Skip to content

Add Bitbucket Pipelines and GitLab CI support to dependency scan#34

Open
ofirshtrull wants to merge 16 commits intomainfrom
add-bitbucket-support
Open

Add Bitbucket Pipelines and GitLab CI support to dependency scan#34
ofirshtrull wants to merge 16 commits intomainfrom
add-bitbucket-support

Conversation

@ofirshtrull
Copy link
Copy Markdown
Contributor

@ofirshtrull ofirshtrull commented Apr 2, 2026 •
edited
Loading

Summary

Adds first-class Bitbucket Pipelines and GitLab CI support to the dependency scan package while keeping GitHub/Azure compatibility, and hardens input handling for token/env misconfiguration.

Changes

Bitbucket Pipelines

  • Add Bitbucket platform adapter and platform selector (GitHub / Bitbucket / GitLab / Azure) for CLI execution.
  • Improve input normalization and CI env resolution (Bitbucket URL/branch derivation, generic env compatibility, legacy INPUT_* support).
  • Add token placeholder validation and preflight-style output improvements for easier runtime diagnosis.
  • Update release/docs workflows and examples (examples/github-action.yml, examples/azure-devops.yml, examples/bitbucket-pipelines.yml).

GitLab CI

  • New GitLabCIPlatform (src/platform/gitlab-ci.ts) — implements Platform interface with CI_PROJECT_DIR workspace, .arnica-scan-outputs.env dotenv artifacts, markdown summary, and warnMissingWorkspace diagnostics.
  • Environment detection via isGitLabEnvironment() with correct priority chain (GitHub > Bitbucket > GitLab > Azure).
  • Input fallbacks for CI_REPOSITORY_URL (embedded CI job tokens stripped automatically), CI_PROJECT_URL, CI_COMMIT_BRANCH, CI_MERGE_REQUEST_SOURCE_BRANCH_NAME, and CI_COMMIT_REF_NAME (tag pipelines handled via CI_COMMIT_TAG check).
  • Example pipeline (examples/gitlab-ci.yml) with npx invocation and dotenv report artifacts.
  • Full GitLab CI README section with quickstart, from-source build, env var docs, and troubleshooting.

Tests

  • 60 total tests covering platform detection, input parsing, and platform behavior for all supported CI environments.

Test plan

  • pnpm run build — compiles cleanly
  • node --test tests/*.test.cjs — 60/60 pass
  • Manual GitHub Action run against a sample repo
  • Manual Azure DevOps run against a sample repo
  • Manual Bitbucket Pipelines run against a sample repo
  • Manual GitLab CI pipeline run against deps-scan-gitlab test repo

Reviewer notes

  • Branch includes workflow and documentation updates in addition to runtime code.
  • Auto-version workflow was adjusted to avoid noisy updates from example file changes.

@ofirshtrull
feat: add Bitbucket Pipelines support to dependency scan
64a4609 
This update introduces support for Bitbucket Pipelines in the Arnica dependency scan tool. The following changes were made:

- Updated README.md and CONTRIBUTING.md to include Bitbucket Pipelines usage instructions and prerequisites.
- Introduced a new BitbucketPipelinesPlatform class to handle specific logic for Bitbucket environments.
- Modified input handling to detect Bitbucket-specific environment variables and fallbacks.
- Added tests for Bitbucket Pipelines platform support and input validation.
- Updated package.json description to reflect Bitbucket Pipelines support.
@ofirshtrull
refactor(input): improve Bitbucket URL normalization
e5c0564 
Add function to normalize Bitbucket Cloud URLs to ensure consistency across different URL formats. Remove unused environment variables in pipeline configurations.
@ofirshtrull
feat: enhance Bitbucket environment detection and URL derivation
bb3565e 
- Added support for additional Bitbucket environment variables: BITBUCKET_WORKSPACE, BITBUCKET_REPO_OWNER, and BITBUCKET_REPO_SLUG.
- Updated getBitbucketRepositoryUrlFallback to derive repo URL using workspace and slug when full name is unavailable.
- Added tests to ensure correct URL derivation from workspace and slug.
@ofirshtrull
feat: add support for detecting GitHub and Azure environments
8d6fd30 
Introduce functions to detect GitHub and Azure CI environments.
- Added `isGitHubEnvironment` and `isAzureEnvironment` functions.
- Updated `getValidatedInput` to utilize new GitHub environment detection.
- Enhanced error handling for missing repository URLs in CI environments.
- Updated tests to cover GitHub environment scenarios.
@ofirshtrull
feat: add logging for Arnica Scan Summary in Bitbucket Pipelines
4adc623 
Introduce console logging for the Arnica Scan Summary when writing summaries.
This enhancement helps in debugging by providing immediate feedback in the console.
@ofirshtrull
fix: validate API token to prevent unresolved placeholders
c999a90 
Add a check to ensure the API token does not start with a '$', indicating an unresolved variable placeholder.
Update tests to include this validation scenario.
@ofirshtrull
ci: update auto-version workflow to ignore example files and refactor…
7cc9b74 
… version update logic

