在 BitBucket 中设置管道

Question

我在 Bitbucket 中设置管道以将我的存储库连接到 DeBricked（一种在线代码扫描服务）时遇到问题。这是描述集成的 YAML 文件：

image: atlassian/default-image:3

pipelines:
  default:
    - parallel:
      - step:
          name: 'DeBricked Integration'
          script:
            - git config --global --add safe.directory /opt/atlassian/pipelines/agent/build
            - pipe: debricked/debricked-scan:3.0.0
              variables:
                DEBRICKED_TOKEN: $DEBRICKED_TOKEN
                # BASE_DIRECTORY: "<string>" # Optional
                # DEBRICKED_EXCLUSIONS: "<string>" # Optional

如你所见，我在声明中添加了：

    - git config --global --add safe.directory /opt/atlassian/pipelines/agent/build

（我在其他地方看到的文档和提示显示该语句没有 - 前缀，但是我摆弄了语法，发现使其有效的唯一方法是插入 - 前缀。）

但是，我仍然遇到致命错误：

fatal: detected dubious ownership in repository at '/opt/atlassian/pipelines/agent/build'

（我看过其他文章建议添加纠正性声明应该可以解决问题。但是，这对我不起作用。）

管道执行的输出表明该语句正在执行，这表明执行时间不到1秒：

但是，这并不能阻止错误的发生。错误消息包含一条诊断信息，指出如果我将该命令添加到我的脚本中，它将阻止该错误，但我无法让它按照广告那样工作。

Status: Downloaded newer image for debricked/debricked-scan:3.0.0
fatal: detected dubious ownership in repository at '/opt/atlassian/pipelines/agent/build'
To add an exception for this directory, call:
    git config --global --add safe.directory /opt/atlassian/pipelines/agent/build

