Bitbucket Pipelines

Scan your staging site in Bitbucket Pipelines after each deploy, fail the pipeline on what you choose, and see each test in the step's Tests tab.

Before you start

• A verified domain for the site.
• An API key. Use a team key in CI: see Keys for CI.

Add the step

pipelines:
  default:
    - step:
        name: ValiqAI scan
        image: node:20
        script:
          - export STAGING_URL=https://staging.example.com
          - npx -y @valiqai/cli scan "$STAGING_URL" --fail-on blocker --output test-results/valiqai.xml

The key goes in: Repository settings › Repository variables (secured). Results show in: the step's Tests tab (Pipelines reads test-results/ on its own).

Deploy, then scan

Steps run in order, so put the scan after the deploy:

pipelines:
  branches:
    main:
      - step:
          name: Deploy to staging
          script:
            - ./scripts/deploy-staging.sh
      - step:
          name: ValiqAI scan
          image: node:22
          script:
            - export STAGING_URL=https://staging.example.com
            - npx -y @valiqai/cli scan "$STAGING_URL" --fail-on blocker --output test-results/valiqai.xml

What you'll see

• The step's Tests tab: each test the scan ran. Bitbucket picks up the JUnit file from test-results/ on its own.
• The step log: progress, the summary, and a link to the scan.
• The scan's page in ValiqAI says Bitbucket Pipelines · main · a1b2c3d, linking back to the pipeline.