Merge 7.0.x Forge AWS into 7.1.x - #16238
Merged
Merged
Conversation
chore: merge 7.0.16->7.0.x; bump to 7.0.17-SNAPSHOT
* Honor configured Forge redirect URL Handle absent redirect values without throwing and cover configured and null binding behavior. Assisted-by: opencode:gpt-5.6-sol * Package Forge for Elastic Beanstalk Build a reproducible Java SE source bundle with normalized nested and outer archives. Assisted-by: opencode:gpt-5.6-sol * Add Forge Elastic Beanstalk infrastructure Define shared ALB, IAM, secrets, artifact lifecycle, five parameterized environments, and optional Route 53 resources. Assisted-by: opencode:gpt-5.6-sol cfn-lint * Add Forge AWS deployment workflow Deploy one Forge slot through OIDC with immutable versions, bounded health polling, ALB-pinned smoke checks, and rollback. Assisted-by: opencode:gpt-5.6-sol * Document Forge AWS migration checkpoint Replace obsolete GCP setup guidance with the AWS runbook and preserve the intentionally local restart handoff. Assisted-by: opencode:gpt-5.6-sol * Remove unused Forge GitHub create and OAuth integration The start.grails.org UI removed Push to GitHub (grails-forge-ui#61). Delete the unused server-side create/OAuth/push stack, related config, JGit dependency, native-image metadata, and deployment secrets so the API no longer accepts GitHub OAuth create flows. Keep generated-app GitHub Actions workflow features and the browser redirect URL used by the Forge UI. Also fix setRedirectUrl so GITHUB_REDIRECT_URL actually overrides the default, and purge retired OAuth env vars from Cloud Run on deploy. Assisted-by: Sisyphus:xai/grok-4.5 * Align Forge AWS stacks with OAuth removal and Corretto 25 Drop the retired GitHub OAuth CloudFormation parameters, Secrets Manager IAM, and Elastic Beanstalk environment properties. Keep GITHUB_REDIRECT_URL as the browser redirect to the Forge UI. Target Corretto 25 for Grails 7 and Grails 8. * Drop Forge AWS WIP handoff and grant instance S3 reads Remove the branch-local handoff document before the 7.0.x pull request. Allow Elastic Beanstalk instances to GetObject from the custom artifact bucket so source-bundle downloads are not limited to elasticbeanstalk-* paths. * Add ASF license headers and Forge AWS lifecycle IAM Give nginx proxy.conf and the infrastructure README recognized Apache headers. Exclude the Elastic Beanstalk Procfile from RAT because it cannot contain comments. Allow the service role to delete expired application versions. * Use HTTPS in the Forge nginx proxy license header checkstyleNohttp failed on grails-forge-web-netty because the Apache license URL in proxy.conf used http. Match start.sh and use https.
Contributor
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Merges the Forge AWS Elastic Beanstalk deployment/infrastructure work from the 7.0.x line into 7.1.x, and removes the unused GitHub OAuth “Push to GitHub” plumbing in favor of AWS/OIDC-based deployments.
Changes:
- Add CloudFormation templates and runbooks for shared + per-slot Elastic Beanstalk environments (ALB, IAM/OIDC, artifact bucket, DNS support).
- Add Gradle packaging for an Elastic Beanstalk source bundle (ZIP with
app.jar,Procfile,start.sh, and.platformconfig). - Remove GitHub OAuth / GitHub API v3 client code, native-image config, and tests related to the deprecated “create/push to GitHub” feature; update configuration and workflows accordingly.
Reviewed changes
Copilot reviewed 46 out of 46 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| grails-forge/infrastructure/shared.yaml | New shared CloudFormation stack for ALB, S3 artifact bucket, EB application, and GitHub OIDC deploy role. |
| grails-forge/infrastructure/environment.yaml | New per-slot CloudFormation stack for one EB environment behind the shared ALB. |
| grails-forge/infrastructure/dns.yaml | Optional Route 53 aliases template for future DNS migration. |
| grails-forge/infrastructure/README.md | Operator doc for deploying shared + slot stacks and current Cloudflare DNS approach. |
| grails-forge/grails-forge-web-netty/src/main/resources/application.yml | Removes GitHub OAuth/client configuration; keeps redirect-url only. |
| grails-forge/grails-forge-web-netty/src/main/resources/META-INF/native-image/org.grails.forge/grails-forge-web-netty/resource-config.json | Removes JGit bundle resources from native-image config. |
| grails-forge/grails-forge-web-netty/src/main/resources/META-INF/native-image/org.grails.forge/grails-forge-web-netty/reflect-config.json | Removes JGit reflection config from native-image config. |
| grails-forge/grails-forge-web-netty/build.gradle | Adds reproducible ShadowJar settings + EB ZIP packaging task; hooks into assemble. |
| grails-forge/grails-forge-web-netty/aws/start.sh | New EB startup script running the app as app.jar on port 5000. |
| grails-forge/grails-forge-web-netty/aws/Procfile | New EB Procfile to launch start.sh. |
