Updated Vortex to 1.41.0.

.ahoy.yml

@@ -87,9 +87,9 @@ commands:
     aliases: [ssh, shell]
     cmd: |
       if [ "${#}" -ne 0 ]; then
-        docker compose exec $(env | cut -f1 -d= | grep "TERM\|COMPOSE_\|GITHUB_\|PACKAGE_\|DOCKER_\|DRUPAL_\|VORTEX_\|LOCALDEV_URL$" | sed 's/^/-e /') cli bash -c "$*"
+        docker compose exec $(env | cut -f1 -d= | grep "TERM\|COMPOSE_\|GITHUB_\|PACKAGE_\|DOCKER_\|DRUPAL_\|VORTEX_\|ENVIRONMENT_\|LOCALDEV_URL$" | sed 's/^/-e /') cli bash -c "$*"
       else
-        docker compose exec $(env | cut -f1 -d= | grep "TERM\|COMPOSE_\|GITHUB_\|PACKAGE_\|DOCKER_\|DRUPAL_\|VORTEX_\|LOCALDEV_URL$" | sed 's/^/-e /') cli bash
+        docker compose exec $(env | cut -f1 -d= | grep "TERM\|COMPOSE_\|GITHUB_\|PACKAGE_\|DOCKER_\|DRUPAL_\|VORTEX_\|ENVIRONMENT_\|LOCALDEV_URL$" | sed 's/^/-e /') cli bash
       fi
 
   composer:

.docker/clamav.dockerfile

@@ -5,18 +5,17 @@
 # Allow running ClamAV in rootless mode.
 # @see https://github.com/Cisco-Talos/clamav/issues/478
 #
-# hadolint global ignore=DL3008,DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/commons/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/commons
 
-FROM uselagoon/commons:26.6.0 AS commons
+FROM uselagoon/commons:26.8.0 AS commons
 
-FROM clamav/clamav-debian:1.5.3
+FROM clamav/clamav-debian:1.5.4
 
 COPY --from=commons /lagoon /lagoon
 COPY --from=commons /bin/fix-permissions /bin/ep /bin/docker-sleep /bin/wait-for /bin/
 
+# hadolint ignore=DL3008 # the package set tracks the pinned base image
 RUN apt-get update -qq && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
@@ -30,10 +29,12 @@ RUN cat /tmp/clamav.conf >> /etc/clamav/clamd.conf && \
     sed -i "s/^UpdateLogFile /# UpdateLogFile /g" /etc/clamav/freshclam.conf && \
     sed -i "s/^#LogSyslog /LogSyslog /g" /etc/clamav/freshclam.conf
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 
 RUN fix-permissions /var/lib/clamav
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER clamav
 
 ENTRYPOINT [ "/init-unprivileged" ]

.docker/cli.dockerfile

@@ -1,13 +1,14 @@
+# check=skip=SecretsUsedInArgOrEnv
 # CLI container.
 #
 # All CLI operations performed in this container.
 #
-# hadolint global ignore=DL3018,SC2174
+# The check skipped above is BuildKit's twin of DL3064, ignored inline below.
 #
 # @see https://hub.docker.com/r/uselagoon/php-8.4-cli-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-cli-drupal
 
-FROM uselagoon/php-8.4-cli-drupal:26.6.0
+FROM uselagoon/php-8.4-cli-drupal:26.8.0
 
 # Add missing variables.
 # @todo Remove once https://github.com/uselagoon/lagoon/issues/3121 is resolved.
@@ -21,12 +22,15 @@ ENV WEBROOT=${WEBROOT}
 
 # Token is used to access private repositories. Not exposed as an environment
 # variable within an image to avoid baking it into the image.
+# hadolint ignore=DL3064 # empty here, the value comes from a build secret
 ARG PACKAGE_TOKEN=""
 
 ARG DRUPAL_PUBLIC_FILES="sites/default/files"
 ENV DRUPAL_PUBLIC_FILES=${DRUPAL_PUBLIC_FILES}
 
+# hadolint ignore=DL3064 # a path, not a secret
 ARG DRUPAL_PRIVATE_FILES="sites/default/files/private"
+# hadolint ignore=DL3064 # a path, not a secret
 ENV DRUPAL_PRIVATE_FILES=${DRUPAL_PRIVATE_FILES}
 
 ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
@@ -42,8 +46,10 @@ ENV COMPOSER_ALLOW_SUPERUSER=1 \
     COMPOSER_CACHE_DIR=/tmp/.composer/cache
 
 # Allow custom PHP runtime configuration for Drush CLI commands.
-# The leading colon appends to the default scan directories.
-# @see https://github.com/drevops/vortex/issues/1913
+# The argument is declared so the reference resolves cleanly; when the base
+# image does not set it, the value stays empty and the leading colon appends
+# to the default scan directories.
+ARG PHP_INI_SCAN_DIR=""
 ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 
 # Starting from this line, Docker adds the result of each command as a
@@ -53,6 +59,7 @@ ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 # earlier in the build process (near the top of this file).
 
