standard_audit 0.14.0 → 0.14.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05062631e84ab99965b101b5381535c345929c0282cb4c0ca645f2636a5d42b3
-  data.tar.gz: 9acf2c4b4f8059ca4290655e065ce2e0fbd093a5747b87658ea426ec2b6d32f6
+  metadata.gz: 052265cb7a2b77f0bdbbec540a7603112a26ad20173828a0009a5aee72d68270
+  data.tar.gz: 3dd110875c9356705e363437c97ef35b27e8412eed4f54c523894d9dc8173ca2
 SHA512:
-  metadata.gz: 48c43519e8dfff7d04ea521ca6700cd85b3ac9096f89288b4c2bdc3a94a1b51d1c941fa6c9f7278e06672e9f1318805b0d0c34e0da282b65fcd85e67cf07ee0f
-  data.tar.gz: 59d4d4dbba01407436d16c6c6007b09b63ac0024f58c7f44d8880dac7f46f38baf279c5142264e2e03a150fec1ca1dcba0ce538d8105fa2c96a0c2fb29979cc2
+  metadata.gz: abba2f5dac90739c1a96b1470030f81bcc967261af6effab9a3561edc1ec57115e19695aa7cebebb716b20a406bdfca2200a89afda7d826acd7de9a5379d5206
+  data.tar.gz: 60985a94ecd78c1c47a9e66ffe7fb0df0ffd26928361c4a0b4ee1417a14eea31762aca75cb1e4805e117af3df668cd5e99f473ff3ddf05b6a920e48c35ef2f40

data/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.1] - 2026-10-22
+
+### Changed
+
+- **`Checks::Retention` fails closed on `APP_ENVIRONMENT`.** Only `staging`,
+  `preview`, `development` and `test` are non-production; any other set value
+  is production, so a misspelt `APP_ENVIRONMENT` can no longer silence the
+  unbounded-retention advisory (before, only the exact value `production`
+  counted). Surrounding whitespace is ignored and matching is case-sensitive
+  (`Staging` is production). Unset or blank still falls back to
+  `Rails.env.production?`. The estate
+  convention shared with standard_id, standard_health and standard_singpass.
+
 ## [0.14.0] - 2026-10-22
 
 ### Added

data/README.md

@@ -949,9 +949,12 @@ StandardHealth.configure do |c|
 end
 ```
 
-When `APP_ENVIRONMENT == "production"` (falling back to `Rails.env.production?`
-when that var is unset — so staging is not flagged) and `retention_days` is nil,
-the check returns `:warn`. With `:indefinite` it returns `:ok` with
+On a production deployment with `retention_days` nil, the check returns `:warn`.
+"Production" follows the estate's `APP_ENVIRONMENT` convention: when the variable
+is set (surrounding whitespace ignored, matched case-sensitively), only
+`staging`, `preview`, `development` and `test` are non-production, so staging is
+not flagged, and any other value, a typo included, counts as production. When it
+is unset or blank, `Rails.env.production?` decides. With `:indefinite` it returns `:ok` with
 `retention: "indefinite"`. That rolls `GET /health/ready` up to `:degraded`,
 which is **still HTTP 200** — it surfaces the advisory in the readiness JSON
 without failing the probe or blocking a deploy. The check is duck-typed and has

data/lib/standard_audit/checks/retention.rb

@@ -19,10 +19,15 @@ module StandardAudit
     # the probe or blocking a deploy. Only a *critical* check failure returns
     # 503, and this check is never critical.
     #
-    # "Production" is ENV["APP_ENVIRONMENT"] == "production" when that var is
-    # set (so staging — which also runs RAILS_ENV=production — is not flagged);
+    # "Production" follows the estate's APP_ENVIRONMENT convention (shared
+    # with standard_id, standard_health and standard_singpass): when that var
+    # is set, only staging, preview, development and test are non-production
+    # (so staging, which also runs RAILS_ENV=production, is not flagged) and
+    # any other value is production, so a typo never silences the advisory;
     # otherwise it falls back to Rails.env.production?.
     class Retention
+      NON_PRODUCTION_APP_ENVIRONMENTS = %w[staging preview development test].freeze
+
       def initialize(name: :audit_retention, critical: false)
         @name = name
         @critical = critical
@@ -51,8 +56,8 @@ module StandardAudit
       private
 
       def production?
-        app_env = ENV["APP_ENVIRONMENT"].to_s
-        return app_env == "production" unless app_env.empty?
+        app_env = ENV["APP_ENVIRONMENT"].to_s.strip
+        return !NON_PRODUCTION_APP_ENVIRONMENTS.include?(app_env) unless app_env.empty?
 
         defined?(Rails) && Rails.respond_to?(:env) && Rails.env.production?
       end

data/lib/standard_audit/version.rb

@@ -1,3 +1,3 @@
 module StandardAudit
-  VERSION = "0.14.0"
+  VERSION = "0.14.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_audit
 version: !ruby/object:Gem::Version
-  version: 0.14.0
+  version: 0.14.1
 platform: ruby
 authors:
 - Jaryl Sim