GauntletCI logoGauntletCI

CI/CD

Bitbucket Pipelines Integration

Add a GauntletCI step to your bitbucket-pipelines.yml to analyze every pull request diff and block high-risk changes from merging.

Basic setup

Add this to your bitbucket-pipelines.yml. The step runs on all pull request branches using the official Microsoft .NET SDK image:

image: mcr.microsoft.com/dotnet/sdk:8.0

pipelines:
  pull-requests:
    '**':
      - step:
          name: GauntletCI Analysis
          script:
            - export PATH="$PATH:$HOME/.dotnet/tools"
            - dotnet tool install -g GauntletCI
            - git fetch origin $BITBUCKET_PR_DESTINATION_BRANCH
            - git diff origin/$BITBUCKET_PR_DESTINATION_BRANCH...HEAD > pr.diff
            - gauntletci analyze --diff pr.diff --no-banner --ascii
  • $BITBUCKET_PR_DESTINATION_BRANCH is set automatically on pull request pipelines.
  • The step fails (exit code 1) if Block-severity findings are detected, blocking the merge.
  • The --ascii flag prevents Unicode box-drawing characters from corrupting the pipeline log.

Enable merge checks

To enforce the pipeline result as a merge gate:

  1. Go to Repository Settings > Merge checks.
  2. Enable Require passing builds.
  3. Optionally restrict it to the GauntletCI Analysis step only.

The merge button stays disabled until the pipeline passes.

Save findings as an artifact

Use --output json and Bitbucket artifact paths to retain the report for 14 days (default):

image: mcr.microsoft.com/dotnet/sdk:8.0

pipelines:
  pull-requests:
    '**':
      - step:
          name: GauntletCI Analysis
          script:
            - export PATH="$PATH:$HOME/.dotnet/tools"
            - dotnet tool install -g GauntletCI
            - git fetch origin $BITBUCKET_PR_DESTINATION_BRANCH
            - git diff origin/$BITBUCKET_PR_DESTINATION_BRANCH...HEAD > pr.diff
            - gauntletci analyze --diff pr.diff --output json --no-banner > gauntletci-report.json
          artifacts:
            - gauntletci-report.json

Artifacts are downloadable from the pipeline step summary page.

Sensitivity via repository variable

Set GAUNTLETCI_SENSITIVITY as a repository variable under Repository Settings > Repository variables to control sensitivity without editing the YAML:

            - gauntletci analyze --diff pr.diff \
                --sensitivity ${GAUNTLETCI_SENSITIVITY:-balanced} \
                --no-banner --ascii

Defaults to balanced if the variable is not set. Valid values: strict, balanced, permissive.

Pipeline step output

GauntletCI AnalysisFAILED

+ gauntletci analyze --diff pr.diff --no-banner --ascii

GauntletCI v2.1.1

Analyzed 3 files, 47 changed lines

[BLOCK] OrderService.cs:42 GCI0001 Logic change without test coverage

[BLOCK] IOrderService.cs:18 GCI0003 Public API breaking change

2 block, 0 warn, 0 advisory

error: process exited with code 1