govuk_app_config 9.6.0 → 9.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c15ac7d4a7297bc830a60b2877bc36d0e1b046fe2a498a0006b29b58ce9a0fec
-  data.tar.gz: 323f249a17a7806f176e88d060e7c99ac0eb54f0244815534056e2820e70f9e0
+  metadata.gz: 9842df0c29ae508b504907d58d8bfbdb31cde911e7d59b4236be45eea6fd4054
+  data.tar.gz: e75ffd357becba4eb101c00fb82573fc556af88255efa2109f54a9257559f47d
 SHA512:
-  metadata.gz: 8d514827abb88965374c9213b700ba05f9fdb3f65098f403d4e583581da768ebb6aa512b8b38adeae4818e839186443a011dfc3dd9ee7e1fc101363cd2721f3d
-  data.tar.gz: 319470197ea8a8ead9e29ba6e01b347215c62d472be68d94eaf58223a0e4b350a1046cee03c2aafef5d8e3828a34e802400eb60ea2322c93e6c5da277230d856
+  metadata.gz: c3c3cb9a9a79c113bb23e7281b26bad0f17825ec6ad53903d323c5a74fced1fb9f0b5189aa97be424fc8090f20c3c433fe23b2af75568d26fd492e3f55c51929
+  data.tar.gz: 1b14f98b1f155e8182e51d50ca1cd7146c357246f835d282f63aa1c92f5f7b2898ec4551934e8c351b982fbfbe68e8a03b67d61c48c8d8b36cc629baf5f63564

data/.github/workflows/ci.yml

@@ -11,6 +11,16 @@ on:
         type: string
 
 jobs:
+  codeql-sast:
+    name: CodeQL SAST scan
+    uses: alphagov/govuk-infrastructure/.github/workflows/codeql-analysis.yml@main
+    permissions:
+      security-events: write
+
+  dependency-review:
+    name: Dependency Review scan
+    uses: alphagov/govuk-infrastructure/.github/workflows/dependency-review.yml@main
+  
   # Run the test suite against multiple Ruby and Rails versions
   test_matrix:
     strategy:

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+# 9.8.0
+
+* Add GOVUK domains to script src CSP ([#334](https://github.com/alphagov/govuk_app_config/pull/334))
+
+# 9.7.0
+
+* Enable adding custom LogStasher fields from apps ([#327](https://github.com/alphagov/govuk_app_config/pull/327))
+
 # 9.6.0
 
 * Allow YouTube thumbnails from https://i.ytimg.com in the global Content Security Policy ([#328](https://github.com/alphagov/govuk_app_config/pull/328))

data/README.md

@@ -149,6 +149,20 @@ allow JSON format logs and `Govuk-Request-Id` to be visible.
 For development logs, in order to see the production style logs, developers should
 set `GOVUK_RAILS_JSON_LOGGING`in `govuk-docker` -> `docker-compose` files.
 
+### Logger configuration
+
+To include additional custom fields in your Rails logs, you can declare them
+within a `GovukJsonLogging.configure` block in a `config/initializers/` file.
+
+Example of adding a key/value to log entries based on a request header:
+
+```ruby
+GovukJsonLogging.configure do
+  add_custom_fields do |fields|
+    fields[:govuk_custom_field] = request.headers["GOVUK-Custom-Header"]
+  end
+end
+```
 
 ## Content Security Policy generation
 

data/govuk_app_config.gemspec

@@ -22,7 +22,7 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "logstasher", "~> 2.1"
   spec.add_dependency "opentelemetry-exporter-otlp", ">= 0.25", "< 0.27"
-  spec.add_dependency "opentelemetry-instrumentation-all", ">= 0.39.1", "< 0.52.0"
+  spec.add_dependency "opentelemetry-instrumentation-all", ">= 0.39.1", "< 0.55.0"
   spec.add_dependency "opentelemetry-sdk", "~> 1.2"
   spec.add_dependency "plek", ">= 4", "< 6"
   spec.add_dependency "prometheus_exporter", "~> 2.0"

data/lib/govuk_app_config/govuk_content_security_policy.rb

@@ -51,6 +51,7 @@ module GovukContentSecurityPolicy
     policy.script_src :self,
                       *GOOGLE_ANALYTICS_DOMAINS,
                       *GOOGLE_STATIC_DOMAINS,
+                      *GOVUK_DOMAINS,
                       # Allow YouTube Embeds (Govspeak turns YouTube links into embeds)
                       "*.ytimg.com",
                       "www.youtube.com",

data/lib/govuk_app_config/govuk_json_logging.rb

@@ -3,7 +3,23 @@ require "logstasher"
 require "action_controller"
 
 module GovukJsonLogging
-  def self.configure
+  class Configuration
+    def initialize
+      @custom_fields_block = proc {}
+    end
+
+    attr_reader :custom_fields_block
+
+    def add_custom_fields(&block)
+      @custom_fields_block = block if block_given?
+    end
+  end
+
+  def self.configure(&block)
+    configuration = Configuration.new
+
+    configuration.instance_eval(&block) if block_given?
+
     # We disable buffering, so that logs aren't lost on crash or delayed
     # indefinitely while troubleshooting.
     $stdout.sync = true
@@ -31,6 +47,8 @@ module GovukJsonLogging
       fields[:govuk_request_id] = request.headers["GOVUK-Request-Id"]
       fields[:varnish_id] = request.headers["X-Varnish"]
       fields[:govuk_app_config] = GovukAppConfig::VERSION
+
+      instance_exec(fields, &configuration.custom_fields_block) if block_given?
     end
 
     Rails.application.config.logstasher.enabled = true

data/lib/govuk_app_config/version.rb

@@ -1,3 +1,3 @@
 module GovukAppConfig
-  VERSION = "9.6.0".freeze
+  VERSION = "9.8.0".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: govuk_app_config
 version: !ruby/object:Gem::Version
-  version: 9.6.0
+  version: 9.8.0
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-11-17 00:00:00.000000000 Z
+date: 2023-12-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstasher
@@ -53,7 +53,7 @@ dependencies:
         version: 0.39.1
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.52.0
+        version: 0.55.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -63,7 +63,7 @@ dependencies:
         version: 0.39.1
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.52.0
+        version: 0.55.0
 - !ruby/object:Gem::Dependency
   name: opentelemetry-sdk
   requirement: !ruby/object:Gem::Requirement
@@ -375,7 +375,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.22
+rubygems_version: 3.5.1
 signing_key: 
 specification_version: 4
 summary: Base configuration for GOV.UK applications