Repository navigation
Updated Vortex to 1.42.0. - #355
Conversation
…ith Vortex 1.42.0.
…th Vortex 1.42.0.
….php' with Vortex 1.42.0.
…ith Vortex 1.42.0.
… with Vortex 1.42.0.
…ith Vortex 1.42.0.
AlexSkrypnyk
added
the
AUTOMERGE
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: 🟡 Moderate · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly identifies the primary change: updating Vortex from version 1.41.1 to 1.42.0. It is concise and specific. |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 9 files. (2 skipped: 2 … |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 9 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
| audit: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| permissions: |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3151, drevops/vortex#3155, drevops/vortex#3215
The Security audit now covers npm (the root and drevops theme lock files) through audit-ci at the high threshold, and uploads Composer, npm and Gitleaks findings to the repo's code scanning tab as SARIF. The permissions block is what the SARIF upload needs. The Gitleaks step also changes from -v "${PWD}" to --volumes-from. The old mount resolved against the runner host instead of the job container, so Gitleaks had been scanning an empty directory and passing. The first run of this job flagged advisories already in both lock files, which the later commits in this PR fix.
|
|
||
| - name: Draft release notes | ||
| uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0 | ||
| uses: release-drafter/release-drafter@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0 |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3174
Routine SHA-pinned bump of release-drafter from v7.7.0 to v7.10.0. Upstream also added a filter-by-range input, but only inside a VORTEX_DEV block, so the installer strips it and consumer projects don't get it.
| persist-credentials: false | ||
|
|
||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||
| - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3195, drevops/vortex#3179
Routine SHA-pinned bumps: setup-node v7.1.0, the Renovate config validator v2.4.1 and renovatebot/github-action v46.3.8. The validator checks the renovate.json changes in this same PR. The installer would also have dropped the project's comment on issues: write, so that comment is kept.
| '''(^|/)\.artifacts/''', | ||
| '''(^|/)\.data/''', | ||
| '''(^|/)\.git/''', | ||
| '''(^|/)\.logs/''', |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3155
Allowlists .logs/. The Security audit now writes its JSON and SARIF reports to .logs/audit/ before Gitleaks runs. Those reports quote advisory text and package metadata, and Gitleaks now scans the real checkout, so without this entry it would scan its own sibling reports.
| @@ -0,0 +1,3 @@ | |||
| ; npm's default floor fails the audit on any advisory, including low-severity | |||
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3151
Sets audit-level=high for the root package, so a plain npm audit or npm ci locally reports the same threshold the CI audit enforces. Without it, npm's default fails on low-severity findings in transitive dev dependencies. CI passes --high to audit-ci explicitly, so this file is for developers, not the gate.
| [//]: # (DO NOT REMOVE THE BADGE BELOW. IT IS USED BY VORTEX TO TRACK INTEGRATION) | ||
|
|
||
| [](https://github.com/drevops/vortex/tree/1.41.1) | ||
| [](https://github.com/drevops/vortex/tree/1.42.0) |
There was a problem hiding this comment.
Vortex badge bump from 1.41.1 to 1.42.0. The installer reads this badge on the next ahoy update-vortex to work out which version the project is on, so it has to stay in this exact form. The installer also rewrapped the rest of the README to 76 columns, which was reverted.
| "cweagans/composer-patches": "^2.0", | ||
| "drevops/test-private-package": "^1.0", | ||
| "drevops/vortex-tooling": "~1.4.0", | ||
| "drevops/vortex-tooling": "~1.5.1", |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3227
2 changes:
drevops/vortex-toolingmoves to~1.5. It's required, not routine: theaudit.ymlandbuild-test-deploy.ymlsteps in this PR callvortex-convert-audit-sarifandvortex-check-worktree-changes, which only exist in 1.5.x.bump-after-updatewrote~1.5.1, the version that was locked.config.platform.phpmoves to8.4.27to match PHP in the Lagoon26.10.0images. That's the release that fixes CVE-2026-109618 and CVE-2026-109619 (CERT-EU 2026-018).
