feat(server): read Bitbucket and GitCafe credentials from a secret provider - #27746

Eligibility
Adds selectable secret-provider credentials for Bitbucket and GitCafe, with server-side resolution and refresh support. Existing literal credentials and empty defaults remain supported, and the new source is opt-in.

Additional Thinking

Your Custom Policy

Applied default approvability criteria. The assessed changes preserve existing empty credential defaults and add an explicitly selected credential source rather than changing product defaults. No added or broadened static-analysis suppression directives appear in the assessed diff.

Code

Adds opt-in secret-provider references for Bitbucket and GitCafe credentials, schema-driven settings controls, server-side resolution, refresh invalidation, and provider-config secret tracking. Literal credentials retain secret-store/redaction handling; references remain settings metadata. Resolution is limited to declared fields and the requested host kind, with cached reads and unreadable references treated as unset.

Review Context

Author is yordis; ownership information was not supplied. All 13 checked review threads are resolved, with no unresolved comments or correctness findings supplied. No CI results or blocking-severity configuration were supplied. Customer-ignored files were not reconstructed.

Verdict

The credential-source extension is opt-in and uses existing configured secret providers and existing source-control credential consumers. Resolved values stay in server-side consumer settings copies; literal credential handling remains intact. No material permissions, product-default, infrastructure, or persistent-data change requires a human decision.

Notes:
No code owners found in target merge base 8d012a6

Agent Credits: 30 credits
Approvability runs at a flat rate of 30 credits whenever the agent is asked for a verdict.