From a52a53095ae1183d9b7a5c1d4c202e019cbdabe3 Mon Sep 17 00:00:00 2001
From: Rafal Golarz <rafal@tyk.io>
Date: Wed, 12 Aug 2026 21:25:16 +0200
Subject: [PATCH 1/8] TT-17868 fix env-up race + drift-check GOPROXY cache

env-up: docker compose up now uses --wait so master- and slave-datacenter profiles block until their existing healthchecks (dashboard-checker, gateway-checker-*) pass, instead of returning as soon as containers are created. dash-bootstrap.sh has no retry of its own (set -e on the first curl), so without --wait it could hit tyk-analytics before it's actually serving -- this was the root cause of an intermittent 'Temporary failure in name resolution' in tyk-analytics api-tests.

drift-check: GOPROXY=direct bypasses proxy.golang.org's CDN, which caches the @master ref's resolved commit for 30 minutes. Without this, a merge to gromit's master can take up to half an hour to be picked up here, making this check flag false drift against a stale render.
---
 .github/actions/tests/env-up/action.yaml | 8 ++++++--
 .github/workflows/drift-check.yml        | 7 +++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/actions/tests/env-up/action.yaml b/.github/actions/tests/env-up/action.yaml
index de6e59a..734f7bd 100644
--- a/.github/actions/tests/env-up/action.yaml
+++ b/.github/actions/tests/env-up/action.yaml
@@ -103,9 +103,13 @@ runs:
         cat versions.env local.env
         echo "::endgroup::"
         # bring up env, the project name is important
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d --wait --wait-timeout 120
+        # dash-bootstrap.sh has no retry of its own (set -e on the first curl),
+        # so without --wait above it could hit tyk-analytics before it's
+        # actually serving, failing the whole step or leaving the org/user
+        # bootstrap incomplete for the slave gateways started next.
         ./dash-bootstrap.sh http://localhost:3000
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d --wait --wait-timeout 120
         echo "$(cat pytest.env | grep USER_API_SECRET)" >> $GITHUB_OUTPUT
         echo "ts=$(date +%s%N)" >> $GITHUB_OUTPUT
         echo "::group::Docker images"
diff --git a/.github/workflows/drift-check.yml b/.github/workflows/drift-check.yml
index 3ab04f9..47d1998 100644
--- a/.github/workflows/drift-check.yml
+++ b/.github/workflows/drift-check.yml
@@ -37,6 +37,13 @@ jobs:
 
       - name: Build gromit from master
         if: ${{ !contains(github.event.pull_request.labels.*.name, inputs.label_name) }}
+        # GOPROXY=direct bypasses proxy.golang.org's CDN, which caches the
+        # @master ref's resolved commit for 30 minutes (Cache-Control:
+        # max-age=1800). Without this, a merge to gromit's master can take
+        # up to half an hour to be picked up here, making this check flag
+        # false drift against a stale render.
+        env:
+          GOPROXY: direct
         run: go install github.com/TykTechnologies/gromit@master
 
       - name: Check for drift from gromit

From 65907d17c566cbdbdca4014ae0779f82634ff76d Mon Sep 17 00:00:00 2001
From: Rafal Golarz <rafal@tyk.io>
Date: Wed, 12 Aug 2026 21:54:49 +0200
Subject: [PATCH 2/8] TT-17868 bump slave-datacenter --wait-timeout to 240s
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Confirmed via a live test run (tyk-analytics PR #6082 pointed at this
branch) that --wait itself works — the name-resolution race is gone —
but the initial 120s timeout was too short for the slave-datacenter
profile's 6 gateways, each behind a checker with retries: 30 x
interval: 5s (up to ~150s worst case): 'application not healthy after
2m0s'.
---
 .github/actions/tests/env-up/action.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/actions/tests/env-up/action.yaml b/.github/actions/tests/env-up/action.yaml
index 734f7bd..7d0fbab 100644
--- a/.github/actions/tests/env-up/action.yaml
+++ b/.github/actions/tests/env-up/action.yaml
@@ -109,7 +109,11 @@ runs:
         # actually serving, failing the whole step or leaving the org/user
         # bootstrap incomplete for the slave gateways started next.
         ./dash-bootstrap.sh http://localhost:3000
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d --wait --wait-timeout 120
+        # slave-datacenter brings up 6 gateways (2 per mini-datacenter) each
+        # behind its own checker with retries: 30 x interval: 5s — worst case
+        # is close to 150s per service, so give this profile more headroom
+        # than the single-dashboard master-datacenter wait above.
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d --wait --wait-timeout 240
         echo "$(cat pytest.env | grep USER_API_SECRET)" >> $GITHUB_OUTPUT
         echo "ts=$(date +%s%N)" >> $GITHUB_OUTPUT
         echo "::group::Docker images"

