TT-17868 fix env-up race + drift-check GOPROXY cache

[rafalgolarz]

Summary

• drift-check: GOPROXY=direct bypasses proxy.golang.org's CDN cache for the @master ref (30 min TTL), so a merge to gromit's master is picked up immediately instead of up to half an hour later.

Why

Confirmed via repeated CI runs pulling a stale gromit version (e.g. an old commit instead of a just-merged one) up to 20+ minutes after merge, matching proxy.golang.org's Cache-Control: public, max-age=1800 header on the @master ref resolution.

Note

This PR originally also included an env-up change (docker compose up --wait) to fix an intermittent Temporary failure in name resolution in tyk-analytics api-tests. That part has been reverted: further investigation (see tyk-analytics PR #6082) showed the actual blocker is keycloak's own healthcheck in tyk-pro's deps_pro-ha.yml consistently exceeding its 10s timeout — keycloak itself starts and imports its realm in ~5.5s every time, confirmed unrelated to wait-timeout tuning (tested 120s/240s) or runner size (tested 8x/16x). The real fix belongs in tyk-pro, not here.

[github-actions]

🎯 Recommended Merge Targets

Based on JIRA ticket TT-17868: Update Tyk components to Go 1.26

Fix Version: Ara 1.33.1

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

Fix Version: Tyk Identity Broker 1.8.0

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

Fix Version: Tyk Sync 2.2.2

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

Fix Version: Tyk Operator 1.5.0

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

Fix Version: Tyk Portal 1.19.0

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

---

📋 Workflow

1. Merge this PR to master first

[probelabs]

This pull request resolves a caching issue in the drift-check workflow that could cause it to run against a stale version of the gromit tool. By setting the GOPROXY=direct environment variable, the workflow now bypasses the Go module proxy's 30-minute cache for the @master reference, ensuring that the latest commit is fetched directly from the source repository. This prevents false-positive drift alerts that occurred when a recently merged change to gromit was not immediately available to the CI job.

Note: A previously included change to address a race condition in the env-up action has been reverted from this PR, as the root cause was identified in an external repository.

Files Changed Analysis

• .github/workflows/drift-check.yml: Modified to add an env block with GOPROXY: direct to the 'Build gromit from master' step. This is the only file changed.

The change is minimal, with only 7 lines of code and comments added to a single CI workflow file.

Architecture & Impact Assessment

• What this PR accomplishes: It increases the accuracy and reliability of the drift-check CI workflow by ensuring it always uses the live master version of the gromit tool, eliminating false negatives caused by CDN caching delays.
• Key technical changes introduced: The GOPROXY environment variable is set to direct for a go install command, altering how Go modules are fetched for this specific step.
• Affected system components: The impact is strictly limited to the drift-check GitHub Actions workflow. There are no changes to production code or other parts of the CI/CD pipeline.

drift-check Dependency Fetching Flow

This diagram illustrates how GOPROXY=direct bypasses the CDN cache to fetch the latest tool version immediately.

sequenceDiagram
    participant CI as drift-check job
    participant GoProxy as proxy.golang.org
    participant GitHub as gromit repository

    group "Before Change (Potential 30-min Delay)"
        CI->>GoProxy: go install gromit@master
        alt "Cache Hit (within 30 min TTL)"
            GoProxy-->>CI: Returns cached (old) commit
        else Cache Miss
            GoProxy->>GitHub: Resolve @master
            GitHub-->>GoProxy: Latest commit
            GoProxy-->>CI: Returns latest commit
        end
    end

    group "After Change (GOPROXY=direct)"
        CI->>GitHub: go install gromit@master
        GitHub-->>CI: Returns latest commit directly
    end

Loading

Scope Discovery & Context Expansion

• The scope of this change is narrow, affecting only the dependency fetching mechanism for the gromit tool within the drift-check workflow.
• This change highlights a tight coupling between this repository's CI and the master branch of the TykTechnologies/gromit repository, where even short delays in propagation are problematic.
• No other files, actions, or workflows are directly impacted. The solution is self-contained within the workflow file.

Metadata

• Review Effort: 1 / 5
• Primary Label: chore

---

Powered by Visor from Probelabs

Last updated: 2026-08-12T23:55:32.560Z | Triggered by: pr_updated | Commit: 0fbbc62

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

\n\n

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

✅ Quality Check Passed

No quality issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-08-12T23:55:17.158Z | Triggered by: pr_updated | Commit: 0fbbc62

💡 TIP: You can chat with Visor using /visor ask <your question>