execute local script from pipeline

[benjamin]

Looking to execute a local script (with a parameter) from a pipeline.

Dont need the pipline to build the artifact, its already built.

Looking for a way to track which compiled code is getting pushed to production with a pull request that will pass a string parameter and execute a script on the local on-prem server.

[Theodora Boudale · Accepted solution]

Hi Benjamin and welcome to the community!

You can use the ssh-run pipe to connect to your server via SSH and then run commands and/or a script on this server. This is the pipe's repo:

• https://bitbucket.org/atlassian/ssh-run/src/master/

If you scroll down, you will see the pipe's README with documentation and several examples using the pipe.

With regards to passing variables, you can pass variables that have been defined as Repository, Workspace, or Deployment variables:

• https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/

It is also possible to use a custom pipeline with variables that you provide during runtime, and pass the custom pipeline's variable:

• https://support.atlassian.com/bitbucket-cloud/docs/pipeline-start-conditions/#Custom--manual--pipeline-variables

If the server you are connecting to is behind a firewall, you will need to whitelist the IPs used by Bitbucket Pipelines build environments so that your server can be reached from the build:

• https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/#Valid-IP-addresses-for-Bitbucket-Pipelines-build-environments

Kind regards,
Theodora

[benjamin]

Thank you!

All this is super useful esp the white listing

[Theodora Boudale]

You are very welcome! Please feel free to reach out if you have any other questions!

[benjamin]

Theodora Boudale Hi. We've configured our corportate firewall but having trouble - keep getting Opersion Timed out when trying to sonnect to our SSH server.

Do we need to use the OIDC config and if so do you have an example?

[Theodora Boudale]

Hi @benjamin,

The documentation of Bitbucket Pipelines Cloud IP addresses is divided into two sections:

• Section 1: Valid IP addresses for Bitbucket Pipelines build environments

  This section applies to 1x/2x step sizes (or 4x/8x steps that have not been explicitly flagged to use atlassian-ip-ranges).
  An exhaustive list of IP addresses from which the traffic may originate on AWS can be obtained by using the following endpoint. You should filter records where the service equals EC2 or S3, and focus on the us-east-1 and us-west-2 regions.
  However, we do not recommend using these IP ranges as a security control due to their broad nature.
  
  

• Section 2: Atlassian IP Ranges

  This section pertains to steps specifically configured to use Atlassian IP ranges. These are applicable only to 4x and 8x size steps that have the atlassian-ip-ranges: true flag enabled. The step sizes 4x and 8x are only available for builds running under a paid Bitbucket Cloud plan (Standard or Premium).
  
  You can see what configuration is needed for a Pipelines step to use this more limited set of IP ranges in the documentation here: Runtime Step Options.

What size is the Pipelines step that connects to your server?

Does it have the atlassian-ip-ranges: true flag enabled as per Runtime Step Options?

And which of the two sections of IPs have you whitelisted?

With regards to OIDC, are we talking about an AWS server? If so, and if the IAM policy has IP whitelisting, you will still need to whitelist IP addresses used by Bitbucket Pipelines environments. If there is no IP whitelisting in the IAM policy, then it is not required.

You can find an example on how to configure OIDC with AWS on the following documentation:

• https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/

Kind regards,
Theodora