fix: Update Go-SCM to v1.15.17 for Bitbucket Group Permissions by tricktron · Pull Request #2479 · tektoncd/pipelines-as-code

tricktron · 2026-02-13T10:07:17Z

📝 Description of the Change

Bumps vendored jenkins-x/go-scm to v1.15.17 to fix three bugs in Bitbucket Data Center group-based permission checking: URL-encoding of group names with spaces, error short-circuiting that aborted authorization checks, and missing repository-level group permission lookups. Adds missing test mock for repo-level group permissions to fix test failures caused by the new IsCollaborator() group lookup.

Changes

Update go-scm dependency to support Bitbucket Data Center users with project or repo access through groups
Add MuxRepoGroupMembership test helper and wire it into acl_test.go to mock the new /permissions/groups endpoint hit by IsCollaborator()

👨🏻‍ Linked Jira

🔗 Linked GitHub Issue

Fixes #2477

🚀 Type of Change

🧪 Testing Strategy

🤖 AI Assistance

I have not used any AI assistance for this PR.
I have used AI assistance for this PR.

If you have used AI assistance, please provide the following details:

Which LLM was used?

Extent of AI Assistance:

Documentation and research only
Unit tests or E2E tests only
Code generation (parts of the code)
Full code generation (most of the PR)
PR description and comments
Commit message(s)

Important

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Gemini gemini@google.com
Co-authored-by: ChatGPT noreply@chatgpt.com
Co-authored-by: Claude noreply@anthropic.com
Co-authored-by: Cursor noreply@cursor.com
Co-authored-by: Copilot Copilot@users.noreply.github.com

**💡You can use the script ./hack/add-llm-coauthor.sh to automatically add
these co-author trailers to your commits.

✅ Submitter Checklist

Fixes group membership checks in Bitbucket Server by properly URL-encoding group names and checking repository-level group permissions.

Enables testing ACL checks for repository-level group permissions alongside existing project-level group checks.

gemini-code-assist · 2026-02-13T10:07:37Z

Summary of Changes

Hello @tricktron, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the reliability and accuracy of Bitbucket Data Center authorization by upgrading a core dependency. The changes ensure that group-based permissions, especially those involving spaces in group names and repository-level access, are correctly evaluated, resolving long-standing issues that could lead to incorrect access decisions.

Highlights

Dependency Update: The github.com/jenkins-x/go-scm dependency has been updated to version v1.15.17.
Bitbucket Data Center Group Permissions Fixes: This update addresses three critical bugs in Bitbucket Data Center's group-based permission checking: incorrect URL-encoding for group names with spaces, premature error short-circuiting during authorization, and missing repository-level group permission lookups.
Test Infrastructure Enhancement: A new test helper, MuxRepoGroupMembership, has been added and integrated into acl_test.go to accurately mock the new /permissions/groups endpoint used by IsCollaborator() for repository-level group lookups, preventing test failures.

Changelog

go.mod
- Updated github.com/jenkins-x/go-scm dependency from v1.15.16 to v1.15.17.
go.sum
- Updated checksums for github.com/jenkins-x/go-scm to reflect the new version.
pkg/provider/bitbucketdatacenter/acl_test.go
- Added repoGroups field to the test case struct to support repository-level group permissions.
- Integrated bbv1test.MuxRepoGroupMembership to mock repository group permissions during tests.
pkg/provider/bitbucketdatacenter/test/test.go
- Introduced MuxRepoGroupMembership function to mock Bitbucket Data Center repository group permission API calls.
vendor/github.com/jenkins-x/go-scm/scm/driver/stash/org.go
- Imported net/url for URL encoding.
- Refactored ListOrgMembers and IsMember to use projectUsersPermissionsPath helper.
- Introduced isRequestedUser helper function for consistent user comparison.
- Refactored IsMember to use isUserInGroups for checking group memberships and handle errors more gracefully.
- Modified usersInGroups to URL-encode group names when querying for members.
- Added projectUsersPermissionsPath helper to construct project user permissions API paths.
- Optimized slice pre-allocation in convertParticipantsToTeamMembers and convertProjectList.
vendor/github.com/jenkins-x/go-scm/scm/driver/stash/repo.go
- Modified IsCollaborator to include checks for repository-level group permissions.
- Introduced getRepoGroups function to fetch groups with permissions for a specific repository.
- Utilized isUserInGroups helper for checking user membership within repository groups.
vendor/modules.txt
- Updated the vendored github.com/jenkins-x/go-scm version to v1.15.17.

