[releng release-5.8.15] gromit: sync templates

[probelabs]

Auto-generated from gromit templates by policy sync.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Preserve basename branch fallback Switching from the basename to the full HEAD_REF can break existing cross-repo branch matching for names like team/feature-x, where tyk-analytics may still use just feature-x. Try the full ref first and fall back to ${HEAD_REF##*/} before declaring the branch missing, so PRs do not unexpectedly stop reusing the intended analytics branch. .github/workflows/release.yml [802-811] -BRANCH="$HEAD_REF" -echo "Checking for branch: $BRANCH in tyk-analytics" +REMOTE_REF="" +for CANDIDATE in "$HEAD_REF" "${HEAD_REF##*/}"; do + BRANCH="$CANDIDATE" + echo "Checking for branch: $BRANCH in tyk-analytics" -if ! REMOTE_REF=$(git ls-remote \ - --heads \ - "https://x-access-token:${GITHUB_TOKEN}@github.com/TykTechnologies/tyk-analytics.git" \ - "refs/heads/$BRANCH"); then - echo "::error::Unable to query tyk-analytics; check GitHub App authentication and repository permissions" - exit 1 -fi + if ! REMOTE_REF=$(git ls-remote \ + --heads \ + "https://x-access-token:${GITHUB_TOKEN}@github.com/TykTechnologies/tyk-analytics.git" \ + "refs/heads/$BRANCH"); then + echo "::error::Unable to query tyk-analytics; check GitHub App authentication and repository permissions" + exit 1 + fi + [ -n "$REMOTE_REF" ] && break +done + Suggestion importance[1-10]: 8 __ Why: Changing BRANCH from ${HEAD_REF##*/} to full HEAD_REF can break existing branch matching for repos that still use the basename form, making this a plausible regression in check_branch. Trying full HEAD_REF first and then falling back preserves the new behavior while keeping backward compatibility.	Medium
	Resolve PRs by branch Matching a tyk-analytics PR by head SHA can select the wrong PR when multiple PRs point at the same commit, which would make this job reuse an unrelated dashboard image. Resolve the PR by branch name instead, and only reuse pr-* images for the PR that actually owns BRANCH. .github/workflows/release.yml [912-918] -TA_REMOTE="https://x-access-token:${GH_TOKEN}@github.com/TykTechnologies/tyk-analytics.git" -BRANCH_SHA=$(git ls-remote --heads "$TA_REMOTE" "refs/heads/$BRANCH" | cut -f1 || true) -DASH_PR=$(git ls-remote "$TA_REMOTE" 'refs/pull/*/head' 2>/dev/null \ - | awk -v sha="$BRANCH_SHA" '$1 == sha { split($2, r, "/"); print r[3] }' \ - | sort -n | tail -1 || true) +DASH_PR=$(gh pr list \ + --repo TykTechnologies/tyk-analytics \ + --head "$BRANCH" \ + --state open \ + --json number \ + --jq '.[0].number // ""' 2>/dev/null || true) if [ -n "$DASH_PR" ] && dash_image_exists "pr-${DASH_PR}"; then Suggestion importance[1-10]: 7 __ Why: Matching tyk-analytics PRs by BRANCH_SHA can incorrectly pick an unrelated PR when multiple PR heads share the same commit, so this is a legitimate correctness issue. The proposed switch to querying by BRANCH is consistent with the newly added GH_TOKEN flow and more accurately targets the intended pr-* image.	Medium

[github-actions]

zizmor findings

Severity	Count
High	29
Medium	63
Low	8
Info	10

Full details are in the workflow run.

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[sonarqubecloud]

Quality Gate failed

Failed conditions
71.5% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[sentinelone-cnapp-eu1]

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

[github-actions]

🚨 Jira Linter Failed

Commit: fd8569e
Failed at: 2026-09-10 11:36:31 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details

failed to validate branch and PR title rules: branch name 'releng/release-5.8.15' must contain a valid Jira ticket ID (e.g., ABC-123)

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

---

This comment will be automatically deleted once the linter passes.