Clear Caches Pipe does not work

[Antoni Florit]

We are using Clear Caches Pipe to clear the "node" cache and the "cypress" custom cache so every run we do the step with Bitbucket's Clear Caches Pipe script ends with a 404 error with the following message:

✖ Failed to retrieve caches: 404 {"type": "error", "error": {"message": "Resource not found"}} https://api.bitbucket.org/2.0/repositories/thebellhop/ess-front/pipelines-config/caches/?page=1&pagelen=100

The step with the script is as follows:

    - step: &clear-cache

        name: delete cache if changes in the build dependencies

        script:

        - pipe: atlassian/bitbucket-clear-cache:3.1.1

          variables:

             BITBUCKET_USERNAME: $BITBUCKET_USERNAME

              BITBUCKET_APP_PASSWORD: $BITBUCKET_APP_PASSWORD

             CACHES: ["cypress", "node"]

        condition:

          changesets:

            includePaths:

             - package.json

Can anyone help us?

[Patrik S · Accepted solution]

Hello @Antoni Florit ,

Thank you for reaching out to Atlassian Support.

The error you are receiving is from one of the API calls the pipe is doing behind the scenes, where it gets all the caches from the repository. A 404 response from that API either means that the repository does not exist (which is not the case here), or the credentials being used to authenticate does not have access to it.

So could you please confirm if the bitbucket username you set as the variable $BITBUCKET_USERNAME is correct, and if that user has access to the repository where the pipeline is running ? Also, make sure this is the bitbucket username of the account, not the e-mail address. You can check the username going to the account's personal settings https://bitbucket.org/account/settings/

Additionally, please make sure the App Password you are using has the required permissions. To narrow down if the issue if with the permissions of the app password you are currently using, you can try creating a new app password with full permissions checked and test if using it the pipe completes successfully.

Hope that helps! Let me know if you run into any issues.

Thank you @Antoni Florit ,

Kind regards,

Patrik S

[Simona Grigoras]

Hi @Patrik S 

I followed your advice and changes the pipe version and it did the trcik.

Now I stumbled upon a different error
DEBUG: Starting new HTTPS connection (1): https://api.bitbucket.org:443

✖ Failed to retrieve caches: 403 {"type": "error", "error": {"message": "To access this repository, an admin must whitelist your IP."}}

DEBUG: https://api.bitbucket.org:443 "GET /2.0/repositories/.../...-sso/pipelines-config/caches/?page=1&pagelen=100 HTTP/11" 403 102

..

could this be related to the ACL of the token/user?

Thank you,

Simona

[Patrik S]

Hello @Simona Grigoras ,

The particular error you're receiving occurs because your workspace has IP-allow listing enabled, meaning that it will only accept connections from IP addresses in the trusted IP list.

The clear cache pipe uses API calls to delete the caches from the repositories. If the Pipeline IP addresses were not added to the trusted IPs of your workspace, any API calls coming from inside the Pipelines environment will fail with a 403 Unauthorized error, as the one you're receiving in the logs:

403 {"type": "error", "error": {"message": "To access this repository, an admin must whitelist your IP."}}

In this case, it would be necessary to add the Valid IP addresses for Bitbucket Pipelines build environments in the IP allowlisting of your workspace under Workspace Settings > Access Controls.

I hope this helps! Should you have any questions, feel free to ask.

Thank you, @Simona Grigoras !

patrik S

[Simona Grigoras]

Hi @Patrik S 

I've raised the request for whitelisting the APIs with our team and I got back a question from the security team: "How attlasian is securing these APIs?".

Thank you,

Simona

[Patrik S]

Hello @Simona Grigoras ,

the steps not configured to use the atlassian-ip-ranges will use the IP addresses owned and maintained by AWS. We do not recommend using these IP ranges as a security control due to their broad nature.

Instead, for steps that need to run from a more restricted set of IP addresses, we recommend using the atlassian-ip-ranges configuration available with our 4x/8x steps. This option provides enhanced security by limiting the IP addresses to a smaller, more manageable list. You can find more details about this configuration here. Those IPs are owned by Atlassian.This configuration does not need to apply to all steps in a pipeline, just the steps that access secure resources.

Thank you, @Simona Grigoras .

Patrik S