Skip to content

Commit 1ef5f9f

Browse files
brendan-kellambrendan-kellam
authored
Merge branch 'main' into bkellam/posthog-ai
2 parents 3e5b31a + 9173835 commit 1ef5f9f

31 files changed

Lines changed: 1234 additions & 48 deletions

File tree

‎.github/workflows/deploy-railway.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Deploy to Railway
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Release Sourcebot (Development)"]
6+
types: [completed]
7+
8+
concurrency:
9+
group: deploy-railway
10+
cancel-in-progress: false
11+
12+
jobs:
13+
deploy:
14+
name: Deploy to Railway
15+
runs-on: ubuntu-latest
16+
container: ghcr.io/railwayapp/cli:latest
17+
if: ${{ github.event.workflow_run.conclusion == 'success' }}
18+
env:
19+
RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
20+
21+
steps:
22+
- name: Deploy image to Railway
23+
run: railway redeploy --service=sourcebot --yes

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
99

1010
### Added
1111
- Added PostHog events for chat UI interactions (details card expand/collapse, copy answer, table of contents toggle) and repo tracking in `wa_chat_message_sent`. [#922](https://github.com/sourcebot-dev/sourcebot/pull/922)
12+
- Added Bitbucket Cloud OAuth identity provider support (`provider: "bitbucket-cloud"`) for SSO and account-linked permission syncing. [#924](https://github.com/sourcebot-dev/sourcebot/pull/924)
13+
- Added permission syncing support for Bitbucket Cloud. [#925](https://github.com/sourcebot-dev/sourcebot/pull/925)
14+
15+
### Changed
16+
- Hide version upgrade toast for askgithub deployment (`EXPERIMENT_ASK_GH_ENABLED`). [#931](https://github.com/sourcebot-dev/sourcebot/pull/931)
17+
18+
### Fixed
19+
- Fixed text inside angle brackets (e.g., `<id>`) being hidden in chat prompt display due to HTML parsing. [#929](https://github.com/sourcebot-dev/sourcebot/pull/929) [#932](https://github.com/sourcebot-dev/sourcebot/pull/932)
1220

1321
## [4.11.7] - 2026-02-23
1422

‎docs/docs/configuration/idp.mdx‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,59 @@ in the GitLab identity provider config.
165165
</Steps>
166166
</Accordion>
167167

168+
### Bitbucket Cloud
169+
170+
[Auth.js Bitbucket Provider Docs](https://authjs.dev/getting-started/providers/bitbucket)
171+
172+
A Bitbucket Cloud connection can be used for [authentication](/docs/configuration/auth) and/or [permission syncing](/docs/features/permission-syncing). This is controlled using the `purpose` field
173+
in the Bitbucket Cloud identity provider config.
174+
175+
<Accordion title="instructions">
176+
<Steps>
177+
<Step title="Register an OAuth Consumer">
178+
To begin, you must register an OAuth consumer in Bitbucket to facilitate the identity provider connection.
179+
180+
Navigate to your Bitbucket workspace settings at `https://bitbucket.org/<your-workspace>/workspace/settings/api` and create a new **OAuth consumer** under the **OAuth consumers** section.
181+
182+
When configuring your consumer:
183+
- Set the callback URL to `<sourcebot_url>/api/auth/callback/bitbucket-cloud` (ex. https://sourcebot.coolcorp.com/api/auth/callback/bitbucket-cloud)
184+
- Enable **Account: Read**
185+
- If using for permission syncing, also enable **Repositories: Read**
186+
187+
The result of creating an OAuth consumer is a `Key` (`CLIENT_ID`) and `Secret` (`CLIENT_SECRET`) which you'll provide to Sourcebot.
188+
</Step>
189+
<Step title="Define environment variables">
190+
To provide Sourcebot the client id and secret for your OAuth consumer you must set them as environment variables. These can be named whatever you like
191+
(ex. `BITBUCKET_CLOUD_IDENTITY_PROVIDER_CLIENT_ID` and `BITBUCKET_CLOUD_IDENTITY_PROVIDER_CLIENT_SECRET`)
192+
</Step>
193+
<Step title="Define the identity provider config">
194+
Finally, pass the client id and secret to Sourcebot by defining a `identityProvider` object in the [config file](/docs/configuration/config-file):
195+
196+
```json wrap icon="code"
197+
{
198+
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
199+
"identityProviders": [
200+
{
201+
"provider": "bitbucket-cloud",
202+
// "sso" for auth + perm sync, "account_linking" for only perm sync
203+
"purpose": "account_linking",
204+
// if purpose == "account_linking" this controls if a user must connect to the IdP
205+
"accountLinkingRequired": true,
206+
"clientId": {
207+
"env": "YOUR_CLIENT_ID_ENV_VAR"
208+
},
209+
"clientSecret": {
210+
"env": "YOUR_CLIENT_SECRET_ENV_VAR"
211+
}
212+
}
213+
]
214+
}
215+
```
216+
</Step>
217+
</Steps>
218+
</Accordion>
219+
220+
168221
### Google
169222

