You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@grails.apache.org by "jamesfredley (via GitHub)" <gi...@apache.org> on 2026/07/01 23:17:17 UTC

[PR] Enforce HTTPS for wrapper remote repositories [grails-core]

jamesfredley opened a new pull request, #15809:
URL: https://github.com/apache/grails-core/pull/15809

   ## Summary
   
   - reject non-HTTPS remote Grails wrapper repository URLs before metadata or artifact downloads
   - validate each redirect target and reject redirects that downgrade to HTTP
   - document that local filesystem repositories remain supported while remote repositories must use HTTPS
   
   ## Verification
   
   - `./gradlew.bat --no-daemon --no-parallel --max-workers=1 :grails-wrapper:check`
   - Review gate: Oracle GREEN, Codex GREEN
   
   ## Notes
   
   - Follow-up from audit `FINDING-005`.
   - Full aggregate verification was attempted locally, but Docker/Testcontainers is unavailable on this machine and the run hit unrelated GSP example integration failures that require Docker.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.

jdaugherty commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-4993846612

   This PR is very close: Simplifying to be consistent, docs updates, & the connection leaks are my remaining concerns.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.

testlens-app[bot] commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-4929487952

   ## ✅ All tests passed ✅
   
   🏷️ Commit: ac9bbc91e0c286adb71b4c2da52063a9281b1c98
   ▶️ Tests:  16136 executed
   ⚪️ Checks: 59/59 completed
   
   ---
   _Learn more about TestLens at [testlens.app](https://testlens.app)._
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.

jamesfredley commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-4992629709

## Review feedback addressed

Merged the latest `8.0.x` (large base gap - clean merge) and pushed follow-up commits.

**@jdaugherty CHANGES_REQUESTED (all four addressed; threads resolved):**

1. *`GRAILS_REPO_URL` consistency across profiles & forge* - traced every `GRAILS_REPO_URL` / `grails.repo.url` consumer. HTTPS enforcement is now applied in **both** the Wrapper and Forge: `GradleRepository` rejects non-HTTPS remote overrides while accepting local filesystem repos (incl. Windows `C:\`, `C:/`, drive-relative `C:` paths). `INSTALL` reworded to scope the requirement to the Wrapper and Forge, noting the legacy Shell CLI preserves existing behavior.
2. *Redirect loop should use `MAX_REDIRECTS` as a hard cap* - implemented your suggested `HttpURLConnectionFactory` seam + hard-cap loop (`redirectCount >= MAX_REDIRECTS`), implicit redirect following disabled, HTTPS re-validated on every hop, missing `Location` fails, and the connection is closed on every exit path (including exceptional exits, so no leak).
3. + 4. *Don't use external URLs / `repo.example.test` in tests* - the HTTPS/redirect tests now run entirely against a local **Ersatz** mock server + an injected `HttpURLConnectionFactory`. No test performs real network I/O or depends on DNS resolving an external name.

**Additional fixes surfaced by a dual GPT review pass:**

- Never leak an `HttpURLConnection` when request setup / `getResponseCode()` / the redirect cap throws mid-iteration.
- **Preserve repository fallback:** the eager metadata connection is opened inside `retrieveMavenMetadata`'s try, so an unavailable repo is reported as a missing release and `update()` falls back to the next repository / Maven Central instead of aborting.
- Reject malformed URL-shaped remote overrides (leading-scheme detection) instead of silently treating them as local paths.
- Align Forge's `GradleRepository` Windows-path handling with the Wrapper (drive-letter check before URI parsing) so `C:\`, `C:/`, `C:repo`, `C:repo\sub` and spaced paths are all accepted as local.

Local verification: `:grails-wrapper:test` and `:grails-forge-core:test --tests GradleRepositorySpec` pass (Ersatz-driven, no external network).

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.

testlens-app[bot] commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-4938231503

   ## ✅ All tests passed ✅
   
   🏷️ Commit: 6689ebf5eb4cd7f356e56c0c56d451804d21f7ce
   ▶️ Tests:  10516 executed
   ⚪️ Checks: 59/59 completed
   
   ---
   _Learn more about TestLens at [testlens.app](https://testlens.app)._
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.

jdaugherty commented on code in PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#discussion_r3596832061


##########
grails-wrapper/src/main/java/grails/init/GrailsWrapperRepo.java:
##########
@@ -113,6 +120,82 @@ private static GrailsWrapperRepo createGrailsWrapperRepo(String urlOrFile) {
         return repo;
     }
 
+    private static void validateRemoteRepositoryUrl(String url) {
+        try {

Review Comment:
   Is there really no way to do this with the built-in java?  We're continually expanding the wrapper implementation and I'm beginning to worry about jar size since this is expected to be checked into a project.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.

