Pipe release failed after updating bitbucket-pipe-release from 3.2.2 to 5.7.1

[Julien HENRY]

Hi,

I know this is a big jump, but the release of our pipe was working fine before, and now it is failing with a cryptic message.

I suspect this is related to the inability to push or tag to master, but I have not changed anything.

The logs ends abruptly:

+ new_version=3.0.2 + USERNAME='Bitbucket Pipelines Push Bot'
+ [[ -n '' ]]
++ git config --get http.http://bitbucket.org/sonarsource/sonarqube-scan.proxy
+ HTTP_PROXY_DEFAULT=

Any idea?

[Igor Stoyanov]

Hi @Julien HENRY . I think, this pipe is required to sue python image by default. Please, try to add:

image: python:3.10

to your release step. Waiting for your feedback.

Regards, Igor

[Julien HENRY]

Thanks, I will try during the next release.

[Andy Fletcher]

I think the problem is actually the changes to Git around "dubious ownership"

Git command returns fatal error: "detected dubious ownership"

The line that's trying to set the HTTP_PROXY_DEFAULT variable by calling `git config` is failing and because of `set -e` this fails the whole script.

If you set `DEBUG: 'true` on the pipe then it shows that `git config --list` isn't returning anything.

I've forked the repo and added `git fsck` in the debug block and get this error:

fatal: detected dubious ownership in repository at '/opt/atlassian/pipelines/agent/build'
To add an exception for this directory, call:

 git config --global --add safe.directory /opt/atlassian/pipelines/agent/build

Adding the `whoami` and `ls -ld $(pwd)` to the debug shows:

root
drwxrwxrwx 6 nobody nobody 4096 Oct 15 08:00 /opt/atlassian/pipelines/agent/build

so whilst the script is running as root the working dir is owned by nobody which seems to be the cause of the problem.

Adding the safe.directory config early in the pipe's script does fix the problem but this needs to be something done by Atlassian (or in a forked pipe)

[Igor Stoyanov]

@Andy Fletcher thank you for your investigation.

Usually we use this option for git push: Configure repository ssh key pair and it will be safely used in pipeline to push to current repository

and your investigation related to the case described by: if neither of above is configured, the http proxy and http origin will be used to push


Our team will try to fix this http proxy and http origin option. Temporary we suggest to use Configure repository ssh key pair with this pipe.

Regards, Igor

[Andy Fletcher]

I'm not sure that's got anything to do with it. The error is happening on line 24 of git-commit.sh when it is setting up some variables.

The if block to decide whether to use ssh key, identity file or proxy starts at line 41

Git commands that need to operate on a working directory just plain don't work. I.e. in the debug block `git --version` is fine, `git config --list` fails because the directory is owned by 'nobody' rather than 'root'.

So even if you moved the set up of this variable inside the else block that handles using the proxy, the lines using git config, add, commit, push etc. are going to fail.

[Andy Fletcher]

A workaround that seems to be working for me so that I don't need to use a modified version of the pipe is to put this in my push step.

Before the atlassian/bitbucket-pipe-release

- echo -e "[safe]\n\tdirectory = /opt/atlassian/pipelines/agent/build" > .custom-git-config
- echo ".custom-git-config" >> .gitignore

And then as an variable to the pipe itself

GIT_CONFIG_GLOBAL: /opt/atlassian/pipelines/agent/build/.custom-git-config

You could also just add the .custom-git-config file directly to your .gitignore rather than modifying it in the pipeline but I put the together so that it's easier to remove once Atlassian fix the pipe itself. 

[Igor Stoyanov]

Hi @Andy Fletcher . Good finding.
 
The pipe bitbucket-pipe-release is open-sourced project, so if you want you may contribute to it.

You are welcome to create a pull request, please follow the contribution page.

Regards, Igor

[Igor Stoyanov]

Hi @Julien HENRY , @Andy Fletcher . Our team released new version of the pipe, where this command 

git config --global --add safe.directory /opt/atlassian/pipelines/agent/build

was added to git-commit.sh file.

@Andy Fletcher thank you for your investigation and solution. Could you please provide feedback about does the new version fix the problem or not.

Regards, Igor

[Julien HENRY]

Thanks @Igor Stoyanov I will test when doing our next release (no ETA yet).

[Andy Fletcher]

Hi @Igor Stoyanov 

Thank you for the fix. I've just backed out of my workaround and updated to the latest release pipe and it is working as expected.

I had intended to come back here and submit a PR but as usual life got in the way!

Many thanks,
Andy