feat: upgrade to Drupal 11 with a Docker-free backend and dev containers

.commitlintrc.json

@@ -0,0 +1,3 @@
+{
+  "extends": ["@commitlint/config-conventional"]
+}

.cspell-project-words.txt

@@ -0,0 +1,62 @@
+Lando
+Landofile
+Stanislav
+appserver
+behaviour
+bmewburn
+bootstrapvue
+commitlint
+davidanson
+dbaeumer
+ddev
+devpod
+docroot
+drush
+druxt
+druxtjs
+endswith
+extensionless
+gdlib
+giget
+hverlin
+instantiator
+intelephense
+interruptible
+knip
+lando
+libasound
+libfreetype
+libgbm
+libicu
+libjpeg
+libnotify
+libnss
+libonig
+libsqlite
+libxss
+libxtst
+libzip
+lndo
+makedirs
+mbstring
+namelist
+nohup
+nuxt
+nuxtjs
+nvmrc
+opcache
+openssl
+openvscode
+phpsab
+phpstan
+phpunit
+repository
+setuptools
+shivammathur
+starterkit
+startswith
+tokenless
+trixie
+valeryan
+vfox
+xauth

.cspell.json

@@ -0,0 +1,22 @@
+{
+  "files": ["**/*.{js,mjs,cjs,vue,json,jsonc,md,yml,yaml}"],
+  "dictionaryDefinitions": [{ "name": "project-words", "path": "./.cspell-project-words.txt" }],
+  "dictionaries": ["project-words", "bash", "misc", "node", "softwareTerms"],
+  "ignorePaths": [
+    ".git/",
+    "node_modules/",
+    "nuxt/",
+    "drupal/",
+    "coverage/",
+    "*.lock",
+    "package-lock.json",
+    "*.svg",
+    "*.png",
+    "*.jpg",
+    "*.gif",
+    "*.ico",
+    "*.min.*",
+    ".devcontainer/extensions/*/*.vsix"
+  ],
+  "useGitignore": true
+}

.devcontainer/devcontainer.json

@@ -0,0 +1,83 @@
+{
+  "name": "Druxt Quickstart (Serverless)",
+  "image": "mcr.microsoft.com/devcontainers/base:trixie",
+  "features": {
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "16.17.0"
+    },
+    "ghcr.io/devcontainers/features/php:1": {
+      "version": "8.4",
+      "installComposer": true
+    },
+    // Installed through gh-release rather than the mise feature: that
+    // feature asks for the "latest" jdx/mise release and does not expose
+    // a tag filter, and mise now publishes vfox-* releases from the same
+    // repository. The resolver picked vfox-v2026.8.15, found no matching
+    // asset, and every container build failed. The regex keeps us on
+    // mise's own v-tags while still tracking the newest one.
+    "ghcr.io/devcontainers-extra/features/gh-release:1": {
+      "repo": "jdx/mise",
+      "binaryNames": "mise",
+      // mise ships the same build as .tar.gz, .tar.xz, .tar.zst and an
+      // extensionless binary; without this the resolver finds four
+      // matches and refuses to choose. This is the value the mise
+      // feature passes.
+      "assetRegex": ".tar.gz$",
+      "releaseTagRegex": "^v[0-9]+\\.[0-9]+\\.[0-9]+$"
+    },
+    "ghcr.io/devcontainers/features/github-cli:1": {}
+  },
+  // Pin the backend port: .devtools/start otherwise auto-discovers the
+  // first free port from 8888 up, and a container that picked 8889 would
+  // sit behind a forward that only maps 8888.
+  "containerEnv": {
+    "WEBSERVER_PORT": "8888",
+    // Node and PHP are provided by the devcontainer features above -
+    // mise.toml's pins are for host users. Without this, `mise install`
+    // (including the mise extension's missing-tools check) tries to
+    // BUILD PHP from source via the vfox-php plugin inside the
+    // container, which is slow, redundant, and fails on missing build
+    // deps (gdlib). mise tasks (`mise run setup` etc.) are unaffected.
+    "MISE_DISABLE_TOOLS": "node,php"
+  },
+  "forwardPorts": [8888, 3000],
+  "portsAttributes": {
+    "8888": {
+      "label": "Drupal backend (drupal/.devtools)",
+      "onAutoForward": "silent"
+    },
+    "3000": {
+      "label": "Nuxt frontend",
+      "onAutoForward": "silent"
+    }
+  },
+  "customizations": {
+    "vscode": {
+      "settings": {
+        // Absolute path to where the mise feature installs the binary
+        // (gh-release feature default binLocation). The extension's
+        // default bare "mise" value trips its workspace-binary security
+        // check - a bare name is treated as workspace-relative, fails
+        // to hash (ENOENT), and re-prompts for approval on every config
+        // reload. An absolute machine-scope path never prompts.
+        "mise.binPath": "/usr/local/bin/mise"
+      },
+      "extensions": [
+        "hverlin.mise-vscode",
+        "davidanson.vscode-markdownlint",
+        "streetsidesoftware.code-spell-checker",
+        "EditorConfig.EditorConfig",
+        "redhat.vscode-yaml",
+        "bmewburn.vscode-intelephense-client",
+        "ValeryanM.vscode-phpsab",
+        "SanderRonde.phpstan-vscode",
+        "xdebug.php-debug",
+        "Stanislav.vscode-drupal",
+        "Vue.volar",
+        "dbaeumer.vscode-eslint"
+      ]
+    }
+  },
+  "postCreateCommand": "bash .devcontainer/post-create.sh",
+  "remoteUser": "vscode"
+}

