Where do you put the checks?

Put the pipeline instructions in the repository’s bitbucket-pipelines.yml file. Choose which changes start the checks. Run a small test before packaging your app so a failure can stop the steps that follow.

Who can continue a pipeline that stops before deployment?

A later step can wait for someone to start it. For a workflow that starts only by hand, define a custom pipeline. Atlassian says manually running a pipeline requires repository write permission. If the production environment needs its own list of allowed deployers, check the custom deployment permissions on Premium.

What should you count and keep?

Compare hosted build minutes and other plan limits, including concurrent steps and storage. If you use your own runners, account for their machines and runner-specific limits. Keep the pipeline file and build scripts in Git and document the separate environment settings and approved destinations.

What should happen when the check fails before the manual step?

Draw a test and a later manual deploy step on paper. A fictional failed test should leave no release for anyone to start.

Draw the failed path
Put a failed check beside the commit and stop the flow before the deploy step.
Draw the approved path
For a passing check, show what still waits and who is allowed to continue.