[#2125] Added support for Composer 2.9.0 automated security audit. #2126
Conversation
WalkthroughAdds Composer audit settings to composer.json, adds CI steps (CircleCI + GitHub Actions) to run Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Developer
participant CI as CI pipeline
participant Runner as Runner / CLI container
participant Composer as Composer
Dev->>CI: push / open PR
CI->>Runner: install deps / normalize composer
CI->>Runner: run composer audit
Runner->>Composer: composer audit (checks advisories)
Composer-->>Runner: advisories + exit code
alt VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE = 1
note right of Runner `#DFF0D8`: Audit failures ignored
Runner-->>CI: exit 0 (continue)
CI-->>Dev: pipeline continues
else VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE = 0
note right of Runner `#FDEBD0`: Audit failures fail pipeline
Runner-->>CI: non-zero exit (fail)
CI-->>Dev: pipeline fails
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20–30 minutes
Possibly related PRs
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: ASSERTIVE Plan: Pro ⛔ Files ignored due to path filters (38)
📒 Files selected for processing (10)
🧰 Additional context used📓 Path-based instructions (1)composer.json📄 CodeRabbit inference engine (CLAUDE.md)
Files:
🧠 Learnings (3)📚 Learning: 2025-07-23T01:16:30.963ZApplied to files:
📚 Learning: 2025-11-24T21:29:10.896ZApplied to files:
📚 Learning: 2025-11-24T21:29:10.896ZApplied to files:
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
🔇 Additional comments (11)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
composer.json (1)
74-96: Add explanatory comment for audit configuration.The audit configuration lacks inline documentation explaining the choice of
abandoned: "report"andblock-insecurevalue. Add a comment for future maintainers:"config": { "allow-plugins": { ... }, // Composer 2.9.0 automated security auditing (issue #2125) // block-insecure: true enforces immediate action on vulnerabilities // abandoned: report logs warnings but doesn't block installation // See: .vortex/docs/content/workflows/development.mdx#composer-security-auditing "audit": { "abandoned": "report", "block-insecure": true }, ... }Based on learnings, documenting the issue reference (#2125) helps maintainability.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
⛔ Files ignored due to path filters (38)
.vortex/installer/tests/Fixtures/install/_baseline/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/_baseline/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/_baseline/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/ciprovider_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deploy_types_all_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deploy_types_none_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deploy_types_none_gha/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deps_updates_provider_ci_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/hosting_acquia/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/hosting_project_name___acquia/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/provision_profile/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/starter_drupal_cms_profile/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/theme_claro/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/theme_olivero/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/theme_stark/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/timezone_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_lint/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_lint_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests_circleci/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat_circleci/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpcs/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpcs_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpmd/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpmd_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpstan/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpstan_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpunit/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpunit_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_rector/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_rector_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_none/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_none/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**
📒 Files selected for processing (10)
.circleci/config.yml(1 hunks).github/workflows/build-test-deploy.yml(1 hunks).vortex/docs/.utils/variables/extra/ci.variables.sh(1 hunks).vortex/docs/content/drupal/composer.mdx(1 hunks).vortex/docs/content/workflows/development.mdx(1 hunks).vortex/docs/content/workflows/releasing.mdx(8 hunks).vortex/docs/content/workflows/variables.mdx(1 hunks).vortex/docs/cspell.json(1 hunks)composer.json(3 hunks)docs/faqs.md(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
composer.json
📄 CodeRabbit inference engine (CLAUDE.md)
composer.json: Define patch configurations in composer.json under 'extra.patches' section, supporting both local patches and external URLs
Document the issue being fixed in composer.json patch description and include issue URLs when available from drupal.org
Files:
composer.json
🧠 Learnings (3)
📓 Common learnings
Learnt from: CR
Repo: drevops/vortex PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T21:29:10.896Z
Learning: Applies to composer.json : Document the issue being fixed in composer.json patch description and include issue URLs when available from drupal.org
Learnt from: CR
Repo: drevops/vortex PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T21:29:10.896Z
Learning: Use git-based patching with 'cweagans/composer-patches' v2.x which provides improved reliability with git apply and SHA-256 checksums
📚 Learning: 2025-11-24T21:29:10.896Z
Learnt from: CR
Repo: drevops/vortex PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T21:29:10.896Z
Learning: Applies to composer.json : Document the issue being fixed in composer.json patch description and include issue URLs when available from drupal.org
Applied to files:
.vortex/docs/content/workflows/development.mdx.vortex/docs/content/drupal/composer.mdxdocs/faqs.mdcomposer.json
📚 Learning: 2025-07-23T01:16:30.963Z
Learnt from: AlexSkrypnyk
Repo: drevops/vortex PR: 1816
File: .docker/cli.dockerfile:72-76
Timestamp: 2025-07-23T01:16:30.963Z
Learning: In the Vortex project, unauthenticated Composer installs should be allowed, so GitHub token secrets should not be marked as `required=true` in Docker build mounts. The conditional check `if [ -s /run/secrets/github_token ]` is the preferred approach to allow builds to proceed without a token when needed.
