bypass branch restrictions as permission option for Bitbucket Pipelines?

[Mathijs]

It seems to me that it's possible to bypass branch restrictions as permission option for Bitbucket Pipelines:

I have configured the following deployment restrictions:

Environment name: Production
Branches allowed to deploy to Production: master

Bitbucket-pipelines looks like this:

branches:
  master:
    - step:
      name: Deploy
      deployment: production
      script:
        - echo "deploy"

This works as expected: I can only deploy my master branch to production and no other branches.

Now I create a branch in which I remove deployment: production from bitbucket-pipelines.
This makes it possible to run pipeline branches:master for this branch, as the branch restriction appears to be out of order.

Is this intended? Is there another way to make it impossible to run master / production pipelines for arbitrary branches?

[Caroline R · Accepted solution]

Hi, @Mathijs !

Now I create a branch in which I remove deployment: production from bitbucket-pipelines.

I assume that you edit the yaml file and remove the deployment: production in the new branch you create, is that correct? If this is the case, you are correct. It will be possible to run pipeline branches:master for this branch. Since deployment: production will be missing from the yaml file, this will no longer be a deployment step so the branch restriction cannot be enforced.

However, if you have defined any credentials needed for the deployment as deployment variables,  these deployment variables won't be available in the pipeline branches:master (since it will be missing the "deployment: production" part), and the deployment will fail.

My suggestion would be to use deployment variables for authentication (instead of repository or workspace variables) to the deploy server, as this way the deployment will fail when the "deployment: production" is missing. 

Please, feel free to share any additional questions regarding this case.

Kind regards,
Caroline