What are best practices for using Ansible Vault on public CI's and Source Control Repositories like BitBucket?
--vault-password-file can instead point to an executable script that writes to stdout. This little-known feature should solve your problem.

First, write a simple, executable script that prints a system environment variable, and check that into your source control. Then, use Bitbucket's encrypted variable feature to set that environment variable to your ansible-vault secret. Finally, execute like so:

ansible-playbook site.yml --vault-password-file ./mypass.sh.

References:


http://docs.ansible.com/ansible/playbooks_vault.html#running-a-playbook-with-vault
https://groups.google.com/forum/#!topic/ansible-devel/1vFc3y6Ogto