Applied to files:
.vortex/docs/.utils/variables/extra/ci.variables.sh
🪛 markdownlint-cli2 (0.18.1)
docs/faqs.md
145-145: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (10)
- GitHub Check: build (1)
- GitHub Check: build (0)
- GitHub Check: vortex-test-workflow (4)
- GitHub Check: vortex-test-workflow (2)
- GitHub Check: vortex-test-workflow (3)
- GitHub Check: vortex-test-workflow (1)
- GitHub Check: vortex-test-workflow (0)
- GitHub Check: vortex-test-common
- GitHub Check: vortex-test-installer (8.4)
- GitHub Check: vortex-test-installer (8.3)
🔇 Additional comments (11)
.vortex/docs/content/workflows/releasing.mdx (1)
50-50: Formatting changes look good.These whitespace adjustments improve readability around headings, code blocks, and lists without altering content or structure.
Also applies to: 139-143, 145-158, 167-170, 199-205, 220-226, 275-283, 292-299
.vortex/docs/cspell.json (1)
12-12: "GHSA" addition aligns with documentation updates.Adding the GitHub Security Advisory acronym to the dictionary supports the new CVE/GHSA references in the Composer security audit documentation.
.vortex/docs/content/drupal/composer.mdx (1)
229-245: Comprehensive audit configuration documentation.The new audit section clearly explains
block-insecure,abandoned, andignoresettings with actionable guidance. The cross-reference to the development workflow documentation improves discoverability..vortex/docs/content/workflows/variables.mdx (1)
449-455: Variable documentation follows established conventions.The
VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILUREentry is correctly positioned and formatted consistently with related ignore-failure variables..circleci/config.yml (1)
289-291: CircleCI implementation is correct.The
composer auditcommand properly executes within the docker compose context, consistent with other linting steps. The bash conditional failure-ignore pattern matches the normalize check above it.docs/faqs.md (2)
130-147: Verify no duplicate FAQ content exists elsewhere in file.The AI summary suggests this FAQ content may be duplicated in two locations within the document. Please confirm this section appears only once. If duplication exists, consolidate to a single entry to maintain document clarity and reduce maintenance burden.
145-146: I'll help you verify the review comment by examining the file and checking for the issues mentioned. Let me start by exploring the faqs.md file and investigating the bare URL and potential duplication.
<function_calls>
#!/bin/bashFirst, check file size and read the section around lines 145-146
wc -l docs/faqs.md
echo "---"Read lines 130-155 to see full context
sed -n '130,155p' docs/faqs.md | cat -n
</function_calls>
#!/bin/bashSearch for the specific URL to see all occurrences
rg 'vortextemplate.com/docs/drupal/composer' docs/faqs.md -n
</function_calls>
#!/bin/bashSearch for potential duplicate FAQ content about "Composer blocks package" or "security vulnerabilities"
rg -i 'composer.*block|security.*vulnerab|audit.*config' docs/faqs.md -n -B 2 -A 2
</function_calls>Waiting for results to verify the bare URL and duplication concerns...
