feat(bitbucket-cloud): add HMAC webhook secret validation by zakisk · Pull Request #2870 · tektoncd/pipelines-as-code

zakisk · 2026-07-21T13:02:08Z

📝 Description of the Change

Implement X-Hub-Signature / X-Hub-Signature-256 HMAC validation for Bitbucket Cloud webhooks, matching the existing GitHub and Bitbucket Data Center pattern. PaC first checks IP-Based validation if it's disabled then fallback to webhook secret validation and checks if a webhook_secret is configured on the Repository CR, incoming payloads are verified against the signature header.

Assisted-by: Claude Opus 4.6 (via Claude Code)

🔗 Linked GitHub Issue

Fixes #

🧪 Testing Strategy

🤖 AI Assistance

AI assistance can be used for various tasks, such as code generation,
documentation, or testing.

Please indicate whether you have used AI assistance
for this PR and provide details if applicable.

I have not used any AI assistance for this PR.
I have used AI assistance for this PR.

Important

Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Claude noreply@anthropic.com

✅ Submitter Checklist

zakisk · 2026-07-21T13:03:04Z

e2e test would fail on it waiting for #2869 to be merged.

gemini-code-assist

Code Review

This pull request introduces webhook secret validation for Bitbucket Cloud using HMAC-SHA256/SHA1 signatures, updating both the documentation and the provider implementation. The review feedback highlights a critical backward compatibility issue: the new validation logic blocks webhooks when no secret is configured, rather than falling back to IP-based validation. To resolve this, the reviewer suggests returning early with no error when the secret is empty and adjusting the corresponding unit tests.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Copilot

Pull request overview

Adds webhook HMAC signature validation to the Bitbucket Cloud provider to align with the existing signature-validation patterns used by other providers, and updates docs/tests accordingly.

Changes:

Implement HMAC signature validation in bitbucket-cloud provider Validate().
Add unit tests covering signature validation scenarios for Bitbucket Cloud.
Update Bitbucket Cloud provider documentation to describe configuring a webhook secret.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`pkg/provider/bitbucketcloud/bitbucket.go`	Adds signature-header extraction and HMAC verification in `Validate()`.
`pkg/provider/bitbucketcloud/bitbucket_test.go`	Introduces unit tests for Bitbucket Cloud webhook validation.
`docs/content/docs/providers/bitbucket-cloud.md`	Documents webhook secret configuration and reframes IP-checking as defense-in-depth.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

codecov · 2026-07-21T13:14:09Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.43%. Comparing base (c42a902) to head (6cbe058).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2870      +/-   ##
==========================================
- Coverage   68.45%   68.43%   -0.02%     
==========================================
  Files         197      197              
  Lines       16766    16777      +11     
==========================================
+ Hits        11477    11482       +5     
- Misses       4417     4423       +6     
  Partials      872      872

Flag	Coverage Δ
unit-tests	`68.43% <100.00%> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

theakshaypant · 2026-07-22T04:28:04Z

-func (v *Provider) Validate(_ context.Context, _ *params.Run, _ *info.Event) error {
-	return nil
+func (v *Provider) Validate(_ context.Context, _ *params.Run, event *info.Event) error {
+	signature := event.Request.Header.Get(github.SHA256SignatureHeader)


The docs suggest PaC validates X-Hub-Signature but github.SHA256SignatureHeader = X-Hub-Signature-256

Bitbucket Cloud sends SHA-256 signatures as X-Hub-Signature: sha256=. The current tests cover X-Hub-Signature-256 with SHA-256 and X-Hub-Signature with SHA-1, but not the format Bitbucket actually sends. Please update the docs and add a positive test for X-Hub-Signature with SHA-256.

See the doc: https://support.atlassian.com/bitbucket-cloud/docs/manage-webhooks/

yeah, this is weird bb cloud send X-Hub-Signature with sha256 prefix and calculated as sha256

zakisk · 2026-07-24T16:57:45Z

Paco Review ⚠️

This PR adds HMAC webhook signature validation to the Bitbucket Cloud provider by checking the X-Hub-Signature-256 (falling back to X-Hub-Signature) header and comparing it against a configured webhook secret using go-github's ValidateSignature helper. It also updates the Bitbucket Cloud docs to describe the new webhook-secret-based validation alongside the existing IP-based checks, and adds a table-driven test suite covering the new Validate logic.