170223
[Auth.js Google Provider Docs](https://authjs.dev/getting-started/providers/google)

‎docs/docs/features/permission-syncing.mdx‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ We are actively working on supporting more code hosts. If you'd like to see a sp
3939
|:----------|------------------------------|
4040
| [GitHub (GHEC & GHEC Server)](/docs/features/permission-syncing#github) | ✅ |
4141
| [GitLab (Self-managed & Cloud)](/docs/features/permission-syncing#gitlab) | ✅ |
42-
| Bitbucket Cloud | 🛑 |
42+
| [Bitbucket Cloud](/docs/features/permission-syncing#bitbucket-cloud) | 🟠 Partial |
4343
| Bitbucket Data Center | 🛑 |
4444
| Gitea | 🛑 |
4545
| Gerrit | 🛑 |
@@ -78,6 +78,28 @@ Permission syncing works with **GitLab Self-managed** and **GitLab Cloud**. User
7878
- OAuth tokens require the `read_api` scope in order to use the [List projects for the authenticated user API](https://docs.gitlab.com/ee/api/projects.html#list-all-projects) during [User driven syncing](/docs/features/permission-syncing#how-it-works).
7979
- [Internal GitLab projects](https://docs.gitlab.com/user/public_access/#internal-projects-and-groups) are **not** enforced by permission syncing and therefore are visible to all users. Only [private projects](https://docs.gitlab.com/user/public_access/#private-projects-and-groups) are enforced.
8080

81+
## Bitbucket Cloud
82+
83+
Prerequisites:
84+
- Configure Bitbucket Cloud as an [external identity provider](/docs/configuration/idp).
85+
86+
Permission syncing works with **Bitbucket Cloud**. OAuth tokens must assume the `account` and `repository` scopes.
87+
88+
<Warning>
89+
**Partial coverage for repo-driven syncing.** Bitbucket Cloud's [repository user permissions API](https://developer.atlassian.com/cloud/bitbucket/rest/api-group-repositories/#api-repositories-workspace-repo-slug-permissions-config-users-get) only returns users who have been **directly and explicitly** granted access to a repository. Users who have access via any of the following are **not** captured by repo-driven syncing:
90+
91+
- Membership in a [group that is added to the repository](https://support.atlassian.com/bitbucket-cloud/docs/grant-repository-access-to-users-and-groups/)
92+
- Membership in the [project that contains the repository](https://support.atlassian.com/bitbucket-cloud/docs/configure-project-permissions-for-users-and-groups/)
93+
- Membership in a group that is part of a project containing the repository
94+
95+
These users **will** still gain access via [user-driven syncing](/docs/features/permission-syncing#how-it-works), which fetches all private repositories accessible to each authenticated user. However, there may be a delay between when a repository is added and when affected users gain access in Sourcebot (up to the `experiment_userDrivenPermissionSyncIntervalMs` interval, which defaults to 24 hours).
96+
97+
If your workspace relies heavily on group or project-level permissions rather than direct user grants, we recommend reducing the `experiment_userDrivenPermissionSyncIntervalMs` interval to limit the window of delay.
98+
</Warning>
99+
100+
**Notes:**
101+
- A Bitbucket Cloud [external identity provider](/docs/configuration/idp) must be configured to (1) correlate a Sourcebot user with a Bitbucket Cloud user, and (2) to list repositories that the user has access to for [User driven syncing](/docs/features/permission-syncing#how-it-works).
102+
- OAuth tokens require the `account` and `repository` scopes. The `repository` scope is required to list private repositories during [User driven syncing](/docs/features/permission-syncing#how-it-works).
81103

