From 4aa2e336d5889785ce7d9a5d816ff5ebaef3391e Mon Sep 17 00:00:00 2001
From: TravisCarden <traviscarden@236758.no-reply.drupal.org>
Date: Fri, 19 Aug 2022 19:03:31 +0000
Subject: [PATCH] Issue #3303727 by TravisCarden: Document in README how to add
paths to composer.json:extra.drupal-core-vendor-hardening to avoid symlink
errors
---
README.md | 52 ++++++++++++++++++++++++++++++++++++++
scripts/setup_local_dev.sh | 6 +++++
2 files changed, 58 insertions(+)
diff --git a/README.md b/README.md
index 6c5678ea0d..7f759a6656 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,7 @@ Automatic Updates
### Limitations
- Drupal multi-site installations are not supported.
- Automatic Updates does not support version control such as Git. It is the responsibility of site administrators to commit any updates to version control if needed.
+- Automatic Updates does not support symlinks. See [What if Automatic Updates says I have symlinks in my codebase?](#what-if-automatic-updates-says-i-have-symlinks-in-my-codebase) for help if you have any.
### Updating contributed modules and themes
Automatic Updates includes a sub-module, Automatic Updates Extensions, which supports updating contributed modules and themes.
@@ -18,3 +19,54 @@ Automatic Updates includes a sub-module, Automatic Updates Extensions, which sup
- Follow and read up on
[Ideas queue - Automatic Updates initiative](https://www.drupal.org/project/ideas/issues/2940731)
+
+### FAQ
+
+#### What if Automatic Updates says I have symlinks in my codebase?
+
+A fresh Drupal installation should not have any symlinks, but third party libraries and custom code can add them. If Automatic Updates says you have some, run the following command in your terminal to find them:
+
+```shell
+cd /var/www # Wherever your active directory is located.
+find . -type l
+```
+
+You might see output like the below, indicating symlinks in Drush's `docs` directory, as an example:
+
+```
+./vendor/drush/drush/docs/misc/icon_PhpStorm.png
+./vendor/drush/drush/docs/img/favicon.ico
+./vendor/drush/drush/docs/contribute/CONTRIBUTING.md
+./vendor/drush/drush/docs/drush_logo-black.png
+```
+
+##### Composer libraries
+
+Symlinks in Composer libraries can be addressed with [Drupal's Vendor Hardening Composer Plugin](https://www.drupal.org/docs/develop/using-composer/using-drupals-vendor-hardening-composer-plugin), which "removes extraneous directories from the project's vendor directory". Use it as follows.
+
+First, add `drupal/core-vendor-hardening` to your Composer project:
+
+```shell
+composer require drupal/core-vendor-hardening
+```
+
+Then, add the following to the `composer.json` in your site root to handle the most common, known culprits. Add your own as necessary.
+
+```json
+"extra": {
+ "drupal-core-vendor-hardening": {
+ "drush/drush": ["docs"],
+ "grasmash/yaml-expander": ["scenarios"]
+ }
+}
+```
+
+The new configuration will take effect on the next Composer install or update event. Do this to apply it immediately:
+
+```shell
+composer install
+```
+
+##### Custom code
+
+Symlinks are seldom truly necessary and should be avoided in your own code. No solution currently exists to get around them--they must be removed in order to use Automatic Updates.
diff --git a/scripts/setup_local_dev.sh b/scripts/setup_local_dev.sh
index d057ad826b..60ca3f670a 100755
--- a/scripts/setup_local_dev.sh
+++ b/scripts/setup_local_dev.sh
@@ -107,6 +107,12 @@ echo "$JSON" > composer.json
# Update the Composer platform PHP requirement.
composer config platform.php 7.4.0
+# Prevent Composer from installing symlinks from common packages known to
+# contain them.
+# @see https://www.drupal.org/docs/develop/using-composer/using-drupals-vendor-hardening-composer-plugin
+composer config --json extra.drupal-core-vendor-hardening.drush/drush '["docs"]'
+composer config --json extra.drupal-core-vendor-hardening.grasmash/yaml-expander '["scenarios"]'
+
# Require the module using the checked out dev branch, ignoring the PHP version
# requirement.
composer require \
--
GitLab