Updated Vortex to 1.41.0.

[AlexSkrypnyk]

Checklist before requesting a review

• Subject includes ticket number as [#123] Verb in past tense. - no ticket; this is a template update
• Ticket number #123 added to description - no ticket; this is a template update
• Added context in Changed section
• Self-reviewed code and commented in commented complex areas.
• Added tests for fix/feature.
• Relevant tests run and passed locally.

Changed

Covers all upstream work between the 1.40.2 release and the 1.41.0 release preparation - roughly five weeks. The badge records 1.41.0.

Key highlights: Security scanning moves out of the main build into its own Security audit workflow, so a failing audit is distinguishable from a failing linter and can be re-run alone. All Lagoon container images move to 26.8.0, and the database container gains a 1GB InnoDB redo log so large production dumps stop aborting mid-import. .dockerignore and .gitignore both flip from allowlists to deny lists. The refactoring toolchain switches to a provider that binds its rule sets to the installed Drupal version rather than a hardcoded list, which immediately surfaced a deprecated entity API call in this codebase.

Overall impact: No runtime code paths change and Drupal core is untouched, so the site behaves identically. The visible day-to-day differences are in CI - a new required check appears on pull requests, and the build job reclaims runner disk space when opted in. There are no breaking changes for developers. One thing is left for a conscious decision later: the template now hard-gates homepage accessibility while this project still audits everything in advisory mode.

Vortex Update

CI

• Split Gitleaks and composer audit into a standalone Security audit workflow, so a failing security scan no longer looks like a failing linter and can be re-run on its own. This adds one new check to every pull request.

• composer audit now runs with --locked, resolving advisories against composer.lock rather than the installed tree, so the result no longer depends on whether dev dependencies are present.

• Added an opt-in "Free up disk space" step to the build and database jobs, gated on a CI_FREE_DISK_SPACE repository variable. It removes preinstalled runner toolchains this project never uses. It is off unless the variable is set.

• The database dump is now deleted from the runner once it has been copied into the container, so the job stops holding two copies of a 31MB file for its remaining lifetime.

• Pinned hadolint to v2.15.1 instead of tracking latest, and taught Renovate to read image tags out of docker run lines in workflows so those pins actually get updated.

• Bumped the CI database cache key to v26.8.0, which discards the existing cache once - the first build on this branch refetches the database rather than restoring it.

• Release drafter's default version bump moved to a version-resolver category. Left on the old top-level key it would have been ignored, and drafted releases would have resolved the wrong version.

• The Lagoon webhook endpoint is now read from vars rather than env. The step declared no env block, so the override silently resolved to an empty string and always fell back to the hardcoded default.

Docker and local environment

• All Lagoon images move to 26.8.0 across the CLI, PHP, Nginx, Solr, ClamAV and database containers, with ClamAV itself on 1.5.4.

• Raised the InnoDB redo log capacity to 1GB. The image default of 128MB is exhausted during a large dump import faster than the checkpointer reclaims it, aborting with ERROR 1114 ... table is full.

• Moved the database config to /etc/mysql/conf.d/, which is the directory the entrypoint actually rewrites - without the move the redo log setting above would have been ignored.

• .dockerignore is now a deny list, so everything not named is included rather than the reverse. This project's theme build outputs (dist, storybook-static, components_combined) were added to the exclusions, since the template only knows about build.

• Replaced file-global hadolint ignores with per-line ones that state why each rule is waived, so a new violation is no longer hidden by a blanket suppression at the top of the file.

• The theme still builds with npm here. The template switched to yarn; this project ships package-lock.json for the drevops subtheme, so npm was kept in both the Docker build and the CI lint step.

Provisioning

• Provisioning is now split into numbered scripts - demo modules, development modules, search indexing and an example - replacing the single example script.

• Added search indexing to provisioning, resetting the tracker and reindexing on local, CI, dev and stage. This project runs Solr but had no indexing step, so search content was only indexed by cron or by hand after a database restore. Set DRUPAL_SEARCH_INDEX_SKIP=1 to disable it per environment.

• Development modules now bail out early in production and install with pm:install rather than the deprecated pm:enable, tolerating modules absent from --no-dev builds.

• Testmode is installed during provisioning. The template did not install it, which would have broken every @testmode Behat scenario. Raised upstream and fixed in 1.41.0, so this file is at template parity rather than carrying a local addition.

• Module installs no longer discard their exit status. The three pm:install calls suppressed a non-zero Drush exit and then printed success, so a failed install left provisioning reporting success with the tool missing. All four modules are declared in require rather than require-dev, so they ship to every environment and the installs are expected to succeed wherever the script runs.

