Skip to main content
Ungathered Thoughts

What patches are we running?

I'm at a code sprint with members of the Drupal community today, and we're looking for tasks to work on. The agency company I work for manages Drupal sites for a number of clients, and across those sites we might apply patches for the same issues to various projects.

Patches are applied using cweagans/composer-patches and defined per-project using an entry in a composer patches file.

By scanning these files and looking at the related issues, we can get a high-level view of the patches in play, and start to see some interesting things.

My goal for this is to build a Composer plugin (xurizaemon/patchwatch) which can be used as a command from the project's CI, but for today (and mostly due to network issues while travelling) I shot for a quick and dirty PHP script which gave me some serviceable output.

Here's some excerpted and redacted output, to show what we can see afterwards. This is a pretty crude PoC.

And here's the quick script, somewhat munged to hopefully share my rough initial script in a single executable .php. The repository for this project will be

(I haven't embedded the output and script here because I apparently haven't sorted out code embeds on my own blog yet ... sorry!)

The interesting things we can start to see from the output above are:

Next steps are:

Something which might be interesting - if wanted to surface it - would be the download stats / popularity of patch URLs. This might indicate patches which are "popular" and being applied by lots of sites, and good candidates for review.

If this looks useful, or you know of a similar approach to this which I don't or are interested to explore further - get in touch! I'd love to hear from you.