[SYSE-363 master] May template application

[alephnull]

User description

• Do not maintain release-4-lts anymore
• Build faster
• Distroless based images
• upgrade tests have incorrect conditional

---

PR Type

enhancement, bug_fix

---

Description

• Updated CI/CD pipeline configuration in .github/workflows/release.yml to fix incorrect metadata references and improve the build process.
• Added new 'cache_db' outputs and updated Docker compose commands to support additional database configurations.
• Introduced a new 'distroless' job in the CI/CD pipeline to build distroless images for the Tyk gateway, enhancing security by minimizing runtime dependencies.
• Created a new ci/Dockerfile.distroless for building distroless images, which includes multi-stage builds and optimized configurations for different architectures.

---

Changes walkthrough 📝

Relevant files

Enhancement

release.yml Enhancements and Fixes in CI/CD Pipeline Configuration      .github/workflows/release.yml Updated Docker metadata step IDs and output tags to use 'ci_metadata' instead of 'metadata'. Modified the goreleaser command to skip signing instead of snapshot signing based on the branch condition. Updated the container version used in the test-controller-api job from v1.7 to v1.8. Added handling for a new 'cache_db' output and included it in Docker compose commands. Introduced a new job 'distroless' to build distroless images of Tyk gateway. +66/-8    Dockerfile.distroless New Dockerfile for Distroless Tyk Gateway Images                  ci/Dockerfile.distroless Created a new Dockerfile for building distroless images of Tyk gateway. Uses multi-stage builds starting from 'debian:bookworm-slim' and transitioning to 'gcr.io/distroless/base-debian12:nonroot'. Copies the Tyk gateway application from the build stage to the distroless stage. +20/-0

---

💡 PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[github-actions]

API Changes

no api changes detected

[github-actions]

PR Description updated to latest commit (e840e35)

[github-actions]

PR Review 🔍

⏱️ Estimated effort to review [1-5]	4, due to the complexity and breadth of changes across multiple configuration files and Docker setups, which require careful validation to ensure they don't introduce regressions or configuration errors.
🧪 Relevant tests	No
⚡ Possible issues	Possible Bug: The condition in the goreleaser command might fail due to incorrect syntax. The logical operator might not work as expected in the shell script within the YAML configuration.
	Configuration Error: The docker compose commands have been updated to include a new file ${{ matrix.cache_db }}.yml which might not exist or be properly configured, leading to runtime errors.
🔒 Security concerns	No

Code feedback:

---

relevant file	.github/workflows/release.yml
suggestion	Consider verifying the existence and correct configuration of ${{ matrix.cache_db }}.yml before using it in docker compose commands to avoid runtime errors. [important]
relevant line	docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.db }}.yml -f ${{ matrix.cache_db }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d

---

relevant file	.github/workflows/release.yml
suggestion	Review and test the conditional logic in the goreleaser command to ensure it executes correctly under all branch conditions. [important]
relevant line	goreleaser release --clean -f ${{ matrix.goreleaser }} ${{ !startsWith(github.ref, 'refs/tags/') && ' --snapshot --skip=sign' || '' }}' | tee /tmp/build.sh

---

relevant file	.github/workflows/release.yml
suggestion	Ensure that all necessary labels and tags are correctly applied in the distroless_metadata step to maintain consistency and traceability of Docker images. [medium]
relevant line	id: distroless_metadata

---

relevant file	ci/Dockerfile.distroless
suggestion	Validate the multi-stage Dockerfile to ensure that all dependencies and configurations are correctly copied from the DEB stage to the distroless base image to prevent runtime issues. [important]
relevant line	COPY --from=DEB /opt/tyk-gateway /opt/tyk-gateway

---

[github-actions]

PR Code Suggestions ✨

Category	Suggestion	Score
Possible bug	Correct the flag in the goreleaser command to ensure proper functionality Ensure that the conditional logic for the goreleaser command is correctly formatted. The original command used --skip-sign while the new command uses --skip=sign. Verify which one is correct as they might have different implications. .github/workflows/release.yml [86] -goreleaser release --clean -f ${{ matrix.goreleaser }} ${{ !startsWith(github.ref, 'refs/tags/') && ' --snapshot --skip=sign' || '' }}' | tee /tmp/build.sh +goreleaser release --clean -f ${{ matrix.goreleaser }} ${{ !startsWith(github.ref, 'refs/tags/') && ' --snapshot --skip-sign' || '' }}' | tee /tmp/build.sh Suggestion importance[1-10]: 10 Why: The suggestion correctly identifies a critical typo in the goreleaser command that affects its functionality. Correcting --skip=sign to --skip-sign is crucial for the intended behavior of the command.	10
Enhancement	Add validation for the new cache_db output to ensure it is properly set The new cache_db output and matrix variable have been added without corresponding validation or error handling. Consider adding checks to ensure that these values are set and valid before they are used in the workflow. .github/workflows/release.yml [171] cache_db: ${{ steps.params.outputs.api_cache_db }} +if: ${{ steps.params.outputs.api_cache_db != '' }} Suggestion importance[1-10]: 7 Why: Adding validation for the cache_db output is a good practice to ensure it is properly set before use, enhancing the robustness of the workflow.	7
Best practice	Add error handling for conditional steps in the distroless job The introduction of the distroless job includes multiple steps that conditionally execute based on the presence of a tag. Ensure that these conditions are necessary and that there is fallback or error handling for cases where the conditions are not met. .github/workflows/release.yml [374-377] - name: Login to DockerHub if: startsWith(github.ref, 'refs/tags') uses: docker/login-action@v3 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} + else: + run: echo "Skipping DockerHub login as no tag is present" Suggestion importance[1-10]: 6 Why: The suggestion to add error handling for conditional steps is a good practice, especially for steps that depend on the presence of a tag. It improves the reliability of the workflow.	6
Possible issue	Verify compatibility of ubuntu:xenial with current dependencies The addition of ubuntu:xenial to the distro matrix might introduce compatibility issues with newer software dependencies. Verify that all dependencies are supported on ubuntu:xenial or consider removing it if not compatible. .github/workflows/release.yml [426] -- ubuntu:xenial +# - ubuntu:xenial # Uncomment if compatibility is confirmed Suggestion importance[1-10]: 5 Why: While the suggestion to verify compatibility of ubuntu:xenial is valid, it is more of a precautionary measure rather than fixing an immediate issue. It's important but not critical unless incompatibility is proven.	5

[github-actions]

💥 CI tests failed 🙈

git-state

all ok

Please look at the run or in the Checks tab.

[github-actions]

💥 CI tests failed 🙈

git-state

all ok

Please look at the run or in the Checks tab.

[github-actions]

💥 CI tests failed 🙈

git-state

all ok

Please look at the run or in the Checks tab.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud