Add permanent warning message for experimental profiles to avoid its usage on production sites

adding some of the ideas that were mentioned for when the message might be displayed

Let's try and hash through this on next week's UX call!

So how do we identify and experimental profile programatically?

We'd need to indicate it somewhere in the profile's info file....

• ModulesListForm tests the module package name to catch experimental modules being enabled.
• Themes can also have the package key, although we don't display it on the appearance page.
• So I guess profiles can have the package key too? None of the core profiles have it though.

My initial idea is that we can add a routing subscriber to core (in system module?) to:

• act on /admin routes (what about /node/add etc?)
• check if the current profile package name says experimental
• then drupal_set_message(). Warning- or Error-level?

Related: there's a github PR to put a message into the Umami Profile itself.
https://github.com/gareth-fivemile/demo_umami/issues/36

That will suffice for the MVP version of Umami Profile, and reduces the urgency of this issue. This issue is about making the message for all experimental profiles in future.

I think this can be done with hook_page_top(). (I was mixed up about what a route subscriber was for in #7.)

I looked at the implementation in update_page_top(), which is how the update module places the reminder about updateson all admin pages. The route test logic for an admin page is there.

I'll have a go at this.

One other idea that came up and is nice is the idea of using a Block for this, because this is simply configuration that the profile can do, vs. having to hack either of the themes.

Here's a first attempt, implements the idea from #7 - #10.

This patch:

• Adds a package: Core line to the info files for Standard and Minimal profiles.
• Adds a package: Testing line to the core test profiles.
• Implements hook_page_top() in the System module.
  • First it checks for an admin route + permission
  • Then it loads up the profile's info file
  • Checks if package key says "Core (Experimental)". This is the same test the module page carries out to warn you about installing experimental modules.
  • Displays a warning message with the human-readable name of the profile.

Note this patch doesn't actually provide an experimental profile. To test manually, you can apply the patch, then manually edit the standard.info.yml to say package: Core (Experimental). Here's what the message looks like:

Todo:

• Decide severity of message; warning, or error?
• Add package: Core (Experimental) to the info file for the Umami profile when it lands in core.
• Add a functional test for this message. I think a test profile could just be an info file with package: Core (Experimental), and hidden: true to avoid displaying it on the installer form.

Re: #13 - if the message is a block, surely a site builder could disable it?

@smaz posted this screenshot of a coded proof of concept earlier today:

I think the technical approach is that the profile would be able to inject some html into the toolbar. I think that would actually be a good way to go about this:

- Toolbar is visible on both site and admin pages
- It’s persistent
- It’s in the location where sitebuilders go to navigate to stuff, which makes it actually visible

Filling up unused space in the toolbar is defensible here, because if more items were to show up in the toolbar, then people are probably extending and building something serious, which they shouldn't. So it would then be better for this message to visually break things.

Anyway, should we be able to also inject some custom CSS for this then it could look something like this:

The warning icon is already present in core, not a new asset. For mobile display it would only show that warning icon.

Thoughts?

#18 seems great to me.

Can we add a "more info" link to the end of the yellow bubble, to link to a help page/status report entry/whatever that tells the user why it's only for testing purposes and what to do once they're done testing and want to build something they will use?

For the mobile version, would clicking on the warning triangle open a vertical pane (like the normal mobile menu) with the same message as the desktop version?

Or make the whole of that message act as that link? Then the mobile version could then go straight to that link as well, without an in-place expansion.

Or make the whole of that message act as that link? Then the mobile version could then go straight to that link as well, without an in-place expansion.

Makes sense for mobile. I think we would want the "More information" text to be included in actual text (and styled more like a link), because the yellow bubble is already visually distinct from the buttons (and so does not look clickable). Unless we actually made it like a long yellow version of the other buttons, or something.

Or make the whole of that message act as that link? Then the mobile version could then go straight to that link as well, without an in-place expansion.

