How can I prevent bitbucket-pipelines.yml to be modified by developers?

[Victor Acin]

Hello,

We have set up our bitbucket-pipelines.yml file, pushed to the repo and it's working. We have read a lot about this configuration but we don't find anything about preventing developers, or just allowing some of them, to modify this file.

This is very important for us, because one developer with access to the repo can wilfully make the server crash if he modifies the source code and modify the pipelines so that Bitbucket does not run the tests and create the build properly.

I think there should exist something but we don't find it.

Many thanks in advance,

Victor.

[raschidjfr]

There's currently a feature request for this: BCLOUD-19457.

You can vote for it.

[Patrick Wickham]

^ Everyone please vote for this -- this is a massive oversight that needs to be fixed

[Lenin Raj]

Hi @Victor Acin

I am afraid this isn't possible. However to prevent someone from modifying the bitbucket-pipelines.yml file, you can use Branch Permissions, assuming your build/deployment runs from master branch.

This will prevent anyone working on the repository to merge anything without approval.

[raschidjfr]

I just want to add that with this approach you would need a Premium Membership to be able to restrict access to certain Deployments (and its variables) ton only selected branches.

But that won't prevent anyone from being able to use those variables in a malicious script in the yaml file, unless the repo admin keeps an eye on what is being modified and merged... which is the opposite of automating 🤦🏻‍♂️

I guess we need to start a feature request.