feat(scm): add bitbucket webhook support

Signed-off-by: Ushira Dineth <[email protected]>

Author: ushiradineth

docs/getting-started.md

@@ -234,6 +234,52 @@ To configure the GitOps Promoter with Bitbucket, you will need to create a repos
    * **Repositories**: Read and Write
    * **Pull requests**: Read and Write
 
+### Webhooks (Optional - but highly recommended)
+
+> [!NOTE]
+> We do support configuration of a Bitbucket webhook that triggers PR creation upon Push. However, we do not configure
+> the ingress to allow Bitbucket to reach the GitOps Promoter. You will need to configure the ingress to allow Bitbucket to reach
+> the GitOps Promoter via the service promoter-webhook-receiver which listens on port `3333`. If you do not use webhooks
+> you might want to adjust the auto reconciliation interval to a lower value using these `promotionStrategyRequeueDuration` and
+> `changeTransferPolicyRequeueDuration` fields of the `ControllerConfiguration` resource.
+
+To enable webhook support for automatic PR creation on push:
+
+1. Navigate to your repository URL
+2. Click on "Repository settings" in the sidebar
+3. Navigate to "Webhooks"
+4. Click "Add webhook"
+5. Configure the webhook:
+   * **Title**: GitOps Promoter
+   * **URL**: `https://argo-github-app-webhook.com/` # Replace with your domain
+   * **Triggers**: Select "Repository: Push"
+
+Here is an example Ingress configuration for the webhook receiver:
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: promoter-webhook-receiver
+  namespace: promoter-system
+  annotations:
+    # Add any necessary annotations for your ingress controller
+    # For example, if using nginx-ingress:
+    # nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  rules:
+  - host: argo-github-app-webhook.com  # Replace with your domain
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: promoter-webhook-receiver
+            port:
+              number: 3333
+```
+
 ### Configuration
 
 This access token should be used in a secret as follows:

internal/webhookreceiver/server.go

@@ -23,10 +23,11 @@ var logger = ctrl.Log.WithName("webhookReceiver")
 
 // Provider type constants
 const (
-	ProviderGitHub  = "github"
-	ProviderGitLab  = "gitlab"
-	ProviderForgejo = "forgejo"
-	ProviderUnknown = ""
+	ProviderGitHub    = "github"
+	ProviderGitLab    = "gitlab"
+	ProviderForgejo   = "forgejo"
+	ProviderBitbucket = "bitbucket"
+	ProviderUnknown   = ""
 )
 
 // WebhookReceiver is a server that listens for webhooks and triggers reconciles of ChangeTransferPolicies.
@@ -75,7 +76,7 @@ func (wr *WebhookReceiver) Start(ctx context.Context, addr string) error {
 }
 
 // DetectProvider determines the SCM provider based on webhook headers.
-// Returns ProviderGitHub, ProviderGitLab, ProviderForgejo, or ProviderUnknown.
+// Returns ProviderGitHub, ProviderGitLab, ProviderForgejo, ProviderBitbucket, or ProviderUnknown.
 func (wr *WebhookReceiver) DetectProvider(r *http.Request) string {
 	// Check for GitHub webhook headers
 	if r.Header.Get("X-Github-Event") != "" || r.Header.Get("X-Github-Delivery") != "" {
@@ -92,6 +93,11 @@ func (wr *WebhookReceiver) DetectProvider(r *http.Request) string {
 		return ProviderForgejo
 	}
 
+	// Check for Bitbucket Cloud webhook headers
+	if r.Header.Get("X-Hook-UUID") != "" {
+		return ProviderBitbucket
+	}
+
 	return ProviderUnknown
 }
 
@@ -193,6 +199,20 @@ func (wr *WebhookReceiver) findChangeTransferPolicy(ctx context.Context, provide
 			beforeSha = gjson.GetBytes(jsonBytes, "before").String()
 			ref = gjson.GetBytes(jsonBytes, "ref").String()
 		}
+	case ProviderBitbucket:
+		// Bitbucket Cloud webhook format
+		if gjson.GetBytes(jsonBytes, "push.changes").Exists() && gjson.GetBytes(jsonBytes, "actor").Exists() {
+			changes := gjson.GetBytes(jsonBytes, "push.changes")
+			if changes.IsArray() && len(changes.Array()) > 0 {
+				firstChange := changes.Array()[0]
+				beforeSha = firstChange.Get("old.target.hash").String()
+				if newName := firstChange.Get("new.name"); newName.Exists() {
+					ref = "refs/heads/" + newName.String()
+				} else if oldName := firstChange.Get("old.name"); oldName.Exists() {
+					ref = "refs/heads/" + oldName.String()
+				}
+			}
+		}
 	default:
 		logger.V(4).Info("unsupported provider", "provider", provider)
 		return nil, nil
@@ -255,5 +275,15 @@ func (wr *WebhookReceiver) extractDeliveryID(r *http.Request) string {
 	if id := r.Header.Get("X-Gitea-Delivery"); id != "" {
 		return id
 	}
+	// Bitbucket Cloud
+	// X-Request-UUID: Unique identifier for the webhook request
+	// X-Hook-UUID: Unique identifier for the webhook itself (also used for provider detection)
+	// Note: Go's http.Header.Get is case-insensitive, so this will match X-Request-UUID correctly
+	if id := r.Header.Get("X-Request-Uuid"); id != "" {
+		return id
+	}
+	if id := r.Header.Get("X-Hook-Uuid"); id != "" {
+		return id
+	}
 	return ""
 }

internal/webhookreceiver/server_test.go

@@ -55,6 +55,12 @@ var _ = Describe("DetectProvider", func() {
 			},
 			expectedResult: webhookreceiver.ProviderForgejo,
 		},
+		"Bitbucket Cloud webhook with X-Hook-UUID": {
+			headers: map[string]string{
+				"X-Hook-UUID": "12345-abcde",
+			},
+			expectedResult: webhookreceiver.ProviderBitbucket,
+		},
 		"Unknown provider - no headers": {
 			headers:        map[string]string{},
 			expectedResult: webhookreceiver.ProviderUnknown,