Skip to content

ci: Fix broken Jira search block PR merges - #1872

Open
isivaselvan wants to merge 2 commits into
hashicorp:mainfrom
isivaselvan:fix/jira-sync-pr
Open

ci: Fix broken Jira search block PR merges#1872
isivaselvan wants to merge 2 commits into
hashicorp:mainfrom
isivaselvan:fix/jira-sync-pr

Conversation

@isivaselvan

@isivaselvan isivaselvan commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Rollback Plan

If a change needs to be reverted, revert this commit - it only changes CI workflow behavior, nothing in the provider binary.

Changes to Security Controls

None. This is a CI-only workflow change; no provider code, schema, or runtime behavior is affected.

Description

The Jira sync check (.github/workflows/jira-pr.yml) fails on every PR event other than opened (edits, closes, reopens). Root cause: the Search step calls tomhjp/gh-action-jira-search, whose main.go hardcodes a call to Jira's GET /rest/api/3/search endpoint — an endpoint Atlassian has since retired:

API call GET /rest/api/3/search failed (410):
"The requested API has been removed. Please migrate to the /rest/api/3/search/jql API."

Since this workflow is internal Jira-ticket bookkeeping with no bearing on code correctness, this PR marks the Search step continue-on-error: true so it stops blocking mergeStateStatus on unrelated PRs while upstream remains unfixed. The downstream steps (Sync comment, Close PR, Reopen PR) already gate on steps.search.outputs.issue, so when Search fails without setting that output, they skip cleanly instead of the job erroring.

Same fix, same root cause, already applied to the sibling terraform-provider-kubernetes repo: hashicorp/terraform-provider-kubernetes#2958.

Scope note: .github/workflows/jira-issues.yml has the identical pattern and will fail the same way, but is intentionally left out of this PR to keep the change scoped to what's actually blocking PR merges — same scoping decision made in the companion k8s-provider fix.

Acceptance tests

  • Have you added an acceptance test for the functionality being added?
  • Have you run the acceptance tests on this branch?

Not applicable — this is a GitHub Actions workflow change, not provider code, so make testacc doesn't apply. Verified instead via:

$ actionlint .github/workflows/jira-pr.yml
# same pre-existing shellcheck warnings as origin/main (unrelated Set-ticket-type
# script quoting); nothing new introduced by this change

$ act workflow_dispatch -W <synthetic repro workflow> -P ubuntu-latest=catthehacker/ubuntu:act-latest
# reproduced the exact step/output mechanism locally against Docker:
# Search step fails (continue-on-error: true) -> "Failed but continue next step"
# downstream step gated on steps.search.outputs.issue -> skipped cleanly, never runs
# job result -> "Job succeeded"

Release Note

Release note for CHANGELOG:

NONE

References

Community Note

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment

tomhjp/gh-action-jira-search still calls the deprecated Jira
/rest/api/3/search endpoint, which Atlassian has removed (returns HTTP
410, migrate to /rest/api/3/search/jql). Same failure and same root
cause as hashicorp/terraform-provider-kubernetes#2958 - upstream shows
no sign of fixing this (no newer tag/commit addresses the endpoint, no
open issue/PR).

Mark the Search step continue-on-error so this internal Jira-sync
housekeeping stops blocking mergeStateStatus on every PR event other
than "opened". Downstream steps already gate on
steps.search.outputs.issue, so they skip cleanly rather than error
when Search fails without setting it.

Note: because this workflow triggers on pull_request_target, GitHub
always executes the workflow file from the base branch (main), never
from the PR's head branch - this is deliberate security hardening so
fork PRs can't rewrite a workflow that has secret access. That means
this fix cannot make its own PR's "Jira sync" check pass; it only
takes effect for PRs opened/edited after this merges into main.
Verified the continue-on-error + downstream-skip mechanism locally via
actionlint and a synthetic `act` repro (same verification already done
for the identical fix in terraform-provider-kubernetes#2958).
@isivaselvan
isivaselvan requested review from a team, iam404 and rigalGit as code owners August 20, 2026 04:48
No release-note block - this is a CI-only workflow change with no
user-facing effect on the provider.
@isivaselvan isivaselvan changed the title ci: Fix broken Jira search block PR merges ci: don't let broken Jira search block PR merges Aug 20, 2026
@isivaselvan isivaselvan changed the title ci: don't let broken Jira search block PR merges ci: Fix broken Jira search block PR merges Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant