From 72ccdcd341f73a06f500a6e1e7b32691c3a11138 Mon Sep 17 00:00:00 2001
From: sujit deokar <sudeokar@aarete.com>
Date: Thu, 16 Apr 2026 11:49:33 +0000
Subject: [PATCH] harden pipeline: improve security for OIDC token handling and
 add version component validation

---
 bitbucket-pipelines.yml | 33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/bitbucket-pipelines.yml b/bitbucket-pipelines.yml
index 8bc4097..ec7ec94 100644
--- a/bitbucket-pipelines.yml
+++ b/bitbucket-pipelines.yml
@@ -109,7 +109,7 @@ definitions:
         script:
           # Slim image doesn't include git — install it + AWS/HTTP libs
           # --no-install-recommends skips git-man/less/openssh-client etc.
-          - apt-get update && apt-get install -y --no-install-recommends git
+          - apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
           - pip install "boto3==1.35.*" "requests==2.32.*"
 
           # --- AWS OIDC authentication setup ---
@@ -121,14 +121,6 @@ definitions:
           - export AWS_REGION=us-east-1
           - export AWS_ROLE_ARN="arn:aws:iam::975049960860:role/DoczyAI-Bitbucket-OIDC"
           - export AWS_WEB_IDENTITY_TOKEN_FILE="$(pwd)/web-identity-token"
-          # install -m 600 atomically creates the file with restricted permissions
-          # BEFORE any data is written, closing the race window that exists when
-          # writing first and chmodding second (default umask would expose the
-          # token briefly as 644). printf (not echo) avoids a trailing newline.
-          - set +x
-          - install -m 600 /dev/null "$(pwd)/web-identity-token"
-          - printf '%s' "$BITBUCKET_STEP_OIDC_TOKEN" > "$(pwd)/web-identity-token"
-          - set -x
 
           # Clone the review agent repo (private — needs BITBUCKET_CLONE_TOKEN)
           # SETUP REQUIRED: set BITBUCKET_CLONE_TOKEN (marked "Secured") in
@@ -140,12 +132,21 @@ definitions:
               echo "Set it in Repository settings → Repository variables (Secured)."
               exit 1
             fi
-          # Use git credential helper to keep the token out of the command line
-          # and out of git error messages. Writing the credential to a file that
-          # is never echoed prevents token exposure in process lists and logs.
+
+          # Disable debug output (set +x) during token/credential handling to prevent
+          # token exposure in process lists or build logs. Wrap all credential operations
+          # in this block. Re-enable debug (set -x) after.
+          - set +x
+          # Create OIDC token file with secure permissions
+          - install -m 600 /dev/null "$(pwd)/web-identity-token"
+          - printf '%s' "$BITBUCKET_STEP_OIDC_TOKEN" > "$(pwd)/web-identity-token"
+          # Configure git credential helper and store credentials
           - git config --global credential.helper store
           - printf 'https://x-token-auth:%s@bitbucket.org\n' "${BITBUCKET_CLONE_TOKEN}" > ~/.git-credentials
           - chmod 600 ~/.git-credentials
+          - set -x
+
+          # Clone the review agent repo
           - git clone -q "https://bitbucket.org/${BITBUCKET_WORKSPACE}/code-review-agent.git"
 
           # Build the PR URL and run the agent.
@@ -157,7 +158,8 @@ definitions:
           # design — they indicate the pipeline setup itself is broken and
           # need to be loud, not silently degraded into a stale warning.
           - export PR_URL="https://bitbucket.org/${BITBUCKET_WORKSPACE}/${BITBUCKET_REPO_SLUG}/pull-requests/${BITBUCKET_PR_ID}"
-          - cd code-review-agent && python main.py "$PR_URL" || echo "WARNING - AI review step failed (non-blocking)"
+          - cd code-review-agent
+          - python main.py "$PR_URL" || echo "WARNING - AI review step failed (non-blocking)"
 
 
 # =============================================================================
@@ -396,6 +398,11 @@ pipelines:
               major=$(echo "$version" | cut -d. -f1)
               minor=$(echo "$version" | cut -d. -f2)
               patch=$(echo "$version" | cut -d. -f3)
+              # Validate all version components were extracted
+              if [ -z "$major" ] || [ -z "$minor" ] || [ -z "$patch" ]; then
+                echo "BLOCKED: failed to parse version components from $latest_tag"
+                exit 1
+              fi
 
             # Bump the correct component, reset everything below it
             - |