Monitoring New Bitbucket Repositories with Jenkins & Slack

A Practical Step-by-Step Implementation Guide

As a Security Engineer, maintaining visibility over the organization’s code assets is essential. New repositories can appear at any time — sometimes outside formal processes, without security review, or even with sensitive information exposed.

To improve transparency and governance, I implemented an automated mechanism that detects newly created repositories in Bitbucket Cloud and sends real-time alerts to Slack.

This guide walks through the exact implementation process, including navigation paths, commands, and configuration details.

Project Architecture Overview

Step 1 — Launch an EC2 Instance

Log in to Amazon Web Services.

Navigate to:

AWS Console → EC2 → Instances → Launch Instance

Use the following settings:

• Name: jenkins-monitor
• AMI: Ubuntu Server 22.04 LTS
• Instance type: t2.micro (sufficient for this workload)
• Key pair: create or select existing
• Security Group:

SSH (22) → your IP

HTTP (8080) → your IP (for Jenkins access)

Launch the instance and connect via SSH:

ssh -i key.pem ubuntu@YOUR_PUBLIC_IP

Step 2 — Update the Server

sudo apt update && sudo apt upgrade -y

Keeping the system updated ensures security and compatibility.

Step 3 — Install Java (Required for Jenkins)

sudo apt install openjdk-17-jdk -y

java -version

Step 4 — Install Jenkins

curl -fsSL https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key | sudo tee \

/usr/share/keyrings/jenkins-keyring.asc > /dev/null

echo deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] \

**https://pkg.jenkins.io/debian-stable binary/ | sudo tee **

/etc/apt/sources.list.d/jenkins.list > /dev/null

sudo apt update

sudo apt install jenkins -y

Start and enable Jenkins:

sudo systemctl enable jenkins

sudo systemctl start jenkins

Step 5 — Access Jenkins UI

Open in browser:

**http://YOUR_PUBLIC_IP:8080**

Retrieve admin password:

sudo cat /var/lib/jenkins/secrets/initialAdminPassword

Complete setup:

➡ Install suggested plugins ➡ Create admin user ➡ Save & finish

Step 6 — Install Required Tools

Install tools used by the monitoring script:

sudo apt install curl jq -y

• curl → API calls
• jq → JSON parsing

Step 7 — Create a Slack Webhook

Go to Slack:

Slack → Apps → Manage Apps → Create New App

Then:

➡ Enable Incoming Webhooks ➡ Add webhook to channel (e.g. #sdlc) ➡ Copy webhook URL

Step 8 — Store Slack Webhook in Jenkins

Navigate:

Jenkins → Manage Jenkins → Credentials → Global → Add Credentials

• Kind: Secret Text
• Secret: webhook URL
• ID: slack-webhook

This keeps the webhook secure.

Step 9 — Create Bitbucket App Password

In Bitbucket:

Personal Settings → API Tokens → Create API token with scopes

Grant:

✔ Repositories: Read

Copy the generated password.

Step 10 — Add Bitbucket Credentials to Jenkins

Navigate:

Manage Jenkins → Credentials → Add Credentials

• Kind: Username & Password
• Username: Bitbucket username
• Password: App Password
• ID: bitbucket-creds

Step 11 — Create the Monitoring Job

Navigate:

Jenkins Dashboard → New Item

• Name: bitbucket-repo-monitor
• Type: Freestyle Project

Click OK.

Step 12 — Configure Scheduled Trigger

Scroll to Build Triggers:

✔ Build periodically

Example (every hour):

H

Step 13 — Add the Monitoring Script

Scroll to:

Build → Add build step → Execute shell

Paste:

#!/bin/bash

set -e

# ============================================================

# Configuration

# ============================================================

# Bitbucket workspace to monitor

WORKSPACE_NAME=”Test”

# Base Bitbucket API endpoint

BASE_URL=”https://api.bitbucket.org/2.0/repositories/${WORKSPACE_NAME}"

# Files used to store repository state between runs

STATE_FILE=”repos_state.txt”

TMP_FILE=”repos_current.txt”

echo “Checking Bitbucket workspace: ${WORKSPACE_NAME}”

# ============================================================

# Environment validation

# ============================================================

# These variables must be provided by Jenkins credentials

if [ -z “$BITBUCKET_USER” ] || [ -z “$BITBUCKET_TOKEN” ] || [ -z “$SLACK_WEBHOOK” ]; then

echo “[ERROR] Missing required environment variables”

exit 1

fi

# ============================================================

# Fetch all repositories from Bitbucket (with pagination)

# ============================================================

# Clear temporary file

> “$TMP_FILE”

# Initial API URL

URL=”${BASE_URL}?pagelen=100"

# Loop through all pages returned by Bitbucket API

while [ -n “$URL” ]; do

RESPONSE=$(curl -sS — fail -u “${BITBUCKET_USER}:${BITBUCKET_TOKEN}” “$URL”)

# Extract repository slugs

echo “$RESPONSE” | jq -r ‘.values[].slug’ >> “$TMP_FILE”

# Get next page URL if exists

URL=$(echo “$RESPONSE” | jq -r ‘.next // empty’)

done

# Sort and remove duplicates

sort -u “$TMP_FILE” -o “$TMP_FILE”

# ============================================================

# First run handling (baseline creation)

# ============================================================

if [ ! -f “$STATE_FILE” ]; then

cp “$TMP_FILE” “$STATE_FILE”

curl -sS — fail -X POST -H ‘Content-type: application/json’ \

— data ‘{“text”:”📦 Jenkins started tracking Bitbucket repositories for workspace paymeservice”}’ \

“$SLACK_WEBHOOK” >/dev/null

echo “[INFO] Initial repository state created”

exit 0

fi

# ============================================================

# Compare current state with previous state

# ============================================================

NEW_REPOS=$(comm -13 “$STATE_FILE” “$TMP_FILE”)

if [ -n “$NEW_REPOS” ]; then

MESSAGE=$(printf “🚀 New Bitbucket repositories detected:\n%s\n” \

“$(echo “$NEW_REPOS” | sed ‘s/^/- /’)”)

else

MESSAGE=”✅ No new Bitbucket repositories were created since last check”

fi

# ============================================================

# Print result to Jenkins console

# ============================================================

echo “ — — — — — — — — — — — — — — — — — — — — “

echo “$MESSAGE”

echo “ — — — — — — — — — — — — — — — — — — — — “

# ============================================================

# Send Slack notification (silent)

# ============================================================

curl -sS — fail -X POST -H ‘Content-type: application/json’ \

— data “$(jq -nc — arg text “$MESSAGE” ‘{text:$text}’)” \

“$SLACK_WEBHOOK” >/dev/null

# ============================================================

# Update baseline for next run

# ============================================================

cp “$TMP_FILE” “$STATE_FILE”

echo “Done”

Step 14 — Handle Pagination (Important)

If your workspace contains more than 100 repositories, extend the script to iterate through pagination using the next field from the API response.

This ensures full repository coverage.

Step 15 — Implement State Tracking

The script stores repository names in a local file within the Jenkins workspace.

This allows comparison between runs to detect newly created repositories.

Step 16 — First Run Baseline Behavior

On the first run, the script creates a baseline file and does not send alerts. This prevents notifications for existing repositories.

Step 17 — Slack Alerts & Jenkins Logs

When new repositories are detected:

✔ Slack receives an alert ✔ Jenkins Console Output logs the result

Final Outcome

This automation provides real-time visibility into repository creation, helping detect shadow projects, enforce governance, and strengthen security oversight.

Security begins with visibility — and automation ensures nothing enters the environment unnoticed.