Forge manifest rejects webhook scopes that `forge lint` requires for Bitbucket webhook endpoints

Forge Forge Platform and Tools
, ,
1

Hi all,

I’ve run into a frustrating catch-22 when building a Forge app for Bitbucket that manages repository webhooks, and wanted to raise it here in case others are hitting the same wall.

The problem

When calling the Bitbucket REST API webhook endpoints (GET /repositories/{workspace}/{repo_slug}/hooks, POST .../hooks, DELETE .../hooks/{uid}), forge lint correctly (according to the documention provided here) reports that the following scopes are required:

  • read:webhook:bitbucket
  • write:webhook:bitbucket
  • delete:webhook:bitbucket

However, when these scopes are added to manifest.yml, forge deploy rejects them outright:

Manifest validation failed: Some scopes defined are not supported: write:webhook:bitbucket, read:webhook:bitbucket, delete:webhook:bitbucket

So forge lint tells you to add scopes that forge deploy refuses to accept. The tooling is directly contradicting itself.

Steps to reproduce

  1. Create a Forge app targeting Bitbucket
  2. Call any of the /repositories/{workspace}/{repo_slug}/hooks endpoints
  3. Run forge lint — it reports read:webhook:bitbucket, write:webhook:bitbucket, delete:webhook:bitbucket as required
  4. Add those scopes to manifest.yml
  5. Run forge deploy — it fails with “Some scopes defined are not supported”

Expected behaviour

The webhook scopes (read:webhook:bitbucket, write:webhook:bitbucket, delete:webhook:bitbucket) should be valid, accepted scopes in the Forge manifest and consistent with what forge lint already expects.

Has anyone found a workaround, or is there a timeline for these scopes being added to the Forge manifest allowlist?

Thanks

2

My @MaksymStelmashenko , Forge Lint works dynamically by pulling the latest OpenAPI spec and comparing it with your use of APIs to help identify what scopes are required.

Manifest validation is maintained by our internal engineering teams contributing changes as they release new features, including new scopes and APIs. I will reach out internally to the Bitbucket team to confirm their plans for supporting these scopes in Forge. Sometimes you can use forge deploy –-no-verify to unblock deployments as it will disable local pre-deployment checks, unfortunately this specific check is done in the backend and cant be disabled by the client.

3

Hi @MaksymStelmashenko, Bitbucket engineer here. Unfortunately accessing webhooks REST APIs in Forge is not currently supported which is why you’re seeing this validation error. We currently don’t have any plans to add support for these endpoints, but I’ve raised a feature suggestion ticket here. I suggest you vote on the issue and leave a comment on your use case, as we use these tickets to gauge interest and prioritise features for our roadmap.