Bitbucket

Guide on integrating Bitbucket with Ketryx

1. Introduction

This section provides an introduction to the integration of Bitbucket with Ketryx. Our focus is on outlining the process of setting up this integration, utilizing App Passwords and Repository Access Tokens, to enhance your software development practices. This guide will walk you through the steps required to establish a connection between Bitbucket and Ketryx.

1.2. Tools

Tools used to develop and release a product with Ketryx Lifecycle Management are provided in MAN-01 Ketryx Lifecycle Management. The release process is described in detail in MAN-02 Software Release Process, while setting up code repositories is described in MAN-03 Supply Chain Management.

2. Repository access

The integration process with Bitbucket varies slightly depending on whether you are working with public or private repositories. Here's a breakdown of the key differences:

2.1. Public Repositories

• Accessibility: Public repositories are open to the public, meaning that anyone can view the repository content and its history.

• Integration Setup: For public repositories, the setup process for integrating with Ketryx is generally straightforward. You do not need to use a access tokens for basic integration tasks, such as SOUP dependency analysis.

• Data Retrieval: Accessing publicly available data from Bitbucket, like pull requests or code changes still requires a Repository Access Token to access Bitbucket's API.

2.2. Private Repositories

• Accessibility: Private repositories restrict access to authorized individuals or collaborators. Only those with permission can view and interact with the repository.

• Integration Setup: When integrating with private repositories, you typically require an access token. This token ensures secure and authorized communication between Bitbucket and Ketryx for tasks like SOUP dependency analysis and Code Change Reviews.

Ketryx supports SOUP dependency analysis using an App Password for private repositories. However, we recommend using a Repository Access Token for this purpose, as this type of token can be restricted to a single repository, while an App Password has access to all repositories in the account. Additionally, only by using the Repository Access Token can you access Code Change Reviews.

It's important to consider your repository's visibility when setting up the integration, as public and private repositories have distinct access requirements. The integration guide provides specific instructions based on the type of repository you are working with, ensuring a seamless and secure integration experience.

3. Access tokens

3.1. Creating a Repository Access Token for Bitbucket

A guide on how to create such a token can be found here.

The same authentication method is used to fetch the Git repository (for SOUP dependency analysis) as well.

The repository access token needs to have at least the following permissions:

1. Repository: Read

2. Pull requests: Read

When entering the authentication credentials in Ketryx, set the following:

1. Username: x-token-auth (as a verbatim value, as documented here)
2. Password: (the access token)

3.2. Creating an App Password for Bitbucket

Please see Bitbucket's documentation for information on how to create an App Password.

When entering the authentication credentials in Ketryx, the username has no effect, but the password should be the App Password.

Ketryx supports SOUP dependency analysis using an App Password for private repositories. Only by using the Repository Access Token can you access Code Change Reviews as well. See 2.2. Q: How do I create a Repository Access Token for Bitbucket? for more information.

4. Related features

4.1. Using the Code Change Review feature with Bitbucket

For information on how to use the Code Change Review feature, please see the guide on Code Change Reviews using Ketryx.