Do bamboo specs require webhooks?

[Sean Peters]

My bamboo server is wrapped up inside our internal network. I could expose it, but before I do so are webhooks required for bamboo-specs to work? Is there some way that the conventional polling method bamboo usually uses could not be employed?

[Foong · Accepted solution]

Apart from Bitbucket Server, the other repository types Bitbucket Cloud, Git, Github and Subversion need webhooks for bamboo specs to work.

Bamboo 6.5 Release Notes

Setting up webhooks

[Miroslav Sommer]

See also https://jira.atlassian.com/browse/BAM-19837

One of the blockers we're facing is that even with exposing our Bamboo server to external network and obviously securing it properly, webhooks still don't work because they require that Anonymous access is enabled on the Bamboo server - which we have obviously disabled for security reasons.

See https://jira.atlassian.com/browse/BAM-19874

[Sean Peters]

Do you know if anonymous users need access to the plan itself, or just enabled globally (and then ensure every plan and project excludes them)?

[Jeyanthan I]

You do not need a permission to trigger a scan. All you need to do is to use the appropriate REST API to trigger specs scanning.

For Eg: You can use a curl URL like below to trigger a scan as the destination for the webhook so that Bamboo knows about new commits:

curl -X POST -H "Content-Type: application/json" http://BambooHostURL:8085/rest/api/latest/repository/scan?repositoryId=123456

 Hope that clarifies.

[Miroslav Sommer]

... but that obviously only works if Anonymous access is enabled. If it's disabled then you will get an error:

curl : The remote server returned an error: (401) Unauthorized. 

[Jeyanthan I]

Agreed. This bug should be fixed soon in the upcoming release. Thanks for clarifying @Miroslav Sommer.

[Miroslav Sommer]

Hi @Jeyanthan I

We have upgraded to Bamboo 6.7.1 and enabled the configuration in Bamboo Administration -> Security -> [x] Allow anonymous users to trigger remote repository change detection and Bamboo Specs detection

How exactly does it work?

We have specifically disabled anonymous access in Bamboo and that needs to stay disabled.

Do we need to give anonymous users access to our build plans? Currently only logged in users or specific groups have access to build plans. Anonymous users don't have access to anything.

When I run 

 curl -X POST -k -H "Content-Tye: application/json" -i https://<bamboo_server_url>/rest/api/latest/repository/scan?repositoryId=30539782

... it returns HTTP/1.1 204

But when I go to the related Linked Repository settings -> Spec status

https://<bamboo_server_url>/admin/configureLinkedRepositories.action?repositoryId=131694701

... it shows "Never scanned". There is a "Scan" button so I could scan the repo manually, but obviously we can't do that and it has to be triggered by webhooks.

[Foong]

it returns HTTP/1.1 204

The request does not have any return message by default.

it shows "Never scanned". There is a "Scan" button so I could scan the repo manually, but obviously we can't do that and it has to be triggered by webhooks.

Try reloading the page before clicking on the "Spec status" tab.

This webhook only works with new commit or changes to Bamboo Specs. Is there any new commit to the Bamboo Specs file? 

[Ranjana Pokharana]

I am facing the same problem. Even though there are new commits in the bamboo specs, in specs status it is showing never scanned.

I have created the webhook which has the url to trigger the scan bamboo specs for the repository.

Can someone please help why this is happening ?

[Mike Newton]

We are having the same issue, were you able to resolve?

[Jeyanthan I]

Hey @Mike Newton , this appears to be an old thread. There are multiple issues discussed here. Which issue are you referring to? Which version of bamboo are you running?

Cheers, Jey

[Mike Newton]

Hi Jey, I've realized we are on an old version. We're going to upgrade and see if that makes a difference, I was referring to a webhook that is returning a 204 but not triggering a bamboo build.

[Jeyanthan I]

Thanks for clarifying. The latest version definitely has enhanced features and bug fixes. For now, your atlassian-bamboo.log should hint you the reason for trigger failure.

You may also use this java property to add verbose output to your log:

"-Dbamboo.specs.log.level=DEBUG" in <Bamboo-install>/bin/setenv.sh under JVM_SUPPORT_RECOMMENDED_ARGS.

You would need to restart Bamboo to apply the setting.

Hope that helps.

Cheers, Jey.