CodeRifts for Bitbucket — API Governance on Every Pull Request

Setup in 3 Steps

No native app to install. Just add the check to your pipeline.

1

Get a free API key

Sign up at app.coderifts.com/api/signup to get your API key.

2

Add `CODERIFTS_API_KEY` as a repository variable

Go to Repository settings → Pipelines → Repository variables and add the key as a secured variable.

3

Add the contract check to `bitbucket-pipelines.yml`

pipelines:
  pull-requests:
    '**':
      - step:
          name: API Contract Check
          image: alpine:latest
          script:
            - apk add --no-cache curl jq git
            - git fetch origin "$BITBUCKET_PR_DESTINATION_BRANCH"
            - OLD=$(git show "origin/$BITBUCKET_PR_DESTINATION_BRANCH:api/openapi.yaml")
            - NEW=$(cat api/openapi.yaml)
            - |
              RESULT=$(jq -n --arg o "$OLD" --arg n "$NEW" '{old_spec:$o,new_spec:$n}' \
                | curl -sf -X POST https://app.coderifts.com/api/v1/diff \
                    -H "Authorization: Bearer $CODERIFTS_API_KEY" \
                    -H "Content-Type: application/json" -d @-)
              echo "$RESULT" | jq .
              BREAKING=$(echo "$RESULT" | jq '.breaking_changes // 0')
              if [ "$BREAKING" -gt 0 ]; then
                echo "ERROR: $BREAKING breaking change(s) detected:"
                echo "$RESULT" | jq -r '(.changelog.breaking // [])[]'
                exit 1
              fi

Every Pull Request will now run this CodeRifts check automatically.

Advisory — this gate trusts the CodeRifts API response and fails the CI job. It does not verify a signed receipt, and it blocks a merge only if you make the job a required check. For a required-check merge gate with offline receipt verification — where administrators cannot bypass only if enforce_admins is set — use coderifts/contract-gate as a required status check — bound to the Action’s app, since the GitHub App posts an identically named advisory check.

What It Does

On every Pull Request, CodeRifts analyzes your OpenAPI specs and reports:

Breaking Changes

Detects 10 types of breaking changes: endpoint removals, type changes, required field additions, and more.

Risk Scoring

Calculates a 0–100 risk score across 4 dimensions so you know exactly how dangerous a change is.

Policy Checks

Checks policy violations from your .coderifts.yml — breaking budgets, freeze windows, no-delete rules.

Security Analysis

Catches auth regressions, sensitive field exposure, and security-critical schema changes.

Deprecated: the Docker pipe

The docker://coderifts/bitbucket-pipe image is not currently published to Docker Hub. Use the API call above (advisory — it trusts the API response and fails the job), or coderifts/contract-gate for a verified, required-check gate. See the REST API documentation for full details.

Start protecting your APIs in Bitbucket today.

Add the contract check, get your free API key, and catch breaking changes on every Pull Request.

Get API Key — Free View contract-gate →