.vortex/docs/.utils/variables/extra/ci.variables.sh (1)
33-34: New CI variable follows established conventions.The
VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE=0addition maintains consistency with the ignore-failure pattern for other CI checks and is appropriately placed in the variable list..vortex/docs/content/workflows/development.mdx (2)
308-409: Good! Now let me check the actual content of the development.mdx file and look for duplicates:
<function_calls>
#!/bin/bashecho "=== Searching for all 'Composer Security Auditing' occurrences ==="
rg -n "Composer Security Auditing" .vortex/docs/content/workflows/development.mdxecho ""
echo "=== Counting total occurrences ==="
rg -c "Composer Security Auditing" .vortex/docs/content/workflows/development.mdxecho ""
echo "=== Get line count of development.mdx ==="
wc -l .vortex/docs/content/workflows/development.mdxecho ""
echo "=== Read lines 300-320 to see context ==="
sed -n '300,320p' .vortex/docs/content/workflows/development.mdx
</function_calls>#!/bin/bash echo "=== Full search for 'Composer Security' in development.mdx ===" rg -n "Composer Security" .vortex/docs/content/workflows/development.mdx echo "" echo "=== Search for composer.json in entire repo ===" find . -name "composer.json" -type f 2>/dev/null | head -5 echo "" echo "=== Check for any audit configuration mentions ===" rg -n "block-insecure" .vortex/docs/content/workflows/development.mdx echo "" echo "=== Get total file size ===" wc -l .vortex/docs/content/workflows/development.mdx </parameter> </function_calls> ```shell #!/bin/bash # Read the section around lines 308-409 echo "=== Reading development.mdx lines 300-420 ===" sed -n '300,420p' .vortex/docs/content/workflows/development.mdx
400-408: The documentation is accurate and the variable is properly implemented.All verification points confirm:
Variable is implemented in CI workflows:
- CircleCI (line 291):
composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ]- GitHub Actions (line 284):
continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }}Variable is documented: Listed in
./.vortex/docs/content/workflows/variables.mdx(line 449) and defined in./.vortex/docs/.utils/variables/extra/ci.variables.sh(line 34) with default value0.Default behavior is correct: When not set, the variable defaults to
0/undefined, which means audit failures will cause the build to fail (as documented).composer.json (1)
15-16: Based on the verification, I can now provide a comprehensive assessment:Verified findings:
- Primary PR goal: Clearly documented as "[#2125] Added support for Composer 2.9.0 automated security audit" with comprehensive documentation added
- Audit configuration: Properly added to composer.json with
block-insecure: trueandabandoned: report- Dependency updates: All are patch or minor version bumps (safe, non-breaking changes):
- Drupal core: 11.2.5 → 11.2.8 (patch within ~11.2.x)
- All dev tools: similar minor/patch increments
- No composer.lock change: Suggests intentional version pinning, not automatic transitive updates
- Documentation: Updated with detailed audit guidance and security best practices
Assessment of original concerns:
- The bundling of dependency updates WITH the audit feature is contextually reasonable—they're all safety-critical patch/minor bumps, not major version changes
- No evidence that these updates are REQUIRED for Composer 2.9.0 compatibility; they appear to be a concurrent lockfile refresh
- The commit message does not explain the rationale for these specific version updates
Verify: Are multiple dependency version updates intentional, or should they be separated?
This PR bundles dependency updates with the Composer 2.9.0 audit configuration. However, all updates are minor or patch-level bumps (e.g., Drupal core 11.2.5→11.2.8, rector 2.2.7→2.2.8, phpstan 2.1.31→2.1.32)—non-breaking, safe changes.
Clarifications needed:
- Are these patch updates intentional security/maintenance refreshes, or coincidental lockfile updates?
- If intentional security updates, document the rationale in the commit message or PR description.
- For future PRs, consider separating feature additions (audit config) from dependency maintenance commits to improve clarity.