jdaugherty commented on code in PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#discussion_r3596873825


##########
grails-wrapper/src/main/java/grails/init/GrailsUpdater.java:
##########
@@ -329,17 +335,100 @@ private String fetchSnapshotForVersion(GrailsWrapperRepo repo, GrailsVersion bas
         }
     }
 
-    private static HttpURLConnection createHttpURLConnection(String mavenMetadataFileUrl) throws IOException {
-        final URL url;
+    static HttpURLConnection createHttpURLConnection(String mavenMetadataFileUrl) throws IOException {
+        return createHttpURLConnection(mavenMetadataFileUrl, url -> (HttpURLConnection) url.openConnection());
+    }
+
+    @FunctionalInterface
+    interface HttpURLConnectionFactory {
+        HttpURLConnection open(URL url) throws IOException;
+    }
+
+    static HttpURLConnection createHttpURLConnection(String mavenMetadataFileUrl, HttpURLConnectionFactory openConnection) throws IOException {
+        URI uri = createSecureRemoteUri(mavenMetadataFileUrl);
+        for (int redirectCount = 0; ; redirectCount++) {
+            URL url = uri.toURL();
+            HttpURLConnection conn = openConnection.open(url);
+            String location;
+            try {
+                conn.setRequestProperty("User-Agent", "Apache-Maven/3.9.6");
+                conn.setInstanceFollowRedirects(false);
+
+                int responseCode = conn.getResponseCode();
+                if (!isRedirect(responseCode)) {
+                    // Ownership of the open connection transfers to the caller.
+                    return conn;

Review Comment:
   Ownership transfers here, but neither caller honors it on failure: in `updateJar()` a 404 makes `conn.getInputStream()` throw and the connection is never disconnected, and `retrieveMavenMetadata()` has the same gap before wrapping the exception. Given how careful this method is about not leaking connections, the callers' failure paths should close/disconnect too.



##########
grails-wrapper/src/main/java/grails/init/GrailsWrapperRepo.java:
##########
@@ -113,6 +120,82 @@ private static GrailsWrapperRepo createGrailsWrapperRepo(String urlOrFile) {
         return repo;
     }
 
+    private static void validateRemoteRepositoryUrl(String url) {
+        try {

Review Comment:
   To be concrete about what I would like to see here: `hasLeadingUrlScheme()` re-implements what a one-line scheme regex (`[A-Za-z][A-Za-z0-9+.-]*://`) already expresses, and the drive-letter handling in `isFileRepository()`/`normalizeBaseUrl()` overlaps with what `URI` parsing already tells us (a single-letter scheme with no authority). On top of that, the wrapper and forge now carry two slightly different hand-rolled classifiers for the same GRAILS_REPO_URL semantics - they should at least converge on one shape. Note the new ersatz/system-stubs dependencies are test-only, so the shipped wrapper jar only grows by these helper methods - the concern is the expanding main-source surface, not the dependencies.



##########
INSTALL:
##########
@@ -95,6 +95,8 @@ This variable also supports multiple repositories by using the separator ';'.  F
 
         export GRAILS_REPO_URL=$HOME/.m2/repository;https://repo1.maven.org/maven2/
 
+The Grails Wrapper and Grails Forge require remote repositories configured with `GRAILS_REPO_URL` to use HTTPS. Local file system repositories, such as `$HOME/.m2/repository`, remain supported. The legacy Grails Shell CLI preserves its existing repository URL behavior.

Review Comment:
   This sentence documents the Shell CLI as exempt, but `ProfileRepoConfig` and `CreateAppCommand` in `grails-shell-cli` still read `grails.repo.url`/`GRAILS_REPO_URL` with no HTTPS enforcement. My earlier comment asked for `GRAILS_REPO_URL` handling to be consistent everywhere it is used - forge is now covered, but the shell CLI only received a doc carve-out. Either apply the same validation there or explain why it needs to keep accepting non-HTTPS repositories.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.

jdaugherty commented on code in PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#discussion_r3554459512


##########
grails-wrapper/src/test/groovy/grails/init/GrailsUpdaterSpec.groovy:
##########
@@ -71,96 +76,132 @@ class GrailsUpdaterSpec extends Specification {
         e.message == 'Redirect response is missing a Location header for Grails wrapper remote resource: https://repo.example.test/releases/maven-metadata.xml'
     }
 
+    def "remote wrapper redirect rejects malformed location header"() {
+        when:
+        GrailsUpdater.resolveSecureRedirectUrl(new URI('https://repo.example.test/releases/maven-metadata.xml'), 'http://[bad')