The template also offered drupal/fast_404, deferred to its own issue because it changes 404 handling at the settings.php level. Every other template difference was a constraint where the project is already equal or newer, so the project's value stays (see composer-analysis.md in the run artifacts).
| <<: [ *default-volumes, *default-user ] | ||
| depends_on: | ||
| - cli | ||
| - php |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3170
Makes nginx wait for php. Both used to start in parallel, and when php hadn't joined the network yet, nginx exited with host not found in upstream "php" and stayed down until the next ahoy up. Lagoon ignores depends_on, so deployments are unaffected. The installer would also have dropped the project's DRUPAL_AI_PROVIDER_GEMINI_API_KEY pass-through, which is kept.
| import { defineConfig } from 'eslint/config'; | ||
| import { fixupPluginRules } from '@eslint/compat'; | ||
| import importPlugin from 'eslint-plugin-import'; | ||
| import { importX } from 'eslint-plugin-import-x'; |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3219
Follows the ESLint 10 bump in package.json. eslint-plugin-import doesn't support ESLint 10, so its fork eslint-plugin-import-x replaces it, and the rule name changes to import-x/no-mutable-exports. eslint-plugin-no-jquery 6 breaks inside fixupPluginRules() (Cannot read properties of undefined (reading 'bind')), so it's now registered directly and @eslint/compat goes away. ahoy lint passes on web/modules/custom with the new setup.
| @@ -0,0 +1,18 @@ | |||
| // audit-ci allowlist for projects based on Vortex. | |||
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3175
The allowlist the root npm audit reads. The only entry is braces GHSA-vfj7-8cjw-p6xm, which has no patched release. It's reached only through Stylelint expanding this project's own lint globs, so no outside input gets to it. The entry expires on 2026-12-31, so the audit starts failing again rather than hiding the advisory forever. Without this file, the required audit job would fail on every PR.
| "engines": { | ||
| "npm": ">= 10.8.0", | ||
| "node": ">= 20.20.0" | ||
| "node": ">= 22.13.0" |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3219, drevops/vortex#3227
Moves the root lint toolchain to ESLint 10 (npm marks eslint@9.39.5 as unsupported), Stylelint 17, eslint-plugin-yml 3, eslint-plugin-no-jquery 6 and globals 17, and swaps eslint-plugin-import for eslint-plugin-import-x. Node 22.13.0 or later is now required to run npm on the host; the CLI container already ships Node 24. The lock file was regenerated from the project's own lock rather than taken from the installer, and was then put through npm audit fix for fast-uri and js-yaml.
| level: 7 | ||
|
|
||
| phpVersion: 80423 | ||
| phpVersion: 80427 |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3227
phpVersion follows config.platform.php to 80427, so PHPStan analyses against the same PHP patch release the containers run. The project's ScriptHandler.php exclusion and its ProviderProxy::chat() ignore for the AI alt-text module, both of which the installer would have dropped, are kept.
| "rangeStrategy": "bump", | ||
| "timezone": "Australia/Melbourne", | ||
| "configMigration": true, | ||
| "internalChecksFilter": "strict", |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3192, drevops/vortex#3194, drevops/vortex#3164, drevops/vortex#3197
Every group now has an explicit automerge flag. The installer kept this project's current choices, so only GitHub Actions auto-merges, as before. Groups wait 14 days (minimumReleaseAge) before proposing an update, so a compromised release that gets pulled within days never reaches us. Drupal core is exempt, so its security releases still arrive on the next daily run. docker-compose.yml images now join the container images group, and a new CI tools group keeps the npx audit-ci@... pin in audit.yml current. The CircleCI Renovate image group has nothing to match on this GitHub Actions project.
| $this->databases = $databases; | ||
| } | ||
|
|
||
| /** |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3101
Adds requireModuleSettingsFile(), which loads 1 per-module settings file against a fixture contrib path. Upstream uses it for the Fast 404 tests. Fast 404 is deferred here, so nothing calls it yet, but it ships with the template regardless of module selection, and keeping it avoids a conflict on the next update. This file was reconciled with a 3-way merge (project ← 1.41.1 render → 1.42.0 render), so the project's own helpers stay untouched.
| declare(strict_types=1); | ||
|
|
||
| if (file_exists($contrib_path . '/clamav') && !empty(getenv('DRUPAL_CLAMAV_ENABLED'))) { | ||
| if (getenv('DRUPAL_CLAMAV_ENABLED') === '1') { |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3122
DRUPAL_CLAMAV_ENABLED now switches ClamAV on only with the exact value 1. Any other non-empty value, true included, now reads as off. .env already sets 1. Upstream also dropped the file_exists($contrib_path . '/clamav') guard. drupal/clamav is in this project's require, so the module is always present and the guard never changed anything here.
