Security steps in Bitbucket Pipelines

As of this writing, Snyk is the only security provider that can deeply integrate with Bitbucket Cloud. Adding Snyk as a security provider allows additional security scans into the repository as steps of the development workflow. Part of this workflow includes running security scans in Bitbucket Pipelines. Let’s see how that’s done.

How to do it…

Snyk uses pipes to integrate with pipelines defined in bitbucket-pipelines.yml. Let’s look at how to set it up:

1. Add the Snyk pipe to the script section of your testing step in the pipeline. Required variables include the Snyk token, the language used (node, ruby, composer, dotnet, or docker), and the image name if the language is set to docker. The following code snippet shows the usage for scanning a Node.js application:

   script:
     - npm install
     - npm test
     - pipe: snyk/snyk-scan:1.0.1
       variables:
     ...