How can we allow pipeline to commit directly to master through permissions?

[Clayton Bailey]

I've seen a question on this before (https://community.atlassian.com/t5/Bitbucket-questions/bitbucket-pipeline-user-permissions-to-write-to-master/qaq-p/1177712) but didn't see an answer that helped.

We are trying to use a pipeline to compile our react code and then commit/push it back into master, the only issue is we don't allow anyone to commit directly to master so this also prevents the bitbucket-pipelines user from committing directly to master. 

In this case we do want the bitbucket-pipelines user to be the ONLY one that can commit directly to master. As of right now we are committing to a new branch and then manually making a PR then approvals have to be done with multiple people then we can merge it into master.

Any fixes/ ideas would be great, Thanks!

[Radek Antoniuk · Accepted solution]

Take a look at this approach :)

[Clayton Bailey]

Yeah we did pretty much this, we had to make a bot account and then use ssh. Thanks!

[Svein Are Grønsund]

@Clayton Bailey Could you describe in detail what you did?

[Svein Are Grønsund]

I am trying to follow the instructions from support.atlassian.com/bitbucket-cloud/docs/push-back-to-your-repository/ (section "SSH Key pair managed with variables") where I:

• Have made a new BitBucket-account for "the bot"
• Have created an SSH-key for this account, and added the public part into BitBucket (personal settings for that user)
• base64-version of the private key is added as repository-variable
• In pipelines I ensure that the private-key exists correctly here: "

  ~/.ssh/id_rsa"

Results

1. If I use SSH-version for "git origin", I get "Permission denied (publickey)".
2. If I don't I get "bitbucket-pipelines" as author (default).
3. If I use "git config user.name / git config user.email" to point to "the bot"-account, it looks great in the git-log, but it fails "branch-permissions". 

[Svein Are Grønsund]

Turned out that my generated key had a password, created new key without password, and it worked great with SSH-mode.