Downloading updates failed: lightning-8.x-1.13-core.tar.gz does not contain any .info.yml files.

I can test this to confirm, but I suspect that this is a stupid in Drupal core.

It sounds to me like Drupal is treating Lightning as a module, which it is not. The update page is probably expecting the downloaded tarball to be a module or theme, which means it would have a .info.yml file in its top-level directory. But Lightning is a distribution, which means that it includes a complete copy of core, as well as several modules (all in subdirectories). It doesn't look like a module because it isn't one. Core should be smart enough to tell the difference, but if my suspicion is correct, it's not. And that is leading to the confusion.

Assuming you originally installed Lightning from a tarball, update it thusly:

1) Download and extract the 1.13 tarball.
2) Overwrite the old core directory with the one from 1.13.
3) Overwrite the old profiles/lightning directory with the one from 1.13.
4) Visit /update.php to perform any needed database updates.

This is also covered in Lightning's UPDATE.md.

I hope this helps!

I've tried to trace this in a debugger (from a clean Composer install of Lightning 1.12) and cannot reproduce it. Lightning does not come up in the list of projects for which updates are available.

I also cannot think of anything Lightning does that would cause Drupal to think it is a module, rather than a profile. I promise, Lightning does not hack core or contain logic that touches the update system in any way. It avoids the low-level inner workings of core. Without being able to reproduce it, I'm not sure how I can help further.

Never mind -- I've traced this after installing the Lightning tarball and it is unambiguously a condition in Drupal core. I can't say for sure that it is a bug, but core definitely treats profiles as modules, and this seems to be the source of the problem. What IS interesting is that this problem appears to affect Lightning only when it was installed by tarball, not via Composer.

The problem occurs in the _system_rebuild_module_data() function, which is called (indirectly) by the update manager:

1. First, the available install profiles are scanned. Lightning is found in this pass, because it is, in fact, an install profile. So far, so good.
2. Lightning is also marked (correctly) as the current profile by drupal_get_profile().
3. On line 977 of system.module, the current profile is explicitly added to the module list. This, in turn, causes it to be added to the update list.

So what we really need to figured out is why core only "sees" Lightning when you've installed the tarball, and not when you've installed via Composer. Either way, this is a core issue, and we should open a follow-up issue in its queue. It's mostly definitely a legitimate (and interesting) discovery, but it's not up to Lightning to fix.

I have taken a look at this with fresh eyes and discovered a few surprising things.

Firstly, it is most definitely a core problem...but not the problem I initially thought it was. The issue is that the core Update module does not know how to deal with distributions. It does know how to handle install profiles (which Lightning is), but it doesn't account for the possibility that the profile might be part of a distribution (which is also the case with Lightning). Therefore, it uses the download URL provided by the update server, which is the full package -- including core, contrib modules, the whole enchilada -- when what it really should be using is the download URL for the profile alone (which is also provided for all distributions).

The good news is, Lightning can patch over the problem. That is what I did here. Apply it, clear all caches, and it should work. If it does, please let us know and we'll commit this to Lightning tout-de-suite. My apologies for the long and protracted time it took to chase this down.

The 8.x-1.x branch of Lightning is no longer supported, so I'm closing this issue.