.devcontainer/post-create.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+#
+# Dev container setup. The official PHP feature (ghcr.io/devcontainers/
+# features/php) builds PHP from source with no "extensions" option -
+# gd isn't compiled in at all. Drupal core needs it regardless of what
+# any composer.json platform override was told (its own installer does
+# an independent runtime check). No sodium needed here - unlike
+# quickstart/quickstart-druxt-site-tome, this repo has no simple_oauth/
+# consumers (and so no lcobucci/jwt) at all.
+set -euo pipefail
+
+echo "==> Installing system dependencies"
+sudo apt-get update
+# python3-setuptools: trixie ships Python 3.13, which dropped the
+# distutils stdlib module entirely - old node-gyp (bundled with this
+# repo's pinned Node 16's npm) still imports it, and setuptools ships a
+# compatible shim. Same fix this project's own CI pipeline already
+# needed for the same reason.
+sudo apt-get install -y python3 python3-setuptools build-essential libjpeg-dev libpng-dev libwebp-dev libfreetype-dev zlib1g-dev
+
+CONF_DIR=$(php --ini | grep 'Scan for additional .ini files' | sed 's/.*: *//')
+# The PHP feature ships Xdebug globally active - every php/composer run
+# stalls trying to reach a debug client and logs a warning. Off by
+# default; `npm run xdebug` re-enables it per-process with -d flags.
+echo 'xdebug.mode=off' | sudo tee "$CONF_DIR/zz-xdebug-off.ini" > /dev/null
+
+
+echo "==> Building gd (not compiled in by the PHP feature at all)"
+# gd is not a real standalone PECL package for current PHP versions -
+# it is a bundled core extension that only gets built via a configure
+# flag (--with-jpeg/--with-webp/--with-freetype) during PHP's own
+# compile. `pecl install gd` fails with "No releases available" even
+# with a fully up-to-date channel, because there is nothing there to
+# install. Build ext/gd directly from PHP's own source tree instead -
+# the same technique the PHP feature itself uses as its xdebug fallback.
+PHP_FULL_VERSION=$(php -r 'echo PHP_VERSION;')
+# mktemp, not a fixed /tmp path: predictable names are open to symlink
+# swaps by any local process between download and extract.
+PHP_SRC_TMP="$(mktemp -d)"
+trap 'rm -rf "$PHP_SRC_TMP"' EXIT
+GD_BUILD_DIR="$PHP_SRC_TMP/gd"
+mkdir -p "$GD_BUILD_DIR"
+curl -fsSL "https://www.php.net/distributions/php-${PHP_FULL_VERSION}.tar.gz" -o "$PHP_SRC_TMP/php-src.tar.gz"
+tar -xzf "$PHP_SRC_TMP/php-src.tar.gz" -C "$GD_BUILD_DIR" --strip-components=3 "php-${PHP_FULL_VERSION}/ext/gd"
+(
+  cd "$GD_BUILD_DIR"
+  phpize
+  ./configure --with-jpeg --with-webp --with-freetype
+  make -j"$(nproc)"
+  make install
+)
+echo 'extension=gd' | sudo tee "$CONF_DIR/gd.ini" > /dev/null
+
+# Fail fast if the gd build above didn't actually take - composer and
+# Drupal's installer both hard-require it, and a broken build surfacing
+# here beats a confusing failure mid-provision.
+php -r "exit(extension_loaded('gd') ? 0 : 1);" || { echo "gd extension failed to load" >&2; exit 1; }
+
+
+echo "==> Trusting this repo's mise.toml"
+mise trust
+
+echo "==> Running npm install (triggers the full setup pipeline)"
+# --loglevel=error: the root devDependencies are lint tooling that
+# requires Node 22 (CI runs them there); installing them under the
+# app's pinned Node 16 works fine but emits a wall of EBADENGINE
+# warnings that drowns the real setup output on first run.
+npm install --loglevel=error