• Raised the Drush memory_limit to 1G, sized for the config sync and database imports this project runs on every deploy.

Testing

• Wired six more behat-steps traits into FeatureContext - Cache, Iframe, Json, Redirect, Rest and Xml - making their steps available immediately, since all of them already existed in the installed library.

• Removed two step definitions the library now provides. behat-steps 3.13.0 absorbed should be pinned to the top of the viewport and should stack above the element, and a duplicate step definition aborts the whole suite before any scenario runs. The library implementations are stronger: the stacking assertion walks the stacking-context chain rather than comparing raw z-index values that are only meaningful within one context, and the pinned assertion allows two pixels of rounding and rejects a zero-height element that would otherwise report as pinned at the origin.

• Added scenarios covering REST, XML and JSON assertions, viewport resizing and redirects, along with two response fixtures and a new redirect.feature.

• Kernel and functional tests now run in separate processes. Measured on one class this costs no time - 64.7s with isolation against 73.2s without.

• The project's own test coverage was preserved throughout. The re-render would have replaced the sitemap, search, accessibility, ClamAV and Behat feature files with template versions, dropping the blog and project sitemap scenarios, the CivicTheme media bundles and the 24-region region map.

Code quality tooling

• Rector now resolves its Drupal rule sets from the installed core version rather than hardcoded Drupal 9 and 10 lists, so the checks track core upgrades without editing configuration. This required a major bump of the rules provider.

• That change immediately found a deprecated API call - two reads of $entity->original in the feed presave hook now use EntityInterface::getOriginal().

• Raised Prettier's printWidth from 80 to 160 while pinning doc comments to 80, so code stays on one line and comments keep the narrow wrap. One JavaScript file was reformatted as a result.

• RemoveUnusedPublicMethodParameterRector is now scoped to src/Hook/* rather than skipped everywhere, which matches the hook classes in do_base, do_feed and do_content_api.

Settings and configuration

• Trusted host patterns are now built with preg_quote over each route individually, instead of a hand-rolled replacement that escaped only dots and folded every route into one alternation. Any other regex metacharacter in LAGOON_ROUTES or LOCALDEV_URL previously reached the pattern unescaped.

• Corrected @phpcs:ignore to phpcs:ignore in settings.php and the Redis settings. With the leading @ the suppressions were read as docblock tags and never applied.

• Added an ENVIRONMENT_TYPE pass-through through Docker Compose, the ahoy container filter and the settings test harness, so the auto-detected environment type can be overridden.

• Anchored the environment variable prefixes forwarded into the CLI container. The filter matched a prefix anywhere in a name, so a host variable such as MY_DRUPAL_SECRET or COMPANY_GITHUB_TOKEN was forwarded alongside the intended ones. Raised upstream and fixed in 1.41.0.

• Fixed getProtectedValue() reading the property from the reflection class rather than the object, which raised a TypeError for any non-static property. This repository already carried the fix; 1.41.0 adopts it, so the file returns to template parity.

• .gitignore is now a deny list. Verified against this project: no file becomes newly visible, and the files directory, simpletest and local settings overrides all remain ignored.

• Added .vortex-manifest.json, a checksum for every template-owned path. A later update reads it to tell whether a file has been modified since it was installed, which is what lets the installer prune paths the template no longer ships without destroying local changes.

Dependency Updates

Drupal core is unchanged at 11.4.5. Every changed package is a development dependency except drupal/stage_file_proxy, which is a development-environment module: it proxies files from production so they do not have to be copied down, and is inert in production.

Composer

Updated

• drevops/behat-steps 3.12.0 → 3.13.0

• drevops/vortex-tooling 1.3.0 → 1.4.0

• mglaman/phpstan-drupal 2.1.1 → 2.1.2

• drupal/stage_file_proxy 3.1.6 → 4.0.0 (major)

• palantirnet/drupal-rector 0.21.2 → 1.1.2 (major)

• rector/rector 2.6.1 → 2.6.2

Added

• softcreatr/jsonpath 0.10.0

Removed

• None

Node

No changes to package.json in either the repository root or the theme.

Not included

Three things were deliberately left out of this update:

• drupal/reroute_email was declined. It surfaced only because the installer was answered with every module option so that declined packages become visible; the settings file generated for it was removed.

• The accessibility gate was not tightened. The template now asserts the homepage passes accessibility checks as a hard gate and audits secondary pages in advisory mode; this project continues to audit everything in advisory mode.

Separately, composer audit reports SA-CONTRIB-2026-096 against drupal/diff. That advisory pre-dates this branch and is unrelated to the update.

