Description

In #6209, it turns out I mixed up Bitbucket access tokens with Bitbucket API tokens. API tokens are the chosen replacement for app passwords, which cannot longer be created starting from 2025-09-09 and will stop working as a whole starting from 2026-06-09 (source).

This PR adds actual support for API tokens instead of access tokens. Using access tokens, operations such as contacting the REST API were working correctly, but others such as cloning a repository weren't.

Guidelines for testing

• In bitbucket.org, create a private Nextflow pipeline repository.
• Create an API token ("Atlassian Account settings > Security tab > Create and manage API Tokens") and an app password ("Personal Bitbucket settings > App passwords > Create app password").
• In your local computer, create a SCM config file (scm_token.config) with the following contents for API token authentication:

providers {
    bitbucket {
        user = '<email>'
        token = '<API token>'
    }
}

• Run the pipeline; the repository is cloned correctly:

export NXF_SCM_FILE="$HOME/scm_token.config"
nextflow run https://bitbucket.org/<workspace>/<repo>

• In your local computer, create a SCM config file (scm_pass.config) with the following contents for app password authentication:

providers {
    bitbucket {
        user = '<username>'
        password = '<app password>'
    }
}

• Run the pipeline, the app password method keeps working correctly:

rm -rf ~/.nextflow/assets # Remove directory to make sure the repo is not fetched from local assets
export NXF_SCM_FILE="$HOME/scm_pass.config"
nextflow run https://bitbucket.org/<workspace>/<repo>