fix: #3611907 Commit patches.lock.json so fresh lock-less builds survive third-party dependency patches

Rajab Natshahrequested to merge
issue/varbase_project-3611907:3611907-patches-lock-json into 11.0.x

Summary

Commits patches.lock.json at the project root so a fresh, lock-less composer create-project drupal/varbase_project:11.0.x-dev build survives a third-party dependency (e.g. AI Context) declaring a patch Composer cannot download during the bootstrap window before the Varbase Patches allow-list is active.

On a lock-less build, cweagans/composer-patches activates before vardot/varbase-patches exists in vendor/, so with no patches.lock.json it resolves and downloads every dependency-declared patch immediately. Any such patch that Composer cannot download aborts the whole build:

The "patches/canvas-3575644-string-long-regex-ai-context-item.patch" file could not be downloaded: Failed to open stream: No such file or directory

Issue: https://www.drupal.org/project/varbase_project/issues/3611907

The file

Unmodified from a verified fresh 11.0.x-dev build: 71 patches across 39 target packages (the union of Varbase Patches 11.0.x + Drupal Core Patches 11.4.0.6), plugin _hash present. One file, no other changes.

Why this doesn't go stale

cweagans/composer-patches v2 loads the committed lock instead of re-resolving during that early window, so nothing is downloaded there. Varbase Patches re-resolves and rewrites the file through its own allow-list as soon as it installs, in the same run, so the committed copy self-corrects on every subsequent install/update that triggers package events.

Same bootstrap window documented in Varbase Patches issue #540 / PR #541 (merged to 11.0.x).

AI-Generated: Yes (Used Claude Code to audit the lock file content and commit it via the GitLab API, and to file the linked issue)

#Also updates the AI Context paths in the Varbase functional testing suite (tests/features/14-ai/14-05-ai-context.feature): AI Context 1.0.0-beta3 moved the Context Control Center from /admin/ai/context/* to /admin/config/ai/context/*, which is what made the previous pipeline's [14-ai] job fail.

Checkpoints

  • File an issue about this project
  • Addition/Change/Update/Fix to this project
  • Testing to ensure no regression
  • Automated unit/functional testing coverage
  • Developer Documentation support on feature change/addition
  • User Guide Documentation support on feature change/addition
  • UX/UI designer responsibilities
  • Accessibility and Readability
  • Reviewed by a human
  • Code review by maintainers
  • Full testing and approval
  • Credit contributors
  • Review with the product owner
  • Update Release Notes
  • Release
Edited by Rajab Natshah

Merge request reports