Pub from Bitbucket Pipelines

Bitbucket Pipelines jobs read and publish your private packages with no stored secret: each job exchanges its own identity token for a Pub token that lasts 15 minutes. How it works on every provider is on Pub from CI.

1. Trust the issuer

Each Bitbucket workspace has its own issuer, so an Owner adds it first: in CI access, under This organization's own CI issuers, choose Bitbucket Pipelines and enter the workspace's URL name.

[TODO: screenshot of This organization's own CI issuers with Bitbucket Pipelines chosen and a workspace entered]

2. Bind the repository

In the Control Room, open Organization, then CI access, Bind a repository, and choose Bitbucket Pipelines. The form asks for:

Repository UUID: in Bitbucket, Repository settings, OpenID Connect: the repository's UUID, braces included.
Workspace UUID: on the same page: the workspace's UUID.
Deployment environment UUID, optional: on the same page, for a step with deployment:. Its deployment permissions then gate every exchange.
Ref pattern, optional: a branch: refs/heads/main. Bitbucket's token names a branch only, never a tag.

Then grant the binding its packages with its Packages button: read, or read and publish.

[TODO: screenshot of Bitbucket's Repository settings, OpenID Connect page, showing the repository and workspace UUIDs]

[TODO: screenshot of the Bind a repository dialog with the Bitbucket issuer chosen and the UUIDs filled in]

3. Exchange in the job

Put your organization id, from the same Organization screen, in DARTASTIC_ORG_ID. This job publishes; for one that only reads, drop dart pub publish and grant the binding read only.

yaml

# bitbucket-pipelines.yml: publish from main
image: dart:stable
pipelines:
  branches:
    main:
      - step:
          name: Publish
          deployment: production   # optional: bind the environment too
          oidc: true
          script:
            - export DARTASTIC_ORG_ID="<your organization id>"
            - apt-get update -qq && apt-get install -y -qq jq
            - |
              RESP=$(curl -sS --fail-with-body -X POST https://api.dartastic.io/v1/ci/exchange \
                -H "Authorization: Bearer $BITBUCKET_STEP_OIDC_TOKEN" -H "Content-Type: application/json" \
                -d "{\"orgId\":\"$DARTASTIC_ORG_ID\"}") || { echo "$RESP" >&2; exit 1; }
              export PUB_TOKEN=$(echo "$RESP" | jq -er .token)
              dart pub token add https://pub.dartastic.io --env-var PUB_TOKEN
            - dart pub get
            - dart pub publish --force
options:
  oidc:
    audiences:
      - https://dartastic.io

oidc: true on the step gives it $BITBUCKET_STEP_OIDC_TOKEN, and the audiences list under oidc: sets its audience to https://dartastic.io.
Bitbucket's token names the repository by UUID only, which is why the binding takes UUIDs.

When it is refused

The job's log shows the reason first, such as TRUSTED PUBLISHER REF MISMATCH. Every reason and what to do is on Pub from CI. Bitbucket Pipelines's own guide to its tokens is in its documentation.