Composer keeps overwriting .htaccess (and other files) every time I do anything

Question

Every time I try to update anything using Composer, it overwrites a load of files. One of the files it overwrites is .htaccess, which I have customised, so I have to keep patching it all the time. Here's an example (below) of it doing this even when package I asked to update didn't need updating. I'm guessing it's because I used the "drupal/core-composer-scaffold" package to create the site. I did that because I was following these instructions: https://www.drupal.org/docs/develop/using-composer/using-composer-to-install-drupal-and-manage-dependencies#composer-from-scratch.

What am I doing wrong, to make it keep scaffolding (if that's the word for it) repeatedly? Thanks.

~/sites/default$ composer update drupal/security_review
Loading composer repositories with package information
Updating dependencies (including require-dev)
Nothing to install or update
Package academicpuma/citeproc-php is abandoned, you should avoid using it. Use seboettg/citeproc-php instead.
Package container-interop/container-interop is abandoned, you should avoid using it. Use psr/container instead.
Package technosophos/LibRIS is abandoned, you should avoid using it. No replacement was suggested.
Package zendframework/zend-diactoros is abandoned, you should avoid using it. Use laminas/laminas-diactoros instead.
Package zendframework/zend-escaper is abandoned, you should avoid using it. Use laminas/laminas-escaper instead.
Package zendframework/zend-feed is abandoned, you should avoid using it. Use laminas/laminas-feed instead.
Package zendframework/zend-stdlib is abandoned, you should avoid using it. Use laminas/laminas-stdlib instead.
Writing lock file
Generating autoload files
Scaffolding files for drupal/core:
  - Copy [project-root]/.editorconfig from assets/scaffold/files/editorconfig
  - Copy [project-root]/.gitattributes from assets/scaffold/files/gitattributes
  - Copy [web-root]/.csslintrc from assets/scaffold/files/csslintrc
  - Copy [web-root]/.eslintignore from assets/scaffold/files/eslintignore
  - Copy [web-root]/.eslintrc.json from assets/scaffold/files/eslintrc.json
  - Copy [web-root]/.ht.router.php from assets/scaffold/files/ht.router.php
  - Copy [web-root]/.htaccess from assets/scaffold/files/htaccess
  - Copy [web-root]/example.gitignore from assets/scaffold/files/example.gitignore
  - Copy [web-root]/index.php from assets/scaffold/files/index.php
  - Copy [web-root]/INSTALL.txt from assets/scaffold/files/drupal.INSTALL.txt
  - Copy [web-root]/README.txt from assets/scaffold/files/drupal.README.txt
  - Copy [web-root]/robots.txt from assets/scaffold/files/robots.txt
  - Copy [web-root]/update.php from assets/scaffold/files/update.php
  - Copy [web-root]/web.config from assets/scaffold/files/web.config
  - Copy [web-root]/sites/README.txt from assets/scaffold/files/sites.README.txt
  - Copy [web-root]/sites/development.services.yml from assets/scaffold/files/development.services.yml
  - Copy [web-root]/sites/example.settings.local.php from assets/scaffold/files/example.settings.local.php
  - Copy [web-root]/sites/example.sites.php from assets/scaffold/files/example.sites.php

Answer 1

That's Drupal's Composer Scaffold. Listed as "drupal/core-composer-scaffold": "^8.8.0" or a different version in your project's composer.json file.

To prevent certain scaffold files from being overwritten every time you run a Composer command you need to specify them one by one in the "extra" section of your project's composer.json. See the docs on Excluding scaffold files.

The following snippet prevents the .htaccess and the development.services.yml from being overwritten.

"drupal-scaffold": {
    "locations": {
        "web-root": "web/"
    },
    "file-mapping": {
        "[web-root]/.htaccess": false,
        "[web-root]/sites/development.services.yml": false
    }
},

---

But maybe you want to ensure you always get Drupal's latest .htaccess for security updates for example. For that you don't exclude this file from Drupal Scaffold but you patch it instead. See the docs on Altering scaffold files.

Create a patch of the .htaccess and maybe put it in a folder called "patches" in your project root. Then configure a "post-drupal-scaffold-cmd" in the "scripts" section of your composer.json file to have this patch applied to Drupal's core .htaccess every time Drupal scaffolding is triggered.

"scripts": {
    ...
    "post-drupal-scaffold-cmd": [
        "cd web && patch -p1 < ../patches/htaccess-ssl.patch"
    ]
}