newrelic_rpm 9.1.0 → 9.21.0

data/lib/new_relic/rack/browser_monitoring.rb

@@ -20,15 +20,15 @@ module NewRelic
       # examine in order to look for a RUM insertion point.
       SCAN_LIMIT = 50_000
 
-      CONTENT_TYPE = 'Content-Type'.freeze
-      CONTENT_DISPOSITION = 'Content-Disposition'.freeze
-      CONTENT_LENGTH = 'Content-Length'.freeze
-      ATTACHMENT = 'attachment'.freeze
-      TEXT_HTML = 'text/html'.freeze
+      CONTENT_TYPE = 'Content-Type'
+      CONTENT_DISPOSITION = 'Content-Disposition'
+      CONTENT_LENGTH = 'Content-Length'
+      ATTACHMENT = /attachment/.freeze
+      TEXT_HTML = %r{text/html}.freeze
 
-      BODY_START = '<body'.freeze
-      HEAD_START = '<head'.freeze
-      GT = '>'.freeze
+      BODY_START = '<body'
+      HEAD_START = '<head'
+      GT = '>'
 
       ALREADY_INSTRUMENTED_KEY = 'newrelic.browser_monitoring_already_instrumented'
       CHARSET_RE = /<\s*meta[^>]+charset\s*=[^>]*>/im.freeze
@@ -38,7 +38,7 @@ module NewRelic
         result = @app.call(env)
         (status, headers, response) = result
 
-        js_to_inject = NewRelic::Agent.browser_timing_header
+        js_to_inject = NewRelic::Agent.browser_timing_header(nonce(env))
         if (js_to_inject != NewRelic::EMPTY_STR) && should_instrument?(env, status, headers)
           response_string = autoinstrument_source(response, js_to_inject)
           if headers.key?(CONTENT_LENGTH)
@@ -58,6 +58,14 @@ module NewRelic
         end
       end
 
+      def nonce(env)
+        return unless NewRelic::Agent.config[:'browser_monitoring.content_security_policy_nonce']
+        return unless NewRelic::Agent.config[:framework] == :rails_notifications
+        return unless defined?(ActionDispatch::ContentSecurityPolicy::Request)
+
+        env[ActionDispatch::ContentSecurityPolicy::Request::NONCE]
+      end
+
       def should_instrument?(env, status, headers)
         NewRelic::Agent.config[:'browser_monitoring.auto_instrument'] &&
           status == 200 &&
@@ -65,6 +73,10 @@ module NewRelic
           html?(headers) &&
           !attachment?(headers) &&
           !streaming?(env, headers)
+      rescue StandardError => e
+        NewRelic::Agent.logger.error('RUM instrumentation applicability check failed on exception:' \
+                                     "#{e.class} - #{e.message}")
+        false
       end
 
       private
@@ -100,15 +112,19 @@ module NewRelic
 
       def html?(headers)
         # needs else branch coverage
-        headers[CONTENT_TYPE] && headers[CONTENT_TYPE].include?(TEXT_HTML) # rubocop:disable Style/SafeNavigation
+        headers[CONTENT_TYPE]&.match?(TEXT_HTML)
       end
 
       def attachment?(headers)
-        headers[CONTENT_DISPOSITION]&.include?(ATTACHMENT)
+        headers[CONTENT_DISPOSITION]&.match?(ATTACHMENT)
       end
 
       def streaming?(env, headers)
-        # Chunked transfer encoding is a streaming data transfer mechanism available only in HTTP/1.1
+        # Up until version 8.0, Rails would set 'Transfer-Encoding' to 'chunked'
+        # to trigger the desired HTTP/1.1 based streaming functionality in Rack.
+        # With version v8.0+, Rails assumes that the web server will be using
+        # Rack v3+ or an equally modern alternative and simply leaves the
+        # streaming behavior up to them.
         return true if headers && headers['Transfer-Encoding'] == 'chunked'
 
         defined?(ActionController::Live) &&
@@ -143,7 +159,7 @@ module NewRelic
       end
 
