Bitbucket Branch Protection and Hygiene Auditor

Overview

This flow audits Bitbucket repositories for branch-protection governance and branch hygiene. On a weekly schedule it lists every repository in the workspace, checks each one's protected branch for required reviewers, a passing-build merge check, and a direct-push restriction, and counts stale branches. It writes one audit record per repository to a Dataverse table, posts a compliance scorecard to a Teams channel, and emails repo owners the specific gaps to remediate.

Why it matters: Branch-protection drift across many repositories is a real security and quality risk — unreviewed or unverified merges into main. A scheduled audit keeps standards enforced and visible, with a durable Dataverse record for trend reporting.

Status: Built and verified (Flow Checker 0 errors / 0 warnings). Ships Off — going live requires only connection authorization, a Bitbucket access token, and env-var configuration.

Use Case

A platform / dev-governance team wants continuous assurance that Bitbucket repositories meet branch-protection standards (required approvals, build gates, no direct pushes to the mainline) and aren't accumulating stale branches. The flow produces a weekly governed record plus an actionable Teams scorecard and per-owner remediation emails.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Bitbucket	shared_bitbucket	ListRepositories
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord
Microsoft Teams	shared_teams	PostMessageToConversation
Office 365 Outlook	shared_office365	SendEmailV2

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Auto-remediate

Add an Approvals gate, then PUT a baseline branch-restriction set back to Bitbucket for approved repos.

Stale-branch cleanup

Extend the loop to propose (or, behind approval, perform) deletion of merged stale branches.

Per-team scorecards

Drive the workspace/owner from a Dataverse mapping table and post each team's scorecard to its own channel.

Cadence

Change the Run_Audit_On_Schedule recurrence (e.g. daily) for higher-frequency governance.

Stricter policy

Raise flowlibs_MinRequiredReviewers or add additional kind checks (e.g. enforce_merge_checks, delete restriction) in the filters.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@less(ticks(coalesce(item()?['target']?['date'], utcNow())), ticks(variables('varStaleCutoff')))

@if(empty(body('Filter_Approval_Rule')), 0, coalesce(first(body('Filter_Approval_Rule'))?['value'], 0))

@add(add(if(less(outputs('Compose_Reviewers_Found'), variables('varMinReviewers')),1,0), if(empty(body('Filter_Build_Rule')),1,0)), if(empty(body('Filter_Push_Rule')),1,0))

@if(and(equals(outputs('Compose_Violation_Count'),0), equals(outputs('Compose_Stale_Count'),0)), 'Compliant', 'Non-Compliant')

@{addDays(utcNow(), mul(-1, int(parameters('EnvVar_StaleBranchThresholdDays'))))}

Customize & download