The current bundling is acceptable given the safety profile of these updates, but transparency about intent would strengthen the PR.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #2126 +/- ##
========================================
Coverage 70.80% 70.80%
========================================
Files 99 99
Lines 5059 5059
Branches 44 44
========================================
Hits 3582 3582
Misses 1477 1477 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
AlexSkrypnyk
force-pushed
the
feature/2125-composer-security-block
branch
from
5f43196 to
57f62d1
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (1)
composer.json (1)
87-90: CRITICAL (unresolved from prior review):block-insecurevalue contradicts PR objectives and backwards-compatibility goal.The past review flagged that
"block-insecure": trueenables security blocking (strict mode), which contradicts the stated objective to "disable Composer 2.9 automated security blocking for backwards compatibility." To disable blocking, the value should befalse.
"block-insecure": false= permissive (don't block insecure packages; backwards-compatible)"block-insecure": true= strict (block insecure packages; security-first)This issue persists unchanged since the last review.
Resolution required: Either correct the value to
falseto match the backwards-compatibility objective, or explicitly update the PR description and documentation to reflect an intentional security-first override.Apply this diff if backwards compatibility is the goal:
"audit": { "abandoned": "report", - "block-insecure": true + "block-insecure": false }If the intent is to enforce strict security blocking (overriding backwards compatibility), update the PR title, objectives, and all documentation to make this clear.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
⛔ Files ignored due to path filters (38)
.vortex/installer/tests/Fixtures/install/_baseline/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/_baseline/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/_baseline/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/ciprovider_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deploy_types_all_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deploy_types_none_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deploy_types_none_gha/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deps_updates_provider_ci_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/hosting_acquia/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/hosting_project_name___acquia/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/provision_profile/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/starter_drupal_cms_profile/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/theme_claro/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/theme_olivero/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/theme_stark/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/timezone_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_lint/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_lint_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests_circleci/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat_circleci/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpcs/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpcs_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpmd/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpmd_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpstan/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpstan_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpunit/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpunit_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_rector/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_rector_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_none/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_none/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**
📒 Files selected for processing (10)
.circleci/config.yml(1 hunks).github/workflows/build-test-deploy.yml(1 hunks).vortex/docs/.utils/variables/extra/ci.variables.sh(1 hunks).vortex/docs/content/drupal/composer.mdx(1 hunks).vortex/docs/content/workflows/development.mdx(1 hunks).vortex/docs/content/workflows/releasing.mdx(8 hunks).vortex/docs/content/workflows/variables.mdx(1 hunks).vortex/docs/cspell.json(1 hunks)composer.json(3 hunks)docs/faqs.md(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
composer.json
📄 CodeRabbit inference engine (CLAUDE.md)
composer.json: Define patch configurations in composer.json under 'extra.patches' section, supporting both local patches and external URLs
Document the issue being fixed in composer.json patch description and include issue URLs when available from drupal.org
Files:
composer.json
🧠 Learnings (2)
📚 Learning: 2025-07-23T01:16:30.963Z
Learnt from: AlexSkrypnyk
Repo: drevops/vortex PR: 1816
File: .docker/cli.dockerfile:72-76
Timestamp: 2025-07-23T01:16:30.963Z
Learning: In the Vortex project, unauthenticated Composer installs should be allowed, so GitHub token secrets should not be marked as `required=true` in Docker build mounts. The conditional check `if [ -s /run/secrets/github_token ]` is the preferred approach to allow builds to proceed without a token when needed.