       # Per "The Response > The Body" section of Rack spec, we should close
-      # if our response is able. http://rack.rubyforge.org/doc/SPEC.html
+      # if our response is able. https://github.com/rack/rack/blob/main/SPEC.rdoc
       def close_old_response(response)
         response.close if response.respond_to?(:close)
       end

data/lib/new_relic/supportability_helper.rb

@@ -13,6 +13,7 @@ module NewRelic
       :insert_distributed_trace_headers,
       :accept_distributed_trace_headers,
       :add_custom_attributes,
+      :add_custom_log_attributes,
       :add_custom_span_attributes,
       :add_instrumentation,
       :add_method_tracer,
@@ -42,9 +43,12 @@ module NewRelic
       :process_response_metadata,
       :record_custom_event,
       :record_metric,
+      :record_llm_feedback_event,
       :recording_web_transaction?,
       :require_test_helper,
       :set_error_group_callback,
+      :set_llm_token_count_callback,
+      :set_segment_callback,
       :set_sql_obfuscator,
       :set_transaction_name,
       :set_user_id,
@@ -78,7 +82,7 @@ module NewRelic
         "Expected #{klass} for `#{name}` but got #{arg.class}"
 
       NewRelic::Agent.logger.warn(message)
-      nil
+      false
     end
   end
 end

data/lib/new_relic/thread_local_storage.rb

@@ -0,0 +1,31 @@
+# This file is distributed under New Relic's license terms.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
+
+module NewRelic
+  module ThreadLocalStorage
+    def self.get(thread, key)
+      if Agent.config[:thread_local_tracer_state]
+        thread.thread_variable_get(key)
+      else
+        thread[key]
+      end
+    end
+
+    def self.set(thread, key, value)
+      if Agent.config[:thread_local_tracer_state]
+        thread.thread_variable_set(key, value)
+      else
+        thread[key] = value
+      end
+    end
+
+    def self.[](key)
+      get(::Thread.current, key)
+    end
+
+    def self.[]=(key, value)
+      set(::Thread.current, key, value)
+    end
+  end
+end

data/lib/new_relic/traced_thread.rb

@@ -22,15 +22,14 @@ module NewRelic
     # @api public
     def initialize(*args, &block)
       NewRelic::Agent.record_api_supportability_metric(:traced_thread)
-      traced_block = create_traced_block(*args, &block)
+      traced_block = create_traced_block(&block)
       super(*args, &traced_block)
     end
 
-    def create_traced_block(*args, &block)
+    def create_traced_block(&block)
       return block if NewRelic::Agent.config[:'instrumentation.thread.tracing'] # if this is on, don't double trace
 
       NewRelic::Agent::Tracer.thread_block_with_current_transaction(
-        *args,
         segment_name: 'Ruby/TracedThread',
         &block
       )

data/lib/new_relic/version.rb

@@ -6,7 +6,7 @@
 module NewRelic
   module VERSION # :nodoc:
     MAJOR = 9
-    MINOR = 1
+    MINOR = 21
     TINY = 0
 
     STRING = "#{MAJOR}.#{MINOR}.#{TINY}"

data/lib/sequel/extensions/new_relic_instrumentation.rb

@@ -27,7 +27,7 @@ module Sequel
   # If you don't want your models or database connections to be instrumented,
   # you can disable them by setting `disable_database_instrumentation` in
   # your `newrelic.yml` to `true`. It will also honor the
-  # `disable_activerecord_instrumentation` setting.
+  # `disable_active_record_instrumentation` setting.
   #
   module NewRelicInstrumentation
     module Naming
@@ -78,8 +78,9 @@ module Sequel
     end
 
     THREAD_SAFE_CONNECTION_POOL_CLASSES = [
-      (defined?(::Sequel::ThreadedConnectionPool) && ::Sequel::ThreadedConnectionPool)
-    ].freeze
+      (defined?(::Sequel::ThreadedConnectionPool) && ::Sequel::ThreadedConnectionPool),
+      (defined?(::Sequel::TimedQueueConnectionPool) && NewRelic::Helper.version_satisfied?(RUBY_VERSION, '>=', '3.2') && ::Sequel::TimedQueueConnectionPool)
+    ].compact.freeze
 
