bitbucket-ci-doctor

Audit bitbucket-pipelines.yml for cost, security, and reliability gaps. Sister project to ci-doctor (GitHub Actions) and gitlab-ci-doctor (GitLab CI).

npx bitbucket-ci-doctor              # audit current repo
npx bitbucket-ci-doctor --markdown   # PR-comment friendly
npx bitbucket-ci-doctor --json       # machine-readable
npx bitbucket-ci-doctor --rules      # list checks
npx bitbucket-ci-doctor --demo       # smoke-test

Rules (8 in v0.1.0)

| ID | Severity | Category | Catches | | --------------------------- | -------- | -------- | -------------------------------------------------------------------------------------------------------- | | image-no-pin | warn | security | Top-level or step image: uses a floating tag (node:22, :latest...) instead of a digest. | | missing-max-time | warn | cost | Steps without max-time: default to 120 minutes; runaway steps burn build minutes. | | expensive-size | warn | cost | size: 2x/4x/8x without an obvious heavy build in the script. | | missing-caches | warn | cost | Step installs deps (npm, pip, bundler, gradle...) without declaring the matching built-in cache. | | service-no-pin | warn | security | definitions.services.<name>.image not pinned to a digest. | | deployment-no-environment | warn | security | deployment: value is not test/staging/production - env protections may not apply. | | artifact-no-paths | info | cost | artifacts: declared without paths or with a wildcard catch-all. | | after-script-leaks | warn | security | after-script: contains env, printenv, set -x, or echo $... - secrets may leak to logs. |

Drop into a Bitbucket pipeline

image: node@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
pipelines:
  pull-requests:
    '**':
      - step:
          name: ci-doctor
          max-time: 5
          caches:
            - node
          script:
            - npx --yes bitbucket-ci-doctor --markdown > ci-doctor.md
            - cat ci-doctor.md
          artifacts:
            - ci-doctor.md

Same engine pattern, different YAML

The audit engine is intentionally tiny and focused on Bitbucket Pipelines' quirks (its YAML structure, build minute cost model, and built-in caches). Pair with ci-doctor and gitlab-ci-doctor if you ship across multiple CI vendors.

MIT.

Sponsor / support depmedic

If this saved you 10 minutes of CI debugging, consider one of these. All of them keep the free CLIs free:

• Tip what you want — pay-what-you-want, $0 minimum: https://buy.polar.sh/polar_cl_tipjar?utm_source=npm&utm_medium=readme&utm_campaign=bitbucket-ci-doctor
• depmedic Pro $5/mo — one license, unlocks Pro tier in every depmedic CLI + the VS Code / Cursor extension, free access to every paid playbook for as long as you stay subscribed: https://buy.polar.sh/polar_cl_SUzmX5RCQCV8MJV3dDEBFMu3MGWu2WQhzZ1s02ZhK09?utm_source=npm&utm_medium=readme&utm_campaign=bitbucket-ci-doctor
• Everything Bundle $59 once — every paid playbook (current and future): https://buy.polar.sh/polar_cl_everything_bundle?utm_source=npm&utm_medium=readme&utm_campaign=bitbucket-ci-doctor
• Sponsor on GitHub — https://github.com/sponsors/depmedicdev-byte

More from depmedic

| | | | --- | --- | | ci-doctor | audit GitHub Actions for cost + security (16 rules) | | gitlab-ci-doctor | same engine for .gitlab-ci.yml (14 rules) | | bitbucket-ci-doctor | for bitbucket-pipelines.yml (8 rules) | | azure-pipelines-ci-doctor | for azure-pipelines.yml (8 rules) | | circleci-ci-doctor | for .circleci/config.yml (8 rules) | | gha-budget | $-denominated cost estimate of any GHA workflow | | pin-actions | one-shot SHA pinner for uses: blocks | | cursor-rules-init | scaffold .cursor/rules/ for your stack | | depmedic | all-in-one cli, finds outdated/risky deps | | depmedic/ci-doctor-action | composite GitHub Action: PR comment + SARIF |

In-browser scanners (no install): GitHub · GitLab · Bitbucket · Azure · CircleCI.

Newsletter (weekly, low-volume): https://depmedicdev-byte.github.io/newsletter.html?utm_source=npm&utm_medium=readme&utm_campaign=bitbucket-ci-doctor.