GitBoost - CommitGraph for Bitbucket - Documentation

CommitGraph is a powerful visualization for quickly understanding git activity and git history. At this time it is currently available as an app for Bitbucket DC.

CommitGraph's "All Branches Graph" captures all recent activity across all branches of a git repository. It's the user friendly version of git log --graph --all --date-order

Table of Contents

• Introduction
• Transition To Paid
• Software Development Security Scans
  1. SAST Results: SonarQube - 0 security findings
  2. SCA Results: OWASP Dependency Check - 0 vulnerabilities
• How To Use CommitGraph
  1. Out of the box
  2. Branch Selection
  3. Jira Integration
  4. Jira Integration - NEXT LEVEL !!!
  5. CI/CD Build Results
  6. Search Results
• Bonus Features
• How To Configure CommitGraph
• Future Roadmap Ideas/Plans
• Compared To Competing Solutions
  1. The OG: "git log --graph --all --date-order"
  2. GitHub Network Graph
  3. Bitbucket Cloud
  4. Charts & Graphs (AppFire)
  5. Anything Else?
• Brief History of A Bitbucket Plugins

Transition To Paid

CommitGraph is a paid app starting with version v2026.02.21. Pricing details available here: gitboost.com/CommitGraph/#pricing

Revenue from CommitGraph also supports our research and development roadmap. In the last year we have tripled our staffing levels and we are pushing hard to make sure all of our existing GitBoost apps (including ControlFreak, CommitGraph, and PR-Booster) fully support the Bitbucket and GitHub cloud platforms. This will help customers with long term strategic planning around Git hosting and AI integration.

We aim to have all GitBoost apps available on Bitbucket Cloud with full feature parity by EOY 2026. For Github: EOY 2027. Customer migration scripts to help with settings and configuration import will also be available.

Software Development Security Scans

We currently run two types of security scans before publishing each release of CommitGraph:

1. SAST ("static application security testing"):

   We use SonarQube's Cloud scanner at the "Team" subscription level. We use Sonar's out-of-the-box "Sonar Way" code quality configuration. We do not adjust it in any way, and we do not "Accept Issues" or mark anything as a false positive in Sonar's web ui.

2. SCA ("software composition analysis"):

   We use the free open-source OWASP Dependency Check for this scan. We also enforce a zero-dependency policy as part of CommitGraph's software development process. And so, in a way, running the SCA scan is moot, but it helps make sure we haven't accidentally introduced a new library dependency without realizing it.

Latest SAST Result: SonarQube - 0 security findings

The March 2026 release of CommitGraph resolved 34 security findings and 5 reliability findings. With a solid security and reliability baseline now in place, our software development policy going forward is to maintain all future CommitGraph versions at this same level: SonarQube rating of "A" for both Security and Reliability.

^{SonarQube SAST scan for v2026.02.21 reports 0 security issues and 0 reliability issues
(click for larger screenshot)}

Last SCA Result: OWASP Dependency Check - 0 vulnerabilities

We enforce a "zero-dependency" policy with CommitGraph. Our SBOM report attests to that (see: commitgraph-2026.02.21.jar.cyclonedx.sbom.json). The SBOM report is also available embedded inside each CommitGraph jar file (look for "./$JAR_NAME.cyclonedx.sbom.json" inside the Jar file). The OWASP Dependency Check plugin reports 8 dependencies, but that's just a quirk of how that scanner processes artifacts on the file system. All 8 dependencies are in-house software artifacts developed by GitBoost.

How To Use CommitGraph

1. Out of the box

   

   As long as it's licensed, CommitGraph is fully functional immediately after installation and does not require any further configuration.

   The "All Branches Graph" option should automatically appear on the left navigation panel whenever you navigate to a repository.

   In addition an "All Branches" link should also start appearing on Bitbucket's built-in "Commits" screen. This link sends the user directly to CommitGraph's "All Branches Graph" page - exactly the same as if they had clicked on it using the left menu. CommitGraph adds this link to the built-in "Commits" screen because this can be easier to find for many users.

   Finally, immediately after installation CommitGraph also applies its date and reverted-commit UI enhancements to the regular "Commits" screen. Please see the "How To Configure CommitGraph" section below for more information about these UI enhancements.

   
   

2. Branch Selection

   

3. Jira Integration

4. Jira Integration - NEXT LEVEL !!!

5. CI/CD Build Results

6. Search Results

Bonus Features

How To Configure CommitGraph

Global Configuration

From Bitbucket's global settings page look for the "CommitGraph" item under the "Add-ons" section.