     def explainer_for(sql)
       proc do |*|

data/lib/tasks/bump_version.rake

@@ -0,0 +1,21 @@
+# This file is distributed under New Relic's license terms.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
+
+require_relative 'helpers/version_bump'
+
+namespace :newrelic do
+  namespace :version do
+    desc 'Returns the current version'
+    task :current do
+      puts "#{NewRelic::VERSION::STRING}"
+    end
+
+    desc 'Update version file and changelog to next version'
+    task :bump, [:format] => [] do |t, args|
+      new_version = VersionBump.update_version
+      VersionBump.update_changelog(new_version)
+      puts "New version: #{new_version}"
+    end
+  end
+end

data/lib/tasks/config.rake

@@ -19,14 +19,20 @@ namespace :newrelic do
       DISABLING => 'Use these settings to toggle instrumentation types during agent startup.',
       ATTRIBUTES => '[Attributes](/docs/features/agent-attributes) are key-value pairs containing information that determines the properties of an event or transaction. These key-value pairs can be viewed within transaction traces in APM, traced errors in APM, transaction events in dashboards, and page views in dashboards. You can customize exactly which attributes will be sent to each of these destinations',
       'transaction_tracer' => 'The [transaction traces](/docs/apm/traces/transaction-traces/transaction-traces) feature collects detailed information from a selection of transactions, including a summary of the calling sequence, a breakdown of time spent, and a list of SQL queries and their query plans (on mysql and postgresql). Available features depend on your New Relic subscription level.',
-      'error_collector' => "The agent collects and reports all uncaught exceptions by default. These configuration options allow you to customize the error collection.\n\nFor information on ignored and expected errors, [see this page on Error Analytics in APM](/docs/agents/manage-apm-agents/agent-data/manage-errors-apm-collect-ignore-or-mark-expected/). To set expected errors via the `NewRelic::Agent.notice_error` Ruby method, [consult the Ruby Agent API](/docs/agents/ruby-agent/api-guides/sending-handled-errors-new-relic/).",
-      'browser_monitoring' => "The browser monitoring [page load timing](/docs/browser/new-relic-browser/page-load-timing/page-load-timing-process) feature (sometimes referred to as real user monitoring or RUM) gives you insight into the performance real users are experiencing with your website. This is accomplished by measuring the time it takes for your users' browsers to download and render your web pages by injecting a small amount of JavaScript code into the header and footer of each page.",
-      'analytics_events' => '[New Relic dashboards](/docs/query-your-data/explore-query-data/dashboards/introduction-new-relic-one-dashboards) is a resource to gather and visualize data about your software and what it says about your business. With it you can quickly and easily create real-time dashboards to get immediate answers about end-user experiences, clickstreams, mobile activities, and server transactions.'
+      'error_collector' => "The agent collects and reports all uncaught exceptions by default. These configuration options allow you to customize the error collection.\n\nFor information on ignored and expected errors, [see this page on Error Analytics in APM](/docs/agents/manage-apm-agents/agent-data/manage-errors-apm-collect-ignore-or-mark-expected/). To set expected errors via the `NewRelic::Agent.notice_error` Ruby method, [consult the Ruby agent API](/docs/agents/ruby-agent/api-guides/sending-handled-errors-new-relic/).",
+      'browser_monitoring' => "The <InlinePopover type='browser' /> [page load timing](/docs/browser/new-relic-browser/page-load-timing/page-load-timing-process) feature (sometimes referred to as real user monitoring or RUM) gives you insight into the performance real users are experiencing with your website. This is accomplished by measuring the time it takes for your users' browsers to download and render your web pages by injecting a small amount of JavaScript code into the header and footer of each page.",
+      'application_logging' => "The Ruby agent supports [APM logs in context](/docs/apm/new-relic-apm/getting-started/get-started-logs-context). For some tips on configuring logs for the Ruby agent, see [Configure Ruby logs in context](/docs/logs/logs-context/configure-logs-context-ruby).\n\nAvailable logging-related config options include:",
+      'analytics_events' => '[New Relic dashboards](/docs/query-your-data/explore-query-data/dashboards/introduction-new-relic-one-dashboards) is a resource to gather and visualize data about your software and what it says about your business. With it you can quickly and easily create real-time dashboards to get immediate answers about end-user experiences, clickstreams, mobile activities, and server transactions.',
+      'ai_monitoring' => "This section includes Ruby agent configurations for setting up AI monitoring.\n\n<Callout variant='important'>You need to enable distributed tracing to capture trace and feedback data. It is turned on by default in Ruby agents 8.0.0 and higher.</Callout>",
+      'security_agent' => "[New Relic Interactive Application Security Testing](https://docs.newrelic.com/docs/iast/introduction/) (IAST) tests your applications for any exploitable vulnerability by replaying the generated HTTP request with vulnerable payloads.\n\n<Callout variant='important'>Run IAST with non-production deployments only to avoid exposing vulnerabilities on your production software. \
+        IAST mode requires Ruby agent version 9.12.0 or higher and the [newrelic_security](https://rubygems.org/gems/newrelic_security) gem. Security agent configurations are disabled by default.</Callout>"
     }
 
