Skip to main content

Bitbucket Pipelines

This step scans the repository, publishes a JUnit report so findings show in the pipeline's Tests tab, and fails on Critical or High findings.

bitbucket-pipelines.yml
image: ubuntu:24.04

pipelines:
  default:
    - step:
        name: vulkro scan
        script:
          - apt-get update -qq && apt-get install -y -qq curl ca-certificates git
          - curl -fsSL https://dist.vulkro.com/install.sh | bash
          - mkdir -p test-results
          - vulkro scan ci . --format junit > test-results/vulkro-junit.xml

Bitbucket reads JUnit XML from test-results/ automatically, including when the step fails.

Set the secret​

Create a CI key in the customer portal (app.vulkro.com, Settings) and add it as a secured repository variable named VULKRO_ACCOUNT_TOKEN (Repository settings, Repository variables). The scan signs in with it, so no vulkro login step is needed. A CI key works during the 14-day trial and on paid plans, and uses no device seat. See CI keys.

What fails the build​

The ci preset exits 1 when it finds Critical or High findings (or breaks the [quality_gate] thresholds in vulkro.toml, when you set them).

Exit codeMeaning
0No findings at the gate level
1Findings at the gate level, or no licence (license_required on stderr)
2Error: bad arguments, IO failure

Fail only on new findings​

For pull requests, make the scan report-only and gate on what the pull request adds with vulkro gate:

pipelines:
  pull-requests:
    '**':
      - step:
          name: vulkro PR scan
          clone:
            depth: full
          script:
            - apt-get update -qq && apt-get install -y -qq curl ca-certificates git
            - curl -fsSL https://dist.vulkro.com/install.sh | bash
            - mkdir -p test-results
            - vulkro scan ci . --format junit > test-results/vulkro-junit.xml || true
            - git fetch origin "+refs/heads/$BITBUCKET_PR_DESTINATION_BRANCH:refs/remotes/origin/$BITBUCKET_PR_DESTINATION_BRANCH"
            - vulkro gate --base "origin/$BITBUCKET_PR_DESTINATION_BRANCH"

To accept today's findings and fail only on new ones without a base branch, commit the .vulkro-baseline.json that vulkro baseline writes and run vulkro scan ci . --ratchet-strict (it exits 2 when the baseline file is missing).

For a pull request comment, vulkro scan ci . --format bitbucket-pr prints Markdown you can post with the Bitbucket API.

Air-gapped runners​

A runner with no route out uses a licence file instead of a CI key. Add the base64 of your .lic file (base64 -w0 your.lic) as a secured variable named VULKRO_LICENSE_B64, set VULKRO_OFFLINE to 1, and install from your internal mirror. See Offline mode.

If this repository is connected to Vulkro Cloud, pull requests are scanned without any pipeline step: see Pull requests in Vulkro Cloud.

Last updated on