Screenshots

N/A - this change touches CI configuration, Docker files, settings includes and tests. Nothing user-facing is rendered differently.

Before / After

Security scanning and the build shared one workflow, so an audit failure and a lint failure were indistinguishable and could not be re-run apart:

┌─────────────────────────────────────────────┐
│ build-test-deploy.yml                       │
│                                             │
│  lint ──┬─ phpcs / phpstan / rector         │
│         ├─ composer audit      ◄── security │
│         └─ gitleaks            ◄── security │
│                                             │
│  build ── provision ── test ── deploy       │
└─────────────────────────────────────────────┘

They now run in their own workflow, and provisioning is split into ordered, individually replaceable scripts:

┌─────────────────────────────────────┐   ┌──────────────────────────┐
│ build-test-deploy.yml               │   │ audit.yml                │
│                                     │   │                          │
│  lint ── phpcs / phpstan / rector   │   │  composer audit --locked │
│                                     │   │  gitleaks                │
│  build ── provision ── test         │   └──────────────────────────┘
│             │                       │
│             ├─ 10 dev modules       │
│             ├─ 20 generated content │
│             └─ 30 search index  ◄── new
│                                     │
│  deploy                             │
└─────────────────────────────────────┘

[AlexSkrypnyk]

Template scaffold example test: method and data-provider renames, the unit:subtraction group prefix collapsed to subtraction, and the placeholder comments reworded. No RunTestsInSeparateProcesses here - the rector rule targets kernel and functional tests, not unit tests.

[AlexSkrypnyk]

#[RunTestsInSeparateProcesses] added for the rector rule. Attribute only; the moderation-policy assertions are unchanged.

This is the class used to measure the cost of the isolation change - 64.7s with the attribute against 73.2s without, over the same 8 tests - which is what established that the rule is not slowing the suite down.

[AlexSkrypnyk]

The only production code change in this PR outside settings files.

Two reads of $entity->original become $entity->getOriginal(). The property is deprecated in favour of the accessor, which returns ?static and is present in the installed core 11.4.5, so the two are equivalent here.

Flagged by rector's ReplaceEntityOriginalPropertyRector, which reached this project through the set-provider migration in rector.php: the deprecation sets are now bound to the installed core version rather than the hardcoded Drupal 9 and 10 lists, so rules newer than those lists now apply. This is the concrete payoff of that change rather than a coincidence.

[AlexSkrypnyk]

#[RunTestsInSeparateProcesses] added for the rector rule. Attribute only; the form assertions are unchanged.

[AlexSkrypnyk]

#[RunTestsInSeparateProcesses] added for the rector rule. Attribute only.

[AlexSkrypnyk]

#[RunTestsInSeparateProcesses] added for the rector rule. Attribute only - notably the assertions did not need changing despite the hook under test moving from $entity->original to $entity->getOriginal(), since the test drives the hook through entity saves rather than stubbing the property.

[AlexSkrypnyk]

Drops a comment that restated the line below it. No behaviour change - mail is still suspended in CI.

[AlexSkrypnyk]

Mostly a comment rewrite, but two real fixes are in here.

@phpcs:disable becomes phpcs:disable. With the leading @ those annotations were parsed as docblock tags rather than sniff directives, so the three suppressions at the top of this file were never actually applied - the sniffs were live the whole time.

The container class string loses its leading backslash: '\Drupal\redis\Cache\PhpRedis' becomes 'Drupal\redis\Cache\PhpRedis'. It is a plain string consumed by the container builder, not a resolved class name, and the leading separator is not part of the class name.

Redis is live here - DRUPAL_REDIS_ENABLED gates it and the service is in the compose stack - so this file is executed rather than dormant.

[AlexSkrypnyk]

Comment rewrite and a reordering of the environment check to read local-then-CI, matching the other settings includes. Behaviour is identical: CSP stays disabled locally and in CI, where the site is not served over HTTPS.

[AlexSkrypnyk]

Comment rewrite and the same local-then-CI reordering as the other settings includes. No behaviour change: Shield stays enforced on every non-production environment and bypassed locally and in CI.

The retained comment is the load-bearing part - unlike the other settings files, enablement here deliberately does not follow the presence of environment variables, because Shield must stay on even when the credential variables are missing. Inverting that would silently unprotect an environment.

[AlexSkrypnyk]

Drops a comment that restated the line below it. No behaviour change.

[AlexSkrypnyk]

A real fix rather than a tidy-up. The trusted host pattern was built by a hand-rolled str_replace that escaped only dots and folded a comma-separated list into a single anchored alternation. Any other regex metacharacter in LOCALDEV_URL reached the pattern unescaped, and the alternation inside one ^...$ did not mean what it looked like.

