Bitbucket Pipelines

Reference the pipe in bitbucket-pipelines.yml, no plugin to install. It runs an offline compliance scan, writes SARIF, and can fail the build on severity. Your code never leaves the runner.

01 · Setup

2 steps.

01Add the pipe step

Reference the pipe in your bitbucket-pipelines.yml with your frameworks and gating severity.

pipelines:
  pull-requests:
    '**':
      - step:
          name: Compliance scan
          script:
            - pipe: docker://nirvahana/scrutora-scan-pipe:1.1.1
              variables:
                FRAMEWORKS: dpdpa,hipaa
                FAIL_ON: high      # none|low|medium|high|critical

02Run the pipeline

The pipe scans offline and writes SARIF. When FAIL_ON is set, a finding at or above that severity fails the step and blocks the pull request.

02 · What you get

After the first run.

No plugin install

It's a standard Bitbucket pipe. Just reference it in your YAML.

Build gating

FAIL_ON fails the step on high/critical findings, or run report-only.

SARIF output

Standard SARIF v2.1.0 for download and downstream tooling.

Obligation citations

Each finding maps to the exact DPDPA/HIPAA obligation.

03 · Questions

The ones people actually ask.

Do I need to install anything?

No. Reference the pipe in bitbucket-pipelines.yml, Bitbucket pulls the image and runs it.

Which frameworks can I scan for?

DPDPA, HIPAA, GDPR, PCI-DSS, RBI and more, set the FRAMEWORKS variable.

Is it free?

Yes, the CI scanning is free with no API key or account.

Bitbucket repository

04 · Try itPUBLIC REPOSITORIES

Wire it into a build.

A public repository, read once and not kept. You get the data map: every personal-data field, where it lands, and who receives it. Or run the container on your own runner, and the source never reaches us.