This pull request enables the building of FIPS-compliant Docker images for amd64 and arm64 architectures by using a FIPS-certified base image. To accommodate the s390x architecture, for which a FIPS image is not available, the Dockerfiles are updated to conditionally select the base image using Docker's TARGETARCH build argument. This ensures s390x builds continue to use the standard Debian base images.

To support this, the release workflow and GoReleaser configurations are updated to introduce a parallel build and release pipeline for a new tyk-gateway-fips package and corresponding Docker image.
\

Files Changed Analysis\

• .github/workflows/release.yml: Adds new steps to the release workflow to build, tag, and push a distinct tyk-gateway-fips Docker image, specifically targeting linux/amd64 and linux/arm64.\
• ci/Dockerfile.distroless & ci/Dockerfile.std: These files are modified to use a multi-stage build pattern. They now dynamically select the base image (tykio/dhi-debian-base:trixie-debian13-fips for amd64/arm64 or debian:trixie-slim for s390x) based on the TARGETARCH variable. This allows a single Dockerfile to produce both FIPS and standard images.\
• ci/goreleaser/goreleaser.yml: Introduces new build configurations (fips-amd64, fips-arm64) that use the fips and boringcrypto build tags and the GOEXPERIMENT=boringcrypto environment variable to compile the gateway with FIPS-validated cryptographic modules. It also defines a new nfpms package and publisher for the resulting FIPS artifacts.
  \

Architecture & Impact Assessment\

• What this PR accomplishes: It allows the project to produce FIPS-compliant Tyk Gateway images for amd64 and arm64 platforms, which is a critical requirement for deployment in regulated environments, while maintaining build compatibility for the s390x platform.\
• Key technical changes introduced:\
  • Conditional base image selection within Dockerfiles using ARG TARGETARCH.\
  • A separate build pipeline for FIPS artifacts defined in GitHub Actions and GoReleaser.\
  • Compilation of the Go binary with BoringCrypto via the fips build tag and GOEXPERIMENT=boringcrypto.\
• Affected system components: The primary impact is on the CI/CD build and release pipeline. The runtime of the gateway is also affected for amd64/arm64 builds, as they will now use the BoringCrypto library for all cryptographic operations. The final container image for these architectures will also have a different base OS```mermaid
  graph TD
  subgraph Docker Build Process
  A[Start Multi-Platform Build] --> B{Check TARGETARCH};
  B --|amd64 or arm64|--> C[FROM tykio/dhi-debian-base:trixie-debian13-fips];
  B --|s390x|--> D[FROM debian:trixie-slim];
  C --> E[Build with FIPS Go binary];
  D --> F[Build with Standard Go binary];
  E --> G[FIPS-compliant Image];
  F --> H[Standard Image];
  end

        F --> H[Standard Image];\
    end\
```\
\
## Scope Discovery & Context Expansion\
- The changes are well-contained within the project's build, packaging, and deployment configurations. No core application logic has been modified in this PR.\
- The key runtime change is the compilation with `GOEXPERIMENT=boringcrypto`. A search for explicit `//go:build fips` tags in the source code yielded no results. This indicates that FIPS compliance is achieved implicitly by the Go toolchain replacing standard crypto libraries with their BoringCrypto counterparts when the experiment is enabled, rather than through conditional file compilation.
<!-- visor:section-end id="overview" -->

<!-- visor:thread-end key="TykTechnologies/tyk#7676@e8d99f3" -->

---

*Powered by [Visor](https://probelabs.com/visor) from [Probelabs](https://probelabs.com)*

*Last updated: 2026-01-16T13:15:38.926Z | Triggered by: pr_updated | Commit: e8d99f3*

💡 **TIP:** You can chat with Visor using `/visor ask <your question>`
<!-- /visor-comment-id:visor-thread-overview-TykTechnologies/tyk#7676 -->

Security Issues (3)

Architecture Issues (2)

Performance Issues (1)

Quality Issues (2)

Powered by Visor from Probelabs

Last updated: 2026-01-16T13:15:41.859Z | Triggered by: pr_updated | Commit: e8d99f3

💡 TIP: You can chat with Visor using /visor ask <your question>

API Changes

no api changes detected

🚨 Jira Linter Failed

Commit: e8d99f3
Failed at: 2026-01-16 13:13:39 UTC

The Jira linter failed to validate your PR. Please check the error details below:

failed to validate branch and PR title rules: branch name 'docker-fips' must contain a valid Jira ticket ID (e.g., ABC-123)

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

Quality Gate failed

Failed conditions
4 Security Hotspots

See analysis details on SonarQube Cloud