Introduction
In this Knowledge Base article, we will share the complete steps needed to set up the Bitbucket Data Center / Server with Frogbot.
Basically, JFrog Frogbot is a Git bot that scans your Git repositories for security vulnerabilities.
It scans pull requests immediately after they are opened but before they are merged. This process notifies you if the pull request is about to introduce new vulnerabilities to your code. This unique capability ensures the code is scanned and can be fixed even before vulnerabilities are introduced into the codebase.
Prerequisites for Setting Up Frogbot with Bitbucket
In order to set up the complete configuration, we need to ensure that the requirements below are satisfied.
An up-and-running Artifactory Server having integration with Xray, as will help us to use the repositories that are needed to pull the dependencies from the upstream and then scan them.
Should have Jenkins Server running and integrated with the JFrog Platform
An On-prem server installation of Bitbucket Data Center / Server.
Step-by-Step Guide: Configuring Bitbucket, Jenkins, and Frogbot
Once, the above points are satisfied, we can proceed by following the below steps:-
-
Create a Project in Bitbucket Data Center / Server and name it accordingly. It will be having a Project Key associated with it.
-
After this, create a repository or import it from anywhere it is available. Here, we have imported the NPM repository from GitHub. Below is the screenshot.
-
Create a Pull Request in this repository and save it.
-
Now, in the Jenkins Server, install the Bitbucket Branch Source plugin so that Jenkins can interact with the Bitbucket Data Center / Server.
Configuring the Jenkins Pipeline & Environment Variables
-
As the above configuration is done, now we will be creating a sample pipeline based on the script that is mentioned in our documentation.
-
In the script, there are some changes that needs to be done in order to make Frogbot Scan the Pull Requests and it is mentioned below.
JF_GIT_TOKEN = "<token of the repository on which the scan needs to be performed>"
JF_GIT_PROVIDER = "bitbucketServer"
JF_GIT_REPO = "<Repository-name>"
JF_GIT_BASE_BRANCH = "<branch>"
// [Mandatory]
// GitHub enterprise server organization namespace
JF_GIT_OWNER = "<project-key>"
// [Mandatory]
// API endpoint to GitHub enterprise server
JF_GIT_API_ENDPOINT = "https://<bitbucket-server-name>/rest"
The GIT_TOKEN can be obtained by navigating to the repository settings -> HTTP access tokens and using it further.
-
The JF_GIT_PROVIDER will be set to bitbucketServer
-
JF_GIT_REPO is the repository name that is initially created.
-
JF_GIT_BASE_BRANCH is the branch that needs to be scanned.
-
JF_GIT_OWNER is the Project Key associated with the project that is initially created.
-
JF_GIT_API_ENDPOINT is mandatory and needs to be set to bitbucket server name having /rest at the end.
-
For ex:- "https://<bitbucket-server-name>/rest"
-
JF_RELEASES_REPO is the repository available in Artifactory that is needed to download the dependencies.JF_INSTALL_DEPS_CMD is the command that needs to be executed to download the dependencies. For example:- mvn install, npm install, etc
-
JF_WORKING_DIR is the relative path to the root of your project present in the Git.
Running the Pipeline and Reviewing PR Scan Results
After all the setup is complete, run the pipeline and we could see in the bitbucket Data Center / server that the PR has been scanned and all the vulnerabilities are available in the comments section.
Now based on the results, the user or organization can decide whether to merge or remove the PR (based on the reviewer's decision).