Skip to content

Commit 8a8fcf6

Browse files
waleedlatif1waleedlatif1
committed
feat(credentials): saved GitHub personal access tokens and Bitbucket access tokens
GitHub: a saved personal access token credential (fine-grained or classic), verified against api.github.com/user with the tools' own headers. GitHub's workflow block authenticates with an inline token rather than OAuth, so it follows the token-block pattern: github_v3 is the credential-only successor of github_v2, which stays exactly as it was, marked legacy and hidden from the toolbar. Every GitHub tool declares the optional saved-token policy; inline tokens keep working. The GitHub App installation credential (Search) is a separate service and is untouched: the Assistant still projects GitHub tools onto the person's connected GitHub account, and Search policy now follows the visible GitHub block (github_v3). Bitbucket: a workspace, project, or repository access token as a second option next to OAuth (the Linear pattern), verified by listing one repository of the typed workspace on api.bitbucket.org; the slug is validated so it cannot steer the path. List Workspaces needs a signed-in user, so it now refuses a saved access token before any request. Also: isHostNotFound no longer lets an outer error code mask ENOTFOUND on its cause.
1 parent 353ac76 commit 8a8fcf6

127 files changed

Lines changed: 720 additions & 126 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎apps/docs/components/ui/icon-mapping.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -481,6 +481,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
481481
generic_webhook: Webhook,
482482
github: GithubIcon,
483483
github_v2: GithubIcon,
484+
github_v3: GithubIcon,
484485
gitlab: GitLabIcon,
485486
gitlab_v2: GitLabIcon,
486487
gmail: GmailIcon,

‎apps/docs/content/docs/integrations/bitbucket-service-account.mdx‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
title: Bitbucket access tokens
3+
description: Connect Bitbucket Cloud to Sim with a workspace, project, or repository access token instead of a personal account
4+
---
5+
6+
import { Callout } from '@/components/ui/callout'
7+
import { Step, Steps } from '@/components/ui/steps'
8+
9+
Connect Bitbucket Cloud with an access token when a workflow should act as an integration rather than as the person who connected it. An access token belongs to a workspace, project, or repository, not to a user, so it keeps working when people leave and its reach is limited to what it was created for.
10+
11+
Bitbucket shows actions taken with the token (comments, merges, pipeline runs) under the token's name.
12+
13+
## Prerequisites
14+
15+
Admin access to the workspace, project, or repository the token is for. Workspace access tokens require a Bitbucket Cloud Premium plan; project and repository access tokens do not.
16+
17+
## Create the access token [#creating-the-access-token]
18+
19+
<Steps>
20+
<Step>
21+
Open the repository, project, or workspace settings in Bitbucket Cloud and go to **Access tokens**
22+
</Step>
23+
<Step>
24+
Click **Create access token** and give it a name (e.g. `Sim workflows`) — this is the name Bitbucket shows on everything the workflow does
25+
</Step>
26+
<Step>
27+
Select **Repositories: Read** (`repository`). Add **Pull requests**, **Repositories: Write**, or **Pipelines** scopes for the actions the workflow takes
28+
</Step>
29+
<Step>
30+
Create the token and copy it right away — Bitbucket shows it only once
31+
</Step>
32+
</Steps>
33+
34+
<Callout type="warn">
35+
A repository access token can only reach its repository, and a project access token only the repositories in its project. Treat the token like a password; Sim encrypts it at rest.
36+
</Callout>
37+
38+
## Add the access token to Sim [#adding-the-access-token-to-sim]
39+
40+
<Steps>
41+
<Step>
42+
Open **Integrations** from your workspace sidebar
43+
</Step>
44+
<Step>
45+
Search for "Bitbucket" and open it, then click **Add to Sim** and choose **Add access token**
46+
</Step>
47+
<Step>
48+
Paste the token and enter the workspace slug it belongs to (the `my-workspace` in `bitbucket.org/my-workspace`)
49+
</Step>
50+
<Step>
51+
Click **Add access token**. Sim verifies the token by listing a repository in that workspace, so the token needs the `repository` scope
52+
</Step>
53+
</Steps>
54+
55+
## Use the credential in workflows [#using-the-credential-in-workflows]
56+
57+
Add a Bitbucket block and select the saved access token in the account dropdown, then choose the workspace and repository. The block calls `api.bitbucket.org` with the token, exactly as it does with a connected account.
58+
59+
Two things need a signed-in account and do not work with an access token:
60+
61+
- **List Workspaces** reads the signed-in user's workspaces, so Sim refuses to run it with an access token. Use a connected account for it.
62+
- The workspace picker lists the signed-in user's workspaces, so it cannot load them for an access token. Switch the workspace field to manual entry and type the slug.
63+
64+
## Rotate tokens and handle permission failures
65+
66+
If validation succeeds but an action fails, the token is likely missing that action's scope, or the repository is outside the token's project or repository. Access tokens cannot be edited after creation: create a replacement with the right scopes, update the credential in Sim, test the workflow, and then revoke the old token. See [Bitbucket's access token documentation](https://support.atlassian.com/bitbucket-cloud/docs/access-tokens/).

‎apps/docs/content/docs/integrations/bitbucket.mdx‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,11 @@ import { ReferenceDetails } from "@/components/ui/reference-details"
1212
{/* MANUAL-CONTENT-START:intro */}
1313
Use [Bitbucket](https://bitbucket.org/) Cloud to read repositories, branches, commits, files, and diffs; create or delete branches; and manage pull requests and comments. Pipeline actions list runs and steps, start or stop runs, and retrieve step logs.
1414

15-
Connect a Bitbucket account through OAuth. Triggers can start workflows on pushes, repository changes, build status updates, and pull request events; Sim manages their webhooks. For example, a workflow can read a failed pipeline's logs or review a newly opened pull request.
15+
Connect a Bitbucket account through OAuth, or a workspace, project, or repository [access token](/integrations/bitbucket-service-account). Triggers can start workflows on pushes, repository changes, build status updates, and pull request events; Sim manages their webhooks. For example, a workflow can read a failed pipeline's logs or review a newly opened pull request.
1616
{/* MANUAL-CONTENT-END */}
1717

18+
Connection guides: [Access tokens](/integrations/bitbucket-service-account).
19+
1820
## OAuth scopes [#oauth-scopes]
1921

2022
Sim requests these scopes when someone connects a Bitbucket account. For a self-hosted deployment, register your own app with the provider using the settings below. See [Integrations and OAuth](/platform/self-hosting/integrations-oauth) for setup.

0 commit comments

Comments
 (0)