Forward-ported the deferred decisions and refreshed dependencies on '2.x'. by AlexSkrypnyk · Pull Request #3235 · drevops/vortex

AlexSkrypnyk · 2026-10-26T03:11:42Z

Scope

Second half of the main -> 2.x forward-port, split out of #3233 so each PR stays rebase-mergeable. It settles the 9 product decisions the first half raised, ports the main commits behind them, and refreshes the dependencies. 51 commits.

Stacked on #3233. The base is feature/propagate-main-20261025 so this diff shows only the second half. Once #3233 is merged into 2.x, this PR is retargeted to 2.x and rebased onto it.

The decisions

Decision	What landed	From main
Security audit: full chain incl. SARIF	npm audit through `audit-ci` with `package-audit.jsonc`, SARIF upload to code scanning, converter rewritten in PHP with tests, `drevops/phpcs-standard` 1.1.0, high-severity npm advisories cleared	#3151, #3155, #3175, #3226, lock part of #3168
Renovate: follow main	Per-group auto-merge flags, CLI prompt to pick auto-merged groups, 14-day minimum release age except core, weekly CircleCI Renovate image group	#3192, #3194, #3197
Database CI: keep 2.x design	Export-step hardening only; no nightly job, no GHA DIDI workflow	part of #3188
Storybook in 2.0	CLI prompt, PHP `vortex-storybook`, `BuildStorybookDeployStep` in `ys_base`, settings, webserver config, theme files, Ahoy subtest	#3158
Behat 4 now	`behat.php`, behat-steps 4.x, Behat 4.0, `friends-of-behat/mink-extension` 3.0 alpha, behat-screenshot 3.0, every feature file reworded	#3159, #3202
All docs passes	Vale with the `Vortex` house style, MD013 at 76 characters, AI-pattern removal, a fresh documentation-voice rewrite of all 83 pages and the Markdown files with every claim checked against 2.x, features-page conventions	#3156, #3198, #3203, #3205, #3229
CLI update model	Previous version rendered at run time, unmodified obsolete files removed, replaced project changes logged to `.logs/vortex-update.md`	#2999, #3096
Maintenance page	`VORTEX_WEBSERVER_MAINTENANCE_MODE` (renamed to match 2.x service names)	#3225
`.env` precedence	Exported variables win over `.env`, `.env.local` still overrides `.env`, as main's Bash did	(2.x fix)

Dependencies

Template JS: ESLint 10 with eslint-plugin-import-x ([#3218] Updated 'eslint' and '@eslint/js' to 10. #3219), the JS majors from Updated all packages to their latest versions and all container images to their latest tags. #3227 (Stylelint 17, eslint-plugin-yml 3, globals 17, postcss-cli 12, node >= 22.13, no more @eslint/compat), and the root overrides (Update JavaScript - All packages - Minor and patch #3232). The root and theme package.json and ESLint configs now match main, every direct dependency is at its latest version, and the npm audit reports 0 vulnerabilities.
.vortex/ subsystems: fresh refreshes of .vortex/cli, .vortex/tests, .vortex/tooling and .vortex/docs (Refreshed '.vortex/' dev dependencies, upgraded 'alexskrypnyk/*' to 1.x and raised the installer to PHP 8.3. #3090, Refreshed '.vortex/' dev dependencies for September 2026 and cleared high-severity npm advisories in the root and theme lock files. #3168, Refreshed '.vortex/' dev dependencies for October 2026. #3199, Refreshed '.vortex/' dev dependencies for October 2026. #3206, the .vortex part of Updated all packages to their latest versions and all container images to their latest tags. #3227). alexskrypnyk/* moves to 1.x with main's API renames, the CLI moves to PHPUnit 12 and the php83 Rector sets, the docs move to Jest 30 and markdownlint-cli2 0.24 (MD060: false).
The update-vortex-dev-deps skill is fixed for the 2.x layout (it staged files that don't exist on 2.x) and picks up main's skill fixes.

