Bitbucket Pipelines

Bitbucket Pipelines is a hosted, distributed continuous integration service used to build and test software projects hosted on Atlassian Bitbucket.

This how-to will provide a basic understanding of how add the Relyance Source Code inspector (SCI) into a typical build job.

Prerequisites:

1. A source code repository needs to be available in Bitbucket.
2. Pipelines need to be enabled in Bitbucket.
3. The relyance.yaml file needs to be in the source code root directory.
4. Grab the command line code from Step 2 of the Relyance Source Code Integration settings from your Relyance instance.

See more info about the SCI commands here.

Steps:

1. Log in to Bitbucket.
2. Go to the source code repository project in question.
3. Click on Pipelines in the left-hand navigation menu.
4. If there is no config, create a new bitbucket-pipelines.yml file with the following configuration:

image: atlassian/default-image:3

definitions:
  services:
    docker:
      memory: 7128

pipelines:
  default:
    - parallel:
      - step:
          name: 'Relyance Scan'
          size: 2x
          services:
            - docker
          script:
            - docker pull gcr.io/relyance-ext/compliance_inspector:release && docker run --rm -v `pwd`:/repo --env 'API_KEY=example:abcdefg0123456789abcdefg0123456789abcdefg'  gcr.io/relyance-ext/compliance_inspector:release

Use the command line found in your source code integration Step 2. This configuration file increases the default docker memory and resource size of your Bitbucket Pipeline. 5. If there is already a configuration file, integrate the relevant commands into it:

image: atlassian/default-image:3
definitions:   services:     docker:       memory: 7128
pipelines:
  default:
    - parallel:
      - step:
          name: 'Build and Test'
          script:
            - echo "Your build and test goes here..."
      - step:
          name: 'Lint'
          script:
            - echo "Your linting goes here..."
      - step:
          name: 'Security scan'
          script:
            - echo "Your security scan goes here..."
      - step:
          name: 'Relyance Scan'           image: atlassian/default-image:3          size: 2x           services:             - docker
          script:
            - docker pull gcr.io/relyance-ext/compliance_inspector:release && docker run --rm -v `pwd`:/repo --env 'API_KEY=example:abcdefg0123456789abcdefg0123456789abcdefg'  gcr.io/relyance-ext/compliance_inspector:release

    # The following deployment steps will be executed for each pipeline run. To configure your steps and conditionally deploy see https://support.atlassian.com/bitbucket-cloud/docs/configure-bitbucket-pipelinesyml/
    - step:
        name: 'Deployment to Staging'
        deployment: staging
        script:
          - echo "Your deployment to staging script goes here..."
    - step:
        name: 'Deployment to Production'
        deployment: production
        trigger: 'manual'
        script:
          - echo "Your deployment to production script goes here..."

6. Once complete,click Commit file to save your Bitbucket Pipelines configuration file to the root of your repository.
7. This should trigger the pipeline, if not run it manually.
8. Go to your Pipeline dashboard to see your pipeline progress.
9. If there are no errors, you should start to see SCI results in your Relyance tenant.

Appendix:

Source Code Integration Step 2 info:

Example Step 2 Command

1. This command pulls the latest version of the Relyance Source Code Inspector.
2. This command initiates the Relyance Source Code Inspector within a local Docker container, establishing a shared folder and providing the necessary tenant API credentials.