     NAME_OVERRIDES = {
-      'slow_sql' => 'Slow SQL',
-      'custom_insights_events' => 'Custom Events'
+      'slow_sql' => 'Slow SQL [#slow-sql]',
+      'custom_insights_events' => 'Custom Events [#custom-events]',
+      'ai_monitoring' => 'AI Monitoring [#ai-monitoring]',
+      'security_agent' => 'Security Agent [#security-agent]'
     }
 
     desc 'Describe available New Relic configuration settings'

data/lib/tasks/coverage_report.rake

@@ -1,6 +1,6 @@
-# frozen_string_literal: true
 # This file is distributed under New Relic's license terms.
 # See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
 
 if ENV['CI']
   namespace :coverage do

data/lib/tasks/gha.rake

@@ -0,0 +1,31 @@
+# This file is distributed under New Relic's license terms.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
+
+require 'yaml'
+require_relative 'helpers/version_bump'
+
+# gha = GitHub Actions
+namespace :gha do
+  # See .github/versions.yml
+  desc 'Update 3rd party action versions across all workflows'
+  task :update_versions do
+    gh_dir = File.expand_path('../../../.github', __FILE__)
+    info = YAML.load_file(File.join(gh_dir, 'versions.yml'))
+    workflows = Dir.glob(File.join(gh_dir, 'workflows', '*.yml'))
+    workflows.each do |workflow|
+      original = File.read(workflow)
+      modified = original.dup
+      info.each do |action, settings|
+        modified.gsub!(/uses: #{action}.*$/, "uses: #{action}@#{settings[:sha]} # tag #{settings[:tag]}")
+      end
+
+      if original != modified
+        File.open(workflow, 'w') { |f| f.puts modified }
+        puts "Updated #{workflow} with changes"
+      else
+        puts "#{workflow} remains unchanged"
+      end
+    end
+  end
+end