Fixes found along the way

Deploy steps compared the environment with 1.x names. 'prod'/'dev' never match the detector's production/development, so the development modules step ran in production and the search index never rebuilt in development. They now use the Environment constants (the docs example too).
reroute_email is installed in the batched development module list again; a separate install call added a container rebuild that tipped the Drupal CMS build over the idle timeout.

Not in this PR

A convergence pass over .vortex/cli and tooling ([#3115] Settled the installer's file checks, badge detection, width measurement and test scaffolding. #3126 and earlier sweeps).
Demo videos: cli-install, test-bdd and provision are stale and need re-recording.

Worth a look

Behaviour changes for consumers:
- Exported variables beat .env.
- Renovate auto-merges every group by default, after 14 days.
- New optional prompts for Storybook and auto-merge.
Alpha and RC dependencies: Behat runs on behat-steps 4.x RC and the mink-extension 3.0 alpha, the same as main.

Snapshots and gates

ahoy update-snapshots ran after each group; the final run covered 155 scenarios with 0 failures.
On the combined branch before the split, all checks passed:
- Every CI check, including Vortex - Test docs and the full template-test matrix.
- Locally: ahoy lint, .vortex/cli (1742 tests), .vortex/tooling (936 tests), and the docs tests and build.

…, as the Bash scripts did. The PHP port of the tooling let '.env' and '.env.local' replace variables already exported in the process environment, reversing the precedence of the Bash scripts.

Forward-ported the export-step hardening from main cf188dd. 2.x keeps database caching in the 'test' job, so the scheduled database job and the GitHub Actions DIDI workflow are not ported.

…R_MAINTENANCE_MODE'. Forward-ported from main d51c741, with the variable named 'VORTEX_WEBSERVER_MAINTENANCE_MODE' to match the 2.x vendor-agnostic service names.

Forward-ported from main c45688a. The CircleCI audit job switches to the 'cimg/php:8.4-node' image because the plain PHP image has no Node.js, GitHub Actions uses the Node.js preinstalled on 'ubuntu-latest', and the existing theme '.npmrc' keeps its 'unsafe-perm' line.

…ARIF. Forward-ported from main 3bdd10d. The Bash and jq converter is rewritten as the PHP tooling script 'vortex-convert-audit-sarif' with its BATS suite ported to PHPUnit, the Gitleaks step keeps the 2.x bind mount because GitHub Actions runs on the host, the upload pins use the latest 'upload-sarif' and 'upload-artifact' SHAs, the tooling variables are referenced without the generated variables table that only lists Bash scripts, and the 'drupal/generated_content' constraint is already ahead of main.

…ed 'drevops/phpcs-standard' to 1.1.0. Forward-ported from main 316e735. The allowlist files are created under their final 'package-audit.jsonc' name with the current expiry, and the 'drevops/phpcs-standard' 1.1.0 snake_case sniff required renaming camelCase parameters and their data provider keys in the CLI code that main had already converted.

…g check. Forward-ported from main 364bdd1. The allowlist filtering is ported into the PHP converter with PHPUnit cases mirroring the BATS ones, and the 'package-audit.jsonc' rename is already in place from the previous port.

Forward-ported the lock-file part of main f576e44 so the npm audit passes on 2.x. Ran 'npm audit fix --package-lock-only' in both trees and re-resolved the root 'brace-expansion' 1.x entry, which 'npm audit fix' left at 1.1.12.

… choose the auto-merged groups. Forward-ported from main 13f761c. Rebuilt the 'DependencyUpdatesAutomerge' handler for the 2.x CLI, gated in 'VortexForm' on a Renovate provider with a processing weight just before the provider, as the install summary is generated from the answers.

…e groups except Drupal core. Forward-ported from main 57950a0. Skipped the CircleCI Renovate image bump because 2.x already pins a newer image, and added the architecture bullet to both copies of its section on the 2.x page.

…sted Renovate image up to date. Forward-ported from main a3b1b16. Applied as on main, with 'LINKED_GROUPS' added to the 2.x CLI handler and the docs reworded for the 2.x page.

@smoke

…to 'behat.php' and dropped 'drupal/drupal-extension'. Forward-ported from main 71ac877. Kept the 2.x 'webserver' and 'browser' service hosts in 'behat.php', the '@a11y' and '@smoke' feature tags, and applied the step rewrites to 2.x's equivalent docs pages and 'SubtestDeploymentTrait'.