Makes sense for mobile. I think we would want the "More information" text to be included in actual explicit text (and styled more like a link), because the yellow bubble is already visually distinct from the buttons (and so does not look clickable). Unless we actually made it like a long yellow version of the other buttons, or something (and even then I'm not sure it'd be clear it was a link).

Links should look like links, not like buttons :)
If we underline the message itself on hover that would communicate a link, "More info…" is mostly redundant then.

A warning on every page is very distracting.

What is the actual problem with using this profile (or any experimental profile) on a production site that is so bad that it would justify such a prominent warning?

I looked at the code and couldn't find much:

1. Like most install profiles, most of the "code" is actually configuration which is installed once and then forgotten about. So it doesn't matter if future iterations of the install profile make radical changes to that configuration; it won't have any effect on a site that is already installed.
2. For the actual code, the main things I found were the two blocks: "Umami Footer promo" and "Umami disclaimer". These are defined by the profile and are also configurable, so if someone edited those blocks to customize their content for a production site, it could theoretically break if the profile decided to made radical changes to how the blocks function later on.

The above doesn't argue for a warning on every page of the site - instead it argues for something much simpler, like a warning message at the top of those two specific block configuration pages (that someone would see before they customized those blocks for their site).

Or are there other ways this could break that I'm not thinking of? (I guess the experimental profile uses an experimental theme, but warning about that is presumably the job of the theme, not the profile, so really more #2829101: Make it possible to add experimental themes into core than this issue - and besides, the easy solution there is just to fork the theme which you'd be likely to do for a production site anyway.)

The profile will also enable experimental modules by default, which is an important reason behind showing the warning.

Right now it doesn't use experimental modules (at least not that I noticed), but even if it will - why do those need to be warned about any more prominently than experimental modules are already warned about elsewhere?

Also, starting with 8.5.0, my understanding is that experimental modules (unlike experimental profiles) will have to meet https://www.drupal.org/core/experimental#beta in order to be included in a stable (non-development) release of Drupal core. This means that it should be pretty low risk to use them on a production site - not zero risk, but again, not really seeing why it justifies a very loud warning.

I agree with #26 that the risks involved with the installation profile are not very likely, especially in basic use cases.

The biggest risk I can see with the installation profile is that we will be changing the install configuration including the enabled modules. Some people will re-install Drupal, for example, if they have multiple applications using the same code base. If the installation configuration has been changed, this could break their applications, CI, etc.

Also, it is difficult to predict what kind of breaks there will be, so I do think that we should have some warnings in place to inform the users and something like #18 seems sufficient for me.

The profile does not use any experimental modules at the moment.

From our latest discussions we don't think it will use experimental modules in the future either.

We plan to show what you can do with Drupal (stable) "out of the box", so may use media when that is stable in core, and layout when that is stable in core, and workflow when that is stable in core etc.

The biggest risk I can see with the installation profile is that we will be changing the install configuration including the enabled modules. Some people will re-install Drupal, for example, if they have multiple applications using the same code base. If the installation configuration has been changed, this could break their applications, CI, etc.

The Standard profile has already changed its configuration and enabled new modules since Drupal 8.0.0 was released. This profile may do it more (even after it stops being "experimental") but I don't see a real difference. And anyone who has the above requirements really needs to be using a custom install profile for that (and almost certainly will be anyway).

--

Bottom line, there really doesn't seem to be an actual reason to put a warning message on every page of the site. This is supposed to be a nice demo of Drupal. A warning message will get in the way of the demo, distract people, show up in screenshots, etc. Maybe it serves as an effective "demo" of Drupal's admin UX failures, but that's probably not the goal :)

`This demo is for testing purposes only.`

Is that agreed text? It’s not ‘just for testing’; it’s for showcasing, educating, selling, exploring, testing, lots of other things.

Maybe something like `This installation is for demonstration purposes only` might be more appropriate.

Agreed to @markconroy It's a bit odd, testing is not an appropriate description.

