Bitbucket管理员插件开发：全仓库提交/推送触发外部审计API

Hey there! As someone who’s built similar Bitbucket admin plugins, let me walk you through the key steps to implement your company-wide automated audit system:

Core Implementation Steps #

• Leverage Bitbucket's Built-in Event Listeners
  For admin-level coverage across all repositories, skip per-repo webhooks and use Bitbucket’s native event extension points. Focus on two critical events:

  • RepositoryPushEvent: Triggers whenever code is pushed to any branch
  • PullRequestMergedEvent: Triggers when a pull request is merged into a target branch
    Create listener classes that implement EventListener and override the onEvent method to handle these events globally.

• Plugin Setup & Event Registration
  Start by initializing a Bitbucket plugin project with the Atlassian SDK. In your atlassian-plugin.xml file, register your listener classes to hook into the target events, like this:

  <component key="auditPushListener" class="com.yourcompany.bitbucket.plugin.AuditPushListener">
    <description>Captures push events to trigger external audit workflows</description>
    <interface>com.atlassian.event.api.EventListener</interface>
  </component>
  <component key="auditMergeListener" class="com.yourcompany.bitbucket.plugin.AuditMergeListener">
    <description>Captures PR merge events to trigger external audit workflows</description>
    <interface>com.atlassian.event.api.EventListener</interface>
  </component>
  

  This ensures your plugin automatically picks up events across every repository in your instance.

• Call the External Audit API
  In your listener’s onEvent method, extract critical audit data from the event object:

  • Committer username/ID
  • Repository key and display name
  • Affected branch names
  • Commit hashes and change summaries
    Use Atlassian’s recommended HttpClient (from the SAL API) to send this data to your external audit service. Be sure to handle errors gracefully—log failures and add retry logic for transient API issues to avoid missing audit triggers.

• Admin Configuration & Permissions
  Add a plugin configuration page so admins can set the external API URL, authentication tokens, and other settings (avoid hardcoding these values). Also, declare the necessary permissions in your plugin descriptor—you’ll need global admin or repo admin permissions to access events across all repositories.

• Optimize for Performance
  Don’t block Bitbucket’s event processing thread with long-running API calls. Use Bitbucket’s TaskManager to offload the API request to an asynchronous task. This keeps Bitbucket responsive while ensuring the audit trigger is sent reliably.

Pro Tip: Test your plugin locally first using atlas-run to spin up a Bitbucket instance. Simulate pushes and PR merges to verify events are captured and the API is called correctly before deploying to production.

内容的提问来源于stack exchange，提问作者joy