| grails-forge/grails-forge-web-netty/aws/.platform/nginx/conf.d/proxy.conf | New Nginx proxy tuning for EB (timeouts, max body). |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/util/GitHubUtil.java | Removes JGit-based “init and push to GitHub” helper. |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/v3/GitHubWorkflowRuns.java | Removes unused GitHub API DTO. |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/v3/GitHubWorkflowRun.java | Removes unused GitHub API DTO. |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/v3/GitHubUser.java | Removes unused GitHub API DTO. |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/v3/GitHubSecretsPublicKey.java | Replaced with unrelated test contents (appears erroneous). |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/v3/GitHubSecret.java | Removes unused GitHub API DTO. |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/v3/GitHubRepository.java | Removes unused GitHub API DTO. |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/v3/GitHubApiOperations.java | Removes GitHub API interface. |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/v3/GitHubApiClient.java | Removes Micronaut GitHub API client. |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/oauth/GitHubOAuthOperations.java | Removes GitHub OAuth API interface. |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/oauth/GitHubOAuthClient.java | Removes Micronaut GitHub OAuth client. |
| grails-forge/grails-forge-core/src/main/java/org/grails/forge/client/github/oauth/AccessToken.java | Removes OAuth token DTO. |
| grails-forge/grails-forge-core/build.gradle | Drops JGit dependency. |
| grails-forge/grails-forge-api/src/test/resources/logback.xml | Removes trace logger for GitHub create path. |
| grails-forge/grails-forge-api/src/test/groovy/org/grails/forge/api/create/github/GitHubOauthMockedController.groovy | Removes mocked OAuth controller for removed feature. |
| grails-forge/grails-forge-api/src/test/groovy/org/grails/forge/api/create/github/GitHubCreateControllerSpec.groovy | Removes GitHub create controller spec (ignored test). |
| grails-forge/grails-forge-api/src/test/groovy/org/grails/forge/api/create/github/GitHubApiMockedController.groovy | Removes mocked GitHub API controller for removed feature. |
| grails-forge/grails-forge-api/src/test/groovy/org/grails/forge/api/ApplicationControllerSpec.groovy | Adds coverage for redirect-url behavior. |
| grails-forge/grails-forge-api/src/main/resources/META-INF/native-image/org.grails.forge.api/grails-forge-api/native-image.properties | Removes JGit native-image tuning args. |
| grails-forge/grails-forge-api/src/main/java/org/grails/forge/api/create/github/GitHubRedirectService.java | Removes redirect service for removed GitHub OAuth flow. |
| grails-forge/grails-forge-api/src/main/java/org/grails/forge/api/create/github/GitHubCreateService.java | Removes service that created/pushed repositories. |
| grails-forge/grails-forge-api/src/main/java/org/grails/forge/api/create/github/GitHubCreateOperation.java | Removes create operation API. |
| grails-forge/grails-forge-api/src/main/java/org/grails/forge/api/create/github/GitHubCreateDTO.java | Removes create DTO. |
| grails-forge/grails-forge-api/src/main/java/org/grails/forge/api/create/github/GitHubCreateController.java | Removes create controller. |
| grails-forge/grails-forge-api/src/main/java/org/grails/forge/api/GrailsForgeConfiguration.java | Fixes redirect URI derivation + null-handling; removes nested GitHub configuration. |
| grails-forge/gradle.properties | Removes jgitVersion. |
| grails-forge/docs/aws-elastic-beanstalk.md | Adds comprehensive AWS EB deployment runbook. |
| grails-forge/README.md | Replaces Cloud Run deployment docs with AWS EB migration documentation + link to runbook. |
| gradle/rat-root-config.gradle | Excludes EB Procfile from RAT due to required no-comments format. |
| .github/workflows/forge-deploy-snapshot.yml | Removes GitHub OAuth env vars from Cloud Run deployment. |
| .github/workflows/forge-deploy-release.yml | Removes GitHub OAuth env vars from Cloud Run deployment (latest + version). |
| .github/workflows/forge-deploy-prev.yml | Removes GitHub OAuth env vars from Cloud Run deployment. |
| .github/workflows/forge-deploy-prev-snapshot.yml | Removes GitHub OAuth env vars from Cloud Run deployment. |
| .github/workflows/forge-deploy-next.yml | Removes GitHub OAuth env vars from Cloud Run deployment. |
| .github/workflows/forge-deploy-aws.yml | Adds AWS EB deploy workflow using OIDC, dynamic source_ref, and Java version from properties. |
Suppressed comments (1)
grails-forge/infrastructure/shared.yaml:1
- The artifact bucket is encrypted and blocks public access, but there is no bucket policy enforcing TLS-only requests (deny
aws:SecureTransport=false). Adding an explicit deny for non-TLS access is a concrete defense-in-depth hardening for deployment artifacts.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
78
to
82
| public void setRedirectUrl(@Nullable String redirectUri) { | ||
| this.redirectUrl = redirectUrl; | ||
| if (redirectUri != null) { | ||
| this.redirectUrl = redirectUri; | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Merge
7.0.xForge AWS Elastic Beanstalk work into7.1.x.Keeps
7.1.7-SNAPSHOT. AWS workflow no longer hardcodes a branch or JDK:source_refselects the git line to build,javaVersioncomes fromgradle.properties, and OIDC trustsrefs/heads/*.xandrefs/tags/v*so later minor/major lines do not need CloudFormation or workflow edits.