Now each URL is split out, lowercased and escaped with preg_quote, producing one anchored pattern per host. The local variables are also prefixed so they cannot collide with the including scope - this file is included into settings.php, so a bare $patterns was shared state.

Covered by a new test in EnvironmentSettingsTest added in this PR, which passes two URLs with surrounding whitespace and a trailing empty entry and asserts both generated patterns.

[AlexSkrypnyk]

The same trusted-host fix as the container settings, applied to LAGOON_ROUTES: each route is split out and escaped with preg_quote rather than folded into one alternation that escaped only dots.

This is the one that was actually in use. This project serves several routes per environment - drevops.com and www.drevops.com on production, dev.drevops.com on develop - so the old single-alternation pattern was the code path running on every Lagoon environment, not a theoretical case.

The rest is comment removal where the comment restated its line.

[AlexSkrypnyk]

@phpcs:ignore corrected to phpcs:ignore. As with the Redis settings, the leading @ made PHPCS read it as a docblock tag rather than a sniff directive, so the unused-variable suppression on the $contrib_path assignment was never applied - the sniff was live and simply had nothing to report yet.

The other change is a comment rewording on the environment-type override. This project's own settings additions in this file are unchanged.

[github-actions]

Code coverage (threshold: 80%)

  Classes: 51.85% (14/27)
  Methods: 77.17% (71/92)
  Lines:   89.03% (747/839)

Per-class coverage

Drupal\do_ai_alt_text\AltTextGenerator
  Methods:  85.71% ( 6/ 7)   Lines:  98.72% ( 77/ 78)
Drupal\do_ai_alt_text\Plugin\Action\RegenerateImageAltText
  Methods: 100.00% ( 8/ 8)   Lines: 100.00% ( 63/ 63)
Drupal\do_base\EventSubscriber\PreviewLinkCacheSubscriber
  Methods:  33.33% ( 1/ 3)   Lines:  11.11% (  1/  9)
Drupal\do_base\EventSubscriber\ThemeColorSubscriber
  Methods:  66.67% ( 2/ 3)   Lines:  40.00% (  4/ 10)
Drupal\do_base\Hook\AutomatedListPagerHook
  Methods: 100.00% ( 5/ 5)   Lines: 100.00% ( 31/ 31)
Drupal\do_base\Hook\LibraryInfoAlterHook
  Methods: 100.00% ( 3/ 3)   Lines: 100.00% (  9/  9)
Drupal\do_base\Hook\MetatagsAlterHook
  Methods: 100.00% ( 7/ 7)   Lines: 100.00% ( 58/ 58)
Drupal\do_base\Hook\PageAttachmentsHook
  Methods:  87.50% ( 7/ 8)   Lines:  94.92% ( 56/ 59)
Drupal\do_base\NavigationScriptHash
  Methods: 100.00% ( 3/ 3)   Lines: 100.00% ( 27/ 27)
Drupal\do_base\Twig\ImageDimensionsExtension
  Methods:  40.00% ( 2/ 5)   Lines:  81.48% ( 44/ 54)
Drupal\do_content_api\EventSubscriber\JsonApiWriteGateSubscriber
  Methods:  66.67% ( 2/ 3)   Lines:  88.89% (  8/  9)
Drupal\do_content_api\Hook\EntityCreateAccessHook
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 12/ 12)
Drupal\do_content_api\Hook\ModerationPolicyHook
  Methods:  50.00% ( 1/ 2)   Lines:  93.75% ( 15/ 16)
Drupal\do_content_api\Routing\RouteSubscriber
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  6/  6)
Drupal\do_feed\FeedUrlBuilder
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 18/ 18)
Drupal\do_feed\Form\FeedSettingsForm
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 15/ 15)
Drupal\do_feed\Hook\EntityDeleteHook
  Methods:  50.00% ( 1/ 2)   Lines:  92.31% ( 12/ 13)
Drupal\do_feed\Hook\EntityPresaveHook
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 54/ 54)
Drupal\do_feed\Hook\PreprocessParagraphHook
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 14/ 14)
Drupal\do_feed\Hook\PreprocessViewsViewRowRssHook
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  3/  3)
Drupal\do_feed\Hook\ViewsPreViewHook
  Methods:  50.00% ( 1/ 2)   Lines:  96.43% ( 27/ 28)
Drupal\do_generated_content\Generator\CaseMatrix
  Methods: 100.00% ( 3/ 3)   Lines: 100.00% ( 12/ 12)
Drupal\do_generated_content\Generator\RelativeDate
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  1/  1)