Bitbucket Pipelines

​

Bitbucket Pipelines Workflow

image: python:3.11

pipelines:
  default:
    - step:
        name: Quality Gate Scan
        script:
          # Set up environment
          - export API_BASE="https://api.codeant.ai"
          
          # Fetch quality gates script
          - echo "Fetching quality gates script..."
          - curl -sS -X GET "${API_BASE}/analysis/ci/quality-gates/script/get" \
              --output quality_gates.sh.b64
          
          # Make script executable
          - base64 -d quality_gates.sh.b64 > quality_gates.sh
          - chmod +x quality_gates.sh
          
          # Start Quality Gate Scan
          - echo "Starting quality gate scan..."
          - ./quality_gates.sh \
              -a "${ACCESS_TOKEN}" \
              -r "${BITBUCKET_REPO_FULL_NAME}" \
              -c "${BITBUCKET_COMMIT}" \
              -s bitbucket \
              -o start
          - echo "Quality gate scan initiated successfully"
          
          # Poll for Quality Gate Results
          - echo "Polling for quality gate results..."
          - ./quality_gates.sh \
              -a "${ACCESS_TOKEN}" \
              -r "${BITBUCKET_REPO_FULL_NAME}" \
              -c "${BITBUCKET_COMMIT}" \
              -s bitbucket \
              -o results \
              -t 300 \
              -p 15
          
          # Display status
          - echo " Quality Gate PASSED - No secrets detected"

Important:

• Define an ACCESS_TOKEN secured Repository variable with a personal access token or repo token (Settings -> Repository settings -> Repository variables).
• Bitbucket Pipelines automatically provides BITBUCKET_REPO_FULL_NAME (e.g. org/repo) and BITBUCKET_COMMIT (current SHA).

​

How it works

1. Download script
   We fetch the quality gates script (quality_gates.sh) from the CodeAnt API endpoint.
2. Start scan
   The script initiates a quality gate scan for your commit using the -o start operation.
3. Poll for results
   The script polls for scan results using the -o results operation with:
   • Timeout: 300 seconds (5 minutes)
   • Poll interval: 15 seconds
4. Pipeline feedback
   • Success: Quality gate passes if no secrets are detected
   • Failure: Quality gate fails if secrets are found, blocking the build

​

Script Parameters

​

Quality Gate Checks

​

Secret Detection

• Scans for hardcoded secrets, API keys, passwords, and tokens
• Analyzes only the changed lines since your merge base commit
• Uses high-confidence detection to minimize false positives
• Blocks the build if any secrets are found

​

Best Practices

1. Run on all branches: Quality gates should run on every push to catch issues early
2. Block merges: Configure merge checks to require quality gate pipeline success before merging
3. Review failures: When quality gates fail, review the detected issues immediately
4. Keep tokens secure: Never commit access tokens directly - always use Repository Variables
5. Use secured variables: Mark your ACCESS_TOKEN as secured in Repository Variables

​

Troubleshooting

​

Quality gate times out

• Increase the timeout using -t 600 (10 minutes)
• Check if the CodeAnt service is operational
• Consider optimizing your repository size

​

Authentication failures

• Verify your ACCESS_TOKEN variable is correctly configured in Repository settings
• Ensure the token has appropriate repository permissions
• Check that the variable is marked as secured

​

No results returned

• Check that quality gates are enabled for your repository in CodeAnt
• Verify the commit SHA is correct
• Ensure your Bitbucket workspace has proper integration with CodeAnt

​

Pipeline fails silently

• Add set -e at the beginning of your script to fail on any error
• Add error handling:
  Copy

  - ./quality_gates.sh ... || { echo "Quality gate failed!"; exit 1; }
  

​

Bitbucket Environment Variables