Applied to files:
.github/workflows/build-test-deploy.yml.vortex/docs/.utils/variables/extra/ci.variables.sh
📚 Learning: 2025-11-24T21:29:10.896Z
Learnt from: CR
Repo: drevops/vortex PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T21:29:10.896Z
Learning: Applies to composer.json : Document the issue being fixed in composer.json patch description and include issue URLs when available from drupal.org
Applied to files:
composer.jsondocs/faqs.md.vortex/docs/content/workflows/development.mdx.vortex/docs/content/drupal/composer.mdx
🪛 markdownlint-cli2 (0.18.1)
docs/faqs.md
145-145: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
- GitHub Check: build (0)
- GitHub Check: build (1)
- GitHub Check: vortex-test-workflow (0)
- GitHub Check: vortex-test-workflow (1)
- GitHub Check: vortex-test-workflow (4)
- GitHub Check: vortex-test-workflow (3)
- GitHub Check: vortex-test-workflow (2)
- GitHub Check: vortex-test-common
- GitHub Check: vortex-test-installer (8.3)
- GitHub Check: vortex-test-installer (8.4)
- GitHub Check: vortex-test-docs
🔇 Additional comments (9)
.vortex/docs/content/workflows/releasing.mdx (1)
50-50: Based on my verification, the original review comment contains several critical errors. Here's what I found:Verification Results:
releasing.mdx is a NEW FILE, not "formatting-only changes": The git log shows
git show 57f62d12reveals this file was created withnew file mode 100644, containing 311 lines of entirely new release workflow documentation (GitFlow, versioning schemes, deployment, monitoring, best practices).Composer 2.9 Security Audit documentation DOES exist:
- composer.mdx (new file): Documents Composer configuration including the new
auditconfig withblock-insecure,abandoned, andignoreoptions (lines ~307-317)- development.mdx (new file): Contains a comprehensive "Composer Security Auditing" section (lines 320-420 in the diff) covering configuration, when to use different settings, ignoring advisories, running audits, and CI/CD integration
releasing.mdx is appropriately scoped: This file documents release workflows and should NOT contain Composer security audit documentation—that belongs in the development and Composer configuration docs where it correctly appears.
Rewritten Review Comment:
File does not require changes—PR objectives are met elsewhere
This file is newly created documentation for release workflows (GitFlow, versioning schemes, deployment procedures, and monitoring). It is not in scope for Composer 2.9 security audit documentation. Composer audit configuration and workflow guidance is appropriately documented in
.vortex/docs/content/drupal/composer.mdxand.vortex/docs/content/workflows/development.mdx#composer-security-auditing, which contain the required Composer 2.9 automated security blocking behavior and audit settings..vortex/docs/cspell.json (1)
12-12: LGTM!Adding "GHSA" to the spell-check dictionary is appropriate given the security audit documentation references GitHub Security Advisories.
.vortex/docs/content/workflows/variables.mdx (1)
449-456: LGTM!The new variable documentation follows the established pattern and is correctly positioned. The description is clear and the default value is appropriate.
.github/workflows/build-test-deploy.yml (1)
282-284: LGTM!The composer audit step correctly uses
docker compose exec -T clito run within the container environment, consistent with other Composer commands. The continue-on-error pattern aligns with existing CI variable conventions.docs/faqs.md (1)
130-148: FAQ content is helpful but check for duplication across docs.The content appropriately addresses the PR objective by providing actionable guidance for when Composer blocks installation. However, the AI summary indicates similar content may exist in
.vortex/docs/content/workflows/development.mdx(the new "Composer Security Auditing" section). Verify that this FAQ and the development documentation don't create redundant or conflicting information.Confirm whether the Composer Security Auditing section in development.mdx duplicates this FAQ content, and ensure they complement each other (FAQ = quick answer, development docs = comprehensive guide).
.vortex/docs/content/drupal/composer.mdx (1)
229-245: LGTM, but verify alignment with composer.json.The audit configuration documentation is clear and well-structured. However, the documented default values (block-insecure=true, abandoned=report) should be verified against the actual
composer.jsonto ensure consistency. Sincecomposer.jsonis not provided in this review, please confirm that the configuration added matches what's documented here.Verify that the audit defaults in
composer.jsonmatch the documented values:block-insecure: true,abandoned: report, andignore: {}..vortex/docs/.utils/variables/extra/ci.variables.sh (1)
33-34: LGTM!The variable is correctly placed in the sequence of Composer-related ignore flags and follows the established naming and default value pattern. Default of
0ensures secure-by-default behavior where audit failures fail the build..vortex/docs/content/workflows/development.mdx (1)
308-408: Comprehensive and well-structured documentation.The new "Composer Security Auditing" section thoroughly covers configuration, use cases, and CI/CD integration. Examples are concrete and helpful. The CI/CD subsection (lines 400-408) correctly explains the automatic audit behavior and the control variable.
composer.json (1)
15-16: Dependency version updates look reasonable.The version bumps align well with the Drupal 11.2.8 series and related tooling updates. The constraints (~ and ^) are appropriate for their respective packages.
