Bitbucket CI/CD for iOS (Flutter): “Keychain Not Found” During Git Clone

[Sebastijan Kokai]

I’m working on a CI/CD pipeline for a Flutter project. I managed to create the pipeline for Android and Web, but I’m having issues with setting up the pipeline for the iOS platform. The company I’m working at has its own Mac Mini on which the build should run. The build and deployment work fine when the Mac Mini manages to pass the “git clone” part, which is the first step in the process.

What happens is, when it tries to “git clone” the project the Mac Mini gets this dialog “Keychain not found - A keychain cannot be found to store ‘x-token-auth’”

So if I press the cancel button, it continues working as expected.

I tried giving permission to all apps in the keychain to the bitbucket.org internet password, but nothing changed. I tried unlocking the system and login keychain, also no change.

There is a magic workaround and it works with that (I can’t find the source from where I got this from):

“

…Remove the account.

…Quit Xcode.

defaults write com.apple.dt.Xcode DVTDeveloperAccountUseKeychainService_2 -bool NO

…Restart Xcode, and re-add the account.

”

After doing the steps above, it doesn’t work immediately, I need to stop using the Mac Mini for 24+ hours and then it magically works (I tried after 12 hours, but it didn’t work).

However, the pipeline stopped working because of an available update for the macOS runner “The version of this runner is outdated. Upgrade to the latest version (3.1.0).”, and after the update, I had to use the workaround again.

Is there some solution to my problem that isn’t a hack? If someone has any idea why is it working with the solution above, that would be also helpful.

macOS version: 14.5

[Syahrul]

G'day, @Sebastijan Kokai 

Welcome to the community!

I believe I have encountered this issue before. From what I understand, it occurs because your Mac is attempting to save a password to Keychain Access. However, since the runner doesn't extract any authentication password from Keychain (as it uses OAuth and secrets derived from the configuration on the UI), we believe this is more of an environment issue, which is unfortunately outside our expertise.

This is further proven by the fact that when you hit "Cancel" on the Keychain prompt, the runner continues to work as expected.

Regards,
Syahrul

[Sebastijan Kokai]

Hi @Syahrul,

Thank you for your response!

I was able to work around the issue by using: 

git config --system credential.helper store

However, I’m concerned about its security implications since it stores credentials in plaintext, so I’d like to switch to SSH authentication instead.

I came across this Bitbucket documentation, and I noticed some conflicting information:

• It states that Bitbucket Pipelines SSH keys are not supported for MacOS runners.
• However, the same page also includes a section on setting up SSH keys for authentication.

Could you clarify whether MacOS runners can be configured to use SSH for cloning?

• If SSH is supported, what’s the best way to set it up so that Git automatically uses SSH instead of HTTPS in the pipeline?
• If SSH is not supported for the initial git clone, is there a recommended approach to securely handle Git authentication without storing credentials in plaintext?

I appreciate any guidance you can provide!

Thanks,

Sebastijan Kokai

[Syahrul]

Hey @Sebastijan Kokai 

We don't support the native pipeline SSH key found under your repository settings > Pipelines > SSH Keys. Instead, our documentation provides a workaround for using SSH keys by passing them through variables. Please note that these two methods are entirely different.

To answer your questions, no, it's not possible to configure the runner to clone the repository during the build setup via SSH connection. We only support HTTPS connection at this moment.

I hope this helps.

Regards,
Syahrul

[Sebastijan Kokai]

Hi @Syahrul ,

Thanks for the clarification. Since SSH cloning isn’t supported, what’s the best secure alternative to handle authentication for the initial git clone?

The workaround I found isn't ideal since it stores credentials in plaintext. Is there a more secure way to handle this on a self-hosted macOS runner?

Regards,
Sebastijan

[Syahrul]

Hi Sebastijan,

Unfortunately, there's no alternative solution at the moment. I recommend verifying your runner configuration to ensure it uses the correct user account to start the runner. Fixing this issue should eliminate the need to store your authentication details as plain text using Git credential helpers.

Regards,
Syahrul

[Sebastijan Kokai]

Thanks a lot for your time and for pointing me in the right direction. At least now I know the issue is with the Mac Mini configuration. I appreciate the help!

Best regards,
Sebastijan