Bitbucket Dependency Vulnerability Alert

Overview

This flow closes the loop on dependency risk in Bitbucket. On a daily schedule it lists every repository in the configured Bitbucket workspace, reads the dependency-vulnerability annotations from each repo's latest security-scan report (Bitbucket Code Insights), opens a tracked Dataverse remediation item per finding, posts the severity and affected package to a security Microsoft Teams channel, and — for critical CVEs — immediately emails the repo owner via Outlook.

Why it matters: Vulnerability alerts that aren't tracked get ignored. Turning each finding into an owned, tracked remediation item with severity-based escalation drives them to closure.

Status: Built and shipped Off (demo). Going live requires only authorizing the four connections and setting the environment-variable values — no logic changes.

Use Case

A dev/security team wants dependency vulnerabilities surfaced, owned, and tracked rather than buried in scan output. Each daily run produces a Dataverse audit trail, a Teams notification stream for the security channel, and high-importance email escalations for critical findings.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Bitbucket	shared_bitbucket	ListRepositories
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord
Microsoft Teams	shared_teams	PostMessageToConversation
Office 365 Outlook	shared_office365	SendEmailV2

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Auto-PR

Add a Bitbucket step (HTTP) to open a dependency-bump pull request for a known fix version.

SLA by severity

Store a per-severity remediation deadline on the Dataverse row and drive reminders from it.

Suppression list

Check a Dataverse accepted-risk table before opening a new item to skip known exceptions.

Per-repo owner

Replace the single flowlibs_RepoOwnerEmail with a lookup (Dataverse or repo metadata) so escalation emails route to the actual owner.

Scanner swap

Repoint the two HTTP calls at any scanner that exposes findings (Snyk, Dependabot, OSV.dev) and adjust the severity/package/CVE field reads.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@toUpper(coalesce(items('Apply_to_each_Finding')?['severity'],'LOW'))

equals(outputs('Compose_Severity'), toUpper(variables('varCritical')))

@{coalesce(first(body('Get_Latest_Commit')?['values'])?['hash'], 'HEAD')}

@{concat(coalesce(item?['path'], item?['summary'], 'Unknown package'), ' - ', coalesce(item?['external_id'], 'No CVE'))}

@{concat(variables('varApiBase'), '/repositories/', variables('varWorkspace'), '/', slug, '/commit/', outputs('Compose_Commit_Hash'), '/reports/', variables('varReportId'), '/annotations?pagelen=100')}

Customize & download