How to manage branch restrictions for a bitbucket pipeline that auto-merges

[Peter McEvoy]

I'm trying to add a pipeline to our repository to automatically merge changes from our env/production branch to env/staging branch when ever a PR is merged to env/production.

I have the following in our pipeline file:

pipelines:
  branches:
    env/production:
      - step:
          name: Merge Production into Staging
          image: atlassian/default-image:4
          clone:
            depth: full
            lfs: true
          script:
            #Install git-lfs
            - curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash
            - apt-get install -y git-lfs
            #Merge from Production to Staging to ensure it's always in sync and push
            - git checkout -b env/staging origin/env/staging
            - git merge env/production --no-ff -m "Auto-merge from production to staging" || { echo "Merge conflict detected. Aborting."; exit 1; }
            - git push origin env/staging

In addition, I created a "bot" user and assigned an SSH key to that bot user. The bot user was added to a User Group named "BitbucketPipelines" and has "Write" permissions on my repository.

With no SSH key set in "Repository Settings | Pipelines | SSH Keys", the git push fails when the pipeline runs. So I add the private+public key to that setting and then the pipeline succeeds when executed: automatic merging

I now want to add Branch Restrictions so that only this bot user can push to the "env/*" branches:

Branch | Access Type             | User and Groups
env/*  | Write Access            | BitBucketPipelines 
       | Merge via pull requests | Everybody

However with that branch restriction in place, the git push fails.

I get this error in the pipeline:

git push origin env/staging
remote: Permission denied to update branch env/staging.
To http://bitbucket.org/myworspace/myrepo
! [remote rejected] env/staging -> env/staging (pre-receive hook declined)
error: failed to push some refs to 'http://bitbucket.org/myworspace/myrepo'

How can I get this to work?

Pete

[Mark C]

Hi @Peter McEvoy

Thank you for reaching out to the community.

For the specific branch restriction setting, could you confirm if the "Allow rewriting branch history" is checked?

Regards,
Mark C

[Peter McEvoy]

Hi @Mark C 

Thanks for taking the time to look at my issue.

No - "Allow rewriting branch history" is not checked: that does not sound safe to me on this branch as surely that could cause issues in clones?

I don't explicitly "force" push in the pipeline - is there an implicit setting attempting that?

Pete

[Mark C]

Hi @Peter McEvoy

Unfortunately, unchecking that setting means no one is allowed to make changes to the specific branch via push.

Also, allowing that with a set of users/groups means that you're allowing those users/groups to make changes to branch. Hence, allowing the bot user as well.

Regards,
Mark C

[Peter McEvoy]

That does not make sense. That setting prevents "force push" that would be required for a rebase.  Rebase creates new commits and abandons old commits - thus orphaning anyone that took branches from older commits.  All git guidance I have read for long lived shared branches is to disable force push for exactly this reason.

My pipeline is doing a merge, creating new commits on the branch and should not require a force push.

My point is that the pipeline works when I allow everyone to write to that branch, but does not work when I restrict to the user that owns the SSH key that I added in the Pipeline SSH Keys section.  This indicates to me that the SSH key in that setting is not being used during the "git push"

[Saxea _Flowie_]

Hi @Peter McEvoy

Check out this docs - you need to set the remote to use SSH, as the default is HTTP.

You might be also interested in checking out Flowie, the Bitbucket cloud addon we provide, which lets you sync between branches. The main advantage is that it keeps track of what has been cascaded and let you handle conflicts too.

Hope that helps!

[Peter McEvoy]

Thanks @Saxea _Flowie_ that seems to have done the trick!