…n' 3.0 alpha and 'drevops/behat-screenshot' 3.0. Forward-ported from main ec77acf. Applied unchanged apart from mapping the installer handler and test paths to '.vortex/cli'.

The baseline 'behat.yml' was replaced by 'behat.php', so these patches no longer apply and block snapshot regeneration.

…rding. Follow-up to the forward-port of main 71ac877.

…atch. Follow-up to the forward-port of main 909660b; a separate install call adds a container rebuild to the deploy step.

…eme. Forward-ported from main e9f53d4, with the Storybook package bumps to 10.6.3 from main 209e0e7551 and the theme README rewrap from main 52d6998 folded in. Rebuilt for 2.x: the 'Storybook' CLI handler is wired in 'VortexForm' after the front-end build question, 'vortex-storybook' is a PHP tooling script with PHPUnit tests, provisioning is a 'BuildStorybookDeployStep' deploy step in 'ys_base' plus a batched module install and local Twig development mode in the development setup step, settings use the environment detector constants, and the Lagoon volume labels target the 'cli' and 'webserver' services.

Follow-up to the forward-port of main e9f53d4; the 2.x processor skips handlers whose 'shouldRun()' is FALSE, so the 'Storybook' handler relies on the form condition to hide the prompt and always processes.

…'dev' names. The environment detector sets 'production' and 'development', so the development modules step ran in production, the content model and migration production checks never matched, and the search index rebuild skipped development environments. The steps now compare against the 'Environment' constants.

…gth rule.

….json'. Forward-ported from main 4c56bc4. Applied as is; the lock file already resolved the raised minimums, so it needed no change.

…sions. Refreshed the root and theme 'package-lock.json' files with 'npm update --package-lock-only' after the manifest changes forward-ported from main.

Forward-ported from main 4817058. Ported main's PR body artifact, matrix check, 'lint-prose' step, '/open-pr body=' with '--skip-verify' and red-flag line, and dropped the staging of '.vortex/cli/patches.lock.json' and the git-ignored box 'composer.json', which do not exist as tracked files on 2.x.

…x and 'phpunit/phpunit' to 12. Forward-ported from main a6bdaf7, f576e44, a4a1a5c, 4817058 and the '.vortex/installer' part of 209e0e7. Applied to '.vortex/cli' (main's installer) with the same majors main took ('alexskrypnyk/file' 1.x, 'alexskrypnyk/phpunit-helpers' 1.x, 'phpunit/phpunit' 12, 'sebastian/diff' 7, 'guzzlehttp/guzzle' 8), the 'assertSnapshotMatchesBaseline()' argument order, the 'php83' Rector set and its lint-fix fallout.

…1.x and 'markdownlint-cli2' to 0.24. Forward-ported from main a6bdaf7, f576e44, a4a1a5c, 4817058 and the '.vortex/tests' part of 209e0e7. Applied the 'phpunit-helpers' 1.x renames ('logSetVerbose()', 'processStreamingOutput', 'logStepMethodPrefix') and disabled 'MD060' as main did for 'markdownlint' 0.42.

…nd 'drevops/phpcs-standard' 1.x. Forward-ported from main a6bdaf7, a4a1a5c and 4817058. The 2.x tooling is a PHP package with its own PHPUnit suite, so it takes the same dev constraints main uses in '.vortex/installer' and '.vortex/tests'; its 'composer.lock' stays local and the runtime 'php' constraint is unchanged.