CommitGraph allows configuration of the following:

Project and Repository Configuration

The same settings are available on CommitGraph's settings pages at the project and repository level. Any project admin or repository admin can adjust these settings to suit their taste on the projects and repositories where they have admin permissions.

Note: the "temporary-license-override" setting is only available at the global level.

Understanding CommitGraph's Configuration Options

The configuration page explains each setting in detail, and should be current with the version running in your Bitbucket instance. Here is a quick summary of the config options in the latest version of CommitGraph (v2026.02.21):

The Basic Configuration Options

• All Branches Graph Enabled (Default value: Yes)

  Set this to "No" and the "All-Branches-Graph" link in the main navigation will disappear. You can set this globally. You can also enable or disable CommitGraph per-project and per-repository.

• Temporary License Override

  GitBoost can provide customers with a special temporary license override to help in situations where a customer's internal procurement processes cannot be completed before Atlassian's default 30 day evaluation license expires.

• Commits Screen Integration (Default value: Bitbucket)

  If you really love our CommitGraph you can also have it enabled for Bitbucket's built-in "Commits" screen. But since Bitbucket already puts its own graph there, it does look weird to have both graphs running side-by-side, and disabling the Bitbucket built-in implementation is a bit involved and requires a Bitbucket restart. This option is really only for the true diehard CommitGraph lovers.

The Advanced Configuration Options

These options adjust how Bitbucket displays data on some of its built-in pages, including the "Commits" screen. I don't think anyone realizes that CommitGraph is making these tiny adjustments, because they are subtle. But, hey, it's the little things in life that spark joy, right?

• Time source to show for commits (Default value: GIT_COMMITTER_DATE)

  Use this to control which data/time to show in the Bitbucket UI on the various pages where this data is presented. Look, we have strong opinions! If things were up to us, we would use "Push Time". But that data is hard to get, and GIT_COMMITTER_DATE tends to be pretty close.

  I don't understand how anyone could think "GIT_AUTHOR_DATE" is a useful or good choice here, except that it's also what "git log" shows by default.

• Bitbucket date/time formatting (Default value: relative time for 7 days)

  Bitbucket likes to say things like "this commit is 5 days old". But I'm a software engineer. Please just give me the date in a consistent format.

  CommitGraph provides 3 options:

  • Relative Time for first 7 days (e.g., "5 days ago")

    This is how Bitbucket normally behaves.

  • Always show date ("e.g., 31 Mar 2026")

    This is the way Bitbucket normally shows dates that are more than 7 days old.

  • Always show date and time ("e.g., 31 Mar 2026, 15:23")

    My favourite!

• Strikethru Reverted Commits (Default value: Yes)

  This is a useful visualization for understanding commits that have been reverted via the "git revert" command.

• Enable cross-repository Jira searching (Default value: Yes)

  The Jira searching can also find commits that match outside the current repository.

  Honestly I have no idea why anyone would ever set this to "No" but I guess someone out there must have requested this.

Comparing Against Competing Solutions

1. The OG: "git log --graph --all --date-order"

   This one is very good! You can even include forks in the graph by adding them via "git remote add" and "git fetch --all". I also like how "git log" graphically maintains the "first-parent" relation, and so if I type "git log --graph origin/main", I know with certainty that every commit on the far-left column is from the "main" branch.

   The Jira integration and CI/CD integration are somewhat lacking, though. You have to manually look up each Jira ticket in Jira! ;-p

   The main downsides:

   1. If you don't run "git fetch" first, the data might be stale.
   2. Not everyone loves fixed-width ascii art. It's also not particularly efficient with screen real estate.
   3. The visualization can get completely messed up with heavy merging or extremely large commit messages because of the ascii word wrapping.

2. GitHub's "Network" Graph

   Not sure how many people even know about this! From your repository's page navigate to: Insights --> Network.

   It's decent for seeing how many forks are ahead or behind a given repository.

   Github's Network graph uses an innovative but very cumbersome horizontal orientation. You hold down your left mouse button to drag. Can also be quite slow to load. I swear I can hear the Azure data center server fans spinning up whenever I click on this (I live about 200 miles away from Azure's US WEST 2 location).

3. Bitbucket Cloud "Commits" Page

   A truly excellent commit graph! Includes all branches, with great Jira and CI/CD integration built-in.

   My only quibble here would be that the visualization trades away a bit of usability in exchange for screen real estate. In other words: the visualization is so compact that it can be a little hard to trace the history of a specific branch line.

   Compared to our CommitGraph it's only missing two things:

   1. Our innovative Jira "compressed" graph functionality.
   2. The ability to see a subset of all branches. With Bitbucket Cloud's native ability here the only choice is one branch or all branches.

4. Charts & Graphs (AppFire)

5. Anything Else

Pricing