LogoLogo
WebsiteBlog
  • OpenText Core Software Composition Analysis (SCA) Documentation
  • Overview
    • Getting started
      • Create a OpenText Core SCA account
      • Running OpenText Core SCA
    • Help
      • Frequently asked questions (FAQ)
      • Upgrade your account
      • Get help in OpenText Core SCA tool
    • Language support
      • C# - Nuget, Paket
      • CycloneDX SBOM
      • Go - Go Modules, Go Dep, Bazel
      • Java & Kotlin - Gradle, Maven, Bazel
      • JavaScript - NPM, Yarn, Bower
      • Objective-C - CocoaPods
      • PHP - Composer
      • Python - Pip, Pipenv
      • Ruby - RubyGems
      • Rust - Cargo
      • Swift - CocoaPods
      • Linux package managers
      • Scala - SBT
    • Security overview
  • Product
    • Vulnerability management
      • Security terms
      • Data sources
      • See your data
      • Pull Requests (PR)
        • Enable Pull Request support
        • Solve vulnerabilities using Pull Requests (PR)
        • Solve vulnerabilities using Pull Requests (PR) via API
      • Set a review status
        • Snooze or pause a review status
      • Reachability Analysis
        • Set up Reachability Analysis for Java
        • Set up Reachability Analysis for Go
      • Solve vulnerabilities manually with root fixes
    • License risk management
      • Licence families
      • License risks
      • Set up a use case
        • Set up a use case using API
      • Proxy non-standard license identifiers
    • Project health
      • Contributors
      • Popularity
      • Security
    • Open source select
      • Search projects
      • Compare projects
      • View more details
      • Start left policies
      • OpenText Core SCA Select Browser Extension
      • End of Life (EOL)
    • Automation
      • Create an automation rule
      • Edit an automation rule
      • Default automation rules
      • Set up webhooks
      • Policies
      • Monitoring
    • Exporting or SBOM
      • Overview
      • License export
      • Vulnerability export
      • SBOM export
        • CycloneDX SBOM export
        • SPDX SBOM export
    • Administration
      • Generate access token
      • Account
        • Change your password
        • Delete your account
        • Delete company account
      • Billing
        • Manage contributing developers
        • Manage billing frequency
        • Manage payment methods
        • Access invoices
        • Manage your subscription
      • Settings
        • Enable and disable snoozing vulnerabilities
        • Supported language for OpenText Core SCA tool
        • View logged events
        • Two-Factor Authentication (2FA)
      • Users
        • User roles (freemium and premium)
        • Role-Based Access Control (Enterprise)
        • Manage users
          • Add a new user
      • Repositories
        • Default Branch
        • Repository groups
        • Manually upload a dependency file
        • Manage your commits
  • Tools & Integrations
    • Command Line Interface (CLI)
      • OpenText Core SCA CLI
        • High performance scans
        • File fingerprinting
      • Legacy CLI
    • CI/CD integrations
      • GitHub
      • CircleCI
      • BuildKite
      • GitLab
      • Bitbucket
      • Azure DevOps
      • Argo workflows
      • Travis CI
      • Jenkins
      • Bamboo
      • TeamCity
    • Fortify on Demand (FoD)
    • Fortify Software Security Center (SSC)
    • OpenText Core SCA APIs
      • Open source select API
    • Integrated Development Environments (IDEs)
    • Single Sign-On (SSO)
      • Single Sign-On (SSO) through Okta
      • Single Sign-On (SSO) through Microsoft Entra ID
      • Single Sign-On (SSO) through JumpCloud OIDC
      • Single Sign-On (SSO) through GitHub
  • Tips & Tricks
    • OpenText Core SCA CLI migration guide
    • Workarounds
      • Scanning Conan (C++) projects
      • Scanning a repository with different services
      • Scanning Docker images
      • Automations: Do not fail on found CVE lacking a fix
      • Configuring user access using API
Powered by GitBook
LogoLogo

Company

  • Blog

Support

  • Privacy Policy
  • Service Status

Resources

  • Vulnerability DB
  • Open Source Select

© 2018-2024 | Open Text

On this page
  • Integrate a single repository
  • Integrate multiple repositories

Was this helpful?