…g Library, 'cspell', 'globals', 'markdownlint-cli2', 'sharp-cli' and the local search plugin. Forward-ported from main a6bdaf7, f576e44, a4a1a5c, 4817058 and the '.vortex/docs' part of 209e0e7. Took the same majors as main, ported the 'VerticalTabs' test to set the URL through the History API because jsdom 26 does not allow 'window.location' to be redefined, and disabled 'MD060'.

coderabbitai · 2026-10-26T03:11:51Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 1

2.x

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Repository UI
Review profile: ASSERTIVE
Plan: Team
Run ID: 94ac65be-7ca9-45e1-a51a-6f33085bcf8b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-26T03:31:36Z

📖 Documentation preview for this pull request has been deployed to Netlify:

https://6adece1c72a84bc778386392--vortex-docs.netlify.app

This preview is rebuilt on every commit and is not the production documentation site.

github-actions · 2026-10-26T03:34:28Z

Code coverage (threshold: 90%)

  Classes: 100.00% (1/1)
  Methods: 100.00% (2/2)
  Lines:   100.00% (174/174)

Per-class coverage

Drupal\ys_demo\Plugin\Block\CounterBlock
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 10/ 10)

codecov · 2026-10-26T03:39:55Z

Codecov Report

❌ Patch coverage is 96.88716% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.33%. Comparing base (eedbde1) to head (4d9ef12).

Files with missing lines	Patch %	Lines
.vortex/cli/src/Command/AbstractInstallCommand.php	90.47%	2 Missing ⚠️
...rc/Prompts/Handlers/DependencyUpdatesAutomerge.php	95.12%	2 Missing ⚠️
.vortex/cli/src/Prompts/Handlers/Storybook.php	94.59%	2 Missing ⚠️
.vortex/cli/src/Prompts/Handlers/Webroot.php	0.00%	1 Missing ⚠️
.vortex/cli/src/Utils/FileManager.php	98.68%	1 Missing ⚠️

Additional details and impacted files

@@                         Coverage Diff                         @@
##           feature/propagate-main-20261025    #3235      +/-   ##
===================================================================
+ Coverage                            87.54%   88.33%   +0.79%     
===================================================================
  Files                                  106      111       +5     
  Lines                                 5683     6165     +482     
  Branches                                 3        3              
===================================================================
+ Hits                                  4975     5446     +471     
- Misses                                 708      719      +11

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

AlexSkrypnyk · 2026-10-26T04:45:04Z

Code coverage (threshold: 90%)

  Classes: 100.00% (1/1)
  Methods: 100.00% (2/2)
  Lines:   100.00% (174/174)

Per-class coverage

Drupal\ys_demo\Plugin\Block\CounterBlock
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 10/ 10)

AlexSkrypnyk · 2026-10-26T04:45:05Z

Code coverage (threshold: 90%)

  Classes: 100.00% (1/1)
  Methods: 100.00% (2/2)
  Lines:   100.00% (174/174)

Per-class coverage

Drupal\ys_demo\Plugin\Block\CounterBlock
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 10/ 10)

AlexSkrypnyk added 30 commits October 26, 2026 07:51

Kept exported environment variables over '.env' values in the tooling…

21d5a5c

…, as the Bash scripts did. The PHP port of the tooling let '.env' and '.env.local' replace variables already exported in the process environment, reversing the precedence of the Bash scripts.

Hardened the database export step in the 'test' job.

6ee3d1c

Forward-ported the export-step hardening from main cf188dd. 2.x keeps database caching in the 'test' job, so the scheduled database job and the GitHub Actions DIDI workflow are not ported.

Added a static nginx maintenance page switched on by 'VORTEX_WEBSERVE…

239f856

…R_MAINTENANCE_MODE'. Forward-ported from main d51c741, with the variable named 'VORTEX_WEBSERVER_MAINTENANCE_MODE' to match the 2.x vendor-agnostic service names.

Updated snapshots.

f7a9b2b

Updated snapshots.

f9e61cb

Updated snapshots.

caaa92b

[#3196] Added a weekly Renovate group that keeps the CircleCI self-ho…

da82692

…sted Renovate image up to date. Forward-ported from main a3b1b16. Applied as on main, with 'LINKED_GROUPS' added to the 2.x CLI handler and the docs reworded for the 2.x page.

Updated snapshots.

10bea5b

Updated 'behat/behat' to 4.0 with the 'friends-of-behat/mink-extensio…

535aa13

…n' 3.0 alpha and 'drevops/behat-screenshot' 3.0. Forward-ported from main ec77acf. Applied unchanged apart from mapping the installer handler and test paths to '.vortex/cli'.