 # Add more tools.
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache ncurses pv tzdata autoconf g++ make && \
     pecl install pcov && \
     docker-php-ext-enable pcov && \
@@ -74,7 +81,6 @@ COPY composer.json composer.* patches.lock.* .env* auth* /app/
 
 # Install PHP dependencies without development packages to avoid exposing
 # potential security vulnerabilities in the production environment.
-# hadolint ignore=SC2155
 RUN --mount=type=secret,id=package_token \
     token=$(if [ -s /run/secrets/package_token ]; then cat /run/secrets/package_token; else echo "${PACKAGE_TOKEN}"; fi) && \
     if [ -n "${token}" ]; then export COMPOSER_AUTH="{\"github-oauth\": {\"github.com\": \"${token}\"}}"; fi && \
@@ -85,6 +91,7 @@ RUN --mount=type=secret,id=package_token \
 COPY . /app
 
 # Create file directories and set correct permissions.
+# hadolint ignore=SC2174 # only the leaf directory needs the mode
 RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 
 RUN if [ "${VORTEX_FRONTEND_BUILD_SKIP}" != "1" ]; then \

.docker/config/database/my.cnf

@@ -1 +1,9 @@
-# Custom configuration for database clients.
+# Custom configuration for the database service.
+
+[mysqld]
+# The image default of 128MB is exhausted during a large dump import faster
+# than the log checkpointer reclaims it, aborting the import with
+# "ERROR 1114 ... table is full".
+# MariaDB images abort at startup on this MySQL-only variable, so the
+# "loose-" prefix downgrades that to a warning.
+loose-innodb_redo_log_capacity = 1073741824

.docker/database.dockerfile

@@ -5,16 +5,19 @@
 #
 # The ARG value will be updated with a value passed from docker-compose.yml
 
-ARG IMAGE=uselagoon/mysql-8.4:26.6.0
-# hadolint ignore=DL3006
+ARG IMAGE=uselagoon/mysql-8.4:26.8.0
 FROM ${IMAGE}
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
-COPY ./.docker/config/database/my.cnf /etc/my.cnf.d/server.cnf
-RUN fix-permissions /etc/my.cnf.d/
+COPY ./.docker/config/database/my.cnf /etc/mysql/conf.d/server.cnf
+# The entrypoint rewrites files in this directory before starting the server.
+RUN fix-permissions /etc/mysql/conf.d/
 
+# hadolint ignore=DL3064 # local development credentials only
 ENV MYSQL_DATABASE=drupal \
     MYSQL_USER=drupal \
     MYSQL_PASSWORD=drupal
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER mysql

.docker/nginx-drupal.dockerfile

@@ -2,21 +2,19 @@
 #
 # All web requests are sent to this container.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/nginx-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/nginx-drupal
 
 ARG CLI_IMAGE
-# hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} AS cli
 
-FROM uselagoon/nginx-drupal:26.6.0
+FROM uselagoon/nginx-drupal:26.8.0
 
 # Webroot is used for Nginx web root configuration.
 ARG WEBROOT=web
 ENV WEBROOT=${WEBROOT}
 
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
 COPY ./.docker/config/nginx/redirects-map.conf /etc/nginx/redirects-map.conf

.docker/php.dockerfile

@@ -3,17 +3,15 @@
 # All web requests are sent from Nginx to this container.
 # This container would be scaled up/down in production.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/php-8.4-fpm/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-fpm
 
 ARG CLI_IMAGE
-# hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} AS cli
 
-FROM uselagoon/php-8.4-fpm:26.6.0
+FROM uselagoon/php-8.4-fpm:26.8.0
 
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
 COPY --from=cli /app /app

.docker/solr.dockerfile

@@ -1,11 +1,9 @@
 # Solr container.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/solr-9-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/blob/main/images/solr-drupal/9.Dockerfile
 
-FROM uselagoon/solr-9-drupal:26.6.0
+FROM uselagoon/solr-9-drupal:26.8.0
 
 # Solr jump-start config needs to be manually copied from the search_api_solr
 # Drupal module to .docker/config/solr/config-set.
@@ -16,13 +14,15 @@ FROM uselagoon/solr-9-drupal:26.6.0
 # whenever this image tag is bumped.
 COPY .docker/config/solr/config-set /solr-conf/conf/
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 
 # Apply custom modifications for Lagoon environment compatibility.
 RUN sed -i -e "s#<dataDir>\${solr.data.dir:}#<dataDir>/var/solr/\${solr.core.name}#g" /solr-conf/conf/solrconfig.xml && \
     sed -i -e "s#solr.lock.type:native#solr.lock.type:none#g" /solr-conf/conf/solrconfig.xml && \
     sed -i -e "s#solr.autoSoftCommit.MaxTime=5000#solr.autoSoftCommit.MaxTime=-1#g" /solr-conf/conf/solrcore.properties
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER solr
 
 # solr-precreate is provided by the base Solr container image.

.dockerignore

@@ -1,59 +1,70 @@
-# Ignore everything but a whitelist of files.
+# Deny list of paths excluded from the container image build context.
+# Everything not listed here is included into the image.
 #
-# It is very important to only add production assets to the container during
-# the build. Adding anything else, like tests files or packages, has potential
-# security implications.
+# Never let VCS internals, secrets, local overrides, database dumps or
+# host-installed dependencies enter the image: they leak data, bloat the
+# context and override the in-image build results.
 
