govuk_app_config 9.5.0 → 9.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 255469d22c10d2e07cb30e465f87a899e119d3fa2b5722aff557071b6e26107f
-  data.tar.gz: 3cfe8d112cc6b7f12071858a7d22f71a6dc212b9016eb970bc6568cff5ec8869
+  metadata.gz: 87265c446c96df0dfc6e7ce62e6e7f645c76af7b335426adc7db55bb5426ef5d
+  data.tar.gz: a78f518813885bf16b6e78c9351102c6b2dc5eb896c23a0913bb870a05bc2118
 SHA512:
-  metadata.gz: fb1c55f3648e0bc20fa2117acbeb7bfef81230b23e4524b0cc040ac83394fd2bb70ae6c998a919e7349388ce7f8a4e622a3ff0de3703b369875ad1f555a6cf41
-  data.tar.gz: 8db44e6eae7f7c1bfb1a34f3fdbb2a49fe46b183bfc379d4158b78b33f8a9ecca40e37d06f991c9af9cbb8a49335f651b16d7488acc31d90fdff60693a1777a2
+  metadata.gz: 2ca052131a146360a268ccc50762f8482342df275e0540b42b36eae8f5a87c9e4daaa403e24b4258bd2a67104b5426af29f0d5b1ec7213bec1c43518a802d068
+  data.tar.gz: b9301f60612daed32d37c6ed82d7f20250dacb9de5e68a270c9c9b1834801ffaf739f5c84219debd016728f9e78882494853e914abcb1556dd32491793d06041

data/.github/workflows/ci.yml

@@ -11,6 +11,16 @@ on:
         type: string
 
 jobs:
+  codeql-sast:
+    name: CodeQL SAST scan
+    uses: alphagov/govuk-infrastructure/.github/workflows/codeql-analysis.yml@main
+    permissions:
+      security-events: write
+
+  dependency-review:
+    name: Dependency Review scan
+    uses: alphagov/govuk-infrastructure/.github/workflows/dependency-review.yml@main
+  
   # Run the test suite against multiple Ruby and Rails versions
   test_matrix:
     strategy:

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+# 9.7.0
+
+* Enable adding custom LogStasher fields from apps ([#327](https://github.com/alphagov/govuk_app_config/pull/327))
+
+# 9.6.0
+
+* Allow YouTube thumbnails from https://i.ytimg.com in the global Content Security Policy ([#328](https://github.com/alphagov/govuk_app_config/pull/328))
+
 # 9.5.0
 
 * Allow gov.uk domains to embed pages in the global Content Security Policy ([#325](https://github.com/alphagov/govuk_app_config/pull/325))

data/README.md

@@ -149,6 +149,20 @@ allow JSON format logs and `Govuk-Request-Id` to be visible.
 For development logs, in order to see the production style logs, developers should
 set `GOVUK_RAILS_JSON_LOGGING`in `govuk-docker` -> `docker-compose` files.
 
+### Logger configuration
+
+To include additional custom fields in your Rails logs, you can declare them
+within a `GovukJsonLogging.configure` block in a `config/initializers/` file.
+
+Example of adding a key/value to log entries based on a request header:
+
+```ruby
+GovukJsonLogging.configure do
+  add_custom_fields do |fields|
+    fields[:govuk_custom_field] = request.headers["GOVUK-Custom-Header"]
+  end
+end
+```
 
 ## Content Security Policy generation
 

data/govuk_app_config.gemspec

@@ -22,7 +22,7 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "logstasher", "~> 2.1"
   spec.add_dependency "opentelemetry-exporter-otlp", ">= 0.25", "< 0.27"
-  spec.add_dependency "opentelemetry-instrumentation-all", ">= 0.39.1", "< 0.51.0"
+  spec.add_dependency "opentelemetry-instrumentation-all", ">= 0.39.1", "< 0.52.0"
   spec.add_dependency "opentelemetry-sdk", "~> 1.2"
   spec.add_dependency "plek", ">= 4", "< 6"
   spec.add_dependency "prometheus_exporter", "~> 2.0"

data/lib/govuk_app_config/govuk_content_security_policy.rb

@@ -41,7 +41,8 @@ module GovukContentSecurityPolicy
                    # Some content still links to an old domain we used to use
                    "assets.digital.cabinet-office.gov.uk",
                    # Allow YouTube thumbnails
-                   "https://img.youtube.com"
+                   "https://img.youtube.com",
+                   "https://i.ytimg.com"
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
     # Note: we purposely don't include `data:`, `unsafe-inline` or `unsafe-eval` because

data/lib/govuk_app_config/govuk_json_logging.rb

@@ -3,7 +3,23 @@ require "logstasher"
 require "action_controller"
 
 module GovukJsonLogging
-  def self.configure
+  class Configuration
+    def initialize
+      @custom_fields_block = proc {}
+    end
+
+    attr_reader :custom_fields_block
+
+    def add_custom_fields(&block)
+      @custom_fields_block = block if block_given?
+    end
+  end
+
+  def self.configure(&block)
+    configuration = Configuration.new
+
+    configuration.instance_eval(&block) if block_given?
+
     # We disable buffering, so that logs aren't lost on crash or delayed
     # indefinitely while troubleshooting.
     $stdout.sync = true
@@ -31,6 +47,8 @@ module GovukJsonLogging
       fields[:govuk_request_id] = request.headers["GOVUK-Request-Id"]
       fields[:varnish_id] = request.headers["X-Varnish"]
       fields[:govuk_app_config] = GovukAppConfig::VERSION
+
+      instance_exec(fields, &configuration.custom_fields_block) if block_given?
     end
 
     Rails.application.config.logstasher.enabled = true

data/lib/govuk_app_config/version.rb

@@ -1,3 +1,3 @@
 module GovukAppConfig
-  VERSION = "9.5.0".freeze
+  VERSION = "9.7.0".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: govuk_app_config
 version: !ruby/object:Gem::Version
-  version: 9.5.0
+  version: 9.7.0
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-10-09 00:00:00.000000000 Z
+date: 2023-11-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstasher
@@ -53,7 +53,7 @@ dependencies:
         version: 0.39.1
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.51.0
+        version: 0.52.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -63,7 +63,7 @@ dependencies:
         version: 0.39.1
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.51.0
+        version: 0.52.0
 - !ruby/object:Gem::Dependency
   name: opentelemetry-sdk
   requirement: !ruby/object:Gem::Requirement
@@ -375,7 +375,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.20
+rubygems_version: 3.4.22
 signing_key: 
 specification_version: 4
 summary: Base configuration for GOV.UK applications