| @@ -1,28 +0,0 @@ | |||
| <?php | |||
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3101
Deleted with no replacement. The guard checked $contrib_path . '/fast404/fast404.inc', but Composer installs the module as fast_404, and this project never required it anyway, so fast404_preboot() never ran. Upstream replaced it with settings.fast_404.php alongside drupal/fast_404. That pair is deferred to its own issue, so removing this file changes no behaviour.
| // removed; the next deployment (#3) uses the project-wide variable with the | ||
| // same value '1', so behavior does not change. | ||
| if (file_exists($contrib_path . '/redis') && !empty(getenv('DRUPAL_REDIS_ENABLED'))) { | ||
| if (file_exists($contrib_path . '/redis') && getenv('DRUPAL_REDIS_ENABLED') === '1') { |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3122
Same exact-1 guard as ClamAV. .env sets DRUPAL_REDIS_ENABLED=1, so local and CI are unaffected. Before deploying, check the Lagoon variables: if any environment sets true or yes, it would silently drop Redis and fall back to the database cache.
|
|
||
| // Allow an environment to opt out of the rerouting set above. | ||
| if (!empty(getenv('DRUPAL_REROUTE_EMAIL_DISABLED'))) { | ||
| if (getenv('DRUPAL_REROUTE_EMAIL_DISABLED') === '1') { |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3122
DRUPAL_REROUTE_EMAIL_DISABLED now opts out of rerouting only with 1. The old !empty() check meant false disabled rerouting, so a stage environment could have emailed real people. The project already carried upstream's other change here (rerouting on every environment except local, ci and prod), so this guard is the only hunk.
| if (!empty(getenv('DRUPAL_SHIELD_USER')) && !empty(getenv('DRUPAL_SHIELD_PASS'))) { | ||
| $config['shield.settings']['credentials']['shield']['user'] = getenv('DRUPAL_SHIELD_USER'); | ||
| $config['shield.settings']['credentials']['shield']['pass'] = getenv('DRUPAL_SHIELD_PASS'); | ||
| $shield_user = getenv('DRUPAL_SHIELD_USER'); |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3122
The headline case for this change: under the old !empty() check, DRUPAL_SHIELD_DISABLED=false disabled Shield. DRUPAL_SHIELD_DISABLED and DRUPAL_SHIELD_ALLOW_ACME_CHALLENGE now act only on 1, and each value variable is read once into a local. Check the Lagoon variables before deploying: an environment that relied on true gets Shield back on.
|
|
||
| if (!empty(getenv('LAGOON_KUBERNETES'))) { | ||
| if (getenv('LAGOON_ENVIRONMENT_TYPE') == 'production') { | ||
| $lagoon_git_branch = getenv('LAGOON_GIT_BRANCH'); |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3122
Reads LAGOON_GIT_BRANCH and VORTEX_LAGOON_PRODUCTION_BRANCH once and switches == to ===. Environment detection gives the same answers: prod by type or by production branch, stage for main, master, release/* and hotfix/*, dev otherwise. EnvironmentSettingsTest covers each branch and still passes.
| // Allow overriding the environment type using the ENVIRONMENT_TYPE variable. | ||
| if (!empty(getenv('ENVIRONMENT_TYPE'))) { | ||
| $settings['environment'] = getenv('ENVIRONMENT_TYPE'); | ||
| $environment_type = getenv('ENVIRONMENT_TYPE'); |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3122
Reads ENVIRONMENT_TYPE once into $environment_type instead of calling getenv() twice. Behaviour is unchanged; it's the same guard form now used across every settings include.
| @@ -0,0 +1,32 @@ | |||
| // audit-ci allowlist for the theme. | |||
There was a problem hiding this comment.
Project-only. The new theme audit step reads this allowlist when it exists, and the template ships one only for its demo theme. After npm audit fix, 2 advisory sources had no fix left:
bracesGHSA-vfj7-8cjw-p6xm has no patched release. Same reasoning as the root allowlist.locutusGHSA-fp25-p6mj-qqg6 and GHSA-vh9h-29pq-r5m8.drupal-twig-extensions(still a beta) pinslocutus^2.0.16, and every 2.x release is affected. The chain runs only whenvite-plugin-twig-drupalrenders the theme's own Twig for the Vite and Storybook build, and nothing from it ships with the site.
