ndr_dev_support 7.3.6 → 7.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 589fcf9c03c62ecbeecffbfe9020e87a7a1d5deec59506eef8129592504ae1c7
-  data.tar.gz: 8e99fb0d7c43f670c8684fdd11e570df00d69895e18f16194dd70a4f1afd6047
+  metadata.gz: bceb17903631013fce3438cf82287cab07bf06575f109345676e45e5e4df28b3
+  data.tar.gz: 0e6f918d2614fbb08f8540b3329314d31dc81533994a68bb9429ab747e7e8717
 SHA512:
-  metadata.gz: 768b8c51a8653ce8866a322fcb2bcf7548bb42a4ce8d133b5e397f961bb143c0b8f2820eb9e5a67d211bb6304d125359ea8f210456604cc4d1d0e62374c50545
-  data.tar.gz: ff1eb7652b61497650afd78d9fb9bd0a8f366b6bcc972240f6c07f6e4529015e0fede07f4787eb965acd848348cbb966ddcd17c1566cc0fb57b9172cc10141f2
+  metadata.gz: f4940867633068addac74dc3e357f4c9eafd361489c52616c044b79a8d3d7a29e01afd1a4b658f6a158cbb9e22a938823ac2dbc191637d8de0bec64a46ae2156
+  data.tar.gz: ed344310df1814ff4304a13514c733a09543e4053d944bc56af4f6533654d6e0a7f7403076951d23916292f01a4f387d3c521bf1371ea874eefb422f959c9340

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 ## [Unreleased]
-*no unreleased changes*
+* no unreleased changes
+
+## 7.3.8 / 2026-09-16
+### Fixed
+* Do not include macOS extended attributes in rbenv tar files
+* Capistrano: validate YAML files when deploying application secrets
+
+## 7.3.7 / 2026-06-29
+### Fixed
+* Drop support for Ruby 3.1 and 3.2, Rails 7.0
+* Capistrano: deployment should continue even if cleanup cannot delete files
 
 ## 7.3.6 / 2026-01-13
 ### Added

data/SECURITY.md

@@ -0,0 +1,35 @@
+# Security
+
+NHS England takes security and the protection of private data extremely seriously. If you believe you have found a vulnerability or other issue which has compromised or could compromise the security of any of our systems and/or private data managed by our systems, please do not hesitate to contact us using the methods outlined below.
+
+## Table of Contents
+
+- [Security](#security)
+  - [Table of Contents](#table-of-contents)
+  - [Reporting a vulnerability](#reporting-a-vulnerability)
+    - [Email](#email)
+    - [NCSC](#ncsc)
+  - [General Security Enquiries](#general-security-enquiries)
+
+## Reporting a vulnerability
+
+Please note, email is our preferred method of receiving reports.
+
+### Email
+
+If you wish to notify us of a vulnerability via email, please include detailed information on the nature of the vulnerability and any steps required to reproduce it.
+
+You can reach us at:
+
+- [Brian.Shand@nhs.net](mailto:Brian.Shand@nhs.net)
+- [cybersecurity@nhs.net](mailto:cybersecurity@nhs.net)
+
+### NCSC
+
+You can send your report to the National Cyber Security Centre, who will assess your report and pass it on to NHS England if necessary.
+
+You can report vulnerabilities here: [https://www.ncsc.gov.uk/information/vulnerability-reporting](https://www.ncsc.gov.uk/information/vulnerability-reporting)
+
+## General Security Enquiries
+
+If you have general enquiries regarding our cybersecurity, please reach out to us at [cybersecurity@nhs.net](mailto:cybersecurity@nhs.net)

data/lib/ndr_dev_support/capistrano/deploy_secrets.rb

@@ -1,4 +1,5 @@
 require 'tmpdir'
+require 'yaml'
 
 # Add a git or svn secrets respository for ndr_dev_support:deploy_secrets
 def add_secrets_repo(name:, url:, scm:, branch: nil)
@@ -114,6 +115,18 @@ Capistrano::Configuration.instance(:must_exist).load do
 
           raise 'Error: cannot export secrets files: aborting' unless ok
 
+          # Ensure YAML files have valid syntax
+          if secret[:shared_dest] =~ /[.]ya?ml\z/
+            begin
+              YAML.load_file(File.join(secret_dir, secret[:shared_dest]))
+            rescue StandardError, Psych::SyntaxError => e # rubocop:disable Lint/ShadowedException
+              Capistrano::CLI.ui.say <<~MSG
+                YAML Error loading file #{repo_root}/#{secret[:repo_path]}: #{e.class}: #{e}
+                #{e.backtrace.join("\n")}
+              MSG
+              raise "Error: invalid YAML syntax in file #{repo_root}/#{secret[:repo_path]}"
+            end
+          end
           secret[:digest] = Digest::SHA256.file(dest_fname).hexdigest
         end
 

data/lib/ndr_dev_support/capistrano/install_ruby.rb

@@ -12,7 +12,7 @@ Capistrano::Configuration.instance(:must_exist).load do
       $ git clone https://github.com/rbenv/ruby-build.git clone_rbenv/.rbenv/plugins/ruby-build
       $ mkdir clone_rbenv/.rbenv/cache
       $ (cd clone_rbenv/.rbenv/cache; curl -O https://cache.ruby-lang.org/pub/ruby/3.1/ruby-3.1.6.tar.gz)
-      $ (cd clone_rbenv; rm -f ../rbenv.tar.gz; tar czf ../rbenv.tar.gz .rbenv)
+      $ (cd clone_rbenv; rm -f ../rbenv.tar.gz; COPYFILE_DISABLE=1 tar czf ../rbenv.tar.gz .rbenv)
       $ rm -rf clone_rbenv
       $ scp -p rbenv.tar.gz app-server:/opt/rbenv.tar.gz
 
