Socket for Bitbucket Pipeline
Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for your open source dependencies. It is easy to integrate Socket into your Bitbucket Pipeline to provide an extra layer of security against Supply Chain Attacks.
Adding Socket to your pipeline
Create your Socket API Key
You can either create your API Key yourself if you have permissions in your socket.dev account or you can have your Admin create it for you with the Reports scope.
-
Log into the socket.dev dashboard
-
Go to Settings
-
Go to the API Tokens tab
-
Select Create API Token
-
Give the token a name like Gitlab API Token
-
Set up the scopes
-
repo
- list
- create
- update
-
full-scans
- list
- create
-
- Click Confirm
- Click on Show key
- Click on the API Token to copy
Create your Socket Environment variable
-
Log into Bitbucket
-
Navigate to your repository
-
Go to Repository Settings
-
Go to Repository variables
-
Add a New variable
- Name: SOCKET_SECURITY_API_KEY
- Value: Your Socket API Key
- Secured: Checked
-
Click Add
Example Bitbucket Pipeline Setup
-
Go to Source
-
Select the
...
menu -
Select Add file
-
filename: bitbucket-pipelines.yml
-
Paste the following YAML or integrate into your existing pipeline
image: python:3.12 pipelines: pull-requests: '**': - step: name: SocketSecurity - Pull Request Check condition: changesets: includePaths: - "**package.json" script: - pip install socketsecurity - socketcli --target_path .
-
-
Commit changes to your main branch or the current branch you are working on
Testing pipeline
-
Create a new branch
-
Modify or add a
package.json
-
Create a new Pull request
-
Confirm that the Socket CI pipeline job ran
Updated 2 months ago
That's it! You're all done now any time there is an update to your manifest file the Socket CI will automatically run. You can update the criteria to add more things like requirements.txt
or other lock files.