This pull request refactors the .github/workflows/release.yml workflow to improve security, reliability, and maintainability. The changes are part of a policy sync and do not alter the core logic of the application.

Files Changed Analysis

The PR modifies a single file, .github/workflows/release.yml, with 46 additions and 18 deletions. The changes focus on replacing inline scripts with more robust, centralized steps and adding new validation logic to the CI pipeline.

Architecture & Impact Assessment

• What this PR accomplishes:

  • Enhances Security: Introduces a new step to validate that the Go version used in the build container is the latest available patch release, preventing the use of outdated versions with potential vulnerabilities.
  • Improves Maintainability: Replaces a custom script for generating the test distribution matrix with a reusable GitHub Action. It also centralizes the installation of the Docker Scout CLI, which was previously duplicated in two separate steps.
  • Increases Reliability: The goreleaser command timeout is increased to 120 minutes to prevent failures during long builds.

• Key technical changes introduced:

  1. Go Version Validation: A new step is added to the build job that fetches the latest Go releases from go.dev and compares the version in the build container against the latest patch. The build will fail if the version is not up-to-date.
  2. Centralized Docker Scout Installation: The installation of the Docker Scout CLI is now handled in a single, dedicated step that pins to a specific version (v1.22.0) and verifies its checksum. This replaces the previous, less secure curl | sh method.
  3. Refactored Test Matrix: A run step that used curl to fetch a test matrix from an internal service has been replaced with a reusable action: TykTechnologies/github-actions/.github/actions/tests/distro-matrix@production.

• Affected system components:

  • CI/CD Pipeline: The core release workflow is directly impacted. Builds are now stricter regarding the Go version. The configuration for the test matrix is now externalized to another repository.
  • VEX Attestation: The process for attaching VEX (Vulnerability Exploitability eXchange) data is made more robust by standardizing the installation of the docker-scout tool it depends on.

• Workflow Visualization:

graph TD
subgraph "Build Job Enhancements"
A[Start Build] --> B{New: Validate Go Version};
B --> C[Build with Goreleaser];
C --> D{New: Centralized Docker Scout Install};
D --> E[Attach VEX Data];
end
subgraph "Tests Job Refactoring"
F[Old: Custom Script for Distro Matrix] --> G("New: Reusable 'distro-matrix' GitHub Action");
end

## Scope Discovery & Context Expansion
The changes in this PR, while confined to one file, have a broader impact on the development and release process:
- **`tykio/golang-cross` container**: This Docker image is a critical dependency. The new Go validation step means this container must be promptly updated whenever a new Go patch is released to avoid blocking builds.
- **`TykTechnologies/github-actions` repository**: The logic for determining which Linux distributions to run tests against is now managed by the `distro-matrix` action in this separate repository. This centralizes configuration but also means changes to the test matrix are managed outside the `tyk` repository.


<details>
<summary>Metadata</summary>

- Review Effort: 2 / 5
- Primary Label: chore


</details>
<!-- visor:section-end id="overview" -->

<!-- visor:thread-end key="TykTechnologies/tyk#8397@0dcd5d5" -->

---

*Powered by [Visor](https://probelabs.com/visor) from [Probelabs](https://probelabs.com)*

*Last updated: 2026-06-30T13:21:49.798Z | Triggered by: pr_updated | Commit: 0dcd5d5*

💡 **TIP:** You can chat with Visor using `/visor ask <your question>`
<!-- /visor-comment-id:visor-thread-overview-TykTechnologies/tyk#8397 -->

Security Issues (1)

Architecture Issues (2)

Security Issues (1)

Quality Issues (1)

Powered by Visor from Probelabs

Last updated: 2026-06-30T13:21:06.336Z | Triggered by: pr_updated | Commit: 0dcd5d5

💡 TIP: You can chat with Visor using /visor ask <your question>

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

🚨 Jira Linter Failed

Commit: 0dcd5d5
Failed at: 2026-06-30 13:21:02 UTC

The Jira linter failed to validate your PR. Please check the error details below:

failed to validate branch and PR title rules: branch name 'releng/release-5.14.0' must contain a valid Jira ticket ID (e.g., ABC-123)

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.