data/lib/tasks/helpers/config.html.erb

@@ -1,3 +1,97 @@
+---
+title: Ruby agent configuration
+tags:
+  - Agents
+  - Ruby agent
+  - Configuration
+metaDescription: 'APM for Ruby: how to configure the Ruby agent, including editing the config file and setting environment variables.'
+redirects:
+  - /docs/agents/ruby-agent/configuration/ruby-agent-configuration
+  - /docs/ruby/ruby-agent-configuration
+  - /docs/agents/ruby-agent/installation-and-configuration/ruby-agent-configuration
+  - /docs/agents/ruby-agent/installation-configuration/ruby-agent-configuration
+freshnessValidatedDate: never
+---
+
+<CONTRIBUTOR_NOTE>
+  This file is automatically generated from values defined in `lib/new_relic/agent/configuration/default_source.rb`.
+  Make all changes directly to `default_source.rb.`
+  Submit PRs or raise issues at: https://github.com/newrelic/newrelic-ruby-agent
+</CONTRIBUTOR_NOTE>
+
+You can configure the New Relic Ruby agent with settings in a configuration file, environment variables, or programmatically with server-side configuration. This document summarizes the configuration options available for the Ruby agent.
+
+If the default value for a configuration option is `(Dynamic)`, this means the Ruby agent calculates the default at runtime. The value for the config setting defaults to the value of another setting as appropriate.
+
+## Configuration methods and precedence [#Options]
+
+The primary (default) method to configure the Ruby agent is via the configuration file (`newrelic.yml`) in the `config` subdirectory. To set configuration values using environment variables:
+
+1. Add the prefix `NEW_RELIC_` to the setting's name.
+2. Replace any periods `.` with underscores `_`.
+
+You can also configure a few values in the UI via [server-side configuration](/docs/agents/manage-apm-agents/configuration/server-side-agent-configuration).
+
+The Ruby agent follows this order of precedence for configuration:
+
+1. Environment variables
+2. Server-side configuration
+3. Configuration file (`newrelic.yml`)
+4. Default configuration settings
+
+In other words, environment variables override all other configuration settings and info, server-side configuration overrides the configuration file and default config settings, and so on.
+
+## View and edit config file options [#Edit]
+
+The Ruby agent's `newrelic.yml` is a standard YAML configuration file. It typically includes a `Defaults` section at the top, plus sections below for each application environment (`Development`, `Test`, `Staging`, and `Production`).
+
+The Ruby agent determines which section of the `newrelic.yml` config file to read from by looking at certain environment variables to derive the application's environment. This can be useful when you want to use `info` for the `log_level` config setting in your production environment, and you want more verbose `log_level` config settings (such as `debug`) in your development environment.
+
+Here is an example `newrelic.yml` config file:
+
+```yaml
+common: &default_settings
+  license_key: 'YOUR_LICENSE_KEY'
+  app_name: 'My Application Name'
+production:
+  <<: *default_settings
+  log_level: info
+development:
+  <<: *default_settings
+  log_level: debug
+```
+
+The Ruby agent looks for the following environment variables, in this order, to find the application environment:
+
+1. `NEW_RELIC_ENV`
+2. `RUBY_ENV`
+3. `RAILS_ENV`
+4. `APP_ENV`
+5. `RACK_ENV`
+
+If the Ruby agent doesn't detect values for any of those environment variables, it will default the application environment to `development` and read from the `development` section of the `newrelic.yml` config file.
+
+When running the Ruby agent in a Rails app, the agent first looks for the `NEW_RELIC_ENV` environment variable to find the application environment and which section of the `newrelic.yml` to use. If `NEW_RELIC_ENV` is not present, the agent uses the Rails environment (`RAILS_ENV`).
+
+When you edit the config file, be sure to:
+
+* Indent only with two spaces.
+* Indent only where relevant, in sections such as **`error_collector`**.
+
+If you do not indent correctly, the agent may throw an `Unable to parse configuration file` error on startup.
+
+To view the most current list of available Ruby agent configuration options, use the `rake newrelic:config:docs` command. This document describes the most common options.
+
+## Update the config file [#Updates]
+
+This documentation applies to the Ruby agent's latest release. For details on earlier versions, refer to the comments in `newrelic.yml` itself.
+
+To update `newrelic.yml` file after a new release, use the template in the base directory of the agent gem. When you update to new gem versions, examine or diff `config/newrelic.yml` and `newrelic.yml` in the [installation directory](/docs/agents/manage-apm-agents/troubleshooting/find-agent-root-directory#ruby-agent) to take advantage of new configuration options.
+
+<Callout variant="important">
+  Updating the gem does not automatically update `config/newrelic.yml`.
+</Callout>
+
 <% sections.each do |(section_key, section_name, section_description, configs)| %>
 ## <%=section_name%>
 

data/lib/tasks/helpers/format.rb

@@ -3,16 +3,19 @@
 # frozen_string_literal: true
 
 module Format
-  def output(format)
-    config_hash = build_config_hash
-    sections = flatten_config_hash(config_hash)
+  DEFAULT_CONFIG_PATH = 'ruby-agent-configuration.mdx'
 
