Skip to main content

Bitbucket Pipelines

1. Store the key​

In Repository settings → Pipelines → Repository variables, add MOATGATOR_API_KEY (mg_live_…, scopes builds:write, builds:read) and tick Secured. Secured variables are masked in logs.

2. Add the step​

bitbucket-pipelines.yml
image: node:22-bookworm-slim

pipelines:
  tags:
    "v*":
      - step:
          name: Build
          image: mingc/android-build-box:latest # or your own Android image
          script:
            - ./gradlew bundleRelease
          artifacts:
            - app/build/outputs/bundle/release/*.aab
      - step:
          name: Moatgator
          script:
            - npx moatgator scan app/build/outputs/bundle/release/app-release.aab --min-grade C
            - npx moatgator protect app/build/outputs/bundle/release/app-release.aab --app-version "$BITBUCKET_TAG" --commit "$BITBUCKET_COMMIT"

Notes​

  • The pipeline runs only for tags (v*); pull-request pipelines from forks do not receive secured variables.
  • Pin the build image by digest in production.
  • Exit codes are in the CI overview.