Activity

The pull request updates the go-scm dependency to fix Bitbucket Data Center group permission issues.
New test mocks were added to support the updated IsCollaborator() group lookup logic and prevent test failures.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

chmouel · 2026-02-13T10:10:04Z

the e2e errors are expected, only the folks that are owner on the pac repo can run them (since we use pull_request_target and secrets)

gemini-code-assist

Code Review

This pull request updates the go-scm dependency to version v1.15.17 to address bugs related to Bitbucket Data Center group permission checks and adds a new test mock helper for repository-level group permissions. However, a security audit identified high-severity vulnerabilities: the updated go-scm library lacks proper URL path escaping for project and repository names, potentially leading to path traversal and API injection. Additionally, the Bitbucket Data Center provider in pipelines-as-code relies on untrusted fields from webhook payloads for security-sensitive operations, which could allow attackers to bypass membership checks or hijack pipeline executions. Furthermore, an issue was found in the new test helper function that might result in invalid mock responses.

gemini-code-assist · 2026-02-13T10:10:52Z

vendor/github.com/jenkins-x/go-scm/scm/driver/stash/org.go

 // getProjectGroups returns the groups which have some permissions in the project
-func getProjectGroups(ctx context.Context, org string, os *organizationService, opts *scm.ListOptions) ([]*projGroup, error) {
+func getProjectGroups(ctx context.Context, org string, client *wrapper, opts *scm.ListOptions) ([]*projGroup, error) {
 	path := fmt.Sprintf("rest/api/1.0/projects/%s/permissions/groups?%s", org, encodeListOptions(opts))


The org parameter is interpolated directly into the API path without escaping. If the organization name contains special characters like / or .., it can lead to path traversal or API injection. This is particularly sensitive as this path is used for authorization checks.

Suggested change

path := fmt.Sprintf("rest/api/1.0/projects/%s/permissions/groups?%s", org, encodeListOptions(opts))

path := fmt.Sprintf("rest/api/1.0/projects/%s/permissions/groups?%s", url.PathEscape(org), encodeListOptions(opts))

gemini-code-assist · 2026-02-13T10:10:52Z

vendor/github.com/jenkins-x/go-scm/scm/driver/stash/org.go

 }

+func projectUsersPermissionsPath(org string, opts *scm.ListOptions) string {
+	return fmt.Sprintf("rest/api/1.0/projects/%s/permissions/users?%s", org, encodeListOptions(opts))


The org parameter is used in the API path without escaping. This can be exploited to manipulate the request path and hit unintended API endpoints.

Suggested change

return fmt.Sprintf("rest/api/1.0/projects/%s/permissions/users?%s", org, encodeListOptions(opts))

return fmt.Sprintf("rest/api/1.0/projects/%s/permissions/users?%s", url.PathEscape(org), encodeListOptions(opts))

gemini-code-assist · 2026-02-13T10:10:52Z

vendor/github.com/jenkins-x/go-scm/scm/driver/stash/repo.go

+}
+
+func getRepoGroups(ctx context.Context, namespace, name string, client *wrapper, opts *scm.ListOptions) ([]*projGroup, error) {
+	path := fmt.Sprintf("rest/api/1.0/projects/%s/repos/%s/permissions/groups?%s", namespace, name, encodeListOptions(opts))


The namespace and name parameters are used in the API path without escaping. This allows for path traversal and manipulation of the Bitbucket API request structure.

Suggested change

path := fmt.Sprintf("rest/api/1.0/projects/%s/repos/%s/permissions/groups?%s", namespace, name, encodeListOptions(opts))

path := fmt.Sprintf("rest/api/1.0/projects/%s/repos/%s/permissions/groups?%s", url.PathEscape(namespace), url.PathEscape(name), encodeListOptions(opts))

gemini-code-assist · 2026-02-13T10:10:52Z

pkg/provider/bitbucketdatacenter/test/test.go

+		if groups == nil {
+			fmt.Fprintf(rw, "{\"values\": []}")
+		}


When groups is nil, the response writer rw is written to by fmt.Fprintf, but the function execution continues, causing a second write by fmt.Fprint at the end of the handler. This results in a malformed JSON response body (e.g., {"values": []}{"values":null}). To fix this, you should add a return statement after the first write to exit the handler early.

if groups == nil { fmt.Fprint(rw, `{"values": []}`) return }

chmouel · 2026-02-13T10:11:01Z

/ok-to-test

pipelines-as-code · 2026-02-13T10:11:26Z

🔍 PR Lint Feedback

Note: This automated check helps ensure your PR follows our contribution guidelines.

