Remove the Varbase API Base requirement, as the recipe is never applied and only drags its dependencies into every install

Problem/Motivation

composer.json requires drupal/varbase_api_base: 1.0.x-dev, but recipe.yml never lists varbase_api_base in its recipes: list. The recipe is therefore never applied — the requirement only pulls its Composer dependencies into every install of this site template.

Varbase API Base describes itself as "A recipe to set up JSON:API with authentication, authorization, and OpenAPI documentation for easy content ingestion by other applications." Its install: list is jsonapi, openapi, openapi_jsonapi, openapi_rest, openapi_ui_redoc, openapi_ui_swagger, simple_oauth, restui, jsonapi_extras, jsonapi_defaults.

Requiring it drags all of that into the dependency graph of every Horizon Aid site:

• drupal/consumers, drupal/simple_oauth (~6)
• drupal/openapi, drupal/openapi_jsonapi, drupal/openapi_rest, drupal/openapi_ui_redoc, drupal/openapi_ui_swagger
• drupal/restui, drupal/jsonapi_extras
• drupal/schema_metatag
• vardot/swagger-ui (a drupal-library package installed into web/libraries)

This is the same pattern as #3620330 (Varbase Dev Base), and it carries an API and authentication surface — simple_oauth, restui, jsonapi — into a site template that never turns any of it on.

Steps to reproduce

Verified on a fresh install of 1.0.x-dev on a Varbase base. None of the ten modules the recipe would install is enabled, which confirms the recipe is never applied:

for m in jsonapi openapi openapi_jsonapi openapi_rest openapi_ui_redoc \
         openapi_ui_swagger simple_oauth restui jsonapi_extras jsonapi_defaults consumers; do
  ddev drush pm:list --status=enabled --field=name --filter="$m"
done

All eleven report not enabled, while the package and its dependencies are present in the codebase. Also confirmed by reading the recipe list directly: varbase_api_base appears in composer.json and nowhere in recipe.yml.

Proposed resolution

Remove "drupal/varbase_api_base": "1.0.x-dev" from composer.json. No recipe, config or install behaviour on an installed site is affected, because recipe.yml does not reference it.

Correction: it does not change only composer.json

An earlier revision of this summary claimed "nothing else changes". That was wrong, and CI caught it. The requirement was load-bearing for the pipeline, not for the site.

.gitlab-ci.yml asserts that six front-end libraries are physically placed after install, and two of those paths exist only because varbase_api_base required vardot/swagger-ui:

web/libraries/swagger-ui/dist/swagger-ui-bundle.js
web/libraries/swagger-ui/dist/swagger-ui.css

With the requirement removed, those files are no longer installed and the assertion fails, so 🧩 (Drupal CMS) Install Horizon Aid site template fails on the merged commit. The library-placement assertion therefore has to drop those two paths in the same change.

Worth stating plainly for anyone reading this later: the dependency was genuinely unused by the site template, and it was still not free to remove. The check that caught it is a placement assertion rather than a declaration, which is exactly why it caught it.

Anyone wanting a JSON:API and OpenAPI surface adds it deliberately on their own site:

composer require drupal/varbase_api_base
drush recipe recipes/varbase_api_base

That is the right place for a recipe that exposes an authenticated API, since whether a site should publish one is a per-project decision rather than a property of the site template.

The same pattern exists elsewhere in this composer.json

Checked, not assumed. Three other Varbase base recipes are required but absent from the recipes: list: varbase_ai_base, varbase_auth_base and varbase_i18n_base. Those are left out of this issue deliberately — each is arguably shipped so a site builder can apply it later, and that is a separate judgement per recipe. This issue covers varbase_api_base only.

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ✅ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ✅ Update Release Notes
• ✅ Release, horizonaid-1.0.0-alpha2

User interface changes

• N/A

API changes

• N/A for site behaviour. The recipe was never applied, so no JSON:API or OpenAPI surface is removed from any installed site. The vardot/swagger-ui library is no longer installed into web/libraries, which is why the CI library-placement assertion changes too.

Data model changes

• N/A

Release notes snippet

• Removed the Varbase API Base requirement. It was never applied by the site template recipe, and its JSON:API, OpenAPI and Simple OAuth dependencies, along with the vardot/swagger-ui library, are no longer installed by default. Add it explicitly if your site needs an API surface.