feat: warn at configuration time when the propagation URL is not https

doCheckPropagationUrl validated only well-formedness: an http:// URL
got a green OK and the only signal that credentials would travel
unencrypted was buried in the system log at notification time. The
form now shows a warning for non-https propagation URLs, reaching the
operator while typing; the value stays accepted, since TLS terminated
on a trusted proxy in front of Bitbucket is a legitimate setup, and
the runtime warning keeps covering the payload-derived URLs no form
validates. Help text updated accordingly.

The new @WithJenkins test pins ok for empty and https values, the
warning with its https hint for http, and the error for malformed
URLs.

Author: cdelmonte-zg

CHANGELOG.md

@@ -6,6 +6,7 @@
 * **Build Server build-status links correctly for base URLs without an explicit port** - The pull request Server action appended `URL.getPort()` verbatim when building commit, approve and decline links, producing an unroutable `host:-1` address whenever the configured propagation URL (or the payload clone URL) carried no explicit port, so those status notifications failed silently. The port is now omitted when absent.
 
 ### Improvements
+* **Warn at configuration time when the propagation URL is not https** - The global configuration form now shows a warning when the *Propagation URL* uses plain `http`, since the credentials of build-status notifications would travel unencrypted. The value is still accepted, for setups terminating TLS on a trusted proxy in front of Bitbucket. This complements the runtime warning below, which also covers the payload-derived URLs no form validates.
 * **Use the JVM's TLS configuration for Basic-auth Bitbucket API calls** - The Basic-auth API client now follows the JVM's standard JSSE/trust-store configuration (`javax.net.ssl.trustStore` and friends, proxy settings), as the Bearer-token client does since 3.3.9. A Bitbucket instance using a private CA or a self-signed certificate present in the JVM trust store now works on both authentication paths.
 * **Warn when build-status notifications are sent over plain HTTP** - The plugin now logs a warning when the Bitbucket URL used for a status notification is not `https://`, since the `Authorization` header (credentials or token) travels unencrypted. The check runs at the dispatch layer, so it covers all three authentication paths (Basic, Bearer and OAuth2), and warns once per origin (`scheme://host[:port]`) rather than per URL, so notification URLs embedding the commit hash do not flood the log. The request is still sent, so setups terminating TLS on a trusted reverse proxy keep working.
 * **Warn when a build-status notification does not succeed** - A notification answered with a non-successful HTTP status (rotated token, revoked credential, wrong repository, a misconfigured proxy answering with a redirect) previously left no trace at default log level, since the HTTP call itself succeeded. The plugin now logs a warning with the origin and status code, once per continuous episode: a repeat of the same status stays silent, and a successful response resets the state so the next incident warns again. The episode state is tracked per origin, without job or credential identity: on a Bitbucket host shared by many jobs, any job's success re-arms the warning and simultaneous same-status incidents collapse into one episode. The response body, truncated and stripped of control characters, is available at FINE. Transport failures are also logged with the full exception instead of only its message.

src/main/java/io/jenkins/plugins/bitbucketpushandpullrequest/config/BitBucketPPRPluginConfig.java

@@ -115,7 +115,16 @@ public FormValidation doCheckPropagationUrl(@QueryParameter String value) {
     }
 
     try {
-      new URL(value); // This will throw MalformedURLException if the URL is not valid
+      URL parsed = new URL(value); // throws MalformedURLException if the URL is not valid
+      // Warn, do not reject: TLS terminated on a trusted reverse proxy in front of Bitbucket is
+      // a legitimate setup. This reaches the operator while typing; the runtime warning still
+      // covers payload-derived URLs that no form validates.
+      if (!"https".equalsIgnoreCase(parsed.getProtocol())) {
+        return FormValidation.warning(
+            "This URL is not https: the credentials used for build status notifications will"
+                + " travel unencrypted. Use an https URL unless TLS is terminated by a trusted"
+                + " proxy in front of Bitbucket.");
+      }
       return FormValidation.ok();
     } catch (MalformedURLException e) {
       return FormValidation.error("This is not a valid URL. Please enter a correct URL.");

src/main/resources/io/jenkins/plugins/bitbucketpushandpullrequest/config/BitBucketPPRPluginConfig/help-propagationUrlTitle.html

@@ -1,4 +1,7 @@
 <div>
     <p>Optional endpoint used to propagate statuses.</p>
     <p>It is mandatory in the case that your bitbucket repository supports only ssh cloning</p>
+    <p>Use an https URL: over plain http the credentials of the build status notifications
+       travel unencrypted. An http URL is still accepted, for setups where TLS is terminated
+       by a trusted proxy in front of Bitbucket, but the form shows a warning.</p>
 </div>

src/test/java/io/jenkins/plugins/bitbucketpushandpullrequest/config/BitBucketPPRPluginConfigValidationTest.java

@@ -0,0 +1,65 @@
+/*******************************************************************************
+ * The MIT License
+ *
+ * Copyright (C) 2018-2026, Christian Del Monte.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+ * associated documentation files (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge, publish, distribute,
+ * sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or
+ * substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+ * NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ ******************************************************************************/
+
+package io.jenkins.plugins.bitbucketpushandpullrequest.config;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import hudson.util.FormValidation;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.junit.jupiter.WithJenkins;
+
+/**
+ * Validation of the propagation URL in the global configuration form: well-formedness as before,
+ * plus a warning (not a rejection) for plain-http URLs, where the credentials of the build status
+ * notifications would travel unencrypted. This reaches the operator at typing time; the runtime
+ * warning covers the payload-derived URLs no form validates.
+ */
+@WithJenkins
+class BitBucketPPRPluginConfigValidationTest {
+
+  private JenkinsRule j;
+
+  @BeforeEach
+  void setUp(JenkinsRule rule) {
+    j = rule;
+  }
+
+  @Test
+  void propagationUrlValidationWarnsOnPlainHttp() {
+    BitBucketPPRPluginConfig config = BitBucketPPRPluginConfig.getInstance();
+
+    assertEquals(FormValidation.Kind.OK, config.doCheckPropagationUrl("").kind);
+    assertEquals(FormValidation.Kind.OK,
+        config.doCheckPropagationUrl("https://bitbucket.example.org/scm/space/repo.git").kind);
+
+    FormValidation http =
+        config.doCheckPropagationUrl("http://bitbucket.example.org/scm/space/repo.git");
+    assertEquals(FormValidation.Kind.WARNING, http.kind);
+    assertTrue(http.getMessage().contains("https"),
+        () -> "the warning must point at https, got: " + http.getMessage());
+
+    assertEquals(FormValidation.Kind.ERROR, config.doCheckPropagationUrl("not a url").kind);
+  }
+}