Bitbucket Pipelines — Shieldome Docs

Overview

Shieldome can run as a pipeline step in Bitbucket Pipelines. The integration uses Shieldome's REST API to trigger a scan, wait for completion, and fail the build if vulnerabilities are found above your threshold.

Step 1 — Add your API key as a repository variable

In Bitbucket, open your repository → Repository settings → Pipelines → Repository variables
Name: SHIELDOME_API_KEY
Value: your Shieldome API key
Check Secured to mask it in logs
Click Add

Step 2 — Configure bitbucket-pipelines.yml

yaml

image: python:3.11-slim

pipelines:
  branches:
    main:
      - step:
          name: Build & Test
          script:
            - echo "your build steps here"

      - step:
          name: Shieldome Security Scan
          script:
            - pip install requests -q
            - |
              python3 - <<'EOF'
              import requests, time, sys, os

              base    = 'https://your-shieldome-url'
              target  = 'https://your-app-url.com'
              key     = os.environ['SHIELDOME_API_KEY']
              headers = {'X-Shieldome-Key': key}

              r = requests.post(f'{base}/api/scan',
                  json={'target_url': target, 'scan_type': 'vuln', 'scan_authorized': True},
                  headers=headers, timeout=30)
              r.raise_for_status()
              scan_id = r.json()['scan_id']
              print(f'Scan ID: {scan_id}')

              for _ in range(72):
                  time.sleep(10)
                  data = requests.get(f'{base}/api/scan/{scan_id}',
                      headers=headers, timeout=15).json()
                  if data.get('status') in ('completed', 'failed'):
                      break

              vulns = data.get('results', {}).get('vulnerabilities', [])
              critical = sum(1 for v in vulns if v.get('severity') == 'critical')
              high     = sum(1 for v in vulns if v.get('severity') == 'high')
              print(f'Critical: {critical}, High: {high}')

              if critical > 0:
                  print('Build FAILED: critical vulnerabilities detected.')
                  sys.exit(1)
              EOF

  pull-requests:
    '**':
      - step:
          name: Security Scan (PR)
          script:
            - echo "Same scan step as above — copy here for PR coverage"

Running on a schedule

Bitbucket Pipelines supports scheduled runs. Go to Repository settings → Pipelines → Schedules → Add schedule. Select your branch and set a cron expression. Use a separate pipeline definition under custom: for scheduled runs:

yaml

custom:
  weekly-security-scan:
    - step:
        name: Shieldome Weekly Scan
        script:
          - pip install requests -q
          - python3 shieldome_scan.py

💡

Tip: extract the scan script Save the Python script as shieldome_scan.py in your repository root instead of using an inline heredoc. This makes it easier to maintain and update without editing the pipeline YAML.