHub App. This adheres to the principle of least privilege and reduces the risk associated with credential exposure.
🔧 Suggested Fix
          ORG_GH_TOKEN: ${{ steps.app-token.outputs.token }}
🟡 Warning .github/workflows/release.yml:36
The workflow is switching from using a pinned commit SHA to a floating tag (`@production`) for its shared GitHub Actions. This makes the build process non-deterministic and can introduce unexpected failures if a breaking change is pushed to the `production` tag in the source repository. While this simplifies maintenance by automatically adopting updates, it sacrifices the stability and reproducibility of pinned versions.
💡 SuggestionAcknowledge the trade-off between maintainability and stability. If build reproducibility is critical, consider reverting to pinned commit SHAs. If the `production` tag is well-governed and the risk is acceptable, this change can remain, but the team should be aware of the potential for upstream changes to break the pipeline.
🟡 Warning .github/workflows/release.yml:178
The `sbom: true` parameter has been removed from the `docker/build-push-action`. This disables the generation of a Software Bill of Materials (SBOM), which is an important artifact for software supply chain security, helping to track dependencies and identify vulnerabilities.
💡 SuggestionRestore the `sbom: true` parameter to the Docker build steps to ensure SBOMs are generated for all published images. If this removal was intentional, ensure it complies with the organization's security and compliance policies.
🟡 Warning .github/workflows/release.yml:207
The `cache-to: type=gha,mode=max` parameter was removed from the steps that push images to production (e.g., 'push ee image to prod'), while it is still present in the steps that push to the development registry. This means the final release builds do not write to the GitHub Actions cache, which could slow down re-runs of the release workflow.
💡 SuggestionFor consistency and to optimize release build times in case of re-runs, consider re-adding `cache-to: type=gha,mode=max` to the production push steps.

Powered by Visor from Probelabs

Last updated: 2026-06-03T20:06:52.618Z | Triggered by: pr_updated | Commit: 72b5180

💡 TIP: You can chat with Visor using /visor ask <your question>

@konrad-sol
konrad-sol requested a review from ilijabojanovic June 3, 2026 20:04
@github-actions

github-actions Bot commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

🚨 Jira Linter Failed

Commit: 72b5180
Failed at: 2026-06-03 20:05:26 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details 
failed to validate branch and PR title rules: branch name 'releng/master' must contain a valid Jira ticket ID (e.g., ABC-123)

Next Steps

  • Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
  • Verify your PR title matches the branch's Jira ticket ID
  • Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

@ilijabojanovic
ilijabojanovic disabled auto-merge June 4, 2026 14:28
@sonarqubecloud

sonarqubecloud Bot commented Jun 4, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
7 Security Hotspots

See analysis details on SonarQube Cloud

@ilijabojanovic
[skip ci]
5cb7e1d 
[skip ci]
@lghiur lghiur closed this Jun 5, 2026
@lghiur lghiur reopened this Jun 5, 2026
@lghiur

lghiur commented Jun 5, 2026

Copy link
Copy Markdown
Collaborator

giving a hand here to @ilijabojanovic and @konrad-sol by force merging this on their request

@lghiur
lghiur merged commit 29ae8f5 into master Jun 5, 2026
@lghiur
lghiur deleted the releng/master branch June 5, 2026 09:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ilijabojanovic ilijabojanovic ilijabojanovic approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@konrad-sol @lghiur @ilijabojanovic