How to Integrate Socket Into Your Bitbucket Pipeline

Socket isn't just for GitHub and GitLab users - we now support integrating with Bitbucket! If you ever wanted to get access to Socket's tools inside your Bitbucket pipeline, now is the time to do it.

Socket offers a quick and easy method for integrating into your existing Bitbucket CI/CD pipeline using our CLI tool. With the CLI tool it is as simple as adding a few lines to your Bitbucket CI yaml to include Socket.

Simple Integration with Socket's CLI Tool#

The Socket CLI is a utility we provide to make it easy to run Socket Project Health Reports on manifest files it finds in its current working directory and sub-directories. When run in the CI mode, it will return a non-zero exit code that Pipelines use to determine a failure.

The process of integrating Socket into your pipeline is remarkably straightforward. With the Socket CI tool and just a few lines of code added to your Pipeline YAML file, you can seamlessly incorporate Socket into your CI/CD workflow.

An example of the YAML file can be found below and we also have step-by-step directions in our documentation.

Example bitbucket-pipelines.yml

image: node:18
pipelines:
  pull-requests:
    '**':
      - step:
          name: Run Socket.dev Security Check
          condition:
            changesets:
              includePaths:
                - "**package.json"
          caches:
            - node
          script:
            - npm install -g @socketsecurity/cli
            - socket ci .

Automatically Generate Project Health Reports#

Once Socket is integrated, it operates seamlessly in the background. It automatically runs and generates Project Health Reports every time it matches the trigger configured in your pipeline. These reports serve as a comprehensive overview of the health of your project, highlighting potential vulnerabilities or issues in your open source dependencies.

Integrate Now to Secure Your Supply Chain#

Integrating Socket into your Bitbucket CI/CD pipeline is a practical step towards enhancing the security of your software development process. The simple integration instantly delivers added security benefits that make it a valuable and invisible addition to your Bitbucket pipeline.

By incorporating Socket seamlessly into your workflow, you establish a proactive approach to identifying and addressing security issues early in the development cycle. The ability to parse Socket CLI output with tools like JQ adds flexibility, allowing you to tailor the integration to fit your specific needs.