How can I let Bitbucket Pipelines make changes to my repository's Wiki

[dana]

---

The situation

I want to automate the updating of my repository's wiki  using Pipelines.

My wiki Markdown files are currently generated programmically from my project repository, and I just need to transfer them to the wiki repository. I need Pipelines to clone both my project repository and my wiki repository for this to work.

The problem

In my BitBucket Pipeline of my project repository, when a step attempts to clone the wiki into the pipeline's build directory,  I'm getting the error.

Cloning into 'wiki'...
fatal: could not read Username for '<https://bitbucket.org>': No such device or address
Error: Command failed: git clone http://bitbucket.org/><WORKSPACE>/<MY_REPO>/wiki

Is there perhaps a way to let Pipelines know to clone both the project repo AND the wiki repo right from the get go?

Otherwise, how can I let Pipelines, running from my project repository, clone and make changes to my wiki repository?

Solutions I tried

Changing wiki access permissions

Whether my wiki was public, private or allowed anyone with wiki access to edit the wiki made no change.

HTTP

Since I cannot reuse the REPOSITORY_ACCESS_TOKEN that was used to clone my project into Pipeline's build environment, I tried giving access to the wiki through HTTP by creating a new Repository Access Token (that had all the read/write privileges), and then, in the pipeline, including a step that looks like this:

git clone https://x-token-auth:$NEW_ACCESS_TOKEN@bitbucket.org/><WORKSPACE>/<MY_REPO>.git/wiki

The Access key is valid the first time I use it (during cloning), but if I want to commit, or even clone again, I get this error:

Cloning into 'wiki'...
remote: Your credentials lack one or more required privilege scopes.
fatal: unable to access 'https://x-token-auth:$NEW_ACCESS_TOKEN@bitbucket.org/><WORKSPACE>/<MY_REPO>.git/wiki/': The requested URL returned error: 403

SSH

I also tried using SSH keys in Pipelines by creating a key and then, somewhat recursively, adding the public key into the repository's Access Keys. In Pipelines, running the step

git clone git@bitbucket.org:<WORKSPACE>/<MY_REPO>.git/wiki

gave the following error

Cloning into 'wiki'...
Warning: Permanently added the ECDSA host key for IP address '18.205.93.1' to the list of known hosts.
accessing wiki via an access key is not supported
fatal: Could not read from remote repository

Annex

Here's a copy of my bitbucket-pipelines.yml

image: node:16

pipelines:
  branches:
    main:
      - step:
          name: Get Wiki
          script:
          - git clone <https://x-token-auth:$NEW_ACCESS_TOKEN@bitbucket.org/><WORKSPACE>/<MY_REPO>.git/wiki
          - cd wiki
          - ls -la

[Theodora Boudale · Accepted solution]

Hi @dana and welcome to the community!

I'm afraid that cloning a wiki with an access token or with access keys is not supported at the moment. We have feature requests about it, https://jira.atlassian.com/browse/BCLOUD-19641 and https://jira.atlassian.com/browse/BCLOUD-22562. It is also not possible for a Pipelines build to clone the wiki by default.

The available options are:

HTTPS

You can create an app password for your account and then clone the wiki using your Bitbucket username (that can be found here: https://bitbucket.org/account/settings/) and the app password.

The clone command would be like this:

git clone https://${username}:${app_password}@bitbucket.org/<WORKSPACE>/<MY_REPO>.git/wiki

I would suggest creating the app password with permissions Wiki - Read and Write only to limit its scope. Repository variables can be accessed by anyone with write access to your repo, so if anyone retrieves your username and app password they will only be able to access wikis that your account has access to.

SSH

You can use SSH keys in Pipelines and then add the public SSH key to the workspace's SSH keys (if you are a workspace admin). This can be done from Workspace settings > SSH keys.

Please be mindful that this SSH key pair will have read-write access to all of the workspace's repositories.

You could also add the public SSH key to your Bitbucket account, but then the SSH key pair would have read-write access to all repos your account can access (regardless of workspace), so I would not recommend that.

Using HTTPS with your username and an app password and permissions Wiki - Read and Write only is the option with the more limited scope.

Please feel free to reach out if you have any questions!

Kind regards,
Theodora