.env.example

@@ -0,0 +1,7 @@
+# Backend URL the Nuxt frontend connects to.
+#
+# You normally never edit this by hand:
+# - `npm run setup` / `make setup` starts the local PHP backend and
+#   rewrites BASE_URL to it, e.g. http://127.0.0.1:8888
+# - For DDEV, keep the project URL below instead.
+BASE_URL=http://quickstart-druxt-serverless.ddev.site

.github/ISSUE_TEMPLATE/bug_report.md

@@ -11,6 +11,7 @@ A clear and concise description of what the bug is.
 
 **To Reproduce**
 Steps to reproduce the behavior:
+
 1. Go to '...'
 2. Click on '....'
 3. Scroll down to '....'
@@ -23,10 +24,11 @@ A clear and concise description of what you expected to happen.
 If applicable, add screenshots or video to help explain your problem.
 
 **Your Environment (please complete the following information):**
- - Device: [e.g. iPhone6]
- - OS: [e.g. iOS]
- - Browser [e.g. chrome, safari]
- - Version [e.g. 22]
+
+- Device: [e.g. iPhone 6]
+- OS: [e.g. iOS]
+- Browser: [e.g. Chrome, Safari]
+- Version [e.g. 22]
 
 **Additional context**
 Add any other context about the problem here.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,17 +1,19 @@
 <!--- Provide a general summary of your changes in the title above -->
 
 ## Types of changes
+
 <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
+
 - [ ] Bug fix (a non-breaking change which fixes an issue)
 - [ ] New feature (a non-breaking change which adds functionality)
 - [ ] Breaking change (fix or feature that would cause existing functionality to change)
 
-
 ## Description
+
 <!--- Describe your changes in detail -->
 <!--- Why is this change required? What problem does it solve? -->
 <!--- If it resolves an open issue, please link to the issue here. For example "Resolves: #1337" -->
 
+## Screenshots/Media
 
-## Screenshots/Media:
 <!--- Add any screenshots or other type of media to demonstrate your change -->

.github/semantic.yml

@@ -0,0 +1,8 @@
+# Semantic Pull Requests: validate the pull request TITLE, not the
+# commits inside it.
+#
+# The app's default accepts a PR when *either* the title or the commits
+# are conventional. These repos squash-merge, so the title becomes the
+# merge commit's subject - a well-committed PR with a prose title passed
+# the check, then broke `lint:commit` on develop for every later push.
+titleOnly: true