-# Ignore everything.
-*
+# VCS, IDE and OS files.
+.git
+.idea
+.vscode
+**/.DS_Store
 
-# Do not ignore web.
-!web
-
-# Do not ignore config.
-!config
-
-# Do not ignore recipes.
-!recipes
-
-# But still ignore Drupal directories generated by Composer.
+# Drupal directories generated by Composer during the image build.
 web/core
+web/libraries
 web/modules/contrib
-web/themes/contrib
 web/profiles/contrib
-web/libraries
-!drush
-drush/contrib/
-
-# Do not ignore other required files.
-!.circleci
-!.docker/config
-!.docker/scripts
-!.env
-!.eslintignore
-!.eslintrc.json
-!.prettierignore
-!.prettierrc.json
-!.sass-lint.yml
-!.stylelintrc.js
-!.twig-cs-fixer.php
-!auth.json
-!behat.yml
-!composer.json
-!composer.lock
-!gherkinlint.json
-!jest.config.js
-!package-lock.json
-!package.json
-!patches
-!patches.lock.json
-!phpcs.xml
-!phpstan.neon
-!phpunit.xml
-!postcss.config.js
-!rector.php
-!scripts
-!tests
-!yarn.lock
-
-!.lagoon.env.*
+web/themes/contrib
+drush/Commands/contrib
+
+# Local settings overrides.
+web/sites/*/settings.local.php
+web/sites/*/services.local.yml
+
+# Content files and test artifacts.
+web/sites/*/files
+web/sites/simpletest
+
+# Dependencies are installed during the image build.
+vendor
+node_modules
+web/themes/**/node_modules
+
+# Theme build assets are compiled during the image build.
+web/themes/**/build
+web/themes/**/components_combined
+web/themes/**/dist
+web/themes/**/storybook-static
+
+# Caches, data, logs and temporary artifacts.
+**/.artifacts
+**/.data
+**/.logs
+**/.phpunit.cache
+**/.twig-cs-fixer.cache
+
+# Database cache key files written into the workspace by the CI workflow.
+db_cache_*
+
+# Database dumps left in the project root. Anchored so that they do not match
+# 'scripts/sanitize.sql', which the sanitisation step reads at runtime.
+/*.dump
+/*.mysql
+/*.sql
+/*.sql.gz
+
+# Key material. Nothing tracked matches these; they exist so that a key copied
+# into the working tree does not reach the image. 'auth.json' is deliberately
+# absent - the CLI image copies it for Composer authentication.
+*.key
+*.p12
+*.pem
+*.pfx
+id_rsa*
+
+# Local override files.
+docker-compose.override.yml
+.env.local
+.ahoy.local.yml

.editorconfig

@@ -13,6 +13,10 @@ charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
 
+# Matches the Prettier 'printWidth' in .prettierrc.json.
+[*.js]
+max_line_length = 160
+
 [*.{json,lock}]
 indent_size = 4
 

.env

@@ -93,7 +93,7 @@ DRUPAL_CLAMAV_MODE=daemon
 #                                 PROVISION                                    #
 ################################################################################
 
-# By "provision", we mean the process of initialising the database (from dump
+# By "provision", we mean the process of initializing the database (from dump
 # or fresh install from profile), running updates, appying configuration
 # changes, clearing caches and performing other tasks that prepare the site for
 # use.

.github/release-drafter.yml

@@ -2,8 +2,9 @@ name-template: '$RESOLVED_VERSION'
 tag-template: '$RESOLVED_VERSION'
 change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
 change-title-escapes: '\<*_&' # You can add # and @ to disable mentions, and add ` to disable code blocks.
-version-resolver:
-  default: minor
+categories:
+  - type: 'version-resolver'
+    semver-increment: 'minor'
 template: |
   ## What's new since $PREVIOUS_TAG
 

.github/workflows/assign-author.yml

@@ -15,4 +15,4 @@ jobs:
 
     steps:
       - name: Assign author
-        uses: toshimaru/auto-author-assign@3e19bfc990cb1cf0589dce95e9f75289bb1e22de # v3.0.3
+        uses: toshimaru/auto-author-assign@a78a94b219445cece8ccf0d45fec60af449f212a # v3.1.0