_{Reviewed commit: 1e2dd36}

zakisk

Paco inline comments -- see the Paco Review summary comment for the overview.

theakshaypant

Minor suggestions for docs.

chmouel · 2026-07-29T11:41:40Z

all good for me but please consider fix the spelling as highlighted by akshay

zakisk · 2026-07-31T10:50:01Z

/retest

zakisk · 2026-07-31T13:41:04Z

/retest

Implement X-Hub-Signature / X-Hub-Signature-256 HMAC validation for Bitbucket Cloud webhooks, matching the existing GitHub and Bitbucket Data Center pattern. When a webhook_secret is configured on the Repository CR, incoming payloads are verified against the signature header. Repositories without a webhook_secret continue to rely on IP-based validation for backward compatibility. Signed-off-by: Zaki Shaikh <zashaikh@redhat.com> Assisted-by: Claude Opus 4.6 (via Claude Code)

zakisk · 2026-08-03T06:29:33Z

I think last week doc-deployment was failing due to cluster issue

zakisk · 2026-08-03T07:32:52Z

/retest

theakshaypant

LGTM, all earlier review comments have been addressed.

gemini-code-assist Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread pkg/provider/bitbucketcloud/bitbucket.go

Comment thread pkg/provider/bitbucketcloud/bitbucket_test.go

chmouel requested a review from Copilot July 21, 2026 13:06

Copilot started reviewing on behalf of chmouel July 21, 2026 13:07 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Comment thread pkg/provider/bitbucketcloud/bitbucket.go

Comment thread pkg/provider/bitbucketcloud/bitbucket_test.go

Comment thread docs/content/docs/providers/bitbucket-cloud.md Outdated

theakshaypant reviewed Jul 22, 2026

View reviewed changes

zakisk force-pushed the SRVKP-12223-bb-cloud-hmac-validation branch 2 times, most recently from b606f5d to 1e2dd36 Compare July 22, 2026 14:54

zakisk commented Jul 24, 2026

View reviewed changes

Comment thread pkg/provider/bitbucketcloud/bitbucket.go Outdated

Comment thread pkg/provider/bitbucketcloud/bitbucket_test.go Outdated

zakisk force-pushed the SRVKP-12223-bb-cloud-hmac-validation branch 3 times, most recently from ad70d85 to 248d89e Compare July 28, 2026 09:20

theakshaypant reviewed Jul 28, 2026

View reviewed changes

Comment thread pkg/provider/bitbucketcloud/bitbucket.go Outdated

Comment thread pkg/provider/bitbucketcloud/bitbucket.go

Comment thread docs/content/docs/providers/bitbucket-cloud.md Outdated

Comment thread docs/content/docs/providers/bitbucket-cloud.md Outdated

zakisk force-pushed the SRVKP-12223-bb-cloud-hmac-validation branch from 248d89e to 734b7cb Compare July 28, 2026 12:54

theakshaypant reviewed Jul 28, 2026

View reviewed changes

Comment thread docs/content/docs/providers/bitbucket-cloud.md Outdated

Comment thread docs/content/docs/providers/bitbucket-cloud.md Outdated

Comment thread docs/content/docs/providers/bitbucket-cloud.md Outdated

zakisk force-pushed the SRVKP-12223-bb-cloud-hmac-validation branch 3 times, most recently from 9b04119 to a849d4a Compare July 31, 2026 10:12

zakisk force-pushed the SRVKP-12223-bb-cloud-hmac-validation branch from a849d4a to 6cbe058 Compare August 3, 2026 06:11

theakshaypant approved these changes Aug 3, 2026

View reviewed changes

zakisk merged commit a5b9155 into tektoncd:main Aug 3, 2026
17 checks passed

zakisk deleted the SRVKP-12223-bb-cloud-hmac-validation branch August 3, 2026 07:49

Uh oh!

Conversation

zakisk commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Description of the Change

🔗 Linked GitHub Issue

🧪 Testing Strategy

🤖 AI Assistance

✅ Submitter Checklist

Uh oh!

zakisk commented Jul 21, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

theakshaypant Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

zakisk Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

chmouel Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

zakisk Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zakisk commented Jul 24, 2026

Paco Review ⚠️

Uh oh!

zakisk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

theakshaypant left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chmouel commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zakisk commented Jul 31, 2026

Uh oh!

zakisk commented Jul 31, 2026

Uh oh!

zakisk commented Aug 3, 2026

Uh oh!

zakisk commented Aug 3, 2026

Uh oh!

theakshaypant left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zakisk commented Jul 21, 2026 •

edited

Loading

codecov Bot commented Jul 21, 2026 •

edited

Loading

chmouel commented Jul 29, 2026 •

edited

Loading