Connecting to Bud

Bloom manages product definition, traceability, and verification intent. Bud manages test execution evidence. Each product runs independently, and neither requires the other. Connecting them adds navigation links between the apps, test case execution outcomes from Bud in Bloom, and report requests from Bloom to Bud. The Bud side of the same setup is in the Bud docs.

Link the two apps

Deploy both apps and give each one the other’s public URL: set BUD_APP_URL and BLOOM_APP_URL in both .env files, so each app shows navigation links to the other. These URLs only add links. Result synchronization requires the separate credentials described under Set the sync secrets.

# Set in both .env files
BUD_APP_URL=https://bud.example.com
BLOOM_APP_URL=https://bloom.example.com

In Bloom, BUD_APP_URL makes Bloom navigation and execution links open Bud. On Cloudron, set it with:

cloudron env set --app '<bloom-app-location>' \
  BUD_APP_URL="https://bud.example.com"

Set the sync secrets

Before the two can exchange credentials, each side needs one secret that is only required for the sync. Bud stores the Bloom token encrypted at rest under a Fernet key, and Bloom hashes the service tokens it issues with an independent pepper of at least 32 characters. For Docker Compose, set both, then restart. Cloudron generates these secrets automatically:

# Generate the Fernet key for Bud
python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

# Bud .env: encrypts the saved Bloom credentials
BUD_INTEGRATION_ENCRYPTION_KEY=<the generated key>

# Bloom .env: peppers the service tokens Bloom issues to Bud
SERVICE_TOKEN_PEPPER=<independent random value, 32+ characters>

Keep SERVICE_TOKEN_PEPPER with your deployment secrets. A different pepper invalidates every Bud result-sync credential Bloom has issued.

Authorize the result flow

In Bloom, open Settings → PLM Integration Token Management and generate a service token with test-results:write scope; in Bud, open Settings → Bloom PLM Integration and paste the Bloom URL and that token. On the test side, give a test class BloomMetaData("PRJ", "001") so every uploaded result carries a Bloom tc_id.

Step by step:

1. Set Bloom’s SERVICE_TOKEN_PEPPER and restart Bloom.

2. In Bloom Settings, open PLM Integration Token Management and select Create Credential.

3. Copy the blm_sync_… credential when it is shown. Bloom displays it only once.

4. In Bud, configure BUD_INTEGRATION_ENCRYPTION_KEY.

5. In Bud, open Settings → Bloom PLM Integration and save Bloom’s reachable URL and the credential.

6. Attach Bloom metadata to the test classes whose results should reach Bloom:

   from budtestlibrary import BudTestCase, BloomMetaData
   
   class TraceableTest(BudTestCase):
       bloom_metadata = BloomMetaData("PRJ", "001")

The credential is scoped to test-results:write, lasts 90 days and can be revoked. It is not an administrator token. How to write and check the test side is in the budtestlibrary docs.

What the sync does

Bud then posts one aggregated execution outcome per tc_id to Bloom, which updates the matching test case and its campaign line items. The integration is execution status only: Bud never creates or synchronizes Bloom campaigns, suites, requirements, or documents. A run links back to a Bloom campaign when the sync response identifies exactly one affected campaign.

• Bloom accepts test case execution outcomes identified by Bloom tc_id. It does not synchronize complete campaigns, requirements, documents, or unrestricted Bloom data.
• Bloom answers each sync with the campaigns and test suites the results reached, each with its ID, public ID, name and page URL. Suites also carry the number of synced cases they hold and their size.
• Execution times reported by a sync are stored in UTC.

Report requests

A reader who can see a linked test case, suite or campaign can select Request report beside its Bud run link. Bloom records the request and shows Pending until a Bud publisher delivers the report or refuses with a reason. Repeated pending requests are deduplicated per reader, run and project. Delivered report links keep the existing document visibility rules.

Bud collects requests through its configured Bloom connection. Bloom stores no reader Bud credentials. The existing integration credential carries the reader name and email and the report request status. Connection failures leave requests pending for a later collection. Report files arrive through the existing Bud publishing path.

A Bud run link opens the run in Bud, where the reader signs in with their own Bud account.

Automated report publishing from Bud uses the scoped service credential. It is separate from the per-user upload allowance, and keeps the same file, document, MIME type, and disk capacity checks as a human upload.