Review Comment:
   While `repo.example.test` shouldn't resolve, nothing stops github from adding a dns entry for this.  We should mock these - nothing prevents the environment you run in from resolving it.  Especially true on corporate networks that may define a .test domain.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.

jdaugherty commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-5012505100

   Once these tests pass, i intend to merge.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.

jdaugherty commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-5012478182

   I'm going to take this PR and make profile / forge / wrapper consistent in their handling of GRAILS_REPO_URL


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.

jamesfredley commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-4861343801

   Addressed the Copilot feedback in follow-up commit fecd1172b3. The missing URI import is fixed, redirect counting now has explicit boundary coverage for the allowed and rejected cases, the shared download error wording no longer says only artifact, all three review threads have replies and are marked resolved, and :grails-wrapper:check passed locally.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.

jamesfredley commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-4862309423

   **Pre-release review pass (2026-07-02, dual-reviewer: GPT-5.5 oracle + Codex CLI):** APPROVE - no blocking findings.
   
   Reviewed the full diff plus local `grails-wrapper` context: HTTPS validation for all remote repo access, implicit redirect following disabled with manual re-validation of each hop, redirect cap (`MAX_REDIRECTS` = 5), missing `Location` treated as failure, local filesystem repos preserved, and the HTTPS requirement documented in `INSTALL`. `GrailsUpdaterSpec` exercises success and failure paths including redirect loops. `:grails-wrapper:test` passed locally and PR checks were green.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.

testlens-app[bot] commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-4861113049

   ## ✅ All tests passed ✅
   
   🏷️ Commit: e64bd9d80e07783067ec7372306dbbe52f5ea45b
   ▶️ Tests:  22560 executed
   ⚪️ Checks: 45/45 completed
   
   ---
   _Learn more about TestLens at [testlens.app](https://testlens.app)._
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.

testlens-app[bot] commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-5006913782

   ## ✅ All tests passed ✅
   
   🏷️ Commit: 6704c1d56b2e1f922c1e72cc64893220e5de71a0
   ▶️ Tests:  7451 executed
   ⚪️ Checks: 59/59 completed
   
   ---
   _Learn more about TestLens at [testlens.app](https://testlens.app)._
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.

testlens-app[bot] commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-4993508170

   ## ✅ All tests passed ✅
   
   🏷️ Commit: 8be73fd71fb787742f49d9c821812a95523d96a4
   ▶️ Tests:  33872 executed
   ⚪️ Checks: 59/59 completed
   
   ---
   _Learn more about TestLens at [testlens.app](https://testlens.app)._
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.

testlens-app[bot] commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-4861712948

   ## ✅ All tests passed ✅
   
   🏷️ Commit: fecd1172b3fb5803762b1536414f1a1908aaae6d
   ▶️ Tests:  40506 executed
   ⚪️ Checks: 44/44 completed
   
   ---
   _Learn more about TestLens at [testlens.app](https://testlens.app)._
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "Copilot (via GitHub)" <gi...@apache.org>.

Copilot commented on code in PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#discussion_r3509561079


##########
grails-wrapper/src/main/java/grails/init/GrailsUpdater.java:
##########
@@ -329,17 +331,62 @@ private String fetchSnapshotForVersion(GrailsWrapperRepo repo, GrailsVersion bas
         }
     }
 
-    private static HttpURLConnection createHttpURLConnection(String mavenMetadataFileUrl) throws IOException {
-        final URL url;
+    static HttpURLConnection createHttpURLConnection(String mavenMetadataFileUrl) throws IOException {
+        URI uri = createSecureRemoteUri(mavenMetadataFileUrl);
+        for (int redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount++) {
+            URL url = uri.toURL();
+            HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+            conn.setRequestProperty("User-Agent", "Apache-Maven/3.9.6");
+            conn.setInstanceFollowRedirects(false);
+
+            int responseCode = conn.getResponseCode();
+            if (!isRedirect(responseCode)) {
+                return conn;
+            }
+
+            String location = conn.getHeaderField("Location");
+            conn.disconnect();
+            uri = resolveSecureRedirectUrl(uri, location);
+        }
+
+        throw new IOException("Too many redirects while downloading Grails wrapper artifact: " + mavenMetadataFileUrl);
+    }

Review Comment:
   The exception message mentions "wrapper artifact", but this helper is also used for Maven metadata downloads (see `retrieveMavenMetadata`). If this triggers while fetching metadata, the message is misleading.



##########
grails-wrapper/src/test/groovy/grails/init/GrailsUpdaterSpec.groovy:
##########
@@ -0,0 +1,69 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package grails.init
+
+import spock.lang.Specification
+import spock.lang.Unroll
+

Review Comment:
   `URI` is used in this spec but not imported, and Groovy’s default imports don’t include `java.net.*`. This will fail to compile.