From 15cc93b4ad1e6b468589b0b7f580961224e5d86c Mon Sep 17 00:00:00 2001
From: Rafal Golarz <rafal@tyk.io>
Date: Wed, 12 Aug 2026 22:09:30 +0200
Subject: [PATCH 3/8] TT-17868 bump master-datacenter --wait-timeout to 240s

Root-caused the second CI failure: keycloak (start_period: 30s,
retries: 15 x interval: 10s) has a 180s worst-case healthcheck
window on its own, longer than the 120s the master-datacenter wait
was given. Confirmed via a live run (tyk-analytics PR #6082): every
other service reached Healthy, keycloak alone stayed Waiting until
the compose command was killed at the timeout.
---
 .github/actions/tests/env-up/action.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/actions/tests/env-up/action.yaml b/.github/actions/tests/env-up/action.yaml
index 7d0fbab..d334883 100644
--- a/.github/actions/tests/env-up/action.yaml
+++ b/.github/actions/tests/env-up/action.yaml
@@ -103,7 +103,10 @@ runs:
         cat versions.env local.env
         echo "::endgroup::"
         # bring up env, the project name is important
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d --wait --wait-timeout 120
+        # keycloak's own healthcheck (start_period: 30s, retries: 15 x
+        # interval: 10s) has a 180s worst case on its own — give the whole
+        # profile enough headroom to clear that.
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d --wait --wait-timeout 240
         # dash-bootstrap.sh has no retry of its own (set -e on the first curl),
         # so without --wait above it could hit tyk-analytics before it's
         # actually serving, failing the whole step or leaving the org/user

From dd0b5a35d1c3f4747bd3138b33849fe09b22fb8b Mon Sep 17 00:00:00 2001
From: Rafal Golarz <rafal@tyk.io>
Date: Wed, 12 Aug 2026 23:17:00 +0200
Subject: [PATCH 4/8] TT-17868 dump keycloak logs on master-datacenter --wait
 failure

keycloak has consistently failed its healthcheck on every prior test
run regardless of --wait-timeout (120s/240s) or runner size (8x/16x),
which rules out both a timeout-too-short and a CPU/IO-starvation
explanation. Dumping its container logs + health state on failure to
find the actual cause instead of continuing to guess at
timeout/resource tuning.
---
 .github/actions/tests/env-up/action.yaml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/actions/tests/env-up/action.yaml b/.github/actions/tests/env-up/action.yaml
index d334883..a08eb31 100644
--- a/.github/actions/tests/env-up/action.yaml
+++ b/.github/actions/tests/env-up/action.yaml
@@ -106,7 +106,17 @@ runs:
         # keycloak's own healthcheck (start_period: 30s, retries: 15 x
         # interval: 10s) has a 180s worst case on its own — give the whole
         # profile enough headroom to clear that.
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d --wait --wait-timeout 240
+        # DEBUG: keycloak has consistently failed this --wait on every prior
+        # run regardless of --wait-timeout (120s/240s) or runner size
+        # (8x/16x) — dump its logs on failure to find the real cause instead
+        # of continuing to guess at timeout/resource tuning.
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d --wait --wait-timeout 240 || {
+          echo "::group::keycloak logs"
+          docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml logs keycloak
+          echo "::endgroup::"
+          docker inspect keycloak --format '{{json .State.Health}}' || true
+          exit 1
+        }
         # dash-bootstrap.sh has no retry of its own (set -e on the first curl),
         # so without --wait above it could hit tyk-analytics before it's
         # actually serving, failing the whole step or leaving the org/user

