[WIP] RHTAP-6071 Change BitBucket AppPassword to Token

[jkopriva]

Assisted-by: Cursor

Summary by CodeRabbit

• Updates
  • Bitbucket integration authentication mechanism has been updated to use API tokens instead of app passwords. Users configuring Bitbucket integrations will need to provide an API token instead of an app password in their deployment and environment configurations.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkopriva

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jkopriva]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jkopriva]

Thi is blocked by: #1652

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e5366729-aac5-406d-a253-a3500dc4bbd1

📥 Commits

Reviewing files that changed from the base of the PR and between 28f762e and 3102781.

⛔ Files ignored due to path filters (1)

• vendor/github.com/redhat-appstudio/helmet/internal/integration/bitbucket.go is excluded by !vendor/**

📒 Files selected for processing (11)

• hack/deploy.sh
• hack/private.env.template
• hack/reset.sh
• installer/charts/tssc-app-namespaces/templates/secrets/bitbucket-auth.yaml
• installer/charts/tssc-dh/templates/app-config-content.yaml
• installer/charts/tssc-dh/templates/extra-env.yaml
• installer/charts/tssc-integrations/templates/gitops/bitbucket-auth.yaml
• integration-tests/README.md
• integration-tests/scripts/.ci-env
• integration-tests/scripts/.env.template
• integration-tests/scripts/install.sh

---

📝 Walkthrough

Walkthrough

The PR migrates Bitbucket authentication across all integration points from app password-based to token-based authentication, updating environment variables, configuration templates, and deployment scripts consistently throughout the codebase.

Changes

Cohort / File(s)	Summary
Local Development Scripts hack/deploy.sh, hack/private.env.template, hack/reset.sh	Replaced Bitbucket authentication from app password to token in deployment scripts, environment templates, and reset operations. Changed CLI flags, environment variable names, and API authorization headers accordingly.
Kubernetes Secret Templates installer/charts/.../bitbucket-auth.yaml, installer/charts/tssc-app-namespaces/templates/secrets/bitbucket-auth.yaml	Updated Bitbucket secret templates to source token instead of appPassword in Secret data fields and generated Kubernetes manifests.
Application Configuration installer/charts/tssc-dh/templates/app-config-content.yaml, installer/charts/tssc-dh/templates/extra-env.yaml	Changed Bitbucket integration configuration from appPassword to token in deployment app config and environment variable mappings. Preserved username field and conditional rendering logic.
Integration Test Infrastructure integration-tests/README.md, integration-tests/scripts/.ci-env, integration-tests/scripts/.env.template, integration-tests/scripts/install.sh	Updated test documentation, environment variable exports, and installation script to use BITBUCKET_TOKEN instead of BITBUCKET_APP_PASSWORD. Changed credential source file path from bitbucket-app-password to bitbucket-token.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Possibly related PRs

• Fix CI GitHub integration #1383 — Modifies Bitbucket integration secret handling in installer charts; this PR updates the secret key structure while the related PR may handle corresponding CLI-side changes.

Suggested labels

lgtm

Suggested reviewers

• otaviof
• prietyc123
• Roming22

Poem

🐰 A token hops where passwords fell,
Through scripts and charts, a migration spell,
From app to auth, the bits now flow,
More secure, the new way to go! 🔐

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: replacing Bitbucket app password authentication with token-based authentication across the entire codebase.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[konflux-ci-qe-bot]

@jkopriva: The following test has Failed, say /retest to rerun failed tests.

PipelineRun Name	Status	Rerun command	Build Log	Test Log
e2e-4.20-vhqqd	Failed	/retest	View Pipeline Log	View Test Logs

Inspecting Test Artifacts

To inspect your test artifacts, follow these steps:

1. Install ORAS (see the ORAS installation guide).
2. Download artifacts with the following commands:

mkdir -p oras-artifacts
cd oras-artifacts
oras pull quay.io/konflux-test-storage/rhtap-team/rhtap-cli:e2e-4.20-vhqqd

Test results analysis

<not enabled>

OCI Artifact Browser URL

<not enabled>

[jkopriva]

Thi is blocked until we migrate to RHDH 1.10