Bitbucket Pipelines

Documentation Index

Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

​

Features

• 🛡️ Automated security and code quality scanning
• 🔍 Deep code analysis and vulnerability detection
• 📊 Detailed reports and insights
• ⚡ Fast and easy integration

​

Setup

​

1. Get Your Access Token

1. Go to your repository Settings
2. Navigate to Security > Access tokens
3. Click Create repository access token
4. Select permissions:
   • Repositories: Read, Write (allow repository read/write access)
   • Pull requests: Read, Write (allow pull request read/write access)
5. Copy the generated token

1. Go to your workspace Settings
2. Navigate to Security > Access tokens
3. Click Create workspace access token
4. Select the same permissions as above
5. Copy the generated token

Note: Do not use an Atlassian API Token (generated at id.atlassian.com) — that token authenticates with Jira Cloud, Confluence Cloud, and Jira Align only, and will not work with Bitbucket. See Atlassian docs. Use a Bitbucket Repository Access Token or Workspace Access Token instead.

​

2. Configure Repository Variables

• BITBUCKET_ACCESS_TOKEN - Your Bitbucket Repository Access Token (set this as a repository variable). Note: pipeline examples reference ACCESS_TOKEN — ensure you assign ACCESS_TOKEN: $BITBUCKET_ACCESS_TOKEN in your pipeline steps or set ACCESS_TOKEN directly as a repository variable.

​

Basic Usage

​

Example 1: Run CI Scan on Every Push

image: atlassian/default-image:3

pipelines:
  default:
    - step:
        name: CodeAnt CI Scan
        script:
          - pipe: docker://public.ecr.aws/d2p9q4a9/ci-scan-codeant:latest
            variables:
              ACCESS_TOKEN: $BITBUCKET_ACCESS_TOKEN

​

Example 2: Run CI Scan on Pull Requests Only

image: atlassian/default-image:3

pipelines:
  pull-requests:
    '**':
      - step:
          name: CodeAnt CI Scan
          script:
            - pipe: docker://public.ecr.aws/d2p9q4a9/ci-scan-codeant:latest
              variables:
                ACCESS_TOKEN: $BITBUCKET_ACCESS_TOKEN
                API_BASE: "https://api.codeant.ai"

​

Example 3: Branch-Specific Scanning

image: atlassian/default-image:3

pipelines:
  branches:
    main:
      - step:
          name: CodeAnt CI Scan
          script:
            - pipe: docker://public.ecr.aws/d2p9q4a9/ci-scan-codeant:latest
              variables:
                ACCESS_TOKEN: $BITBUCKET_ACCESS_TOKEN

    develop:
      - step:
          name: CodeAnt CI Scan
          script:
            - pipe: docker://public.ecr.aws/d2p9q4a9/ci-scan-codeant:latest
              variables:
                ACCESS_TOKEN: $BITBUCKET_ACCESS_TOKEN
                EXCLUDE_PATHS: 'tests,experimental'

​

Example 4: Custom File Filtering with Timeout and Scanners

- step:
    name: CodeAnt CI Scan
    script:
      - pipe: docker://public.ecr.aws/d2p9q4a9/ci-scan-codeant:latest
        variables:
          ACCESS_TOKEN: $BITBUCKET_ACCESS_TOKEN
          API_BASE: 'https://api.codeant.ai'
          SCANNERS: 'sast,secrets'
          INCLUDE_PATHS: 'src,lib'
          EXCLUDE_PATHS: 'tests,docs'
          TIMEOUT: '900'              # 15 minutes
          POLLING_INTERVAL: '45'      # Poll every 45 seconds

​

Example 5: Manual Trigger Pipeline

image: atlassian/default-image:3

pipelines:
  custom:
    security-scan:
      - step:
          name: CodeAnt CI Scan
          script:
            - pipe: docker://public.ecr.aws/d2p9q4a9/ci-scan-codeant:latest
              variables:
                ACCESS_TOKEN: $BITBUCKET_ACCESS_TOKEN

​

Configuration Variables

​

Scanner Options

• sast - Static Application Security Testing (code vulnerabilities)
• sca - Software Composition Analysis (dependency vulnerabilities)
• secrets - Secret detection (API keys, passwords, tokens)
• antipatterns - Code quality and duplicate code detection
• iac - Infrastructure as Code security (Terraform, CloudFormation, etc.)
• all - Run all available scanners

• Run all scanners: SCANNERS: 'all'
• Only SAST: SCANNERS: 'sast'
• SAST + Secrets: SCANNERS: 'sast,secrets'
• Full security suite: SCANNERS: 'sast,sca,secrets,iac'

​

Scanner Configuration Examples

​

Run All Scanners

- step:
    name: CodeAnt CI Scan (All Scanners)
    script:
      - pipe: docker://public.ecr.aws/d2p9q4a9/ci-scan-codeant:latest
        variables:
          ACCESS_TOKEN: $BITBUCKET_ACCESS_TOKEN
          SCANNERS: 'all'

​

Security-Focused Scan

- step:
    name: CodeAnt CI Scan (Security Only)
    script:
      - pipe: docker://public.ecr.aws/d2p9q4a9/ci-scan-codeant:latest
        variables:
          ACCESS_TOKEN: $BITBUCKET_ACCESS_TOKEN
          SCANNERS: 'sast,secrets'

​

How It Works

1. Download script We fetch a small Bash helper (start_scan.sh) from the CodeAnt CI endpoint.
2. Make it runnable Mark the script executable so you can invoke it directly.
3. Invoke the scan The script POSTs your repo, commit, and file-globs to /analysis/ci/scan, using your token for auth.
4. Pipeline feedback
   • On success, you’ll see a parsed JSON response in the job log.
   • On failure (non-2xx HTTP), the script exits non-zero, failing your pipeline immediately.

​

Execution Time Considerations

• Default behavior (with result waiting): ~5-7 minutes
  • Triggers scan and waits for complete analysis results
  • Includes both security and SCA (Software Composition Analysis) results
  • Best for comprehensive CI/CD pipelines where you need immediate feedback
• Custom timeout settings: Adjust based on repository size
  • Use TIMEOUT: '900' (15 minutes) for larger repositories
  • Use POLLING_INTERVAL: '45' to reduce API polling frequency
  • Results can also be viewed in the CodeAnt dashboard

​

Troubleshooting

​

Pipeline Fails Immediately

​

Scan Failures

​

Authentication Errors

​

Pipe Not Found

​

Support

• 📧 Email: support@codeant.ai
• 📚 Documentation: https://docs.codeant.ai
• 🐛 Repository: https://bitbucket.org/codeantworkspace/ci-scan-codeant/src/main/

​

License