Bitbucket Pipelines

This page explains how to integrate HoundDog.ai’s code scanner with Atlassian’s Bitbucket Pipelines.

Defining the Required Pipeline Variables

First, follow the steps in API Keys to generate a HoundDog.ai organization API key. Then follow the steps in Atlassian’s documentation to create a secured pipeline variable named HOUNDDOG_API_KEY using the value of your key. Bitbucket allows you to define variables at the workspace or repository level — either works. Deployment variables only apply to steps that declare a deployment: environment, which the example below does not.

Defining the Scan Step in bitbucket-pipelines.yml

Next, add a new step in the bitbucket-pipelines.yml file at the root of your repository. Here is an example which scans your repository and uploads the results to the HoundDog.ai Cloud Platform:

bitbucket-pipelines.yml

pipelines:
  branches:
    main:
      - step:
          name: Run HoundDog.ai Scan
          image: hounddogai/hounddog
          script:
            - hounddog scan --ci bitbucket-pipelines

Blocking the Pipeline Upon Detecting Vulnerabilities

By default, the scanner exits with code 0 (success) even when risky dataflows are found. To halt the pipeline upon detecting vulnerabilities, provide the --fail-severity-threshold option to the hounddog scan command:

bitbucket-pipelines.yml

pipelines:
  branches:
    main:
      - step:
          name: Run HoundDog.ai Scan
          image: hounddogai/hounddog
          script:
            # Fail if a risky dataflow with severity "medium" or higher is detected.
            - hounddog scan --ci bitbucket-pipelines --fail-severity-threshold=medium

The scan results still upload to the Cloud Platform before the step fails, so the platform always reflects the latest scan.

To view all available command-line options for the hounddog scan command, see Scanner Configuration.