CI/CD Pipeline Broken After Revoking Access Token

Question

Recently a developer on our team left who created the CI/CD pipeline connecting our Bitbucket repository to our Laravel Forge server. The CI/CD pipeline was created through Bitbucket Pipelines. After the developer left, we deleted their access token thinking nothing of it. However, this has appeared to cause our pipeline to break, and I was looking for some helpful insights where this problem could be fixed.

To begin, our bitbucket-pipelines.yml file has 4 requests which look something like this: ssh forge@xxx.XXX.XXX.XXX "cd /path/to/server && git pull origin master"

This is the first command which is called and it immediately fails with this error message:
“The requested repository either does not exist or you do not have access. If you believe this repository exists and you have access, make sure you're authenticated.
fatal: Could not read from remote repository.
Please make sure you have the correct access rights, and the repository exists.”

Above this error message in the build output there is a reference to “REPOSITORY_OAUTH_ACCESS_TOKEN” which I believe could possibly be the access token we had revoked from the previous developer. An issue with this is that I cannot find where this is referenced. It’s not referenced in any of our source code, and I was not able to find any repository or workspace variables referencing this.

This pipeline is running our live website where I am able to push code to the main branch successfully but in the build process I am receiving a permissions error. Would anybody know what may be the solution to this problem? Thank you for your time!

Theodora Boudale · Answer

Hi @Hunter Erickson and welcome to the community!

You mentioned that the request that fails is the following:

ssh forge@xxx.XXX.XXX.XXX "cd /path/to/server && git pull origin master

This command connects via SSH to your server, then it changes directory to what I assume is a repo's clone directory and then tries to do a git pull.

The error you see typically occurs when you do a Git operation via SSH, so I'm not sure if an access token is the culprit here.

Are you able to connect to this server outside of Pipelines, switch to the directory /path/to/server, and then run the command

git remote -v

Can you share what output you see? Replace any usernames, workspace-id, and repo name with dummy values before sharing, I would just like to see the format of the URL. This will indicate what protocol is used when pulling and I can then advise you on the next steps.

It would also be helpful to see the full output of the command ssh forge@xxx.XXX.XXX.XXX "cd /path/to/server && git pull origin master (again, sanitize any sensitive data) to confirm if the error indeed occurs on the git pull part.

Kind regards,
Theodora

Aron Gombas _Midori_ · Answer

I think that token value isn't stored anywhere, but it is obtained dynamically by the build prior  to the line where it wants to use it (and fails).

See: https://support.atlassian.com/bitbucket-cloud/docs/using-access-tokens/

And check your bitbucket-pipelines.yml for commands where tries to connect to the Atlassian Oauth service. The answer (or at least the next step) will be there. I think it will just not be able to get the token there.