[chmouel]

📝 Description of the Change

You can now use a Bitbucket Cloud repository access token in the Repository CR instead of a personal API token. Pipelines-as-Code recognizes these tokens by their ATCT prefix and signs in to Bitbucket and clones the repository the way Bitbucket expects for them. No extra setting is needed.

A repository access token cannot see who belongs to the workspace. When Bitbucket refuses that lookup, Pipelines-as-Code falls back to the OWNERS files and /ok-to-test comments to decide who may run pipelines, so the event still gets processed. Those OWNERS files are now always read from the default branch, so a pull request cannot approve itself by editing them.

Workspace and project access tokens use the same prefix, but they need a Bitbucket Premium plan and we cannot test them, so this PR does not document or claim support for them.

🔗 Linked GitHub Issue

Jira: SRVKP-14667

🧪 Testing Strategy

• Unit tests
• Integration tests
• End-to-end tests
• Manual testing
• Not Applicable

🤖 AI Assistance

AI assistance can be used for various tasks, such as code generation,
documentation, or testing.

Please indicate whether you have used AI assistance
for this PR and provide details if applicable.

• I have not used any AI assistance for this PR.
• I have used AI assistance for this PR.

Important

Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Claude noreply@anthropic.com

✅ Submitter Checklist

• 📝 My commit messages are clear, informative, and follow the project's How to write a git commit message guide. The Gitlint linter ensures in CI it's properly validated
• ✨ I have ensured my commit message prefix (e.g., fix:, feat:) matches the "Type of Change" I selected above.
• ♽ I have run make test and make lint locally to check for and fix any
  issues. For an efficient workflow, I have considered installing
  pre-commit and running pre-commit install to
  automate these checks.
• 📖 I have added or updated documentation for any user-facing changes.
• 🧪 I have added sufficient unit tests for my code changes.
• 🎁 I have added end-to-end tests where feasible. See README for more details.
• 🔎 I have addressed any CI test flakiness or provided a clear reason to bypass it.
• If adding a provider feature, I have filled in the following and updated the provider documentation:
  • GitHub App
  • GitHub Webhook
  • Gitea/Forgejo
  • GitLab
  • Bitbucket Cloud
  • Bitbucket Data Center

[pipelines-as-code]

Paco Review 🔍

This PR adds support for Bitbucket Cloud workspace and repository access tokens (prefixed with ATCT). When such a token is detected, the Bitbucket client is initialized with bearer auth instead of basic auth, git clones use x-token-auth as the username, and workspace-membership errors (401/403) are silently swallowed so that OWNERS-file and comment-based authorization still works. Documentation, tests, and a shared vcshost constant are updated accordingly.

Review difficulty: 3/5 (Moderate) — The change is moderate in size and touches authentication logic, ACL enforcement, and secret generation across several packages, but each piece is well-scoped and individually testable.

3 new inline comment(s) found.

_{Reviewed commit: 17377af}

[pipelines-as-code]

Paco inline comments -- see the Paco Review summary comment for the overview.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.97%. Comparing base (282110d) to head (9bd6fd6).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3010      +/-   ##
==========================================
+ Coverage   91.95%   91.97%   +0.02%     
==========================================
  Files         167      167              
  Lines       12954    12965      +11     
==========================================
+ Hits        11912    11925      +13     
+ Misses       1041     1039       -2     
  Partials        1        1              

Flag	Coverage Δ
unit-tests	91.97% <100.00%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot review overview

🟡 Changes recommended

The access-token permission instructions use API-token scope names that are unavailable during resource-token creation.

Review effort: Balanced
Findings: 2

Open (2)

• Use resource-token permissions instead of API-token scopes · New
• Document workspace token handling in the membership fallback · New

What changed in this PR

Adds Bitbucket Cloud workspace/repository access-token support across API authentication, Git checkout, ACL handling, and documentation.

Changes:

• Detects ATCT tokens and uses bearer authentication.
• Uses x-token-auth for Git credentials.
• Adds ACL fallback and tests for restricted membership access.

File	Description
pkg/​vcshost/​vcshost_test.go	Uses canonical host constants.
pkg/​secrets/​basic_auth.go	Selects the access-token Git username.
pkg/​secrets/​basic_auth_test.go	Tests generated access-token credentials.
pkg/​provider/​bitbucketcloud/​bitbucket.go	Configures bearer authentication.
pkg/​provider/​bitbucketcloud/​bitbucket_test.go	Verifies authorization headers.
pkg/​provider/​bitbucketcloud/​acl.go	Handles unavailable membership lookup and securely reads default-branch OWNERS files.
pkg/​provider/​bitbucketcloud/​acl_test.go	Covers access-token authorization paths.
pkg/​cmd/​tknpac/​webhook/​update-token.go	Reuses the canonical Bitbucket hostname.
docs/​content/​docs/​providers/​bitbucket-cloud.md	Documents resource access-token setup.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[zakisk]

closing this as we cannot test this at this time, feel free to reopen if someone asks for this...

[chmouel]

project level feature is testable

[pipelines-as-code]

Paco inline comments -- see the Paco Review summary comment for the overview.

[zakisk]

@chmouel I see only one way of getting user's account id is seeing webhook payload and getting accound id out of it but I think we shoud sepcify here how to get account id in easy way so and with repo access token it's not accessible as /2.0/user endpoint in bitbucket api is not allowed by repo access token. saying that how to get one's account id so that we can specify the way to get it in this docs?

[zakisk]

@chmouel can you please take a look? and we're good to go...

[chmouel]

@chmouel can you please take a look? and we're good to go...

this is documented here, anything missed? https://github.com/tektoncd/pipelines-as-code/pull/3010/changes#diff-549bbed8b30913afbf55052b9fed1614225cea101641a71224c3b2630afe050aR59 (line 59)

[zakisk]

Yes, fine

[chmouel]

Error is a 502 on github and we don't have enable-api-retry by default on e2e #3039

[chmouel]

@zakisk good for you?

[zakisk]

@zakisk good for you?

I was waiting for you here #3010 (comment)