This PR introduces an automated update to the GitHub release workflow, synchronized from a central gromit template. The primary goal is to enforce gzip compression for all Docker images built in the pipeline and to add a verification step to ensure compliance.

Files Changed Analysis

• .github/workflows/release.yml (+264, -6): The changes are concentrated in this single file. The modifications are highly repetitive, applying the same logic to six distinct Docker image build jobs for the ee, fips, and std variants, covering both CI (pull request) and production (tag) builds.

Architecture & Impact Assessment

• What this PR accomplishes: It standardizes Docker image layer compression to gzip. This change is a defensive measure to ensure compatibility with container registries or client environments that may not support the newer zstd compression format, which has become the default in recent versions of build tooling.

• Key technical changes introduced:

  1. Forced Gzip Compression: The docker/build-push-action steps are updated. The push: true parameter is replaced with outputs: type=image,push=true,compression=gzip,force-compression=true,oci-mediatypes=true to explicitly mandate gzip compression.
  2. Compression Verification: A new step is added immediately after each image build. This step runs a shell script that uses docker buildx imagetools inspect and jq to parse the image manifest. It verifies that all layer media types are gzip-based and fails the workflow if any layer uses a different compression format.

• Affected system components: The change directly impacts the CI/CD release pipeline. It modifies the build process for all Docker image artifacts (tyk-gateway, tyk-gateway-ee, tyk-gateway-fips), altering the final format of the published images.

  The updated build flow can be visualized as follows:

  graph TD
      A[Start Build Job] --> B(Build & Push Docker Image);
      B -- set compression=gzip --> B;
      B --> C{Verify Image Compression};
      C -- All layers are gzip --> D[Step Succeeds];
      C -- Mismatched compression --> E[Fail Workflow];
  

  Loading

Scope Discovery & Context Expansion

• The PR title and description indicate this is a policy-driven update synchronized from a central template system (gromit). This suggests the change is likely being rolled out across multiple repositories to enforce a consistent build standard.
• The context implies a reaction to an environmental change, where the default compression algorithm in the build tools (likely Docker Buildx) shifted to zstd. This PR pins the compression format to maintain broad compatibility for the project's Docker images.

Powered by Visor from Probelabs

Last updated: 2026-06-09T08:20:54.826Z | Triggered by: pr_updated | Commit: feee33f

💡 TIP: You can chat with Visor using /visor ask <your question>

Architecture Issues (1)

✅ Performance Check Passed

No performance issues found – changes LGTM.

Architecture Issues (1)

No performance issues found – changes LGTM.

Quality Issues (1)

Powered by Visor from Probelabs

Last updated: 2026-06-09T08:20:43.316Z | Triggered by: pr_updated | Commit: feee33f

💡 TIP: You can chat with Visor using /visor ask <your question>

🚨 Jira Linter Failed

Commit: feee33f
Failed at: 2026-06-09 08:19:45 UTC

The Jira linter failed to validate your PR. Please check the error details below:

failed to validate branch and PR title rules: branch name 'releng/master' must contain a valid Jira ticket ID (e.g., ABC-123)

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

🎯 Recommended Merge Targets

Based on JIRA ticket TT-17333: Normalize Docker image layer compression to gzip for DHI-based images

Fix Version: Tyk 5.13.1

Required:

• release-5.13 - Minor version branch for 5.13.x patches - required for creating Tyk 5.13.1
• master - Main development branch - ensures fix is in all future releases

📋 Workflow

1. Merge this PR to master first

2. Cherry-pick to release branches by commenting on the merged PR:

   • /release to release-5.13

3. Automated backport - The bot will automatically create backport PRs to the specified release branches

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud