Only allow pipeline to push into master?

Question

We are using semantic release in our pipeline which means that after merging a branch the pipeline has to push a new commit with a version tag. This seems to be only possible if Everybody is allowed to push to master which we do not want.

Is there a way to explicitly allow the pipeline to push to master?

Oleg Sigida · Answer

what worked for me
1) create a dedicated user for BB Pipeline, f. ex ROBOT

2) create private and public ssh keys for it, update the user with the key

3) go to settings->branch permission-> add -> branch name: master; merge via PR : ROBOT or write access: ROBOT (depends on what you actually want); make sure nobody else has access

4) go to settings-> SSH keys (under pipeline settings) -> use my own keys -> add private and public key of the ROBOT from step 2

now very easy, but worked for me

Steven Vaccarella · Answer

Ok thanks for clarifying. I'm not aware of a way to do this currently without creating a separate user account for use by the pipeline. If you like you can create a feature request here: https://bitbucket.org/site/master/issues

Highly voted feature requests are an important source of information for us when planning new features.

Christoph Grimmer · Answer

Hi Steven,

when using semantic release the pipeline has to be able to push a new commit containing the version tag after a branch has been merged into master. This works as long as the master has no push restrictions. Since the pipeline uses an anonymous ssh key we cannot explicitly allow the pipeline to exclusively push to master short of spending the money to create a pipeline user.

This leaves us with the option to not push to master as a policy which went wrong once already.