Operations | Monitoring | ITSM | DevOps | Cloud

The latest News and Information on Continuous Integration and Development, and related technologies.

Bitbucket Tests now supports tracking tests from multiple branches

Tracking tests on non-default branches was one of the most requested capabilities during the Bitbucket Tests (beta). We heard you, and today, we’re shipping it. Most teams don’t ship from main. Integration happens on develop, stabilisation on staging, releases cut from release. Until now, Bitbucket Tests only tracked the tests from default(main) branch, leaving the branches that actually matter invisible. Multiple branch tracking in Tests changes that.

Feature Flag Security in your CI/CD Pipeline | Harness Blog

Incorporating robust security measures into feature flag management is critical to protecting sensitive data and maintaining compliance. Harness FME security features, like remote evaluations in Thin SDKs and governed AI flag cleanup, let you practice security by design and standardize solid security practices across your teams.

How to Use JFrog CLI Without Editing Your CI Scripts

Using JFrog CLI used to come with a catch. To run a build through it, you had to put it in front of the command. For example, jf npm install instead of npm install or jf mvn package instead of mvn package per the example below: npm install → jf npm install mvn package → jf mvn package Doing that once is easy enough.

Where Test Management Fits in a Modern CI/CD Pipeline

Ask most DevOps teams where testing lives in their pipeline and you'll get a confident answer: "It's automated, it runs on every commit." That's true, and it's also only half the story. Automated checks in CI cover a slice of quality - usually unit and integration tests - but the wider discipline of *test management* often sits outside the pipeline entirely, scattered across spreadsheets, wikis, and someone's memory.

Share packages across your workspace with internal packages

We launched Bitbucket Packages to give teams one place to manage code, pipelines, and artifacts, and we’ve been expanding it ever since, first with Maven and npm, then PyPI and NuGet. Every one of those packages has shared one trait: it lives inside a single repository and inherits that repository’s permissions. Most of the time, that’s exactly what you want. But it also means sharing a package across repositories has meant granting people access to source code they never needed to see.

Scanners aren't enough. Here's the layer most teams are missing.

Vulnerability scanners tell you what's wrong with what you already pulled. They don't stop a malicious package from entering your environment in the first place. A private registry with minimum release age policies adds that missing layer – packages newer than two or three days don't reach developers until the industry has had time to identify and remove malicious ones from public registries. Active campaigns like TeamPCP are targeting npm, PyPI, and Maven Central right now. The gate has to come before the scan. Cloudsmith provides that gate.

Custom deployment permissions for your environments (Beta)

You shouldn’t have to grant full repository admin rights just to let an engineer or release manager trigger a deployment. To solve the all-or-nothing access problem, Bitbucket Pipelines introduces custom deployment permissions (Beta). You can now gate specific environments to authorized users and groups, ensuring safer releases and easier compliance. Left: Add users and groups to gate deployments for this environment.