这是 pipe 步骤的完整执行输出。

+ docker container run \
   --volume=/opt/atlassian/pipelines/agent/build:/opt/atlassian/pipelines/agent/build \
   --volume=/opt/atlassian/pipelines/agent/ssh:/opt/atlassian/pipelines/agent/ssh:ro \
   --volume=/usr/local/bin/docker:/usr/local/bin/docker:ro \
   --volume=/opt/atlassian/pipelines/agent/build/.bitbucket/pipelines/generated/pipeline/pipes:/opt/atlassian/pipelines/agent/build/.bitbucket/pipelines/generated/pipeline/pipes \
   --volume=/opt/atlassian/pipelines/agent/build/.bitbucket/pipelines/generated/pipeline/pipes/debricked/debricked-scan:/opt/atlassian/pipelines/agent/build/.bitbucket/pipelines/generated/pipeline/pipes/debricked/debricked-scan \
   --workdir=$(pwd) \
   --label=org.bitbucket.pipelines.system=true \
   --env=BITBUCKET_STEP_TRIGGERER_UUID="$BITBUCKET_STEP_TRIGGERER_UUID" \
   --env=BITBUCKET_REPO_FULL_NAME="$BITBUCKET_REPO_FULL_NAME" \
   --env=BITBUCKET_GIT_HTTP_ORIGIN="$BITBUCKET_GIT_HTTP_ORIGIN" \
   --env=BITBUCKET_PROJECT_UUID="$BITBUCKET_PROJECT_UUID" \
   --env=BITBUCKET_REPO_IS_PRIVATE="$BITBUCKET_REPO_IS_PRIVATE" \
   --env=BITBUCKET_WORKSPACE="$BITBUCKET_WORKSPACE" \
   --env=BITBUCKET_SSH_KEY_FILE="$BITBUCKET_SSH_KEY_FILE" \
   --env=BITBUCKET_REPO_OWNER_UUID="$BITBUCKET_REPO_OWNER_UUID" \
   --env=BITBUCKET_BRANCH="$BITBUCKET_BRANCH" \
   --env=BITBUCKET_REPO_UUID="$BITBUCKET_REPO_UUID" \
   --env=BITBUCKET_PROJECT_KEY="$BITBUCKET_PROJECT_KEY" \
   --env=BITBUCKET_PARALLEL_STEP_COUNT="$BITBUCKET_PARALLEL_STEP_COUNT" \
   --env=BITBUCKET_REPO_SLUG="$BITBUCKET_REPO_SLUG" \
   --env=CI="$CI" \
   --env=BITBUCKET_REPO_OWNER="$BITBUCKET_REPO_OWNER" \
   --env=BITBUCKET_PARALLEL_STEP="$BITBUCKET_PARALLEL_STEP" \
   --env=BITBUCKET_STEP_RUN_NUMBER="$BITBUCKET_STEP_RUN_NUMBER" \
   --env=BITBUCKET_BUILD_NUMBER="$BITBUCKET_BUILD_NUMBER" \
   --env=BITBUCKET_GIT_SSH_ORIGIN="$BITBUCKET_GIT_SSH_ORIGIN" \
   --env=BITBUCKET_PIPELINE_UUID="$BITBUCKET_PIPELINE_UUID" \
   --env=BITBUCKET_COMMIT="$BITBUCKET_COMMIT" \
   --env=BITBUCKET_CLONE_DIR="$BITBUCKET_CLONE_DIR" \
   --env=PIPELINES_JWT_TOKEN="$PIPELINES_JWT_TOKEN" \
   --env=BITBUCKET_STEP_UUID="$BITBUCKET_STEP_UUID" \
   --env=BITBUCKET_DOCKER_HOST_INTERNAL="$BITBUCKET_DOCKER_HOST_INTERNAL" \
   --env=DOCKER_HOST="tcp://host.docker.internal:2375" \
   --env=BITBUCKET_PIPE_SHARED_STORAGE_DIR="/opt/atlassian/pipelines/agent/build/.bitbucket/pipelines/generated/pipeline/pipes" \
   --env=BITBUCKET_PIPE_STORAGE_DIR="/opt/atlassian/pipelines/agent/build/.bitbucket/pipelines/generated/pipeline/pipes/debricked/debricked-scan" \
   --env=DEBRICKED_TOKEN="$DEBRICKED_TOKEN" \
   --add-host="host.docker.internal:$BITBUCKET_DOCKER_HOST_INTERNAL" \
   debricked/debricked-scan:3.0.0
Unable to find image 'debricked/debricked-scan:3.0.0' locally
3.0.0: Pulling from debricked/debricked-scan
7264a8db6415: Pulling fs layer
8928de6d3c14: Pulling fs layer
4f4fb700ef54: Pulling fs layer
2b7ef838e455: Pulling fs layer
e173fea3cade: Pulling fs layer
fc7af08a16d5: Pulling fs layer
7fee9dc293a1: Pulling fs layer
c4f131ca463e: Pulling fs layer
ae3bb37734a1: Pulling fs layer
1d9fdbb6c760: Pulling fs layer
fc7af08a16d5: Waiting
7fee9dc293a1: Waiting
c4f131ca463e: Waiting
ae3bb37734a1: Waiting
2b7ef838e455: Waiting
e173fea3cade: Waiting
1d9fdbb6c760: Waiting
7264a8db6415: Download complete
4f4fb700ef54: Download complete
7264a8db6415: Pull complete
8928de6d3c14: Verifying Checksum
8928de6d3c14: Download complete
2b7ef838e455: Verifying Checksum
2b7ef838e455: Download complete
8928de6d3c14: Pull complete
4f4fb700ef54: Pull complete
fc7af08a16d5: Verifying Checksum
fc7af08a16d5: Download complete
2b7ef838e455: Pull complete
c4f131ca463e: Verifying Checksum
c4f131ca463e: Download complete
ae3bb37734a1: Download complete
1d9fdbb6c760: Verifying Checksum
1d9fdbb6c760: Download complete
7fee9dc293a1: Download complete
e173fea3cade: Verifying Checksum
e173fea3cade: Download complete
e173fea3cade: Pull complete
fc7af08a16d5: Pull complete
7fee9dc293a1: Pull complete
c4f131ca463e: Pull complete
ae3bb37734a1: Pull complete
1d9fdbb6c760: Pull complete
Digest: sha256:604965fecd783c47bb88386c********62a4d5ef6933175be616d978ba4a68e3
Status: Downloaded newer image for debricked/debricked-scan:3.0.0
fatal: detected dubious ownership in repository at '/opt/atlassian/pipelines/agent/build'
To add an exception for this directory, call:
    git config --global --add safe.directory /opt/atlassian/pipelines/agent/build
Integration: bitbucket
Working directory: /opt/atlassian/pipelines/agent/build

Answer 1

根据我的经验，这是由管道中的 git 版本中未公布的更新触发的，并且

git config --global --add safe.directory /opt/atlassian/pipelines/agent/build

指令必须在管道中（例如在其 Dockerfile 中）完成，而不是在管道步骤脚本中完成。

这是因为该指令将为管道用户更改

$HOME/.gitconfig

，但它并未安装在管道中，正如您从 docker run 指令中的

--volume

标志中看到的那样。

您可以尝试删除

[--global]

标志，看看这是否会将配置值移动到

/opt/atlassian/pipelines/agent/build/.git/config

中，它确实已安装到管道中，并且仍然受到尊重。

Answer 2

这就是答案。最终，这里的主要问题是供应商的文档不完善。

DeBricked 在公共 Bitbucket 帐户中托管此管道的示例。我当然无法执行管道，但我可以查看日志结果。

https://bitbucket.org/debricked/example-use-of-debricked-pipe/pipelines/results/21

你瞧，发出了同样的“致命”错误（显然不是那么致命），但脚本继续执行，并且完成后结果与预期一致！

最终，这里没有问题。因此，如果您在此特定集成中收到此异常，只需允许脚本继续；尽管有例外，您应该会看到预期的结果。