-    puts build_erb(format).result(binding).split("\n").map(&:rstrip).join("\n").gsub('.  ', '. ')
-    sections # silences unused warning to return this
+  def output(format)
+    result = build_erb(format).result(binding).split("\n").map(&:rstrip).join("\n").gsub('.  ', '. ')
+    File.write(DEFAULT_CONFIG_PATH, result)
   end
 
   private
 
+  def sections
+    @sections ||= flatten_config_hash(build_config_hash)
+  end
+
   def add_data_to_sections(sections)
     sections.each do |section|
       section_key = section[0]
@@ -66,7 +69,7 @@ module Format
 
   def format_description(value)
     description = ''
-    description += '<b>DEPRECATED</b> ' if value[:deprecated]
+    description += '<DNT>**DEPRECATED**</DNT> ' if value[:deprecated]
     description += value[:description]
     description
   end
@@ -81,9 +84,10 @@ module Format
     name = NAME_OVERRIDES[key]
     return name if name
 
-    key.split('_')
+    title = key.split('_')
       .each { |fragment| fragment[0] = fragment[0].upcase }
       .join(' ')
+    "#{title} [##{key.tr('_', '-')}]"
   end
 
   def format_sections(key, value)

data/lib/tasks/helpers/newrelicyml.rb

@@ -0,0 +1,211 @@
+# This file is distributed under New Relic's license terms.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
+
+require_relative '../../new_relic/agent/configuration/default_source'
+
+module NewRelicYML
+  CRITICAL = [:'agent_enabled', :'app_name', :'license_key', :'log_level']
+  DEFAULTS = NewRelic::Agent::Configuration::DEFAULTS
+  # Skip because not configurable via yml
+  SKIP = [:'defer_rails_initialization']
+  # Don't evaluate Procs, instead use set values
+  PROCS = {:'config_path' => 'newrelic.yml',
+           :'process_host.display_name' => 'default hostname',
+           :'transaction_tracer.transaction_threshold' => 1.0}
+
+  HEADER = <<~HEADER
+    #
+    # This file configures the New Relic agent.  New Relic monitors Ruby, Java,
+    # .NET, PHP, Python, Node, and Go applications with deep visibility and low
+    # overhead.  For more information, visit www.newrelic.com.
+
+    # Generated <%= Time.now.strftime('%B %d, %Y') %><%= ", for version \#{@agent_version}" if @agent_version %>
+    #<%= "\\n# \#{generated_for_user}\\n#" if generated_for_user %>
+    # For full documentation of agent configuration options, please refer to
+    # https://docs.newrelic.com/docs/agents/ruby-agent/installation-configuration/ruby-agent-configuration
+
+    common: &default_settings
+      # Required license key associated with your New Relic account.
+      license_key: <%= license_key %>
+
+      # Your application name. Renaming here affects where data displays in New
+      # Relic. For more details, see https://docs.newrelic.com/docs/apm/new-relic-apm/maintenance/renaming-applications
+      app_name: <%= app_name %>
+
+      # To disable the agent regardless of other settings, uncomment the following:
+      # agent_enabled: false
+
+      # Logging level for log/newrelic_agent.log; options are error, warn, info, or
+      # debug.
+      log_level: info
+
+      # All of the following configuration options are optional. Review them, and
+      # uncomment or edit them if they appear relevant to your application needs.
+
+  HEADER
+
+  SECURITY_BEGIN = <<-SECURITY
+  # BEGIN security agent
+  #
+  #   NOTE: At this time, the security agent is intended for use only within
+  #         a dedicated security testing environment with data that can tolerate
+  #         modification or deletion. The security agent is available as a
+  #         separate Ruby gem, newrelic_security. It is recommended that this
+  #         separate gem only be introduced to a security testing environment
+  #         by leveraging Bundler grouping like so:
+  #
+  #         # Gemfile
+  #         gem 'newrelic_rpm'               # New Relic APM observability agent
+  #         gem 'newrelic-infinite_tracing'  # New Relic Infinite Tracing
+  #
+  #         group :security do
+  #           gem 'newrelic_security', require: false # New Relic security agent
+  #         end
+  #
+  #   NOTE: All "security.*" configuration parameters are related only to the
+  #         security agent, and all other configuration parameters that may
+  #         have "security" in the name somewhere are related to the APM agent.
