Vault with Bitbucket Pipelines

Run your deployment through gops vault run so Vault injects secrets only into the deploy command.

Configure the pipeline

Add GOPS_API_KEY as a protected secret in Bitbucket Pipelines, and set GOPS_PROJECT_ID as a protected variable. The API key must have permission to export Vault secrets for that project.

Deploy with Vault

Add this to bitbucket-pipelines.yml. Change --path, --env, and npm run deploy to match your application.

image: node:20

pipelines:
  branches:
    main:
      - step:
          name: Deploy
          script:
            - npm install --global @getgitops/cli
            - npm ci
            - gops vault run --api-url https://cloud.getgitops.com/api --api-key "$GOPS_API_KEY" --project-id "$GOPS_PROJECT_ID" --path / --env production -- npm run deploy

The command fetches secrets from Vault, makes them available only for the deploy process, and does not write an environment file to the repository or CI workspace.

See the official Bitbucket Pipelines documentation for its secret and variable configuration.