From e6d1ec307852916b7f78ce63f0b2a8347a23835d Mon Sep 17 00:00:00 2001
From: Rafal Golarz <rafal@tyk.io>
Date: Wed, 12 Aug 2026 23:33:52 +0200
Subject: [PATCH 5/8] TT-17868 fix keycloak log dump to use plain docker logs

Previous attempt called 'docker compose ... logs keycloak' without
--env-file, so Compose failed re-parsing pro-ha.yml with
'invalid spec: :/conf/: empty section between colons' before it
could even print keycloak's logs. keycloak has a fixed container_name
so 'docker logs keycloak' works directly without needing the compose
project context at all.
---
 .github/actions/tests/env-up/action.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/tests/env-up/action.yaml b/.github/actions/tests/env-up/action.yaml
index a08eb31..1880542 100644
--- a/.github/actions/tests/env-up/action.yaml
+++ b/.github/actions/tests/env-up/action.yaml
@@ -112,7 +112,7 @@ runs:
         # of continuing to guess at timeout/resource tuning.
         docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d --wait --wait-timeout 240 || {
           echo "::group::keycloak logs"
-          docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml logs keycloak
+          docker logs keycloak
           echo "::endgroup::"
           docker inspect keycloak --format '{{json .State.Health}}' || true
           exit 1

From 757a0060d9f077d0bfefc89c7c2941a43774f8f1 Mon Sep 17 00:00:00 2001
From: Rafal Golarz <rafal@tyk.io>
Date: Thu, 13 Aug 2026 00:00:18 +0200
Subject: [PATCH 6/8] Revert env-up --wait experiment

keycloak in the multi-datacenter test env consistently fails its own healthcheck ('Health check exceeded timeout (10s)') regardless of --wait-timeout (120s/240s) or runner size (8x/16x) -- keycloak itself starts and imports its realm in ~5.5s every time, so this isn't a startup-time or resource problem. The real fix belongs in tyk-pro's keycloak healthcheck definition (deps_pro-ha.yml), not here. Reverting env-up to its original form and keeping only the drift-check GOPROXY fix in this PR.
---
 .github/actions/tests/env-up/action.yaml | 25 ++----------------------
 1 file changed, 2 insertions(+), 23 deletions(-)

diff --git a/.github/actions/tests/env-up/action.yaml b/.github/actions/tests/env-up/action.yaml
index 1880542..de6e59a 100644
--- a/.github/actions/tests/env-up/action.yaml
+++ b/.github/actions/tests/env-up/action.yaml
@@ -103,30 +103,9 @@ runs:
         cat versions.env local.env
         echo "::endgroup::"
         # bring up env, the project name is important
-        # keycloak's own healthcheck (start_period: 30s, retries: 15 x
-        # interval: 10s) has a 180s worst case on its own — give the whole
-        # profile enough headroom to clear that.
-        # DEBUG: keycloak has consistently failed this --wait on every prior
-        # run regardless of --wait-timeout (120s/240s) or runner size
-        # (8x/16x) — dump its logs on failure to find the real cause instead
-        # of continuing to guess at timeout/resource tuning.
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d --wait --wait-timeout 240 || {
-          echo "::group::keycloak logs"
-          docker logs keycloak
-          echo "::endgroup::"
-          docker inspect keycloak --format '{{json .State.Health}}' || true
-          exit 1
-        }
-        # dash-bootstrap.sh has no retry of its own (set -e on the first curl),
-        # so without --wait above it could hit tyk-analytics before it's
-        # actually serving, failing the whole step or leaving the org/user
-        # bootstrap incomplete for the slave gateways started next.
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d
         ./dash-bootstrap.sh http://localhost:3000
-        # slave-datacenter brings up 6 gateways (2 per mini-datacenter) each
-        # behind its own checker with retries: 30 x interval: 5s — worst case
-        # is close to 150s per service, so give this profile more headroom
-        # than the single-dashboard master-datacenter wait above.
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d --wait --wait-timeout 240
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d
         echo "$(cat pytest.env | grep USER_API_SECRET)" >> $GITHUB_OUTPUT
         echo "ts=$(date +%s%N)" >> $GITHUB_OUTPUT
         echo "::group::Docker images"

