feat: add config drift checks to Drupal site workflow

CHANGELOG.md

@@ -6,6 +6,10 @@ Changelog", this file is a reverse-chronological list of merged pull requests.
 
 ## Open PR's
 
+- [PR-160](https://github.com/itk-dev/devops_itkdev-docker/pull/160) - 2026-10-28 -
+  Drupal site workflow checks that config exports unchanged, that update
+  hooks leave no unexported config, and (with `drupal/config_inspector`)
+  that config matches its schema
 - [PR-159](https://github.com/itk-dev/devops_itkdev-docker/pull/159) - 2026-10-26 -
   Switched the Drupal and Symfony templates to `nginx/nginx-unprivileged`,
   as `nginxinc/nginx-unprivileged` is no longer maintained

docs/github-actions-templates.md

@@ -1,6 +1,6 @@
 <!-- DO NOT EDIT THIS FILE!
 
-It was automatically created at 2025-06-12T14:50:42+02:00
+It was automatically created at 2026-10-28T08:54:52+01:00
 by task/scripts/github-documentation-update
 based on /app/task/scripts/../templates/github-actions-templates.md
 -->
@@ -182,6 +182,21 @@ pull request).
    services.
 3. The Drupal site can be installed from existing config.
 
+#### Config checks
+
+1. Config is up to date: exporting config from a site installed from config
+   must not change anything in `config/`.
+2. Config changed by update hooks is exported: after running database
+   updates (on pull request), the active config may only differ from the
+   config in code where the pull request itself changes config.
+3. Config matches its schema (only if
+   [drupal/config_inspector](https://www.drupal.org/project/config_inspector)
+   is a dev requirement in `composer.json`):
+
+   ``` shell
+   docker compose run --rm phpfpm composer require --dev drupal/config_inspector
+   ```
+
 ---
 
 [github/workflows/drupal/styles.yaml](github/workflows/drupal/styles.yaml)

github/workflows/drupal/site.yaml

@@ -15,6 +15,21 @@
 ###    services and the default settings match connection credentials for these
 ###    services.
 ### 3. The Drupal site can be installed from existing config.
+###
+### #### Config checks
+###
+### 1. Config is up to date: exporting config from a site installed from config
+###    must not change anything in `config/`.
+### 2. Config changed by update hooks is exported: after running database
+###    updates (on pull request), the active config may only differ from the
+###    config in code where the pull request itself changes config.
+### 3. Config matches its schema (only if
+###    [drupal/config_inspector](https://www.drupal.org/project/config_inspector)
+###    is a dev requirement in `composer.json`):
+###
+###    ``` shell
+###    docker compose run --rm phpfpm composer require --dev drupal/config_inspector
+###    ```
 
 name: Drupal
 
@@ -54,11 +69,32 @@ jobs:
           <?php
 
           $settings['hash_salt'] = '${{ github.head_ref }}';
+          // Do not download translations when installing modules.
+          $config['locale.settings']['translation']['import_enabled'] = FALSE;
           EOF
 
           # Install the site from config
           docker compose exec phpfpm vendor/bin/drush site:install --existing-config --yes
 
+      - name: Check that config is up to date
+        run: |
+          # Exporting a site installed from config must reproduce the config.
+          docker compose exec phpfpm vendor/bin/drush config:export --yes
+          git status --porcelain config/
+          git diff --exit-code config/
+          test -z "$(git status --porcelain config/)"
+
+      - name: Check that config matches its schema
+        # Report schema errors even if the config is not up to date.
+        if: ${{ !cancelled() }}
+        run: |
+          if ! docker compose exec phpfpm composer show drupal/config_inspector > /dev/null 2>&1; then
+            echo "::notice::drupal/config_inspector is not installed; skipping config schema check"
+            exit 0
+          fi
+          docker compose exec phpfpm vendor/bin/drush pm:install config_inspector --yes
+          docker compose exec phpfpm vendor/bin/drush config:inspect --only-error --detail
+
       - name: Show site URL
         run: |
           echo $(docker compose exec phpfpm vendor/bin/drush --uri=http://$(docker compose port nginx 8080) user:login)
@@ -115,6 +151,8 @@ jobs:
           <?php
 
           $settings['hash_salt'] = '${{ github.head_ref }}';
+          // Do not download translations when installing modules.
+          $config['locale.settings']['translation']['import_enabled'] = FALSE;
           EOF
 
           # Install the site from config
@@ -135,6 +173,8 @@ jobs:
           # Keep our local settings (cf.
           # https://github.com/actions/checkout?tab=readme-ov-file#usage)
           clean: false
+          # Needed to diff config against the base branch.
+          fetch-depth: 0
 
       - name: Start docker and install dependencies
         run: |
@@ -144,6 +184,30 @@ jobs:
           # Important: Use --no-interaction to make https://getcomposer.org/doc/06-config.md#discard-changes have effect.
           docker compose exec phpfpm composer install --no-interaction
 
+      - name: Run database updates
+        run: |
+          docker compose exec phpfpm vendor/bin/drush updatedb --yes
+
+      - name: Check that config changed by updates is exported
+        run: |
+          # After running updates, but before importing config, the active
+          # config may only differ from the config in code where this pull
+          # request changes the config. Any other difference comes from an
+          # update hook changing config that has not been exported.
+          # Collection prefixes (e.g. "language.da:") and directories are
+          # stripped so names from both sides compare.
+          git diff --name-only origin/${{ github.base_ref }} -- config/ \
+            | sed -E 's#^.*/##; s#\.yml$##' | sort -u > changed-by-pr.txt
+          docker compose exec -T phpfpm vendor/bin/drush config:status --format=json \
+            | jq -r 'if type == "object" then keys[] else empty end' \
+            | sed -E 's#^.*:##' | sort -u > changed-in-db.txt
+          comm -23 changed-in-db.txt changed-by-pr.txt > not-exported.txt
+          if [ -s not-exported.txt ]; then
+            echo "::error::Active config differs from config/sync (not changed by this pull request), e.g. config changed by update hooks that has not been exported:"
+            cat not-exported.txt
+            exit 1
+          fi
+
       - name: Update site
         run: |
           docker compose exec phpfpm vendor/bin/drush deploy --yes