##########
grails-wrapper/src/main/java/grails/init/GrailsUpdater.java:
##########
@@ -329,17 +331,62 @@ private String fetchSnapshotForVersion(GrailsWrapperRepo repo, GrailsVersion bas
         }
     }
 
-    private static HttpURLConnection createHttpURLConnection(String mavenMetadataFileUrl) throws IOException {
-        final URL url;
+    static HttpURLConnection createHttpURLConnection(String mavenMetadataFileUrl) throws IOException {
+        URI uri = createSecureRemoteUri(mavenMetadataFileUrl);
+        for (int redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount++) {
+            URL url = uri.toURL();

Review Comment:
   The redirect loop uses `redirectCount <= MAX_REDIRECTS`, which actually permits `MAX_REDIRECTS + 1` redirect responses before failing. If `MAX_REDIRECTS` is intended to be a hard cap (as the name suggests), this should be `< MAX_REDIRECTS`.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.

codecov[bot] commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-4860912242

   ## [Codecov](https://app.codecov.io/gh/apache/grails-core/pull/15809?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
   :x: Patch coverage is `40.00000%` with `15 lines` in your changes missing coverage. Please review.
   :white_check_mark: Project coverage is 49.4724%. Comparing base ([`b86be15`](https://app.codecov.io/gh/apache/grails-core/commit/b86be15eeaf641879b51d1b6e1cbb8ffae27ba89?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`e64bd9d`](https://app.codecov.io/gh/apache/grails-core/commit/e64bd9d80e07783067ec7372306dbbe52f5ea45b?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
   :warning: Report is 2 commits behind head on 8.0.x.
   
   | [Files with missing lines](https://app.codecov.io/gh/apache/grails-core/pull/15809?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
   |---|---|---|
   | [...apper/src/main/java/grails/init/GrailsUpdater.java](https://app.codecov.io/gh/apache/grails-core/pull/15809?src=pr&el=tree&filepath=grails-wrapper%2Fsrc%2Fmain%2Fjava%2Fgrails%2Finit%2FGrailsUpdater.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Z3JhaWxzLXdyYXBwZXIvc3JjL21haW4vamF2YS9ncmFpbHMvaW5pdC9HcmFpbHNVcGRhdGVyLmphdmE=) | 40.0000% | [14 Missing and 1 partial :warning: ](https://app.codecov.io/gh/apache/grails-core/pull/15809?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
   
   <details><summary>Additional details and impacted files</summary>
   
   
   
   [![Impacted file tree graph](https://app.codecov.io/gh/apache/grails-core/pull/15809/graphs/tree.svg?width=650&height=150&src=pr&token=qJrryhpk7u&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)](https://app.codecov.io/gh/apache/grails-core/pull/15809?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
   
   ```diff
   @@                Coverage Diff                 @@
   ##                8.0.x     #15809        +/-   ##
   ==================================================
   - Coverage     49.4820%   49.4724%   -0.0096%     
     Complexity      16698      16698                
   ==================================================
     Files            1947       1947                
     Lines           92474      92494        +20     
     Branches        16152      16154         +2     
   ==================================================
   + Hits            45758      45759         +1     
   - Misses          39610      39626        +16     
   - Partials         7106       7109         +3     
   ```
   
   | [Files with missing lines](https://app.codecov.io/gh/apache/grails-core/pull/15809?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
   |---|---|---|
   | [...apper/src/main/java/grails/init/GrailsUpdater.java](https://app.codecov.io/gh/apache/grails-core/pull/15809?src=pr&el=tree&filepath=grails-wrapper%2Fsrc%2Fmain%2Fjava%2Fgrails%2Finit%2FGrailsUpdater.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Z3JhaWxzLXdyYXBwZXIvc3JjL21haW4vamF2YS9ncmFpbHMvaW5pdC9HcmFpbHNVcGRhdGVyLmphdmE=) | `5.8511% <40.0000%> (+5.8511%)` | :arrow_up: |
   
   ... and [1 file with indirect coverage changes](https://app.codecov.io/gh/apache/grails-core/pull/15809/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
   </details>
   <details><summary> :rocket: New features to boost your workflow: </summary>
   
   - :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
   - :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.

jdaugherty commented on PR #15809:
URL: https://github.com/apache/grails-core/pull/15809#issuecomment-5012454543

   To get this merged for the milestone, I'm going to take a pass at it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce HTTPS for wrapper remote repositories [grails-core]

Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.

jdaugherty merged PR #15809:
URL: https://github.com/apache/grails-core/pull/15809


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org