# Technical documentation — Webformulys

Evidence date: 2026-09-28.

Source: `git@bitbucket.org:overdrive/webformulys.git`, `main` at `b94306f` (2024-04-03, author Abdurahmaan Ismail, "Initial Bitbucket Pipelines configuration"). Only branch: `main`. `origin/HEAD` points at `main`.

The scan-host path `~/projects/sonar_scan/repos/Webformulys` was not on the machine that produced this document. Facts below come from that git revision. No secret values are stored in the tree.

## What this repository is

A Bitbucket repository with two tracked files and no application. Remote: `git@bitbucket.org:overdrive/webformulys.git`.

| Commit | Date | Author | Subject |
|---|---|---|---|
| `71d3c3f` | 2024-01-23 | Lloyd `<lloyd@overdrive.co.za>` | Initial commit (`.gitignore` only) |
| `b94306f` | 2024-04-03 | Abdurahmaan Ismail `<maanie@overdrive.co.za>` | Initial Bitbucket Pipelines configuration |

No tags. No other branches.

## Architecture

There is no runtime, database, or API. The only executable description is Bitbucket Pipelines.

```text
bitbucket-pipelines.yml
  image: node:16
  pipelines.branches.master
        step 1   npm install
                 npm run build
                 artifacts: build/**
        step 2   git ftp push
                 ftp://$FTP_HOST_QA/public_html/pestelite.overdriveqa.co.za
```

`main` does not appear in the file. Pushes to `main` do not start these steps.

## Repository layout

| Path | What it is |
|---|---|
| `.gitignore` | Bitbucket's default example ignore list, from `71d3c3f`. Header comment links to `https://www.atlassian.com/git/tutorials/saving-changes/gitignore` and says to customize the list. |
| `bitbucket-pipelines.yml` | Node.js pipeline template, edited down to a build step plus an FTP step. From `b94306f`. |

Absent, including paths the task-creation scan listed:

| Path | Status |
|---|---|
| `README.md` | Not in git |
| `package.json`, lockfile, `src/` | Not in git |
| `sonar-project.properties` | Named by the scan. Not in either commit |
| `sonarqube_scan.bat` | Named by the scan. Not in either commit |
| Tests, Docker, infrastructure-as-code, app config | Not in git |

## Languages and frameworks

**Unknown** for the product. No source file selects a language.

The pipeline image is `node:16`, and the commands are `npm install` and `npm run build`. That is a template choice. `.gitignore` also contains Java, Python, and Maven patterns because it is the stock Bitbucket list, not because those toolchains are configured.

No framework, ORM, or UI library is declared.

## Pipeline

Full behaviour of `bitbucket-pipelines.yml`:

- Comment block calls the file "Template NodeJS build" and says it validates Node.js code, runs tests, and lints on the default branch.
- `image: node:16`.
- One branch pipeline, key `master`.
- Step 1 script: `npm install` with comment "required to install zip"; then `npm run build`. Artifacts: `build/**`.
- Step 2 script: `git ftp push -u "$FTP_USERNAME_QA" -p "$FTP_PASSWORD_QA" ftp://$FTP_HOST_QA/public_html/pestelite.overdriveqa.co.za`.

Not present in the YAML: caches, services, definitions, deployment environments, manual triggers, pull-request pipelines, a `default` pipeline, a Sonar scanner step, a test step, or an install of `git-ftp`.

`git ftp` is a separate tool (`git-ftp`). The official `node:16` image does not add it, and this file does not install it. Provenance: **Inferred**. A custom runner that already has `git-ftp` is **Unknown / Requires Confirmation**.

Step 2 does not `cd build`. `git ftp push` uploads the git tree, not untracked files. The `build/**` artifact is produced in the pipeline workspace and is not part of commit `b94306f`. Whether that artifact would be uploaded is **Inferred** as no, and **Requires Confirmation** if a git-ftp flag or deploy script outside this file includes it.

## Environments

| Name in the file | What is known |
|---|---|
| QA | Inferred from the variable suffix `_QA` and the path `pestelite.overdriveqa.co.za`. No Bitbucket deployment environment is declared. |
| Production | Not named. |
| Local development | No instructions, no `.env.example`, no dev server. |

Variable names the step expects:

| Variable | Used as |
|---|---|
| `FTP_USERNAME_QA` | `git ftp push -u` |
| `FTP_PASSWORD_QA` | `git ftp push -p` |
| `FTP_HOST_QA` | Host in the `ftp://` URL |

Values are not in the repository. Whether they are set on the Bitbucket repository is **Unknown / Requires Confirmation**.

## External hosts written in source

One URL, with the host parameterized:

```text
ftp://$FTP_HOST_QA/public_html/pestelite.overdriveqa.co.za
```

No other hostname, API base, or database host is written in the tree.

## Auth

No application auth.

Pipeline publish auth is the FTP username and password variables above, passed on the `git ftp` command line. The URL scheme is `ftp`.

## Data

No database, schema, migration, or storage bucket is configured. `.gitignore` would ignore logs, `node_modules/`, `dist/`, and build outputs of several languages if those files were created later. `build/` is not ignored.

## Background work

No worker, cron, or queue. The pipeline is the only job, and it is branch-triggered for `master` only.

## Security notes from the tree

- No passwords, tokens, or private keys are committed.
- The publish URL uses FTP, which does not encrypt the password in transit.
- The password is passed as a process argument (`-p "$FTP_PASSWORD_QA"`), which can appear in a process list on the runner. The YAML does not use an alternate git-ftp credential file.
- `.gitignore` does not list `.env`. No `.env` file is committed.

## Build, run, and deploy

From this clone, there is nothing to install or run. There is no `package.json`.

The deploy command that would run, on a `master` pipeline only, is the `git ftp push` line in the second step. It was not executed for this document.

## Quality and tests

No test runner, linter, formatter, or Sonar properties file is in git. The task-creation scan's `sonar-project.properties` and `sonarqube_scan.bat` are not in history.

The template comment that mentions tests and linting is not wired to a command.

## Monitoring

No metrics, logs pipeline, health check, or alerting config is in the repository.

## Local development gaps

- No README or setup steps.
- No application source.
- Default branch `main` and pipeline branch `master` do not match.
- `npm` commands referenced by CI have no project file.
- `git ftp` is referenced and not installed by the pipeline.
- Deploy path names Pestelite, which is not explained in this repository.