Skip to content

Require Bitbucket DC bot token + username when BBDC auth enabled #732

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ak684 merged 4 commits into from
Jun 18, 2026
+20 −6
Merged

Require Bitbucket DC bot token + username when BBDC auth enabled #732

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3c75dc2
Require Bitbucket DC bot token + bot username when BBDC auth enabled
ak684 Jun 18, 2026
ddb1a51
docs(codereview): document KOTS-layer integration credential enforcement
ak684 Jun 18, 2026
58263e9
chore(config): tidy BBDC bot token field; revert review-guide note
ak684 Jun 18, 2026
56e5daa
chore(config): trim BBDC bot token help text
ak684 Jun 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/openhands/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
description: OpenHands is an AI-driven autonomous software engineer
name: openhands
appVersion: cloud-1.38.0
version: 0.7.61
version: 0.7.62
maintainers:
- name: rbren
- name: xingyao
Expand Down
2 changes: 2 additions & 0 deletions charts/openhands/templates/_env.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,6 +200,8 @@
{{- if .Values.bitbucketDataCenter.enabled }}
- name: BITBUCKET_DATA_CENTER_HOST
value: {{ .Values.bitbucketDataCenter.host }}
- name: BITBUCKET_DATA_CENTER_BOT_USERNAME
value: {{ .Values.bitbucketDataCenter.botUsername | quote }}

@all-hands-bot all-hands-bot Jun 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Important: This adds the env var, but direct Helm installs render it as an empty string when bitbucketDataCenter.enabled=true and bitbucketDataCenter.botUsername is unset. In the same chart path, BITBUCKET_DATA_CENTER_BOT_TOKEN is still sourced from an optional secret key, so the chart still permits exactly the bot-less BBDC configuration this PR is trying to forbid. Please fail fast here (for example, required "bitbucketDataCenter.botUsername is required when bitbucketDataCenter.enabled=true" .Values.bitbucketDataCenter.botUsername and make the bot-token secret key non-optional or add an explicit required value/schema path), and update charts/openhands/README.md's BBDC secret/values example to include both bot credentials.

- name: BITBUCKET_DATA_CENTER_CLIENT_ID
valueFrom:
secretKeyRef:
Expand Down
1 change: 1 addition & 0 deletions charts/openhands/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,7 @@ secretsChecksum: ""
bitbucketDataCenter:
enabled: false
host: ""
botUsername: ""

azureDevOps:
enabled: false
Expand Down
20 changes: 15 additions & 5 deletions replicated/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -553,14 +553,24 @@ spec:
when: 'repl{{ ConfigOptionEquals "bitbucket_data_center_auth_enabled" "1" }}'
required: true
- name: bitbucket_data_center_bot_token
title: Bitbucket Data Center Bot Token (strongly recommended)
title: Bitbucket Data Center Bot Token
help_text: >-
HTTP access token for a dedicated bot user with repo access. When
set, OpenHands posts comments and reactions as the bot instead of
as the mentioning user or installer; jobs still run on the invoking
user's workspace.
HTTP access token (Repository write) for a dedicated bot user with
access to the target repos. OpenHands posts comments and reactions
as this bot -- not as the mentioning user -- so its own replies
don't re-trigger jobs; the agent still runs on the invoking user's
workspace.
type: password
when: 'repl{{ ConfigOptionEquals "bitbucket_data_center_auth_enabled" "1" }}'
required: true
- name: bitbucket_data_center_bot_username
title: Bitbucket Data Center Bot Username
help_text: >-
Username (slug) of the bot account above, e.g. openhands. Used to
ignore the bot's own comments so its replies don't re-trigger jobs.
type: text
when: 'repl{{ ConfigOptionEquals "bitbucket_data_center_auth_enabled" "1" }}'
required: true

- name: azure_devops_authentication
title: Azure DevOps Authentication
Expand Down
1 change: 1 addition & 0 deletions replicated/openhands.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,6 +403,7 @@ spec:
bitbucketDataCenter:
enabled: repl{{ ConfigOptionEquals "bitbucket_data_center_auth_enabled" "1" }}
host: 'repl{{ ConfigOption "bitbucket_data_center_domain" }}'
botUsername: 'repl{{ ConfigOption "bitbucket_data_center_bot_username" }}'
azureDevOps:
enabled: repl{{ ConfigOptionEquals "azure_devops_auth_enabled" "1" }}
tenantId: 'repl{{ ConfigOption "azure_devops_tenant_id" }}'
Expand Down
Loading