This installation is for demonstration purposes only.

is much better!

+1 for the suggested text change.

This needs a committable patch by alpha, the wording can be refined after.

EDIT: or maybe this is included in the Umami profile patch?

I am not sure the status of this issue - there now seem to be several others addressing similar things (such as #2938800: Finalize wording for Toolbar warning message).

Also, the issue title here is about experimental profiles in general, but the issue summary is about Umami-specific considerations (that go beyond whether or not it is in the experimental profile stage, and instead focus on its "demo" nature).

In any case, after delving pretty deeply into Umami and writing a few patches for it, I'm even more convinced than I was before that "this-profile-is-always-intended-to-be-a-demo-and-if-you-use-it-to-build-your-production-site-it-will-break" is not the right message to be conveying. The profile is mostly configuration, with only a small amount of custom code. And the custom code related to the profile's blocks (which I mentioned in #26 above) will go away if #2938900: Replace profile-defined blocks with custom blocks to fix a variety of problems gets in. The theme may certainly change in the future, but shouldn't (deliberately) break a valid site Drupal configuration that wasn't already broken before. So there shouldn't be a long-term risk.

That said, the warning message proposed in the toolbar here doesn't actually scream out the above warning - it's more informational in nature, and tells people that the main purpose of the profile is to create demo sites (which it obviously is). So it's not necessarily in conflict with the above argument.

Also, the profile is currently experimental, and during that time, it might have some bugs that break things in the Drupal admin UI (#2938911: Umami theme hardcodes too many assumptions about the install profile and site configuration contains some examples). That is a good reason to warn people about this, or any, experimental profile.

Bottom line:

1. Figure out if a toolbar message is appropriate for experimental profiles in general (I think probably not).
2. Figure out if a toolbar message is appropriate for Umami in particular, due to its demo nature (not due to its experimental nature), and if so, figure out what it should look like. Can continue discussion in #2938800: Finalize wording for Toolbar warning message, I suppose.
3. Figure out what else should be done to warn about experimental profiles in general. For example, Umami puts a warning on the status report - if that is appropriate for experimental profiles in general then the wording can be generalized (note that #2938805: Finalise the wording of the warning message on the status report page contains some text changes that might make it so) and the code moved out of Umami and into the main part of Drupal core.

Hope that helps.

This has been covered by several other issues now, I believe. The following meta issue can be used for tracking their status:

#2938189: [META] Finalise the wording of the messages in installer, toolbar and on the status report page

I don't think this is outdated. Other issues hve been making changes directly in the Umami profile, which I understood was a temporary measure for the Umami MVP deadline which was missed.

The meta issue you linked to is just about wording in Umami. If other experimental profiles emerge, we'd still want to look at a generic approach.

Sorry, I'll leave the status alone, probably don't need to reopen until another experimental profile idea emerges.

I think it should remain open, at least for point 3 in #38 - contrib installation profiles could decide to be "experimental" too (just like some contrib modules are) and it would be better to have a standardized message about those on the status report, rather than having each profile try to come up with its own ideas for how to signal it.

Also point #1 in the same comment; I'm fine with the answer being "no" personally, but not sure if everyone else here agrees yet.

Thank you for creating this issue to improve Drupal.

We are working to decide if this task is still relevant to a currently supported version of Drupal. There hasn't been any discussion here for over 8 years which suggests that this has either been implemented or is no longer relevant. Your thoughts on this will allow a decision to be made.

Since we need more information to move forward with this issue, the status is now Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.

Thanks!

Given that Umami is our only experimental profile and that is moving to contrib/recipes/site templates, I don't think we need to keep this issue open any more.

Originally - back in 2016 or sometime - we had a thought that we might have other installation profiles as well as Umami (that's why we called it demo_umami, so we could also have demo_* profiles). I don't think there will be an appetite to create more of these now that we have the idea of site templates and recipes.

Closing as outdated.