.png)
Buildkite Integration Guide
Connect Buildkite pipelines, builds, jobs, agents, and artifacts with enterprise systems through REST, GraphQL, webhooks, and orchestrated workflows.
Buildkite integration options at a glance
Buildkite provides a REST API for organizations, pipelines, builds, jobs, agents, teams, users, and artifacts, plus a GraphQL API for tailored queries and supported mutations. Selected pipeline, build, and job events can be delivered through outgoing webhooks, while builds and jobs execute asynchronously on Buildkite agents. Buildkite also supports artifact upload, listing, and download through its artifact interfaces. Martini can authenticate with bearer API tokens or applicable OAuth credentials, validate webhook signatures, orchestrate API calls, map Buildkite objects, transfer artifacts, and expose APIs for triggering or monitoring builds. Large synchronizations should use pagination, checkpoints, bounded concurrency, and reconciliation rather than assuming a general-purpose bulk API.
Common Buildkite integration patterns
Common Buildkite data objects used in integrations
Authentication and security considerations
Token and delegated authentication
Buildkite REST and GraphQL requests use API-token-based authentication, typically with bearer tokens and permissions determined by the token and user or organization access. OAuth is available when an application must act on behalf of Buildkite users.
Webhook validation
Buildkite webhook requests should be validated with the documented signature and shared secret before a Martini workflow accepts or acts on an event.
Least privilege and secrets
- Use separate, least-privilege credentials for each environment and integration purpose.
- Store API tokens, OAuth credentials, and webhook secrets in secure Martini configuration.
- Restrict exposed endpoints and authorize build-triggering operations and parameters.
Operational considerations for Buildkite integrations
Rate limits and pagination
Respect Buildkite rate limits and response headers where supplied. Paginate collections and use checkpoints rather than assuming that one response contains all pipelines, builds, jobs, agents, or artifacts.
Events and idempotency
Webhook deliveries can be duplicated or arrive out of order. Persist an event, build, job, or artifact key, retrieve authoritative state when needed, and use a Martini-side deduplication record before triggering asynchronous builds or downstream actions.
Retries and concurrency
Retry transient failures and HTTP 429 responses with controlled backoff. Use bounded concurrency and avoid high-frequency polling, especially across large organizations.
State and schema changes
Model pipeline, build, and job lifecycles separately, including blocked, waiting, running, passed, failed, canceled, and skipped states. Treat webhook payloads as event envelopes, handle optional fields, and review GraphQL queries against schema changes.
Testing and artifacts
Test webhook signatures, duplicate delivery, out-of-order events, failed jobs, partial completion, and large artifact transfers. Record artifact identifiers and destination status to prevent duplicate transfers.
Why use Martini instead of scripts or point-to-point integrations?
Orchestration instead of isolated scripts
Martini centralizes Buildkite API calls, webhook handling, downstream updates, asynchronous status monitoring, and artifact transfers in versionable workflows rather than scattering logic across scripts.
Reusable integration behavior
Reusable workflows and exposed APIs can standardize authentication, correlation, validation, mapping, business rules, retries, and reconciliation across multiple Buildkite organizations or pipelines.
Controlled evolution
Martini separates vendor-specific Buildkite models from canonical downstream models. This makes it easier to accommodate optional fields, lifecycle differences, API changes, and new target systems without rebuilding point-to-point integrations.
Operational visibility
Centralized error handling, logs, checkpoints, and monitoring support troubleshooting of webhook delivery, rate limits, asynchronous execution, pagination, and artifact transfer failures.