Bitbucket Pipelines

1. Add the variable

Create a secret key in Safeguard under Settings → Developer with the scopes scans:trigger and scans:read. In Bitbucket, add it under Repository settings → Repository variables as SAFEGUARD_API_KEY, with Secured on. A workspace variable works too.

2. Add the step

Save this as bitbucket-pipelines.yml (download), or copy the step into the file you have:

definitions:
  steps:
    - step: &safeguard-scan
        name: Safeguard scan
        image: alpine:3.20
        script:
          - apk add --no-cache bash curl ca-certificates
          - curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_INSTALL_DIR=/usr/local/bin bash
          - safeguard ci scan --wait --fail-on critical

pipelines:
  branches:
    main:
      - step: *safeguard-scan
  pull-requests:
    '**':
      - step: *safeguard-scan

No Pipe or Docker image is needed beyond alpine.

Choose the branches

• Under pipelines.branches, add one entry per branch (glob patterns work: 'release/*').
• pull-requests: '**' scans every pull request, whatever its target. Bitbucket matches this pattern against the source branch, so it cannot filter by target. Delete the block to scan pushes only.

The source branch is scanned and its commit names the version.

Options

Troubleshooting

• The file does not validate. Bitbucket allows one definitions and one pipelines key: merge them into the file you have rather than appending a second copy.
• Pull requests from forks. Secured variables are not passed to fork pull requests.
• Other errors: see Troubleshooting.