RightUp's front end returns HTTP 500 after install: the header pins Canvas component versions that do not exist

Problem/Motivation

A fresh RightUp install on Drupal CMS exits 0 with no warnings, but every front-end page answers HTTP 500: /, /features, /blog, /about-varbase, /contact-us, /user/login and /search.

Reproduced on Drupal core 11.4.6, drupal/canvas 1.11.0, drupal/rightup 1.0.x-dev at e2699b0, drupal/vartheme_bs5_rightup 1.0.x-dev at 331128e.

OutOfRangeException: The requested version `1fabce12570a28f0` is not available.
Available versions: `5398ac38a86f677e`, `ab1b678dc1806d89`, `89c883e11d4f832c`, `5a87298f3691cd43`.
in Drupal\canvas\Entity\VersionedConfigEntityBase->assertVersionExists()

config/canvas.page_region.vartheme_bs5_rightup.header.yml (added in #3620717) pins two components to versions that no shipped component config declares:

• sdc.vartheme_bs5_rightup.icon-toggle@1fabce12570a28f0; the recipe ships active ab1b678dc1806d89
• sdc.vartheme_bs5_rightup.button@89760b927a14a505; the recipe ships active 7c8b7b626a4fbd83

The header renders on every page, so the whole front end is down. The header also uses sdc.vartheme_bs5_rightup.offcanvas-menu, whose component config the recipe does not ship at all. Its version resolves today only because it matches whatever the theme's code hashes to on install day, so the next change to that component in the theme breaks the header the same way.

Nothing in CI checks that a shipped component tree references a declared version.

Steps to reproduce

mkdir -p my-drupal-cms-rightup && cd my-drupal-cms-rightup
ddev config --project-type=drupal11 --docroot=web
ddev composer create-project drupal/cms
ddev composer config minimum-stability dev
ddev composer require drupal/rightup:1.0.x-dev
ddev drush si -y ../recipes/rightup
curl -sk -o /dev/null -w '%{http_code}\n' https://my-drupal-cms-rightup.ddev.site/

Proposed resolution

• Point the header's icon-toggle and button at the active versions the recipe ships (ab1b678dc1806d89, 7c8b7b626a4fbd83). These are the versions every other shipped tree already uses, and Canvas keeps them in the installed version history.
• Ship config/canvas.component.sdc.vartheme_bs5_rightup.offcanvas-menu.yml, so the header's offcanvas-menu reference no longer depends on install-day hashing.
• Add a validate-stage CI job, .gitlab-ci/check-canvas-component-versions.py, that fails when any tree in config/ or content/ references an undeclared or unshipped component version (active is accepted). Against the current 1.0.x it reports all three problems and exits 1.

Verification

A fresh DDEV project built with the steps above, with the fixed recipe in recipes/rightup, no patches and no cache rebuild after the install:

• drush si exits 0, with no warnings or errors.
• All seven pages above answer HTTP 200.
• 0 of the 503 component instances on the site (pages, page regions, content templates, patterns) reference an unavailable version.
• The CI check passes on the branch: 174 references, 0 invalid.

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ✅ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

N/A

API changes

N/A

Data model changes

N/A

Release notes snippet

RightUp's front end no longer returns HTTP 500 after a fresh install: the header references the component versions the recipe ships, and CI now rejects component trees pinned to undeclared versions.