Export as PDF
  1. Tools & Integrations
  2. CI/CD integrations

Bitbucket

Learn how to integrate OpenText Core SCA with Bitbucket.

Last updated 1 month ago

Was this helpful?

With CI integration to Bitbucket you can upload your latest commits and pull requests to OpenText Core SCA automatically, or whenever you run your pipeline.

Integrate a single repository

  1. Start by generating an access token. Copy the token so that you can use it in the next step.

  2. Configure your DEBRICKED_TOKEN by going to your repository -> Repository settings -> Repository variables.

  3. Paste in the access token from the previous step. Make sure to secure the token, so that it does not show in the logs.

  4. Go to your repository and add the following template to your "bitbucket-pipelines.yml" file (if the file doesn't exist, create one):

  1. Commit your changes to "bitbucket-pipelines.yml" and watch the CI run.

Example output:

For more information on Bitbucket Pipes, please visit https://bitbucket.org/product/features/pipelines

Integrate multiple repositories

Note that this functionality is only available on the Bitbucket Premium plan.

Integrating many repositories with one configuration using Bitbucket can greatly simplify the process of managing and deploying code across multiple projects.

You can set this up with shared pipeline configurations:

Step 1: Create a Workspace variable

To avoid having to add the DEBRICKED_TOKEN to every integrated repository, it is possible to share the Debricked token between repositories. In order to enable this, you need to create a Workspace variable. Note: This can only be done by administrators:

  1. Generate a Debricked access token.

  2. Sign in to your organization.

  3. From your profile avatar, select a workspace.

  4. Click the Settings cog on the top navigation bar.

  5. Click Workspace settings from the Settings drop-down menu.

  6. In the menu on the left, go to Pipelines > Workspace variables.

  7. Add your token to a secured variable called DEBRICKED_TOKEN.

Step 2: Create a repository for the shared pipeline definition

Set up a repository within your workspace for the shared pipeline definition:

  1. Create a new repository in your workspace or enter an already existing one.

  2. Create a "bitbucket pipelines yaml" file and paste the Debricked template contents. By default, the template sets up scanning in this repository as well. It is, however, possible to deactivate this, by removing or commenting out the bottom pipelines definition (rows 17-19):

Step 3: Set up a reference to the shared pipeline definition in the required repositories

The final step is to set up the reference template for all repositories you would like to integrate with Debricked.

  1. Create a "bitbucket pipelines yaml" file in the repository that will reference the shared pipeline definition and paste the contents below.

  2. Adjust the references to point to the repository and branch containing the file created in step 2:

pipelines:
  default:
    running-debricked-scan:
      import: <repository_name>:<branch_name>:debricked-scan
https://github.com/debricked/cli/blob/main/examples/templates/Bitbucket/bitbucket-pipelines.yml
export: true

image:
  name: atlassian/default-image:2

definitions:
  pipelines:
    debricked-scan: &debricked-scan
      - step:
          name: "Debricked Scan"
          script:
            - curl -LsS https://github.com/debricked/cli/releases/download/release-v2/cli_linux_x86_64.tar.gz | tar -xz debricked
            - ./debricked scan
          services:
            - docker
            
pipelines:
  default:
    - <<: *debricked-scan
https://github.com/debricked/cli/blob/main/examples/templates/Bitbucket/bitbucket-pipelines.yml
export: true

image:
  name: atlassian/default-image:2

definitions:
  pipelines:
    debricked-scan: &debricked-scan
      - step:
          name: "Debricked Scan"
          script:
            - curl -LsS https://github.com/debricked/cli/releases/download/release-v2/cli_linux_x86_64.tar.gz | tar -xz debricked
            - ./debricked scan
          services:
            - docker
            
pipelines:
  default:
    - <<: *debricked-scan