CodeRifts for Bitbucket — API governance on every pull request

Get a free API key

Add CODERIFTS_API_KEY as a repository variable

Go to Repository settings → Pipelines → Repository variables and add the key as a secured variable.

Add the contract check to bitbucket-pipelines.yml

pipelines:
  pull-requests:
    '**':
      - step:
          name: API Contract Check
          image: alpine:latest
          script:
            - apk add --no-cache curl jq git
            - git fetch origin "$BITBUCKET_PR_DESTINATION_BRANCH"
            - OLD=$(git show "origin/$BITBUCKET_PR_DESTINATION_BRANCH:api/openapi.yaml")
            - NEW=$(cat api/openapi.yaml)
            - |
              RESULT=$(jq -n --arg o "$OLD" --arg n "$NEW" '{old_spec:$o,new_spec:$n}' \
                | curl -sf -X POST https://app.coderifts.com/api/v1/diff \
                  -H "Authorization: Bearer $CODERIFTS_API_KEY" \
                  -H "Content-Type: application/json" -d @-)
              echo "$RESULT" | jq .
              BREAKING=$(echo "$RESULT" | jq '.breaking_changes // 0')
              if [ "$BREAKING" -gt 0 ]; then
                echo "ERROR: $BREAKING breaking change(s) detected:"
                echo "$RESULT" | jq -r '(.changelog.breaking // [])[]'
                exit 1
              fi

Every Pull Request will now run this CodeRifts check automatically.

Advisory — this gate trusts the CodeRifts API response and fails the CI job. For an unbypassable, cryptographically verified gate, use coderifts/contract-gate as a required status check.

What it does#

On every Pull Request: breaking changes (10 types), risk scoring (0–100 across 4 dimensions), policy checks from .coderifts.yml, and security analysis.

Note on the Docker pipe#

The docker://coderifts/bitbucket-pipe image is not currently published to Docker Hub. Use the API call above (advisory), or coderifts/contract-gate for a verified, required-check gate. See REST API.

Updated Aug 15, 2026