Upgrade Dynatrace RUM: script-tag loading, runtime config, fetch tooling

[redbugz]

Summary

Upgrades Dynatrace RUM to the latest agent (build 10341260622154106) and loads it exclusively via <script> tags to fix an EJS 500, adds runtime config injection with baked-in fallbacks, and adds a script to automate future RUM upgrades. Ships as @fs/react-scripts 8.17.0.

Reasoned Changes

New RUM loaded exclusively via script tags (dynatrace.ejs)

What: Rewrote the three treatment branches so that when frontier_snow_dynatraceNewRUM is on, each mechanism emits a <script> tag (SRI async, SRI sync, or _complete.js async) instead of an EJS include() of the agent.
Why: The 1.341-era agent's minified JS contains the EJS open-delimiter (<%) inside a string, so include() made EJS 500 with "Could not find matching close tag" on every page. Loading only via script tags sidesteps the EJS compile step and avoids re-shipping 300–460 KB per view. asyncCS-inline was remapped to a synchronous SRI tag (name kept for old-RUM compatibility) since the new RUM has no small-bootstrap format.

Runtime config injection with baked-in fallbacks

What: Each new-RUM value reads locals.dynatrace.* first, falling back to publish-time constants; adds scripts/dynatrace-rum-config.json.
Why: RUM app IDs / integrity / data-dtconfig rotate Dynatrace-side with no way to refresh without a react-scripts release. This lets Snow supply fresh values at runtime (from the S3 config, consumed by fs-webdev/snow#446) while fallbacks keep older Snow deploys working. Two independent flags separate mechanism rollout from version rollout; with the version flag off, behavior is unchanged.

Release automation for future RUM upgrades (fetch-dynatrace-scripts.js)

What: Node script that calls the Dynatrace tag endpoints per env, rewrites the dynatrace.ejs fallbacks, writes the config JSON, and publishes it to S3.
Why: No repeatable path existed to consume new RUM releases. Fails fast with an aws sts get-caller-identity preflight + SSO-aware guidance, warns when AWS_PROFILE is unset, prints the downloaded agent version, and reads the token from the macOS keychain.

Release metadata and operator documentation

What: Version bump to 8.17.0, CHANGELOG-FRONTIER.md 8.17.0 entry, and scripts/DYNATRACE_RUM_UPDATE.md runbook.
Why: Ships as the @fs/react-scripts release Snow consumes. The runbook documents the non-obvious asyncCS-inline remap so future operators don't "fix" it back to an inline include.

Related PRs

• fs-webdev/snow#446 (companion) — dynamic Dynatrace RUM config injection; consumes the dynatrace-rum-config.json this PR publishes and the locals.dynatrace.* values dynatrace.ejs reads.
• fs-webdev/snow#447 — EJS 3 via ejs-mate 3.0.0; the EJS-3 upgrade the layout.ejs include conversion (merged from frontierMaster) targets.

Risk Assessment

Residual risk is server-side render behavior in dynatrace.ejs and the template-rewriting regex in the fetch script.

1. fetch-dynatrace-scripts.js replaceFallback — matches the fallback body with {[^}]+}, stopping at the first }; a future data-dtconfig value with a literal/decoded } would truncate the rewrite. Values are URL-encoded today, so low-probability, but worth knowing.
2. dynatrace.ejs asyncCS-inline (new) — emits a synchronous SRI <script>; if the baked-in integrity fallback ever drifts from the CDN asset and locals.dynatrace is absent (older Snow deploy), the browser blocks it under SRI and RUM stops silently. Mitigated by the locals.dynatrace override (snow#446).

Testing

• Verified all 11 layout .ejs templates compile under EJS 3.1.10 (the version this must survive) via a standalone ejs.compile harness — the exact regression class behind the original 500.
• Render-tested every treatment × new/old-flag branch: correct script tags emitted, locals.dynatrace.* overrides fallbacks, old-RUM paths unchanged.
• fetch-dynatrace-scripts.js syntax-checked; AWS preflight fail-fast path exercised; ran end-to-end against Dynatrace to produce the committed config (agent 10341260622154106, published to S3).
• Gap: no in-repo automated test harness for the EJS layer (root npm test is a no-op); verification was manual/scripted.

[Copilot]

Pull request overview

This PR upgrades Dynatrace RUM to a newer agent version and switches new-RUM loading to <script> tags (avoiding EJS include() compilation failures), adds runtime-config fallbacks via locals.dynatrace.*, and introduces tooling/docs to automate future RUM updates and publishing of a config artifact.

Changes:

• Reworked dynatrace.ejs to support dual-flag rollout (mechanism vs version) and load new RUM exclusively via script tags with SRI/config support.
• Added a fetch/publish automation script plus a generated dynatrace-rum-config.json artifact for Snow runtime injection.
• Bumped @fs/react-scripts to 8.17.0 and documented/released the change.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/react-scripts/layout/views/partials/dynatrace.ejs	Adds new-RUM script-tag branches, locals-first runtime config, and dual-flag gating.
packages/react-scripts/scripts/fetch-dynatrace-scripts.js	New automation script to fetch Dynatrace tags, update EJS fallbacks, generate config JSON, and publish to S3.
packages/react-scripts/scripts/dynatrace-rum-config.json	Generated per-env CDN URL/SRI/config values for Snow to consume at runtime.
packages/react-scripts/scripts/DYNATRACE_RUM_UPDATE.md	Operator runbook for fetching/publishing and validating treatment mappings.
packages/react-scripts/package.json	Version bump to 8.17.0.
package-lock.json	Lockfile version update for the react-scripts package entry.
CHANGELOG-FRONTIER.md	Release notes for 8.17.0 Dynatrace RUM changes.

Comments suppressed due to low confidence (3)

packages/react-scripts/scripts/DYNATRACE_RUM_UPDATE.md:81

• This relative link points to ./partials/dynatrace.ejs, but the actual file lives under layout/views/partials/dynatrace.ejs. As written, the link is broken.

Two flags drive the experiment (see [dynatrace.ejs](./partials/dynatrace.ejs)):

packages/react-scripts/scripts/DYNATRACE_RUM_UPDATE.md:184

• These relative links are incorrect from the scripts/ directory. dynatrace.ejs is under layout/views/partials/, and fetch-dynatrace-scripts.js is the current file (same directory), so the links should be updated to avoid 404s in the runbook.

- [dynatrace.ejs](./partials/dynatrace.ejs) - Main RUM configuration file
- [fetch-dynatrace-scripts.js](./fetch-dynatrace-scripts.js) - The fetch script itself

packages/react-scripts/scripts/DYNATRACE_RUM_UPDATE.md:73

• The example snippet treats cdnIntegrityNew as a single string, but dynatrace.ejs defines cdnIntegrityNew as an environment-keyed object (and integrity values may differ per env). The example should reflect the actual shape.

```javascript
const cdnUrlsNew = {
  int: '...',    // Copy from script output
  beta: '...',   // Copy from script output
  prod: '...'    // Copy from script output

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.