⚠️ Items that need attention:

🤖 AI attribution

The following commits lack an explicit AI attribution footer:

3335a77 fix: Update jenkins-x/go-scm to v1.15.17
e823d78 fix: Add repo group membership support to Bitbucket tests
098865c fix: nil-guard bug and add group ACL tests for BBC

If no AI assistance was used for a commit, you can ignore this warning.
Otherwise add an Assisted-by: or Co-authored-by: footer referencing the AI used.

ℹ️ Next Steps

Review and address the items above
Push new commits to update this PR
This comment will be automatically updated when issues are resolved

🔧 Admin Tools (click to expand)

Automated Issue/Ticket Creation:

/issue-create - Generate a GitHub issue from this PR content using AI
/jira-create - Create a SRVKP Jira ticket from this PR content using AI

⚠️ Important: Always review and edit generated content before finalizing tickets/issues.
The AI-generated content should be used as a starting point and may need adjustments.

These commands are available to maintainers and will post the generated content as PR comments for review.

_{🤖 This feedback was generated automatically by the PR CI system}

tricktron · 2026-02-13T10:15:37Z

@chmouel I should add some more tests to check the bug fixes in go-scm.

The 4 Mux permission helpers wrote double responses when input was nil due to missing returns. Extract shared muxPermissions helper and add test coverage for project/repo group-based access.

tricktron · 2026-02-13T10:52:16Z

@chmouel Ok, I added the tests. We are not in a hurry for this as we will receive these updates anyway only with our openshift-pipelines update. As far as I can see the bitbucket e2e tests don't test this additional feature. So in my opinion you can already merge this.

zakisk · 2026-02-17T09:56:38Z

/ok-to-test

chmouel · 2026-02-17T19:06:16Z

Thank you 🙏🏻

tricktron added 2 commits February 13, 2026 11:04

fix: Update jenkins-x/go-scm to v1.15.17

3335a77

Fixes group membership checks in Bitbucket Server by properly URL-encoding group names and checking repository-level group permissions.

fix: Add repo group membership support to Bitbucket tests

e823d78

Enables testing ACL checks for repository-level group permissions alongside existing project-level group checks.

gemini-code-assist bot reviewed Feb 13, 2026

View reviewed changes

pipelines-as-code bot added the bitbucket-datacenter label Feb 13, 2026

tricktron marked this pull request as draft February 13, 2026 10:14

fix: nil-guard bug and add group ACL tests for BBC

098865c

The 4 Mux permission helpers wrote double responses when input was nil due to missing returns. Extract shared muxPermissions helper and add test coverage for project/repo group-based access.

tricktron marked this pull request as ready for review February 13, 2026 10:30

Merge branch 'main' into update-go-scm

af545ce

zakisk approved these changes Feb 17, 2026

View reviewed changes

chmouel merged commit 2ec9bb3 into tektoncd:main Feb 17, 2026
6 of 14 checks passed

	path := fmt.Sprintf("rest/api/1.0/projects/%s/permissions/groups?%s", org, encodeListOptions(opts))
	path := fmt.Sprintf("rest/api/1.0/projects/%s/permissions/groups?%s", url.PathEscape(org), encodeListOptions(opts))

	return fmt.Sprintf("rest/api/1.0/projects/%s/permissions/users?%s", org, encodeListOptions(opts))
	return fmt.Sprintf("rest/api/1.0/projects/%s/permissions/users?%s", url.PathEscape(org), encodeListOptions(opts))

Conversation

tricktron commented Feb 13, 2026

📝 Description of the Change

👨🏻‍ Linked Jira

🔗 Linked GitHub Issue

🚀 Type of Change

🧪 Testing Strategy

🤖 AI Assistance

✅ Submitter Checklist

Uh oh!

gemini-code-assist bot commented Feb 13, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

chmouel commented Feb 13, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

chmouel commented Feb 13, 2026

Uh oh!

pipelines-as-code bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 PR Lint Feedback

⚠️ Items that need attention:

🤖 AI attribution

ℹ️ Next Steps

Uh oh!

tricktron commented Feb 13, 2026

Uh oh!

tricktron commented Feb 13, 2026

Uh oh!

zakisk commented Feb 17, 2026

Uh oh!

Uh oh!

chmouel commented Feb 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pipelines-as-code bot commented Feb 13, 2026 •

edited

Loading