The 2 moderate locutus advisories sit below the --high threshold and are deliberately left out. Both entries expire on 2026-12-31.
| "@storybook/addon-docs": "10.2.13", | ||
| "@storybook/addon-links": "10.2.13", | ||
| "@storybook/html-vite": "10.2.13", | ||
| "@storybook/addon-docs": "10.6.3", |
There was a problem hiding this comment.
Project-only, forced by the new theme npm audit. Storybook 10.2.13 carries a critical advisory (GHSA-f2ph-cmg5-wxc8, missing origin validation in the preview), fixed in 10.6.3. The theme pins Storybook exactly, and the addons have to match the core version, so all 4 @storybook/* and storybook pins move together. The lock then went through npm audit fix for Vite, PostCSS, Twig, brace-expansion, immutable, nanoid and others. ahoy build compiles the theme with Vite and builds Storybook successfully on the new lock.
| container: | ||
| # https://hub.docker.com/r/drevops/ci-runner | ||
| image: drevops/ci-runner:26.8.0@sha256:80be478cfff66d81fa804ccc707dbeae478655d8b850f1ae06824c194bd6528e | ||
| image: drevops/ci-runner:26.10.0@sha256:36db4ee12da3372c86966fccd543e49c9470bca12e86eb5d4aad7904dd84a0dd |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3149, drevops/vortex#3188, drevops/vortex#3215, drevops/vortex#3227
This file is taken whole from the template. All of its hunks are upstream:
- The
buildjob ends withvortex-check-worktree-changes, which fails when the build leaves a modified or untracked file. It runs after the tests, so a dirty tree never hides their results.VORTEX_CI_WORKTREE_CHANGES_IGNORE_FAILURE=1reports without failing. - The DB cache key moves from
v26.8.0tov26.10.0, so the first build after merge fetches a fresh database instead of reusing the old dump. - The
databasejob gains the nightly database-in-image refresh. It does nothing here because the project doesn't setVORTEX_DB_IMAGE. - DCLint switches to
--volumes-from. It had been linting an empty directory. drevops/ci-runnermoves to26.10.0, plus SHA bumps forupload-artifact,download-artifactandcodecov-action.
|
|
||
| /** | ||
| * Test ClamAV configs in Daemon mode with defaults. | ||
| * Test ClamAV config. |
There was a problem hiding this comment.
Vortex 1.42.0: drevops/vortex#3122
Covers the exact-1 guard change in the settings includes. The ClamAV and Redis tests become data providers, with cases asserting that an unset, empty, 0 or true value no longer switches the service on. The Shield cases flip from shield_enable => FALSE to TRUE for DRUPAL_SHIELD_DISABLED set to false or true, which is the bug #3122 fixed. New cases cover 01 and a truthy DRUPAL_SHIELD_ALLOW_ACME_CHALLENGE and DRUPAL_REROUTE_EMAIL_DISABLED. The file was reconciled by a 3-way merge of the 1.41.1 and 1.42.0 renders (both without Fast 404) onto the project's version, so every project-specific case is still there. The unit suite runs 444 tests, up from 385.
