v5.1.0

What's Changed

• #169, #191: unify drupal:composer task and add composer dep to drupal:update by @deviantintegral in #1162
• #358: Prefer standard TERMINUS_MACHINE_TOKEN variable name for Pantheon tasks, actions and workflows by @rabbitlair in #1186
• #481: Restore --prefer-lowest dependency testing for composer plugin by @rabbitlair in #1187
• #510, #499: Standardize Pantheon and Acquia hosting provider configuration by @rabbitlair in #1177
• #703: Add test to verify Twig CS Fixer extension behavior by @rabbitlair in #1185
• #1034: Improve Tugboat environment indicator by @rabbitlair in #1180
• #1036: Add gitleaks secret scanning job to Security workflow by @rabbitlair in #1182
• #1120: Require phpstan/extension-installer in Drainpipe Dev by @rabbitlair in #1176
• #1124: deprecation warnings by @bronzehedwick in #1178
• #1171: Improve logic to parse image in Tugboat config plugin by @rabbitlair in #1175
• #1172: Increase default PHPStan settings to level 6 by @rabbitlair in #1174
• chore: initialize AI task manager and agent configuration by @deviantintegral in #1163
• fix: skip Security job on push events by @deviantintegral in #1167
• chore(deps): update actions/download-artifact action to v8.0.1 by @renovate[bot] in #1159
• chore(deps): update webfactory/ssh-agent action to v0.10.0 by @renovate[bot] in #1160
• chore(deps): update actions/cache action to v5.0.4 by @renovate[bot] in #1169
• chore(deps): update marocchino/sticky-pull-request-comment action to v3 by @renovate[bot] in #1161
• chore(deps): update yarn to v4.13.0 by @renovate[bot] in #1170
• chore(deps): update shivammathur/setup-php action to v2.37.0 by @renovate[bot] in #1165
• chore(deps): update github/codeql-action action to v4.35.1 by @renovate[bot] in #1183

Upgrading to v5.1.0

PHPStan level raised to 6

The default PHPStan analysis level has been increased from 1 to 6. This will likely cause new failures in existing projects immediately after upgrading. To suppress pre-existing violations and only fail on new code, generate a baseline before or after upgrading:

task test:phpstan:generate-baseline
git add phpstan.neon phpstan-baseline.neon
git commit -m "Add PHPStan level 6 baseline"

phpstan/extension-installer now required

drainpipe-dev now requires the phpstan/extension-installer Composer plugin. If your project does not already allow it (e.g. via drupal/core-dev), add the following to your root composer.json to prevent CI failures:

"config": {
    "allow-plugins": {
        "phpstan/extension-installer": true
    }
}

Hosting provider configuration syntax updated

The CI configuration schema for Pantheon and Acquia has changed. The old flat-array syntax (e.g. "github": ["PantheonReviewApps"]) is deprecated — update to the new named sub-key syntax:

"github": { "pantheon": ["ReviewApps"] }
"github": { "acquia": ["Deploy"] }
"gitlab": { "pantheon": ["Deploy", "ReviewApps"] }

The old syntax continues to work but will be removed in a future release.

Pantheon authentication variable renamed

TERMINUS_MACHINE_TOKEN is now the preferred environment variable for Pantheon authentication, aligning with the standard used by DDEV and the Terminus documentation. The old names (PANTHEON_TERMINUS_TOKEN, PANTHEON_TOKEN) continue to work but will emit a deprecation warning.

Additionally, the setup-terminus GitHub Action input has been renamed from pantheon-token to terminus-token. Update any workflows that reference it:

# Before
- uses: ./.github/actions/pantheon/setup-terminus
  with:
    pantheon-token: ${{ secrets.PANTHEON_TERMINUS_TOKEN }}

# After
- uses: ./.github/actions/pantheon/setup-terminus
  with:
    terminus-token: ${{ secrets.TERMINUS_MACHINE_TOKEN }}

drupal:update now runs drupal:composer automatically

The drupal:composer:development and drupal:composer:production tasks have been unified into a single drupal:composer task (the old names remain as aliases). As part of this change, drupal:update now automatically runs drupal:composer to ensure the vendor directory is up to date. If your workflow depends on drupal:update not touching vendor, adjust accordingly. Where you previously called drupal:composer:development or drupal:composer:production explicitly, switch to:

task drupal:composer                    # development (default)
COMPOSER_NO_DEV=1 task drupal:composer  # production

Full Changelog: v5.0.0...v5.1.0