osinet / qa

Quality Assurance tools for Drupal

Quality Assurance module

This module needs to be installed on your site to run checks on various aspects of your Drupal production database, configuration storage (D9/D8) and file layout.

It also has branches for D7 and D6, each running on the matching version.

CAVEAT EMPTOR - using this module and interpreting its results requires significant understanding of core operation: just because a check reports on suspicious data does not imply there is actually an problem, only that human review is needed. This tools is primarily designed to help professional auditors review sites; it is not meant for webmasters in the general case.

Built-in checks

QA is designed to be extended by additional modules implementing control plugins.

Check	Status	Description
Cache.Sizes	OK	Report on cache bins with suspicious sizes: empty, too big, too many items, items too large
Config.Overrides	Plan	Find config not matching its default value.
Config.Schema	Plan	Find config not matching its schema and schemaless config
References.Integrity	OK	Find broken references in file, image, entity_reference, entity_reference_revisions, and dynamic_entity_reference fields
References.TaxonomyIndex	OK	Find broken links in the taxonomy relating nodes and taxonomy terms
System.External	OK	Find code loaded from directories outside the project
System.ForceRemoved	TBP	Find incorrectly removed extensions
System.UndeclaredDependencies	OK	Find module dependencies not declared in <module>.info.yml files.
System.Unused	OK	Find entirely unused projects
Taxonomy.Freetagging	TBP	Find unused free-tagging terms.
Workflows.Summary	OK	Summarize content moderation workflows
Workflows.Transitions	WIP	Find inconsistent transitions

• Plan: check is expected to be developed, but not yet started
• TBP: to be ported = check existing in earlier versions but not yet ported to D9/D8.
• WIP: work in progress.

QA also includes some non-check commands.

Graph	Status	Description
qa:dependencies	OK	Graph of module and theme dependencies
qa:workflows-list	WIP	Graph of workflow

Graphs

• dependency graph of enabled modules and themes, usable either on the Web UI for smaller sites or from drush for bigger graphs. This feature will generate GraphViz .dot files, to convert with Graphviz dot command, typically by piping the output like this:

      $ drush qa-dependencies | dot -Tsvg > qa_dependencies.svg

• On Drupal 8.3 and later, graphs of the transitions in a given workflow (for core workflows, not for the contrib workflow module). This feature will generate GraphViz .dot files, to convert with Graphviz dot command, typically by piping the output like this:

       $ drush qa_workflow_graph | dot -Tsvg > qa_workflow.svg

• The workflow graph also has a tabular version.

Copyright and license

This module is © 2005-2020 Frédéric G. MARAND, for OSInet.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

Contributing

Developing additional custom checks follows this process:

• create a custom module
• create a QaCheck plugin, which will implement QaCheckInterface, and likely be based on QaCheckBase for simplicity. Its properties are:
  • id : just like any Drupal plugin. The name should be like <package>.<check_name>, where <package> will be used to group related packages in the UI. Plugins are expected to be located in the Plugin\QaCheck\<Package> directory, instead of being just in the Plugin\QaCheck directory.
  • label: the short description of the plugin, used in admin lists.
  • details: optional. A longer description of the plugin purpose, used for help in the Web UI. Default: empty.
  • usesBatch: optional. Enables use of the Batch API for long-running checks (WIP). Default: false.
  • steps: optional. The number of different steps reported by the check. Default: 1.
• add a command to QaCommands, calling QaCommands::runPlugin($name).

Contributions are welcome: use Github issues and pull requests.

qa's Issues

Native Drupal 8 plugins

Replace the home-grown plugin system with the standard D8/D9 plugins architecture.

Detect undeclared dependencies

Custom modules frequently uses code from other custom modules without declaring its dependency, assuming both are always deployed.

This check attempts to detect such missing dependencies.

In its first versions it will not attempt to be exhaustive, but just identify (a) function calls (b) in module files (c) calling functions (d) in other module files. Later versions could track OO code and/or check availability with the autoloader.

Web UI

Currently the D8/D9 version is only usable with Drush, the Web UI pages are just placeholders.

They need to be plugged with the command implementations to offer a choice between web and CLI usage.

Make Undeclared aware of required modules and indirect dependencies

Currently, Undeclared

• only checks direct dependencies
• considers required modules (normally only present in core) as undeclared dependencies. Since these are always present, they need not be considered as undeclared

Support Drush 9 for 8.x-1.x branch

The existing 8.x-1.x HEAD is only usable with Drush 8 which is no longer recommended after Drupal 8.5, and is likely to not work at all in 8.7.

Drupal 9 port

Needs

• Drush 10 (cf #7)
• composer.json / qa.info.yml upgrade
• upgrade_status compliance

qadep should not include version requirements in module names

Currently, versioned dependencies appear like "menu (> 7.11)", causing duplicate displays with normal dependencies like "menu".

The plugin should gather them together, either simply merging the dependencies and ignoring the version requirements, or gathering them with a representation of the multiples version dependencies.

Implement orphan tags check

Most content entities can be standalone, unlike taxonomy terms which are meant to be used as classifiers for other types of content.

This check identifies terms which are present but not referenced by any other content entity, or only by other terms. Manual review is needed starting from there to identify which are really unneeded, as some terms may be predefined for later use, or used only as parents of other used terms.

Fix modules without project not being detected as unused

When a project is not declared in the info.yml file, and not available through other means, it is linked to the default project, which always has enabled modules, causing such unused projects not to be discovered.

The discovery process needs to be smarter and obtain project information, possibly from the d.o. API or some heuristics based on the filesystem layout.

One possibility might be to check how update and upgrade_manager access the project information in these cases.

Port ForceRemoved to D9/D8

Extension status has evolved a lot since D7, with the removal of the system table and the installed but not enabled state.

Add support for broken ER/ERR tracking

Probably should go in a submodule which can remain enabled even if the main audit-oriented QA module is not enabled.

Support options for ignored modules

In audit situations, some modules are typically added, like QA itself : it would be convenient to provide a way to ignore some modules. Use cases:

• ignoring audit-added modules like QA or Schema
• ignoring core modules
• ignoring or only examining specific big packages, like Drupal Commerce
• ignoring disables modules
• ignoring, or just displaying, themes, libraries

Port Cache\Size control to D8

Drush 10 support

This is needed to work on Drupal 9 and useful in late Drupal 8 versions.