Description:

This control ensures that pull requests cannot be merged into protected branches until the configured Continuous Integration (CI) pipeline has completed successfully. The CI pipeline validates code changes through automated build, test, and verification processes before integration.


Rationale:

Requiring a successful CI pipeline before merge helps prevent defective, unstable, or non-compliant code from being introduced into protected branches. Automated validation improves software quality, reduces deployment risks, and ensures that code changes meet organizational standards before being merged.


Impact:

  • Prevents pull requests from being merged when CI pipeline checks fail.

  • Improves code quality and software reliability.

  • Identifies build, test, and integration issues before code is merged.

  • Supports secure software development and change management requirements.

  • May increase merge times while CI pipeline checks complete.


Default Value:

Disabled by default. Repository administrators must explicitly configure branch restrictions to require successful build or pipeline checks before pull requests can be merged.


Remediation

Test Plan

  1. Navigate to the target Bitbucket repository.

  2. Verify that Bitbucket Pipelines is enabled, or an external CI tool is integrated and posting build statuses.

  3. Verify that a branch restriction is configured for the protected branch.

  4. Verify that "Minimum number of successful builds for the last commit with no failed builds and no in progress builds" is enabled, with value ≥ 1.

  5. If CI is not connected, the check is not enabled, or the value is 0, follow the Implementation Steps to remediate and repeat the test.

  6. Create a test PR, attempt merge while the build is failing/running — verify it's blocked.

  7. Let the build pass, attempt merge again — verify it succeeds. Delete the test PR/branch afterward.



Implementation Steps:

  1. Sign in to Bitbucket with administrative access to the repository.

  2. Navigate to the target repository.

  3. Click the three-dot menu (⋯) next to the repository name and select Settings.

        

  1. Under Workflow, select Branch restrictions.

            

  1. Click Add a branch restriction or edit an existing branch restriction.

  2. In the branch Restriction, select by branch name or pattern add “*” value (it will include all branches).

  1. Select the Merge settings tab.

  2. Enable Minimum number of successful builds for the last commit with no failed builds and no in progress builds.

  3. Specify the minimum number of successful builds required (typically 1 or greater according to organizational policy).

  1. Click Save to apply the branch restriction.


Backout Plan:

  1. Sign in to Bitbucket with administrative access to the repository.

  2. Navigate to the target repository.

  3. Click the three-dot menu (⋯) next to the repository name and select Settings.

  4. Under Workflow, select Branch restrictions.

  5. Edit the applicable branch restriction.

  6. Disable Minimum number of successful builds for the last commit with no failed builds and no in progress builds.

  7. Click Save.


References: