The only issue is for people for whom cannot access outside urls. For instance at my bank we are locked down (although those might be open).

I know it. but there are other problems.

I have CircleCI generate HTML coverage reports.
In fact, CircleCI artifacts are provided in HTTPS, so browsers cannot load resources in HTTP
(because resources in HTTP are insecure).

using protocol relative urls for resources are recommended.

cf. https://support.google.com/webmasters/answer/6073543?hl=en

It doesn't work when the page is opened from local filesystem (file://.... URL).
Maybe just use https everywhere, where it's available.

Certainly..., I will fix it.

oh, i have missed.

+1
I was about to fix this myself and submit a PR, checked existing PR's first and found it has been done just not merged.

I would love to see this merged and get the sbt-scoverage plugin updated to include it! I know circle CI was mentioned here, but more enterprises now are starting to run their internal build tools on https now in addition to the cloud based ones. The Scoverage report looks quite awful as the browser won't load any of the resources.