+  
+  SECURITY
+
+  SECURITY_END = <<-SECURITY
+  # END security agent
+  SECURITY
+
+  FOOTER = <<~FOOTER
+    # Environment-specific settings are in this section.
+    # RAILS_ENV or RACK_ENV (as appropriate) is used to determine the environment.
+    # If your application has other named environments, configure them here.
+    development:
+      <<: *default_settings
+      app_name: <%= app_name %> (Development)
+
+    test:
+      <<: *default_settings
+      # It doesn't make sense to report to New Relic from automated test runs.
+      monitor_mode: false
+
+    staging:
+      <<: *default_settings
+      app_name: <%= app_name %> (Staging)
+
+    production:
+      <<: *default_settings
+  FOOTER
+
+  def self.get_configs(defaults)
+    agent_configs = {}
+    security_configs = {}
+
+    defaults.sort.each do |key, value|
+      next if CRITICAL.include?(key) || SKIP.include?(key)
+
+      next unless public_config?(value) && !deprecated?(value)
+
+      # TODO: OLD RUBIES < 2.6
+      # Remove `to_s`. `start_with?` doesn't accept symbols in Ruby <2.6
+      if key.to_s.start_with?('security.')
+        description, default = build_config(key, value)
+        security_configs[key] = {description: description, default: default}
+        next
+      end
+
+      description, default = build_config(key, value)
+      agent_configs[key] = {description: description, default: default}
+    end
+
+    [agent_configs, security_configs]
+  end
+
+  def self.build_config(key, value)
+    sanitized_description = sanitize_description(value[:description])
+    description = format_description(sanitized_description)
+    default = default_value(key, value)
+
+    [description, default]
+  end
+
+  def self.public_config?(value)
+    value[:public] == true
+  end
+
+  def self.deprecated?(value)
+    value[:deprecated] == true
+  end
+
+  def self.sanitize_description(description)
+    # remove callouts
+    description = description.split("\n").reject { |line| line.match?('</?Callout') }.join("\n")
+    # remove InlinePopover, keep the text inside type
+    description.gsub!(/<InlinePopover type="(.*)" \/>/, '\1')
+    # remove hyperlinks
+    description.gsub!(/\[([^\]]+)\]\([^\)]+\)/, '\1')
+    # delete lines with code fences including the language
+    description.gsub!(/```[a-zA-Z0-9_]*\n(.*?)```/m, '\1')
+    # remove single pairs of backticks
+    description.gsub!(/`([^`]+)`/, '\1')
+    # removed href links
+    description.gsub!(/<a href="(.*)">(.*)<\/a>/, '\2')
+
+    description
+  end
+
+  def self.format_description(description)
+    # remove all tab characters
+    description.delete!("\t")
+    # remove leading and trailing whitespace
+    description.strip!
+    # wrap text after 80 characters, assuming we're at one tabstop's (two
+    # spaces') level of indentation already, keep leading whitespace
+    description.gsub!(/(.{1,78})(\s|\Z)/, "\\1\n")
+    # add hashtags to lines
+    description = description.split("\n").map { |line| "  # #{line}" }.join("\n")
+
+    description
+  end
+
+  def self.default_value(key, config_hash)
+    if PROCS.include?(key)
+      PROCS[key]
+    else
+      default = config_hash[:documentation_default].nil? ? config_hash[:default] : config_hash[:documentation_default]
+      default = 'nil' if default.nil?
+      default = '""' if default == ''
+
+      default
+    end
+  end
+
+  def self.agent_configs_yml(agent_configs)
+    agent_yml = ''
+    agent_configs.each do |key, value|
+      agent_yml += "#{value[:description]}\n  # #{key}: #{value[:default]}\n\n"
+    end
+
+    agent_yml
+  end
+
+  def self.security_configs_yml(security_configs)
+    security_yml = ''
+    security_configs.each do |key, value|
+      security_yml += "#{value[:description]}\n  # #{key}: #{value[:default]}\n\n"
+    end
+
+    security_yml
+  end
+
+  def self.build_string(defaults)
+    agent_configs, security_configs = get_configs(defaults)
+    agent_string = agent_configs_yml(agent_configs)
+    security_string = security_configs_yml(security_configs)
+
+    agent_string + SECURITY_BEGIN + security_string + SECURITY_END + "\n"
+  end
+
+  # :nocov:
+  def self.write_file(defaults = DEFAULTS)
+    File.write('newrelic.yml', HEADER + build_string(defaults) + FOOTER)
+  end
+  # :nocov:
+end