Using drupal-scaffold correctly

Question

I am in the process of starting new projects using drupal/recommended-project over the Drupal composer project template. One of the differences I have noted is that the Drupal scaffold tool fires every time even when just installing a new module or theme.

In this case, I get write permission warnings about settings.php, and I have other concerns such as .htaccess or robots.txt being replaced.

I read some of the docs and added this in my composer.json file:

"drupal-scaffold": {
    "locations": {
        "web-root": "docroot/"
    },
    "file-mapping": {
        "[web-root]/sites/default/settings.php": false,
        "[web-root]/.htaccess": {
            "mode": "replace",
            "path": "assets/drupal/.htaccess"
        }
    }
},

This prevents settings.php from being touched, and replaces the .htaccess file from Drupal with one containing our modifications. The drawback that I see here is if .htaccess had some security changes, I would have to do a manual diff and put the custom rewrite rules back in.

Is this the proper way to use drupal-scaffold?

Answer 1

I use the patch method mentioned on https://www.drupal.org/docs/develop/using-composer/using-drupals-composer-scaffold#toc_4

e.g:

"name": "my/project",
...
"scripts": {
  "post-drupal-scaffold-cmd": [
    "cd docroot && patch -p1 <../patches/htaccess-ssl.patch"
  ]
}

Then if the core file changes it will either merge correctly or the patch will fail and you'll see that in your composer command and can make the relevant changes to your patch