Repository navigation
feat(bitbucket): run a hub on Bitbucket Pipelines - #22
Merged
Merged
Conversation
hubch detects Bitbucket Pipelines (BITBUCKET_BUILD_NUMBER): the hub's fingerprint is bitbucket.org/<repository UUID>, lowercase without braces; --hub-fp and previous_fingerprints also take the UUID in braces, as BITBUCKET_REPO_UUID gives it. A pull request pipeline is pull_request, a branch pipeline (push or custom) a push run. Pipelines names no default branch, so the hub channel reads it, the tip and the visibility through the REST API with TOUCHMARK_PIPELINES_TOKEN, an access token of the hub, before any guard; without it distribute and doctor refuse. distribute and doctor need deployment: touchmark-distribute (BITBUCKET_DEPLOYMENT_ENVIRONMENT). Only Premium deployment permissions keep other branches out of it, and the API does not show them, so write_isolation platform needs security.reason stating them; without it they refuse, and doctor fails the check. doctor --hub-token reads the repository, workspace and deployment variables: a write key outside the deployment fails, one in it is unknown (ok with admin-only deployments). plan --comment keeps one comment in the hub pull request through the Bitbucket API, without HTML and with a link reference definition as its marker; other platforms keep the HTML comment byte for byte. The config takes its implicit provider from Bitbucket Pipelines and from an origin on bitbucket.org. setup bitbucket points at the manual steps. TestTemplatePipelines checks the template's bitbucket-pipelines.yml without Bitbucket: its steps, and that only the deployment steps hold the write key. Docs: getting started on Bitbucket Cloud, CI, providers, security, environment.
Whoever sets the environment touchmark starts in (a CI variable, a custom pipeline run with variables) could change what git does in the hub or a target: GIT_CONFIG_COUNT with core.fsmonitor runs a command on an ordinary read of the index. No git of touchmark's inherits the variables that add config (GIT_CONFIG_COUNT, GIT_CONFIG_KEY_*, GIT_CONFIG_VALUE_*, GIT_CONFIG_PARAMETERS, GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM), name a program git runs (GIT_EXEC_PATH, GIT_SSH*, askpass, GIT_PROXY_COMMAND, GIT_EXTERNAL_DIFF, pagers and editors), write traces, change the template directory, the namespace or the attribute source, or load a library (LD_*, DYLD_*). touchmark's own isolation sets its values through Git.Env and keeps them; the variables that only take config away (GIT_CONFIG_NOSYSTEM, GIT_ATTR_NOSYSTEM, GIT_CEILING_DIRECTORIES) stay. The Bitbucket guide recommends restricting the deployment touchmark-distribute to admins or selected users, not only to the default branch, and lists custom pipeline variables through the API among the points to confirm live.
…lling it unchanged A candidate comment whose content already equalled the new body was reported unchanged before any edit, so someone else's comment that copied the body exactly stood in for touchmark's. Ownership is proven only by an accepted edit: replace the candidate all the same, report unchanged after a 2xx, and move on to the next candidate on 403 or 404.
Bitbucket clones as root (BCLOUD-23217), and the plan step's git fetch writes into the clone's .git: run as the image's user 65532, it may fail. Say what to do and add it to the points to confirm live.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A hub can now live on Bitbucket Cloud and run touchmark in Bitbucket Pipelines. The template's
bitbucket-pipelines.ymlfollows once a release carries this.Bitbucket Pipelines as the hub's CI.
BITBUCKET_BUILD_NUMBER. The hub fingerprint isbitbucket.org/<repository uuid>, lower case without braces.--hub-fpandprevious_fingerprintsalso acceptBITBUCKET_REPO_UUIDas Pipelines gives it.mainbranchthrough the API withTOUCHMARK_PIPELINES_TOKEN, an access token of the hub repository. Without it,distributeanddoctorrefuse.touchmark-distribute, anddistributeanddoctorrequire a step in that deployment.security.write_isolation: platformis accepted on Bitbucket only withsecurity.reasonstating it; otherwise touchmark exits 2. On Free and Standard, usenonewith a reason, orexternal.plan --commentposts one comment on the hub's pull request. Its marker is a Markdown reference definition and the body has no HTML, because Bitbucket escapes HTML. touchmark updates a comment only after a PUT has proven it is its own.doctor --hub-tokenreads where the write key lives: repository, workspace and deployment variables.setup bitbucketpoints to the new guide, Getting started: Bitbucket Cloud.Security, all platforms. The git that the local commands (
check,status,apply, plan's hub reads) run no longer inherits variables that add configuration or run programs:GIT_CONFIG_COUNT,GIT_CONFIG_KEY_*,GIT_CONFIG_VALUE_*,GIT_CONFIG_PARAMETERS,GIT_EXEC_PATH,GIT_SSH_COMMANDand the like. Delivery's git already ran with an allowlisted environment. A test proves that a hostilecore.fsmonitorfrom the environment runs nothing.Tests.
TestTemplatePipelines: it parses the template's pipelines, hands each step its repository and deployment variables, and checks that only the deployment steps see the write key and that the guards hold. It skips until the published template has the file.An independent review found no regressions on GitHub, GitLab, Gitea or Forgejo hubs. Its findings are fixed here.
Not verified live (no account). These are listed in the guide:
git fetchworks in the plan step;