@@ -62,11 +62,12 @@ ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 # Add more tools.
 # hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache ncurses pv tzdata autoconf g++ make && \
-    pecl install pcov && \
-    docker-php-ext-enable pcov && \
+    pie install --no-build-tools-check pecl/pcov && \
     docker-php-ext-install pcntl && \
     apk del g++ make autoconf
 
+COPY ./.docker/config/cli/custom.ini /usr/local/etc/php/conf.d/custom.ini
+
 # Add patches and scripts.
 COPY patches /app/patches
 COPY scripts /app/scripts
@@ -78,7 +79,7 @@ COPY scripts /app/scripts
 # to the repository.
 # The .env file (and other environment files) is copied into the image, as it
 # may be needed by Composer scripts to access additional variables.
-COPY composer.json composer.* patches.lock.* .env* auth* /app/
+COPY composer.json composer.* patches.lock.* .env* /app/
 
 # Install PHP dependencies without development packages to avoid exposing
 # potential security vulnerabilities in the production environment.
 
@@ -0,0 +1 @@
+; Custom configuration for the CLI service.
@@ -0,0 +1,6 @@
+; Custom configuration for the PHP service.
+
+[Session]
+; Drupal does not use session upload progress, so it is turned off to reduce
+; the attack surface of multipart requests.
+session.upload_progress.enabled = Off
@@ -14,4 +14,6 @@ FROM uselagoon/php-8.4-fpm:__VERSION__
 # hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
+COPY ./.docker/config/php/custom.ini /usr/local/etc/php/conf.d/custom.ini
+
 COPY --from=cli /app /app
@@ -11,6 +11,9 @@
 .vscode
 **/.DS_Store
 
+# Credentials. The package token reaches the build through a build secret.
+auth*
+
 # Drupal directories generated by Composer during the image build.
 web/core
 web/libraries
 
@@ -97,7 +97,7 @@ DRUPAL_CLAMAV_MODE=daemon
 ################################################################################
 
 # By "provision", we mean the process of initialising the database (from dump
-# or fresh install from profile), running updates, appying configuration
+# or fresh install from profile), running updates, applying configuration
 # changes, clearing caches and performing other tasks that prepare the site for
 # use.
 # @see https://www.vortextemplate.com/docs/development/provision
@@ -125,6 +125,12 @@ VORTEX_PROVISION_FALLBACK_TO_PROFILE=0
 # drush config:import from silently overwriting those changes.
 VORTEX_PROVISION_VERIFY_CONFIG_UNCHANGED_AFTER_UPDATE=0
 
+# Verify that configuration was not changed by post-provision operations.
+# If enabled and config files are present, the provision will fail if any
+# active configuration item differs from the exported configuration once
+# configuration imports, deployment hooks and deploy steps have run.
+VORTEX_PROVISION_VERIFY_CONFIG_UNCHANGED_AFTER_PROVISION=0
+
 # Skip database sanitization.
 #
 # Database sanitization is enabled by default in all non-production
 
@@ -447,6 +447,11 @@ jobs:
           files: |
             .logs/test_results/**/*.xml
 
+      # Placed after the test steps so a dirty tree never suppresses them.
+      - name: Check that the build left a clean working tree
+        run: ./vendor/bin/vortex-check-worktree-changes
+        continue-on-error: ${{ vars.VORTEX_CI_WORKTREE_CHANGES_IGNORE_FAILURE == '1' }}
+
       - name: Setup tmate session
         if: ${{ !cancelled() && github.event.inputs.enable_terminal }}
         uses: mxschmitt/action-tmate@__HASH__ # __VERSION__
 
@@ -18,8 +18,9 @@ default:
         - DrevOps\BehatScreenshotExtension\Context\ScreenshotContext
 
   formatters:
-    # Show test progress and explicit fail information whule continuing the test run.
-    progress_fail: true
+    # Show test progress and explicit fail information while continuing the test run.
+    progress:
+      inline_failures: true
 
     # Output test results in JUnit format.
     junit:
@@ -93,9 +94,6 @@ default:
         - step
         - datetime
 
-    # Show explicit fail information and continue the test run.
-    DrevOps\BehatFormatProgressFail\FormatExtension: ~
-
 # Profiles for parallel testing. CI derives the profile number from the index
 # of the runner it is on minus 'VORTEX_CI_BEHAT_PROFILE_OFFSET', so profiles
 # stay numbered from 'p0' regardless of which runner Behat starts on. Adding a
 
@@ -19,6 +19,7 @@
         "drupal/devel": "__VERSION__",
         "drupal/drupal_helpers": "__VERSION__",
         "drupal/environment_indicator": "__VERSION__",
+        "drupal/fast_404": "__VERSION__",
         "drupal/generated_content": "__VERSION__",
         "drupal/navigation_extra_tools": "__VERSION__",
         "drupal/pathauto": "__VERSION__",
@@ -34,22 +35,17 @@
         "drupal/stage_file_proxy": "__VERSION__",
         "drupal/testmode": "__VERSION__",
         "drupal/xmlsitemap": "__VERSION__",
-        "drush/drush": "__VERSION__",
-        "webflo/drupal-finder": "__VERSION__"
+        "drush/drush": "__VERSION__"
     },
     "require-dev": {
         "behat/behat": "__VERSION__",
         "dantleech/gherkin-lint": "__VERSION__",
-        "dealerdirect/phpcodesniffer-composer-installer": "__VERSION__",
-        "drevops/behat-format-progress-fail": "__VERSION__",
         "drevops/behat-screenshot": "__VERSION__",
         "drevops/behat-steps": "__VERSION__",
         "drevops/phpcs-standard": "__VERSION__",
         "drupal/coder": "__VERSION__",
         "drupal/drupal-extension": "__VERSION__",
         "ergebnis/composer-normalize": "__VERSION__",
-        "lullabot/mink-selenium2-driver": "__VERSION__",
-        "lullabot/php-webdriver": "__VERSION__",
         "mglaman/phpstan-drupal": "__VERSION__",
         "mikey179/vfsstream": "__VERSION__",
         "palantirnet/drupal-rector": "__VERSION__",
@@ -59,7 +55,6 @@
         "phpstan/phpstan": "__VERSION__",
         "phpunit/phpunit": "__VERSION__",
         "pyrech/composer-changelogs": "__VERSION__",
-        "rector/rector": "__VERSION__",
         "softcreatr/jsonpath": "^0.10 || ^1.0",
         "vincentlanglet/twig-cs-fixer": "__VERSION__"
     },
 
@@ -123,6 +123,7 @@ services:
     <<: [ *default-volumes, *default-user ]
     depends_on:
       - cli
+      - appserver
     networks:
       - default # This is a standard network and is used for all other environments, where requests routing is not required and/or not supported.
       - amazeeio-network ### This network is supported by Pygmy and used to route all requests to host machine locally. Removed in CI.
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+; Custom configuration for the CLI service.`