How to manage branch restrictions for a bitbucket pipeline that auto-merges

[Peter McEvoy]

I'm trying to add a pipeline to our repository to automatically merge changes from our env/production branch to env/staging branch when ever a PR is merged to env/production.

I have the following in our pipeline file:

pipelines:
  branches:
    env/production:
      - step:
          name: Merge Production into Staging
          image: atlassian/default-image:4
          clone:
            depth: full
            lfs: true
          script:
            #Install git-lfs
            - curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash
            - apt-get install -y git-lfs
            #Merge from Production to Staging to ensure it's always in sync and push
            - git checkout -b env/staging origin/env/staging
            - git merge env/production --no-ff -m "Auto-merge from production to staging" || { echo "Merge conflict detected. Aborting."; exit 1; }
            - git push origin env/staging

In addition, I created a "bot" user and assigned an SSH key to that bot user. The bot user was added to a User Group named "BitbucketPipelines" and has "Write" permissions on my repository.

With no SSH key set in "Repository Settings | Pipelines | SSH Keys", the git push fails when the pipeline runs. So I add the private+public key to that setting and then the pipeline succeeds when executed: automatic merging

I now want to add Branch Restrictions so that only this bot user can push to the "env/*" branches:

Branch | Access Type             | User and Groups
env/*  | Write Access            | BitBucketPipelines 
       | Merge via pull requests | Everybody

However with that branch restriction in place, the git push fails.

I get this error in the pipeline:

git push origin env/staging
remote: Permission denied to update branch env/staging.
To http://bitbucket.org/myworspace/myrepo
! [remote rejected] env/staging -> env/staging (pre-receive hook declined)
error: failed to push some refs to 'http://bitbucket.org/myworspace/myrepo'

How can I get this to work?

Pete

[Mark C]

Hi @Peter McEvoy

Thank you for reaching out to the community.

For the specific branch restriction setting, could you confirm if the "Allow rewriting branch history" is checked?

Regards,
Mark C

[Peter McEvoy]

Hi @Mark C 

Thanks for taking the time to look at my issue.

No - "Allow rewriting branch history" is not checked: that does not sound safe to me on this branch as surely that could cause issues in clones?

I don't explicitly "force" push in the pipeline - is there an implicit setting attempting that?

Pete