CI/CD Deployment of API Mesh via Bitbucket Pipelines

[lachlanturner]

Hi,

  I'm currently trying to set up deployment of an API Mesh application via Bitbucket Pipelines.

I know that there is an existing GitHub actions workflow, but I cannot use GitHub at this point. I have tried to copy most of the steps from the GitHub actions workflow, but I am getting an error.

Rather than generating a token via curl or something along those lines, I am setting a "ci" context via aio config:set ims.contexts.ci --json --file ci-context.json, which appears to be working. I am able to generate an access token via aio auth:login --no-open, but then following commands, such as aio console org:select or even aio api-mesh:describe get the following error:

IMSOAuthLibError: [IMSOAuthSDK:IMSOAUTHCLI_LOGIN_CI_ERROR] Interactive login is not supported in CI environments. Use a service account and configure credentials via environment variables. See: https://developer.adobe.com/app-builder/docs/guides/deployment/ci_cd_for_firefly_apps/
Code: IMSOAUTHCLI_LOGIN_CI_ERROR

Based  on the GitHub action setting the environment variable AIO_IMS_CONTEXTS_CLI_ACCESS__TOKEN_TOKEN, I tried setting this, as well as AIO_IMS_CONTEXTS_CI_ACCESS__TOKEN_TOKEN, along with setting values via aio config:set ims.contexts.ci.access_token $token, etc. but I just keep getting the same error.

Additionally, the documentation mentioned in the error message redirects to https://developer.adobe.com/app-builder/docs/guides/app_builder_guides/deployment/cicd-for-app-build... and is completely unhelpful, as it just talks about GitHub actions. There is a very small section titled "Bring your own CI/CD pipeline", which has basically zero details about what needs to happen.

Does anyone know how to get past this error and have the mesh actually deploy?

[MaxCa1]

Hi, 

I have the same challenge when configuring a GitLab pipeline. It seems like only Github is supported. Logically, you should set variables to authenticate, rather than using aio login....

so you could try something like:

- echo "Delete variables"
- aio config:delete runtime.auth
- aio config:delete runtime.namespace
- aio config:delete runtime.apihost

- aio config:set runtime.auth "client_id:client_secreet"
- aio config:set runtime.namespace "my-namespace"
- aio config:set runtime.apihost "https://adobeioruntime.net"

 and any other variable if you need (I think those are sufficient to authenticate)
or even using a direct variable named __OW_API_KEY, which is used in node_modules/openwhisk/lib/client.js


I haven't succeeded, though. I am having the following issue (in case someone got something similar):

025-07-16T04:42:25.534Z @adobe/aio-lib-runtime:RuntimeAPI:debug proxy settings not found
2025-07-16T04:42:25.538Z aio-cli-plugin-runtime TypeError [ERR_INVALID_ARG_TYPE]: The first argument must be of type string or an instance of Buffer, ArrayBuffer, or Array or an Array-like Object. Received an instance of Object
    at Function.from (node:buffer:322:9)
    at Client.authHeader (/usr/local/lib/node_modules/@adobe/aio-cli/node_modules/openwhisk/lib/client.js:247:35)
    at Client.params (/usr/local/lib/node_modules/@adobe/aio-cli/node_modules/openwhisk/lib/client.js:185:17)
    at Client.request (/usr/local/lib/node_modules/@adobe/aio-cli/node_modules/openwhisk/lib/client.js:175:25)
    at Packages.request (/usr/local/lib/node_modules/@adobe/aio-cli/node_modules/openwhisk/lib/base_operation.js:30:24)
    at Packages.operation (/usr/local/lib/node_modules/@adobe/aio-cli/node_modules/openwhisk/lib/resources.js:69:17)
    at Packages.list (/usr/local/lib/node_modules/@adobe/aio-cli/node_modules/openwhisk/lib/resources.js:31:17)
    at Packages.list (/usr/local/lib/node_modules/@adobe/aio-cli/node_modules/openwhisk/lib/packages.js:33:18)
    at PackageList.run (/usr/local/lib/node_modules/@adobe/aio-cli/node_modules/@adobe/aio-cli-plugin-runtime/src/comma

I even tried hardcoding all the variables, but it keeps saying api_key is an object

[lachlanturner]

I did eventually work this out, but forgot to post back here.

The issue is that in setting the context, it actually needs to be the "cli" context specifically. The help documentation is a little confusing for the "aio auth:ctx" command, as it says:

Please note, that the following IMS context label names is reserved: `cli`
and should not be used as an IMS context name.

This is what the relevant parts of our pipeline look like now:

# Bitbucket Pipelines configuration for Adobe API Mesh deployment
# Deploys to staging on push to 'staging' branch
# Deploys to production on push to 'production' branch

image: node:22

definitions:
  steps:
    - step: &build-and-deploy
        name: Build and Deploy API Mesh
        caches:
          - node
        script:
          # Install dependencies
          - corepack enable
          - yarn install
          
          # Build TypeScript resolvers
          - yarn build:resolvers
          
          # Create .env file with environment-specific values
                    
          # Create secrets.yaml with environment-specific values
          
          # Install Adobe I/O CLI
          - npm install -g @adobe/aio-cli
          
          # Install API Mesh plugin
          - aio plugins:install @adobe/aio-cli-plugin-api-mesh
          
          # Authenticate with Adobe
          - echo "Authenticating with Adobe I/O"
          - |
            cat <<EOF > cli-context.json
            {
              "client_id": "$CLIENT_ID",
              "client_secrets": [ "$CLIENT_SECRET" ],
              "technical_account_id": "$TECHNICAL_ACC_ID",
              "technical_account_email": "$TECHNICAL_ACC_EMAIL",
              "ims_org_id": "$IMS_ORG_ID",
              "scopes": [
                "AdobeID",
                "openid",
                "read_organizations",
                "additional_info.projectedProductContext",
                "additional_info.roles",
                "adobeio_api",
                "read_client_secret",
                "manage_client_secrets"
              ]
            }
            EOF
            aio config:set ims.contexts.cli --json --file ./cli-context.json
            aio auth:ctx -s cli
          
          - aio auth:login --no-open
          
          # Set CLI ENV
          - aio config set cli.env $ENV_ID
          
          # Select organization
          - aio console:org:select $ORG_ID
          
          # Select project
          - aio console:project:select $PROJECT_ID
          
          # Select workspace
          - aio console:workspace:select $WORKSPACE_ID
          
          # Check if mesh exists
          - |
            MESH_STATUS=$(aio api-mesh:status || echo "NO_MESH")
            echo "Mesh status: $MESH_STATUS"
          
          # Create or update mesh
          - |
            if [[ "$MESH_STATUS" == *"NO_MESH"* ]] || [[ "$MESH_STATUS" == *"Error"* ]]; then
              echo "Creating new mesh..."
              aio api-mesh:create --env=.env --secrets=secrets.yaml -c mesh.json
            else
              echo "Updating existing mesh..."
              aio api-mesh:update --env=.env --secrets=secrets.yaml -c mesh.json
            fi

          # Wait for 30 seconds
          - sleep 30
          
          # Verify deployment
          - aio api-mesh:describe
          - aio api-mesh:status