82104
# How it works
83105

‎docs/snippets/schemas/v3/identityProvider.schema.mdx‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -648,6 +648,91 @@
648648
"audience"
649649
]
650650
},
651+
"BitbucketCloudIdentityProviderConfig": {
652+
"type": "object",
653+
"additionalProperties": false,
654+
"properties": {
655+
"provider": {
656+
"const": "bitbucket-cloud"
657+
},
658+
"purpose": {
659+
"enum": [
660+
"sso",
661+
"account_linking"
662+
]
663+
},
664+
"clientId": {
665+
"anyOf": [
666+
{
667+
"type": "object",
668+
"properties": {
669+
"env": {
670+
"type": "string",
671+
"description": "The name of the environment variable that contains the token."
672+
}
673+
},
674+
"required": [
675+
"env"
676+
],
677+
"additionalProperties": false
678+
},
679+
{
680+
"type": "object",
681+
"properties": {
682+
"googleCloudSecret": {
683+
"type": "string",
684+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
685+
}
686+
},
687+
"required": [
688+
"googleCloudSecret"
689+
],
690+
"additionalProperties": false
691+
}
692+
]
693+
},
694+
"clientSecret": {
695+
"anyOf": [
696+
{
697+
"type": "object",
698+
"properties": {
699+
"env": {
700+
"type": "string",
701+
"description": "The name of the environment variable that contains the token."
702+
}
703+
},
704+
"required": [
705+
"env"
706+
],
707+
"additionalProperties": false
708+
},
709+
{
710+
"type": "object",
711+
"properties": {
712+
"googleCloudSecret": {
713+
"type": "string",
714+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
715+
}
716+
},
717+
"required": [
718+
"googleCloudSecret"
719+
],
720+
"additionalProperties": false
721+
}
722+
]
723+
},
724+
"accountLinkingRequired": {
725+
"type": "boolean",
726+
"default": false
727+
}
728+
},
729+
"required": [
730+
"provider",
731+
"purpose",
732+
"clientId",
733+
"clientSecret"
734+
]
735+
},
651736
"AuthentikIdentityProviderConfig": {
652737
"type": "object",
653738
"additionalProperties": false,
@@ -1511,6 +1596,91 @@
15111596
"clientSecret",
15121597
"issuer"
15131598
]
1599+
},
1600+
{
1601+
"type": "object",
1602+
"additionalProperties": false,
1603+
"properties": {
1604+
"provider": {
1605+
"const": "bitbucket-cloud"
1606+
},
1607+
"purpose": {
1608+
"enum": [
1609+
"sso",
1610+
"account_linking"
1611+
]
1612+
},
1613+
"clientId": {
1614+
"anyOf": [
1615+
{
1616+
"type": "object",
1617+
"properties": {
1618+
"env": {
1619+
"type": "string",
1620+
"description": "The name of the environment variable that contains the token."
1621+
}
1622+
},
1623+
"required": [
1624+
"env"
1625+
],
1626+
"additionalProperties": false
1627+
},
1628+
{
1629+
"type": "object",
1630+
"properties": {
1631+
"googleCloudSecret": {
1632+
"type": "string",
1633+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
1634+
}
1635+
},
1636+
"required": [
1637+
"googleCloudSecret"
1638+
],
1639+
"additionalProperties": false
1640+
}
1641+
]
1642+
},
1643+
"clientSecret": {
1644+
"anyOf": [
1645+
{
1646+
"type": "object",
1647+
"properties": {
1648+
"env": {
1649+
"type": "string",
1650+
"description": "The name of the environment variable that contains the token."
1651+
}
1652+
},
1653+
"required": [
1654+
"env"
1655+
],
1656+
"additionalProperties": false
1657+
},
1658+
{
1659+
"type": "object",
1660+
"properties": {
1661+
"googleCloudSecret": {
1662+
"type": "string",
1663+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
1664+
}
1665+
},
1666+
"required": [
1667+
"googleCloudSecret"
1668+
],
1669+
"additionalProperties": false
1670+
}
1671+
]
1672+
},
1673+
"accountLinkingRequired": {
1674+
"type": "boolean",
1675+
"default": false
1676+
}
1677+
},
1678+
"required": [
1679+
"provider",
1680+
"purpose",
1681+
"clientId",
1682+
"clientSecret"
1683+
]
15141684
}
15151685
]
15161686
}

0 commit comments

Comments
 (0)