AlexSkrypnyk
added
the
Needs review
Vortex 1.41.1 → 1.42.0 - Impact Summary
Covers releases: 1.42.0
Key highlights: The PHP images move to Lagoon
26.10.0, and thephpcontainer now turns off session upload progress through a new project-ownedcustom.ini. The security audit now covers npm as well as Composer and Gitleaks, with findings uploaded to GitHub code scanning. The CI build ends with a check that fails when the build leaves a dirty working tree.Overall impact: Nothing changes for visitors or editors; this is build, CI and settings plumbing. The one behaviour change worth knowing is that boolean settings flags such as
DRUPAL_SHIELD_DISABLEDnow switch on only with the exact value1, so any hosting variable set totrueoryesstops working..envalready uses1. The project was already on Behat 4 and behat-steps 4, so the template's Behat migration had nothing left to apply here.Vortex Update
Containers
Added
.docker/config/cli/custom.iniand.docker/config/php/custom.ini, copied into PHP'sconf.dso project PHP settings live in the repo; thephpone setssession.upload_progress.enabled = Off.Made
nginxdepend onphpindocker-compose.yml, so nginx no longer exits withhost not found in upstream "php"when both start at once.CI
Extended the Security audit to npm, auditing the root and theme lock files through
audit-ciat thehighthreshold, with assessed advisories allowlisted in the newpackage-audit.jsonc.Uploaded Composer, npm and Gitleaks findings to GitHub code scanning as SARIF, and attached every report to the run as a
security-findingsartifact.Cleared the advisories the new npm audit found in both lock files:
npm audit fixin the root and the theme, and the theme's Storybook pins raised to10.6.3for its critical advisory. The theme gets its ownpackage-audit.jsonc, which allowlists the unpatchedbracesadvisory and the build-timelocutus2.x advisories pinned bydrupal-twig-extensionsuntil 2026-12-31.Fixed Gitleaks and DCLint scanning an empty directory - both now mount the real checkout with
--volumes-from, so they can start reporting real findings.Added a clean-worktree gate at the end of the
buildjob; setVORTEX_CI_WORKTREE_CHANGES_IGNORE_FAILURE=1to report without failing.Added the nightly database-in-image refresh to the
databasejob; it does nothing here because the project doesn't setVORTEX_DB_IMAGE.Bumped the database cache key to
v26.10.0and thedrevops/ci-runnerimage to26.10.0, so the first build after merge fetches a fresh database.Moved pinned actions forward:
upload-artifact,download-artifact,codecov-action,release-drafter7.10.0,setup-node7.1.0, the Renovate action46.3.8and its config validator2.4.1.Dependency automation
Gave every Renovate group an explicit
automergeflag and a 14-dayminimumReleaseAge, except Drupal core, whose security releases still arrive on the next daily run.Grouped
docker-compose.ymlimage bumps with the other container images, and added a CI tools group that keeps thenpx audit-cipin current.Drupal settings
Switched boolean flags to exact
1checks forDRUPAL_CLAMAV_ENABLED,DRUPAL_REDIS_ENABLED,DRUPAL_REROUTE_EMAIL_DISABLED,DRUPAL_SHIELD_DISABLEDandDRUPAL_SHIELD_ALLOW_ACME_CHALLENGE- change anytrueoryesvalue in Lagoon to1.Dropped the
file_exists()guard fromsettings.clamav.php, so ClamAV config applies wheneverDRUPAL_CLAMAV_ENABLED=1.Read each environment variable once in
settings.lagoon.php,settings.shield.phpandsettings.php; environment detection behaves the same.Removed
settings.fast404.php, which guarded a path Composer never creates and so never ran.Code quality
Moved the root lint toolchain to ESLint 10 and Stylelint 17, replacing
eslint-plugin-importwitheslint-plugin-import-xand registeringeslint-plugin-no-jquerydirectly - run npm on the host with Node22.13.0or later.Raised
phpVersioninphpstan.neonto80427to match the new platform PHP.Added
.logs/to the Gitleaks allowlist, since the audit now writes its reports there.Testing
SwitchableSettingsTestwith data providers that assert empty,0andtruevalues no longer switch ClamAV, Redis, Shield or email rerouting.Dependency Updates
Composer
Updated
drevops/vortex-tooling1.4.0 → 1.5.1config.platform.php8.4.23 → 8.4.27Node
Updated
@eslint/js9.39.5 → 10.0.1eslint9.39.5 → 10.13.0eslint-plugin-no-jquery5.0.0 → 6.0.1eslint-plugin-prettier5.5.6 → 5.5.7eslint-plugin-yml1.19.1 → 3.9.0globals16.5.0 → 17.13.0prettier3.9.6 → 3.9.10stylelint16.26.1 → 17.16.0stylelint-config-standard38.0.0 → 40.0.0stylelint-order7.0.1 → 8.1.2Added
eslint-plugin-import-x4.17.1Removed
@eslint/compat2.1.0eslint-plugin-import2.32.0Node (theme)
Updated
storybook10.2.13 → 10.6.3@storybook/addon-docs10.2.13 → 10.6.3@storybook/addon-links10.2.13 → 10.6.3@storybook/html-vite10.2.13 → 10.6.3Transitive
npm audit fixupdates in the root and theme locks, includingfast-uri,js-yaml,vite,postcss,twig,brace-expansion,immutableandnanoidHow to test
Locally
ahoy buildCI
Hosting