Log every Bitbucket pipeline run to a Google Sheet

Every time a Bitbucket pipeline finishes running (success, failed, or stopped), append one row to a Google Sheets deploy log. The goal is an audit-friendly, append-only ledger of every CI/CD run so we have a trustworthy record for later analysis or SOC 2 review, without paying for a separate analytics tool.

Trigger: a Bitbucket webhook subscribed to the pipeline completion event for the workspace. Bitbucket emits an event on every finished pipeline regardless of outcome, and the payload already contains everything we need, so no follow-up Bitbucket call is required in the happy path.

Step 1. Parse the webhook payload. Pull out: the repository full name (workspace/repo_slug), the target ref (branch, tag, or commit hash), the commit SHA, the commit author (display name or username), the trigger reason (push, manual, schedule, pull request, and so on), the pipeline state and result (SUCCESSFUL, FAILED, STOPPED, ERROR), the pipeline build number and UUID, and the created_on and completed_on timestamps.

Step 2. Check the repository full name against an allow-list configured on the workflow. If the repo is not on the list, stop cleanly without writing anything. The allow-list is a plain array of repository full names (for example, acme-co/frontend, acme-co/backend).

Step 3. Compute the duration in seconds from created_on and completed_on. If either timestamp is missing (rare), leave the duration cell blank rather than guessing or defaulting to zero.

Step 4. Build the pipeline URL as https://bitbucket.org/{workspace}/{repo_slug}/pipelines/results/{buildNumber} using the workspace, repo slug, and build number from the payload.

Step 5. Append a single row to the configured Google Sheet using the Google Sheets Append Values operation with valueInputOption=USER_ENTERED so the timestamp and URL render naturally. The columns, in order, are: timestamp (ISO 8601 UTC of completion), repository full name, branch (or tag/commit ref), commit SHA, commit author, trigger reason, pipeline status, duration in seconds, and the pipeline URL.

Append-only invariant: the workflow must never update or delete existing rows, even to fix a duplicate. If the same webhook fires twice, allow the second row to land as-is. The whole point of this ledger is that historical rows are immutable, so audit consumers can trust it.

Configuration knobs to expose to the user: the Google spreadsheet ID and tab name (default Sheet1), the allow-list of repository full names, and an optional column-mapping override for teams whose sheet already has more columns than the default nine.

Failure behavior: if the Google Sheets append is rate-limited or transiently fails, retry with exponential backoff. If it still fails after retries, log the dropped event with enough detail to reconstruct it manually, but do not attempt any compensating writes. If the Bitbucket webhook payload is malformed, log and drop without writing to the sheet.

This is a deterministic step-by-step workflow with no reasoning required, which is why it is a code workflow rather than an agent.