Updated snapshots.

8503e09

Removed stale 'behat.yml' snapshot patches.

1b0640d

The baseline 'behat.yml' was replaced by 'behat.php', so these patches no longer apply and block snapshot regeneration.

Updated snapshots.

58f4487

Matched the Behat screenshot step assertion to the behat-steps 4.x wo…

52c86ac

…rding. Follow-up to the forward-port of main 71ac877.

Installed 'reroute_email' with the other development modules in one b…

ef47926

…atch. Follow-up to the forward-port of main 909660b; a separate install call adds a container rebuild to the deploy step.

Updated snapshots.

69ce509

Updated snapshots.

8c6eebf

Removed the Storybook files from projects that use a core theme.

ad7dc60

Follow-up to the forward-port of main e9f53d4; the 2.x processor skips handlers whose 'shouldRun()' is FALSE, so the 'Storybook' handler relies on the form condition to hide the prompt and always processes.

Updated snapshots.

c11c99a

Updated snapshots.

cba8176

Split the search index environment list to satisfy the array line len…

be50103

…gth rule.

AlexSkrypnyk added 8 commits October 26, 2026 12:09

Updated the 'test-exclude' and 'jsdom' overrides in the root 'package…

7e736cb

….json'. Forward-ported from main 4c56bc4. Applied as is; the lock file already resolved the raised minimums, so it needed no change.

Updated the template JavaScript lock files to the latest in-range ver…

047a97a

…sions. Refreshed the root and theme 'package-lock.json' files with 'npm update --package-lock-only' after the manifest changes forward-ported from main.

Updated snapshots.

1b34b2b

github-project-automation Bot added this to Vortex 1.x Oct 26, 2026

AlexSkrypnyk added the A1 Board worker 1 label Oct 26, 2026

github-project-automation Bot moved this to BACKLOG in Vortex 1.x Oct 26, 2026

github-actions Bot assigned AlexSkrypnyk Oct 26, 2026

AlexSkrypnyk mentioned this pull request Oct 26, 2026

Forward-ported 70 commits from 'main' onto '2.x'. #3233

Merged

This comment has been minimized.

Sign in to view

Re-triggered CI to clear a flaky check.

4d9ef12

This comment has been minimized.

Sign in to view

AlexSkrypnyk added the Needs review Pull request needs a review from assigned developers label Oct 26, 2026

AlexSkrypnyk merged commit a75f76a into feature/propagate-main-20261025 Oct 26, 2026
41 checks passed

AlexSkrypnyk deleted the feature/propagate-main-20261025-2 branch October 26, 2026 03:51

github-project-automation Bot moved this from BACKLOG to Release queue in Vortex 1.x Oct 26, 2026

AlexSkrypnyk restored the feature/propagate-main-20261025-2 branch October 26, 2026 04:34

AlexSkrypnyk mentioned this pull request Oct 26, 2026

Forward-ported the deferred decisions and refreshed dependencies on '2.x'. #3236

Merged

Navigation Menu

Repository navigation

Forward-ported the deferred decisions and refreshed dependencies on '2.x'. - #3235

Forward-ported the deferred decisions and refreshed dependencies on '2.x'.#3235
AlexSkrypnyk merged 52 commits into
feature/propagate-main-20261025from
feature/propagate-main-20261025-2

AlexSkrypnyk commented Oct 26, 2026

Uh oh!

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading

Review skipped

Uh oh!

This comment has been minimized.

github-actions Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

codecov Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

AlexSkrypnyk commented Oct 26, 2026

Uh oh!

AlexSkrypnyk commented Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

AlexSkrypnyk commented Oct 26, 2026

Scope

The decisions

Dependencies

Fixes found along the way

Not in this PR

Worth a look

Snapshots and gates

Uh oh!

coderabbitai Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

This comment has been minimized.

github-actions Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

codecov Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

AlexSkrypnyk commented Oct 26, 2026

Uh oh!

AlexSkrypnyk commented Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading

github-actions Bot commented Oct 26, 2026 •

edited

Loading

codecov Bot commented Oct 26, 2026 •

edited

Loading