Also applies to: 20-20, 32-51
AlexSkrypnyk
force-pushed
the
feature/2125-composer-security-block
branch
from
57f62d1 to
6aa314b
Compare
AlexSkrypnyk
force-pushed
the
feature/2125-composer-security-block
branch
from
6aa314b to
d2a1d00
Compare
AlexSkrypnyk
force-pushed
the
feature/2125-composer-security-block
branch
from
d2a1d00 to
5fe742d
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
⛔ Files ignored due to path filters (38)
.vortex/installer/tests/Fixtures/install/_baseline/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/_baseline/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/_baseline/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/ciprovider_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deploy_types_all_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deploy_types_none_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deploy_types_none_gha/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/deps_updates_provider_ci_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/hosting_acquia/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/hosting_project_name___acquia/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/provision_profile/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/starter_drupal_cms_profile/composer.jsonis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/theme_claro/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/theme_olivero/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/theme_stark/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/timezone_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_lint/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_lint_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_groups_no_be_tests_circleci/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_behat_circleci/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpcs/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpcs_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpmd/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpmd_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpstan/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpstan_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpunit/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_phpunit_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_rector/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_no_rector_circleci/.circleci/config.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_none/.github/workflows/build-test-deploy.ymlis excluded by!.vortex/installer/tests/Fixtures/**.vortex/installer/tests/Fixtures/install/tools_none/docs/faqs.mdis excluded by!.vortex/installer/tests/Fixtures/**
📒 Files selected for processing (10)
.circleci/config.yml(1 hunks).github/workflows/build-test-deploy.yml(1 hunks).vortex/docs/.utils/variables/extra/ci.variables.sh(1 hunks).vortex/docs/content/drupal/composer.mdx(1 hunks).vortex/docs/content/workflows/development.mdx(2 hunks).vortex/docs/content/workflows/releasing.mdx(8 hunks).vortex/docs/content/workflows/variables.mdx(1 hunks).vortex/docs/cspell.json(1 hunks)composer.json(3 hunks)docs/faqs.md(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
composer.json
📄 CodeRabbit inference engine (CLAUDE.md)
composer.json: Define patch configurations in composer.json under 'extra.patches' section, supporting both local patches and external URLs
Document the issue being fixed in composer.json patch description and include issue URLs when available from drupal.org
Files:
composer.json
🧠 Learnings (3)
📚 Learning: 2025-07-23T01:16:30.963Z
Learnt from: AlexSkrypnyk
Repo: drevops/vortex PR: 1816
File: .docker/cli.dockerfile:72-76
Timestamp: 2025-07-23T01:16:30.963Z
Learning: In the Vortex project, unauthenticated Composer installs should be allowed, so GitHub token secrets should not be marked as `required=true` in Docker build mounts. The conditional check `if [ -s /run/secrets/github_token ]` is the preferred approach to allow builds to proceed without a token when needed.
