RightUp does not install: 379 warnings, dangling media references, and no functional CI

Problem/Motivation

drupal/rightup:1.0.x-dev cannot be installed on a plain Drupal CMS host. Reproduced on Drupal core 11.4.6, PHP 8.4, drupal/canvas 1.11.0:

ddev drush si -y ../recipes/rightup
=> exit 1, 379 warnings, 1 error

Three separate defects:

1. 21 broken Canvas component config files. config/canvas.component.sdc.vartheme_bs5_rightup.*.yml are exported with active_version: fallback and an empty last_active_version, so every load emits three PHP warnings from Component.php (Undefined array key "" then two Trying to access array offset on null) - 126 of them before the install aborts.
2. 25 dangling media references. The five Canvas pages and canvas.pattern.hero_slider.yml reference 18 unique media entities by UUID that nothing ships. #3621686 removed varbase_demo_content, which was the only thing pulling in the media those pages point at. Install dies with AssertionError: assert($entity instanceof EntityInterface) in DefaultContentSubscriber.php:204.
3. canvas_page_template_component is not installed by the recipe. RightUp ships canvas.page_region.vartheme_bs5_rightup.header and .footer, so Canvas installs that module during RecipeAppliedEvent, rebuilding the container mid-dispatch. Same defect and same one-line fix as varbase_starter #3622105 and horizonaid #3622092.

Separately, CI only runs composer validate and a YAML lint - 54 lines, no install and no functional testing, so none of the above was caught.

Steps to reproduce

mkdir -p my-drupal-site-rightup && cd my-drupal-site-rightup
ddev config --project-type=drupal11 --docroot=web
ddev composer create-project drupal/cms
ddev composer config minimum-stability dev
ddev composer require drupal/rightup:1.0.x-dev
ddev drush si -y ../recipes/rightup

Proposed resolution

• Delete the 21 active_version: fallback config files and their 21 matching disable: [] actions in recipe.yml - removing only the files fails the install with Entity ... does not exist.
• Ship RightUp's own media, the way Horizon Aid does: 18 media entities, 17 file entities and their 17 image binaries in content/media and content/file (~16 MB), keeping the existing UUIDs so the Canvas pages resolve unchanged. No dependency on varbase_media_assets or varbase_demo_content - RightUp stays self-contained.
• Add canvas_page_template_component to the recipe's install: list.
• Replace .gitlab-ci.yml with the Drupal CMS pipeline Varbase Starter now uses (install job, plus the functional and functional smoke test jobs), and add the Varbase E2E suite (tests/, package.json, cucumber.js, playwright.config.ts, eslint.config.js, scripts/). The install job's content guard checks Canvas pages only, because RightUp deliberately ships no demo content nodes (#3621686).

Verification

All run locally, no patches, nothing pinned.

After install on both: default theme vartheme_bs5_rightup, 18 media, 5 Canvas pages, and /, /features, /blog, /about-varbase, /contact-us, /user/login all HTTP 200.

Remaining tasks

• ✅ File an issue
• ❌ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ❌ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• RightUp now installs cleanly on Drupal CMS and on a Varbase project: the broken Canvas component configs are removed, the site template ships its own media, canvas_page_template_component is installed by the recipe, and CI runs a real install plus functional tests.

Notes for whoever sets this up

• On a drupal/varbase_project:~11 host, composer require drupal/rightup:1.0.x-dev fails to resolve without --with-all-dependencies: the project lock pins drupal/varbase_recipes to 1.0.0 while RightUp's dev dependencies want 1.0.x-dev.
• That host's patches.lock.json can pin a stale Canvas patch URL even with vardot/varbase-patches 11.0.43 installed, failing with No available patcher was able to apply patch ... canvas--2026-07-26--3560889--mr-1425.patch. ddev composer patches-relock rewrites it.