ci: Bootstrap composer-drupal-lenient in CI so CKEditor Media Resize resolves against Drupal core 11.4

Problem/Motivation

The 🍹 Automated Functional Testing CI job assembles a throwaway Varbase 11 site via composer create-project drupal/varbase_project:11.0.x-dev then composer require "drupal/varbase_events_base:@dev" drush/drush:^13 -W. On the current 1.0.x branch this fails with:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires vardot/varbase 11.0.x-dev -> satisfiable by vardot/varbase[11.0.x-dev].
    - drupal/ckeditor_media_resize[1.1.0, ..., 1.1.x-dev] require drupal/core ~10.5.0 || ~10.6.0 || ~11.2.0 || ~11.3.0 -> found drupal/core[10.5.0-beta1, ..., 10.6.x-dev, 11.2.0-alpha1, ..., 11.3.x-dev] but it conflicts with your root composer.json require (~11.4.0).
    - drupal/varbase_editor_base 1.0.x-dev requires drupal/ckeditor_media_resize ~1.1.0 -> satisfiable by drupal/ckeditor_media_resize[1.1.0, 1.1.x-dev].
    - drupal/varbase_starter 1.0.x-dev requires drupal/varbase_editor_base 1.0.x-dev -> satisfiable by drupal/varbase_starter[1.0.x-dev].
    - vardot/varbase 11.0.x-dev requires drupal/varbase_starter 1.0.x-dev -> satisfiable by drupal/varbase_starter[1.0.x-dev].

See the failing job: job 11027103 on pipeline 894306, which ran on the latest commit merged to 1.0.x (from !8, #3610873).

Upstream root cause (not ours to fix, already filed by the maintainer): #3607786 – the CKEditor Media Resize module's published 1.1.0 metadata narrows its drupal/core constraint to ~10.5.0 || ~10.6.0 || ~11.2.0 || ~11.3.0, excluding Drupal 11.4. Four MRs are open there, unmerged.

varbase_project already declares mglaman/composer-drupal-lenient (^1.0) with extra.drupal-lenient.allowed-list: ["drupal/ckeditor_media_resize"] to work around this – but a plugin that must influence dependency resolution has to already be active (in vendor/) before the solve. A plugin only listed in require is not installed/active until after a successful solve, so on a lock-less create-project --no-install + require, it never engages and the raw conflict above surfaces.

Steps to reproduce

1. On a fresh container matching the CI image (php:8.4-apache), run composer create-project drupal/varbase_project:11.0.x-dev test-project --no-interaction --no-install.
2. Run composer require "drupal/varbase_events_base:@dev" drush/drush:^13 -W against a path repository for the actual varbase_events_base recipe (or simply re-run the 🍹 Automated Functional Testing job on the current 1.0.x HEAD, e.g. job 11027103).
3. Observe the "Your requirements could not be resolved" error above.

Proposed resolution

Bootstrap mglaman/composer-drupal-lenient globally in the job's before_script, before composer create-project runs, so its solver hook is already active (Composer loads globally-installed plugins for every command) by the time the real solve happens. The project's own extra.drupal-lenient.allowed-list is still read from the root package being solved, so this only relaxes drupal/ckeditor_media_resize's own declared core constraint (working around #3607786), nothing else:

composer global config --no-plugins allow-plugins.mglaman/composer-drupal-lenient true
composer global require mglaman/composer-drupal-lenient --no-interaction --no-progress

This is added to .gitlab-ci.yml's 🍹 Automated Functional Testing job, right after apt-get install -y nodejs and before the project is assembled.

This exact fix is already independently proven to work: an unrelated open MR on this repo, !7 (#3611860), already carries this same global-bootstrap snippet. Its pipeline run (job 11025212, pipeline 894183) shows the solve succeeding – Locking drupal/ckeditor_media_resize (1.1.0) appears in the trace, and composer require succeeds on the first attempt. !7 is unrelated in scope (it removes a temporary Varbase Components issue-fork pin) and is not touched by this issue; this issue ports the same CI fix onto 1.0.x directly since !7 has not merged yet.

Note: that same job 11025212 still went red overall, but only because of a different, pre-existing, unrelated bug – a missing local patch file (patches/canvas-3575644-string-long-regex-ai-context-item.patch) referenced by the curated Varbase patch set, which breaks composer install's patch-application step. That is out of scope for this issue.

Remaining tasks

• ✅ File an issue about this project
• ❌ Addition/Change/Update/Fix to this project
• ❌ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support on feature change/addition
• ➖ User Guide Documentation support on feature change/addition
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ✅ Update Release Notes
• ✅ Release varbase_events_base-1.0.0-alpha1

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• N/A