@dotcom-reliability-kit/app-info - npm Package Compare versions

Comparing version 1.0.3 to 1.1.0

lib/index.js

 const path = require('path');
 
+// This package relies on Heroku and AWS Lambda environment variables.
+// Documentation for these variables is available here:
+//
+//   - Heroku: https://devcenter.heroku.com/articles/dyno-metadata
+//   - Lambda: https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html
+
 /**
@@ -50,3 +56,7 @@ * Get the application system code from a package.json file.
 	 */
-	commitHash: process.env.HEROKU_SLUG_COMMIT || null,
+	commitHash:
+		process.env.HEROKU_SLUG_COMMIT ||
+		process.env.GIT_COMMIT_LONG ||
+		process.env.GIT_COMMIT ||
+		null,
 
@@ -67,3 +77,3 @@ /**
 	 */
-	region: process.env.REGION || null,
+	region: process.env.REGION || process.env.AWS_REGION || null,
 
@@ -84,3 +94,6 @@ /**
 	 */
-	releaseVersion: process.env.HEROKU_RELEASE_VERSION || null,
+	releaseVersion:
+		process.env.HEROKU_RELEASE_VERSION ||
+		process.env.AWS_LAMBDA_FUNCTION_VERSION ||
+		null,
 
@@ -87,0 +100,0 @@ /**

package.json

 {
   "name": "@dotcom-reliability-kit/app-info",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "A utility to get application info in a consistent way.",
@@ -5,0 +5,0 @@ "repository": {

README.md

@@ -37,4 +37,8 @@
 
-Get the commit hash that the application last deployed. This will be a string (if `process.env.HEROKU_SLUG_COMMIT` is defined) or `null` otherwise. This relies on the [Heroku Dyno metadata labs feature](https://devcenter.heroku.com/articles/dyno-metadata) and will not be present in local development.
+Get the commit hash that the application last deployed. This will be a string (if `process.env.HEROKU_SLUG_COMMIT`, `process.env.GIT_COMMIT_LONG`, or `process.env.GIT_COMMIT` is defined) or `null` otherwise.
 
+For Heroku, this relies on the [Dyno Metadata labs feature](https://devcenter.heroku.com/articles/dyno-metadata) and will not be present in local development.
+
+For AWS Lambda, you can use a plugin like [serverless-plugin-git-variables](https://www.npmjs.com/package/serverless-plugin-git-variables) to provide this data or set the `GIT_COMMIT` environment variable during deployment.
+
 ### `appInfo.environment`
@@ -46,12 +50,16 @@
 
-Get the application Heroku region. This will be a string (if `process.env.REGION` is defined) or `null` otherwise.
+Get the region that the application is running in. This will be a string (if `process.env.REGION` or `process.env.AWS_REGION` is defined) or `null` otherwise.
 
 ### `appInfo.releaseDate`
 
-Get the application Heroku release date. This will be a string (if `process.env.HEROKU_RELEASE_CREATED_AT` is defined) or `null` otherwise. This relies on the [Heroku Dyno metadata labs feature](https://devcenter.heroku.com/articles/dyno-metadata) and will not be present in local development.
+Get the application Heroku release date. This will be a string (if `process.env.HEROKU_RELEASE_CREATED_AT` is defined) or `null` otherwise.
 
+For Heroku, this relies on the [Dyno Metadata labs feature](https://devcenter.heroku.com/articles/dyno-metadata) and will not be present in local development.
+
 ### `appInfo.releaseVersion`
 
-Get the application Heroku release version. This will be a string (if `process.env.HEROKU_RELEASE_VERSION` is defined) or `null` otherwise. This relies on the [Heroku Dyno metadata labs feature](https://devcenter.heroku.com/articles/dyno-metadata) and will not be present in local development.
+Get the application Heroku release version. This will be a string (if `process.env.HEROKU_RELEASE_VERSION` or `process.env.AWS_LAMBDA_FUNCTION_VERSION` is defined) or `null` otherwise.
 
+For Heroku, this relies on the [Dyno Metadata labs feature](https://devcenter.heroku.com/articles/dyno-metadata) and will not be present in local development.
+
 ### `appInfo.systemCode`
@@ -58,0 +66,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

7527

increased by12.18%

Lines of code

108

increased by12.5%

Number of lines in readme file

79

increased by11.27%

Worsened metrics

Number of low supply chain risk alerts

11

increased by57.14%

No dependency changes