Build local copy of Digital Analytics Program

[aduth]

🛠 Summary of changes

Updates usage of Digital Analytics Program to build and serve a local copy of the script.

Why?

• Serving from local copy reduces security risks inherent to loading scripts from third-party CDNs, even if the third-party is a trusted government source
  • Allows further strictening of content security policy
• Incorporating into existing build toolchain adds support for:
  • Subresource integrity (see related Slack thread)
  • Optimized minification from bundler dead code elimination (see upstream Use bundler to build minified JavaScript digital-analytics-program/gov-wide-code#118)
• Adds ability to fast-track patches to the code (see example upstream Load Google Tag Manager script as asynchronous digital-analytics-program/gov-wide-code#121 )
• Sets precedent for copying external assets for local use, hopefully

📜 Testing Plan

Add to config/application.yml:

participate_in_dap: true

Verify analytics script loads successfully:

1. Go to http://localhost:3000
2. Verify on errors in local console, and that Google Analytics loads successfully. You should see some warnings about Third-party cookies being blocked in future versions of Chrome

[aduth]

See: digital-analytics-program/gov-wide-code#118 (comment)

[aduth]

• Optimized minification from bundler dead code elimination (see upstream Use bundler to build minified JavaScript digital-analytics-program/gov-wide-code#118)

We can also benefit from our Brotli compression, compared to Gzip used with the hosted version.

Before:

curl --silent "https://dap.digitalgov.gov/Universal-Federated-Analytics-Min.js?agency=GSA&subagency=TTS" | gzip-size

8.24 kB

After:

NODE_ENV=production yarn build && brotli-size public/packs/digital-analytics-program*.js

6.78 kB

Diff: -1.46kb (-17.6%)