Applied to files:
.vortex/docs/.utils/variables/extra/ci.variables.sh.circleci/config.yml.github/workflows/build-test-deploy.yml
📚 Learning: 2025-11-24T21:29:10.896Z
Learnt from: CR
Repo: drevops/vortex PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T21:29:10.896Z
Learning: Applies to composer.json : Document the issue being fixed in composer.json patch description and include issue URLs when available from drupal.org
Applied to files:
.vortex/docs/content/workflows/development.mdx.vortex/docs/content/drupal/composer.mdxcomposer.jsondocs/faqs.md
📚 Learning: 2025-11-24T21:29:10.896Z
Learnt from: CR
Repo: drevops/vortex PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T21:29:10.896Z
Learning: Use 'ahoy build' for initial site setup, 'ahoy up/down' for environment management, and 'ahoy provision' to re-provision with fresh database
Applied to files:
.vortex/docs/content/workflows/development.mdx
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
- GitHub Check: build (0)
- GitHub Check: build (1)
- GitHub Check: vortex-test-workflow (4)
- GitHub Check: vortex-test-workflow (1)
- GitHub Check: vortex-test-workflow (3)
- GitHub Check: vortex-test-workflow (2)
- GitHub Check: vortex-test-workflow (0)
- GitHub Check: vortex-test-common
- GitHub Check: vortex-test-installer (8.4)
- GitHub Check: vortex-test-installer (8.3)
- GitHub Check: vortex-test-docs
🔇 Additional comments (9)
.vortex/docs/content/workflows/releasing.mdx (1)
50-50: Verify Composer audit documentation alignment with PR objectives.The changes in this file are formatting-only (whitespace and blank line additions for readability). However, the PR objectives include updating the Composer section in
.vortex/docsto describe Composer 2.9's new automated security blocking behavior and audit-setting guidance.This releasing workflow file does not contain Composer audit documentation. Please clarify:
- Are Composer audit documentation updates in a different file not shown in this review?
- Should this file include documentation about Composer security audits in the context of the releasing workflow?
- Are the whitespace-only changes here the complete scope for this file, or are content updates expected?
Also applies to: 139-143, 148-170, 198-232, 275-282, 292-298
.vortex/docs/cspell.json (1)
12-12: LGTM!Adding "GHSA" to the cspell dictionary is appropriate given the security advisory references in the new audit documentation.
.vortex/docs/content/drupal/composer.mdx (1)
229-245: LGTM!The audit configuration documentation is clear and well-structured. The explanation of each option (block-insecure, abandoned, ignore) is helpful, and the cross-reference to the development guide for comprehensive guidance is appropriate.
.vortex/docs/content/workflows/development.mdx (1)
308-419: Comprehensive audit documentation with good security philosophy callout.The new "Composer security auditing" section is well-structured with clear subsections covering configuration, use cases, ignoring advisories, manual auditing, and CI/CD integration. The :::warning block at lines 358–366 appropriately explains Vortex's security-first approach and when/how to override it, which directly addresses the security philosophy guidance flagged in past reviews.
.github/workflows/build-test-deploy.yml (1)
282-284: LGTM!The CI step correctly executes
composer auditinside the Docker container viadocker compose exec -T cli, maintaining consistency with other Composer commands in the workflow. The variable reference for optional failure ignoring is properly implemented..vortex/docs/content/workflows/variables.mdx (1)
449-455: LGTM!The variable documentation is consistent with the pattern established by other
IGNORE_FAILUREvariables and correctly positioned in the document. The description and default value are appropriate..vortex/docs/.utils/variables/extra/ci.variables.sh (1)
33-34: LGTM!The environment variable is correctly defined with a sensible default (0 = fail on audit issues by default) and follows the established pattern in the file.
.circleci/config.yml (1)
289-291: LGTM!The CircleCI audit step correctly executes
composer auditin the Docker container and uses the OR logic with conditional check to handle optional failure ignoring. This is equivalent to the GitHub Actionscontinue-on-errorapproach and properly handles the variable with appropriate bash syntax.docs/faqs.md (1)
130-147: ✅ Markdown link syntax is now correct; content is clear and helpful.The new FAQ section appropriately addresses Composer 2.9.0's security blocking behavior with three practical options (update packages, run audit, adjust settings). The markdown link wrapping at line 145 now correctly uses link syntax instead of a bare URL, resolving the earlier MD034 linting issue.
Please verify that the documentation target URL (https://www.vortextemplate.com/docs/drupal/composer#config) exists and includes the audit configuration guidance (abandoned/report, block-insecure) as intended by the PR objectives. Since the Composer documentation file updates are mentioned in the PR objectives but not provided in this review, ensure the
#configanchor section exists and is properly documented.
AlexSkrypnyk
force-pushed
the
feature/2125-composer-security-block
branch
from
5fe742d to
3e40569
Compare
Closes #2125
Summary by CodeRabbit
New Features
Documentation
Chores
✏️ Tip: You can customize this high-level summary in your review settings.