@@ -21,12 +21,12 @@ Capistrano::Configuration.instance(:must_exist).load do
       $ mkdir clone_rbenv
       $ git clone https://github.com/rbenv/rbenv.git clone_rbenv/.rbenv
       $ mkdir -p vendor/rbenv; rm -f vendor/rbenv/rbenv.tar.gz
-      $ tar czf vendor/rbenv/rbenv.tar.gz -C clone_rbenv .rbenv
+      $ COPYFILE_DISABLE=1 tar czf vendor/rbenv/rbenv.tar.gz -C clone_rbenv .rbenv
       $ rm -rf clone_rbenv
       $ mkdir clone_ruby-build
       $ git clone https://github.com/rbenv/ruby-build.git clone_ruby-build/ruby-build
       $ mkdir -p vendor/rbenv/cache; rm -f vendor/rbenv/ruby-build.tar.gz
-      $ tar czf vendor/rbenv/ruby-build.tar.gz -C clone_ruby-build ruby-build
+      $ COPYFILE_DISABLE=1 tar czf vendor/rbenv/ruby-build.tar.gz -C clone_ruby-build ruby-build
       $ rm -rf clone_ruby-build
       $ (cd vendor/rbenv/cache; curl -O https://cache.ruby-lang.org/pub/ruby/3.2/ruby-3.2.6.tar.gz)
       $ git add vendor/rbenv/{rbenv,ruby-build}.tar.gz vendor/rbenv/cache/*

data/lib/ndr_dev_support/capistrano/restart.rb

@@ -5,5 +5,15 @@ Capistrano::Configuration.instance(:must_exist).load do
       # The tmp/ directory should be shared, so this affects all prior deployments
       run "touch #{shared_path}/tmp/restart.txt"
     end
+
+    desc <<~DESC
+      Clean up old releases. Overrides the default deploy:cleanup but without blocking \
+      subsequent tasks if cleanup fails (e.g. because of locked files or permissions issues).
+    DESC
+    task :cleanup, except: { no_release: true } do
+      count = fetch(:keep_releases, 5).to_i
+      try_sudo "ls -1dt #{releases_path}/* | tail -n +#{count + 1} | #{try_sudo} xargs -r rm -rf " \
+               "|| echo 'cap deploy:cleanup failed - continuing, but check permissions.' >&2"
+    end
   end
 end

data/lib/ndr_dev_support/version.rb

@@ -2,5 +2,5 @@
 # This defines the NdrDevSupport version. If you change it, rebuild and commit the gem.
 # Use "rake build" to build the gem, see rake -T for all bundler rake tasks (and our own).
 module NdrDevSupport
-  VERSION = '7.3.6'
+  VERSION = '7.3.8'
 end

data/ndr_dev_support.gemspec

@@ -13,14 +13,14 @@ Gem::Specification.new do |spec|
   spec.license       = 'MIT'
 
   gem_files          = %w[CHANGELOG.md CODE_OF_CONDUCT.md LICENSE.txt README.md
-                          config lib ndr_dev_support.gemspec]
+                          SECURITY.md config lib ndr_dev_support.gemspec]
   spec.files         = `git ls-files -z`.split("\x0").
                        select { |f| gem_files.include?(f.split('/')[0]) }
   spec.bindir        = 'exe'
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.required_ruby_version = '>= 3.1'
+  spec.required_ruby_version = '>= 3.3'
 
   spec.add_dependency 'pry'
 
@@ -39,12 +39,12 @@ Gem::Specification.new do |spec|
   # Integration test dependencies:
   spec.add_dependency 'capybara', '>= 3.34'
   spec.add_dependency 'capybara-screenshot'
-  spec.add_dependency 'minitest', '~> 5.11'
+  spec.add_dependency 'minitest', '>= 5.11', '< 7.0'
   spec.add_dependency 'selenium-webdriver', '~> 4.8'
   spec.add_dependency 'show_me_the_cookies'
 
   # CI server dependencies:
-  spec.add_dependency 'activesupport', '>= 7.0', '< 8.2'
+  spec.add_dependency 'activesupport', '>= 7.1', '< 8.2'
   spec.add_dependency 'brakeman', '>= 4.7.1'
   spec.add_dependency 'bundler-audit'
   spec.add_dependency 'github-linguist'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ndr_dev_support
 version: !ruby/object:Gem::Version
-  version: 7.3.6
+  version: 7.3.8
 platform: ruby
 authors:
 - NCRS Development Team
@@ -167,16 +167,22 @@ dependencies:
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.11'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '7.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.11'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '7.0'
 - !ruby/object:Gem::Dependency
   name: selenium-webdriver
   requirement: !ruby/object:Gem::Requirement
@@ -211,7 +217,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.1'
     - - "<"
       - !ruby/object:Gem::Version
         version: '8.2'
@@ -221,7 +227,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '7.1'
     - - "<"
       - !ruby/object:Gem::Version
         version: '8.2'
@@ -403,6 +409,7 @@ files:
 - CODE_OF_CONDUCT.md
 - LICENSE.txt
 - README.md
+- SECURITY.md
 - config/rubocop/ndr.yml
 - lib/minitest/rake_ci.rb
 - lib/minitest/rake_ci_plugin.rb
@@ -480,7 +487,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.1'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="