How to manage branch restrictions for a bitbucket pipeline that auto-merges

Question

I'm trying to add a pipeline to our repository to automatically merge changes from our env/production branch to env/staging branch when ever a PR is merged to env/production.

I have the following in our pipeline file:

pipelines:
  branches:
    env/production:
      - step:
          name: Merge Production into Staging
          image: atlassian/default-image:4
          clone:
            depth: full
            lfs: true
          script:
            #Install git-lfs
            - curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash
            - apt-get install -y git-lfs
            #Merge from Production to Staging to ensure it's always in sync and push
            - git checkout -b env/staging origin/env/staging
            - git merge env/production --no-ff -m "Auto-merge from production to staging" || { echo "Merge conflict detected. Aborting."; exit 1; }
            - git push origin env/staging

In addition, I created a "bot" user and assigned an SSH key to that bot user. The bot user was added to a User Group named "BitbucketPipelines" and has "Write" permissions on my repository.

With no SSH key set in "Repository Settings | Pipelines | SSH Keys", the git push fails when the pipeline runs. So I add the private+public key to that setting and then the pipeline succeeds when executed: automatic merging

I now want to add Branch Restrictions so that only this bot user can push to the "env/*" branches:

Branch | Access Type             | User and Groups
env/*  | Write Access            | BitBucketPipelines 
       | Merge via pull requests | Everybody

However with that branch restriction in place, the git push fails.

I get this error in the pipeline:

git push origin env/staging
remote: Permission denied to update branch env/staging.
To http://bitbucket.org/myworspace/myrepo
! [remote rejected] env/staging -> env/staging (pre-receive hook declined)
error: failed to push some refs to 'http://bitbucket.org/myworspace/myrepo'

How can I get this to work?

Pete

Peter McEvoy · Answer

Thanks @Saxea _Flowie_ that seems to have done the trick!

Saxea _Flowie_ · Answer

Hi @Peter McEvoy

Check out this docs - you need to set the remote to use SSH, as the default is HTTP.

You might be also interested in checking out Flowie, the Bitbucket cloud addon we provide, which lets you sync between branches. The main advantage is that it keeps track of what has been cascaded and let you handle conflicts too.

Hope that helps!

Peter McEvoy · Answer

That does not make sense. That setting prevents "force push" that would be required for a rebase.  Rebase creates new commits and abandons old commits - thus orphaning anyone that took branches from older commits.  All git guidance I have read for long lived shared branches is to disable force push for exactly this reason.

My pipeline is doing a merge, creating new commits on the branch and should not require a force push.

My point is that the pipeline works when I allow everyone to write to that branch, but does not work when I restrict to the user that owns the SSH key that I added in the Pipeline SSH Keys section.  This indicates to me that the SSH key in that setting is not being used during the "git push"