From 9effa5e21af0fbd9bde91818fce134a5b1f1797d Mon Sep 17 00:00:00 2001
From: Rafal Golarz <rafal@tyk.io>
Date: Thu, 13 Aug 2026 00:35:43 +0200
Subject: [PATCH 7/8] TT-17868 re-add --wait to env-up now that keycloak
 healthcheck is fixed

Reverting was correct at the time -- keycloak's healthcheck was
hanging regardless of --wait-timeout, so --wait alone couldn't help.
Now that tyk-pro's TT-17868_fix_keycloak_healthcheck_timeout branch
fixes the actual healthcheck (adds Connection: close), re-adding
--wait (no custom timeout needed -- Compose's default is generous)
to verify both fixes together resolve the original
'Temporary failure in name resolution' in tyk-analytics api-tests.
---
 .github/actions/tests/env-up/action.yaml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/actions/tests/env-up/action.yaml b/.github/actions/tests/env-up/action.yaml
index de6e59a..4093720 100644
--- a/.github/actions/tests/env-up/action.yaml
+++ b/.github/actions/tests/env-up/action.yaml
@@ -103,9 +103,14 @@ runs:
         cat versions.env local.env
         echo "::endgroup::"
         # bring up env, the project name is important
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d
+        # --wait requires TykTechnologies/tyk-pro's keycloak healthcheck fix
+        # (TT-17868_fix_keycloak_healthcheck_timeout / Connection: close) --
+        # without it, keycloak's healthcheck hangs until Docker's own 10s
+        # timeout on every attempt even though keycloak itself is fully up,
+        # so --wait never returns cleanly.
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d --wait
         ./dash-bootstrap.sh http://localhost:3000
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d --wait
         echo "$(cat pytest.env | grep USER_API_SECRET)" >> $GITHUB_OUTPUT
         echo "ts=$(date +%s%N)" >> $GITHUB_OUTPUT
         echo "::group::Docker images"

From 0fbbc625cab246f75686a9fb9c5c6c2d9e39640e Mon Sep 17 00:00:00 2001
From: Rafal Golarz <rafal@tyk.io>
Date: Thu, 13 Aug 2026 01:52:35 +0200
Subject: [PATCH 8/8] Revert --wait in env-up, keep only the GOPROXY
 drift-check fix

--wait is incompatible with the one-shot barrier containers
(wait_db/wait_tyk_components) used in tyk-pro's compose setup: they're
designed to exit 0 once their depends_on condition is satisfied, but
--wait treats any non-running/non-healthy exit as a failure. Simplifying
this PR to just the drift-check GOPROXY fix, which is unrelated and
safe on its own.
---
 .github/actions/tests/env-up/action.yaml | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/.github/actions/tests/env-up/action.yaml b/.github/actions/tests/env-up/action.yaml
index 4093720..de6e59a 100644
--- a/.github/actions/tests/env-up/action.yaml
+++ b/.github/actions/tests/env-up/action.yaml
@@ -103,14 +103,9 @@ runs:
         cat versions.env local.env
         echo "::endgroup::"
         # bring up env, the project name is important
-        # --wait requires TykTechnologies/tyk-pro's keycloak healthcheck fix
-        # (TT-17868_fix_keycloak_healthcheck_timeout / Connection: close) --
-        # without it, keycloak's healthcheck hangs until Docker's own 10s
-        # timeout on every attempt even though keycloak itself is fully up,
-        # so --wait never returns cleanly.
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d --wait
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d
         ./dash-bootstrap.sh http://localhost:3000
-        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d --wait
+        docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d
         echo "$(cat pytest.env | grep USER_API_SECRET)" >> $GITHUB_OUTPUT
         echo "ts=$(date +%s%N)" >> $GITHUB_OUTPUT
         echo "::group::Docker images"