The workflow now ignores changes in the 'examples/**' path, preventing unnecessary version bumps for example file modifications.
Refactored the version update logic to handle multiple files, including README.md and any example YAML files, ensuring all relevant files have their version references updated consistently.
@ofirshtrull
style: update API_BASE_URL references in example configs
8bcadf7 
Rename API_BASE_URL to ARNICA_API_BASE_URL in azure-devops.yml and bitbucket-pipelines.yml for consistency.
@ofirshtrull ofirshtrull requested a review from aayachnes April 2, 2026 19:44
@ofirshtrull
test: isolate env between input parsing tests
ba7b508
@ofirshtrull
refactor(input): improve Bitbucket environment detection
a696091 
- Moved isBitbucketEnvironment function to select-platform module to enhance modularity
- Updated to accept process environment as a parameter for better testability
- Removed redundant DEBUG environment variable handling for improved clarity
@ofirshtrull
refactor: modularize environment detection and enhance Bitbucket URL …
50da4dd 
…handling

Extracted isGitHubEnvironment function for reusability and clarity.
Enhanced Bitbucket Server URL construction by using BITBUCKET_SERVER_SCM_PREFIX if provided.
Updated PULL_REQUEST_TEMPLATE, CONTRIBUTING, and README to reflect new build and test expectations.
Added tests for new functionality and refactored existing ones for clarity.
@ofirshtrull
docs: update environment variable names for consistency
4fbe1af 
Renamed environment variables to include 'ARNICA_' prefix for consistency across documentation and examples.
- Updated `SCAN_PATH` to `ARNICA_SCAN_PATH`.
- Updated `SCAN_TIMEOUT_SECONDS` to `ARNICA_SCAN_TIMEOUT_SECONDS`.
- Updated `ON_FINDINGS` to `ARNICA_ON_FINDINGS`.
These changes ensure uniformity in naming conventions, making the configuration more intuitive.
@ofirshtrull
feat: add support for GitLab CI environment
4d771f1 
Introduce `GitLabCIPlatform` class to handle GitLab CI environments.
- Implement functions to retrieve GitLab-specific environment variables.
- Update platform selection logic to include GitLab CI.
- Add helper functions for GitLab repository URL and branch fallback.
@ofirshtrull
feat(gitlab-ci): enhance GitLab CI support with robust environment ha…
198c627 
…ndling and tests

Improved the GitLab CI platform by adding a warning mechanism for missing workspace paths and handling file write errors more gracefully.

- Introduced `warnMissingWorkspace` to notify when `CI_PROJECT_DIR` is unset.
- Enhanced `setOutput` and `writeSummary` to handle file write failures with warnings.
- Updated `getGitLabBranchFallback` for better branch determination.
- Modified `isGitLabEnvironment` to require both `CI_PROJECT_DIR` and `CI_PIPELINE_ID` for detection.
- Added comprehensive test coverage for GitLab CI functionalities, including handling of environment variables and file operations.
@ofirshtrull
docs: add GitLab CI documentation and example pipeline
953c9cd 
Made-with: Cursor
@ofirshtrull ofirshtrull changed the title Add Bitbucket Pipelines support to dependency scan Add Bitbucket Pipelines and GitLab CI support to dependency scan Apr 7, 2026
@ofirshtrull
feat: enhance GitLab CI branch detection and improve error handling
0ab78a3 
- Updated branch detection to use `CI_DEFAULT_BRANCH` as a fallback in tag pipelines for GitLab CI.
- Improved error handling in Bitbucket Pipelines by catching file write errors and logging warnings instead of crashing.
- Added tests to verify new branch detection logic and error handling improvements.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aayachnes aayachnes Awaiting requested review from aayachnes

At least 1 approving review is required to merge this pull request.

Assignees

@aayachnes aayachnes

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@ofirshtrull @aayachnes