# Drupal Update

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-trebormc-drupal-ai-agents-drupal-update`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [trebormc](https://agentstack.voostack.com/s/trebormc)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [trebormc](https://github.com/trebormc)
- **Source:** https://github.com/trebormc/drupal-ai-agents/tree/main/.claude/skills/drupal-update

## Install

```sh
agentstack add skill-trebormc-drupal-ai-agents-drupal-update
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Drupal Update Workflow

Execute updates following this EXACT sequence.

## Phase 1: Pre-flight Checks

```bash
# Verify DDEV and Drupal version
ssh web drush status --field=drupal-version

# Check for uncommitted changes (STOP if dirty)
git status --porcelain

# Check available updates
ssh web composer outdated --direct --format=json

# Check for pending database updates (should be clean)
ssh web drush updatedb:status
```

**STOP if**: Git working directory is dirty, DDEV not responding, or pending DB updates exist.

## Phase 2: Backup

```bash
ssh web drush sql:dump --result-file=/tmp/pre-update-backup.sql --gzip
git rev-parse HEAD  # Note for rollback

# VERIFY the backup before continuing (file exists and is non-empty):
ssh web test -s /tmp/pre-update-backup.sql.gz && echo "BACKUP OK" || echo "STOP: backup failed"
```

**If the output is not "BACKUP OK": STOP. Tell the user the backup failed. Do NOT continue the update.**

## Phase 3: Composer Updates

Pick ONE variant:

```bash
# Update everything — routine maintenance window, full regression test planned
ssh web composer update --with-all-dependencies

# Core only — when you only want the Drupal core release (safest scope)
ssh web composer update "drupal/core-*" --with-all-dependencies

# Specific package — targeted fix or single contrib update
ssh web composer update drupal/package_name --with-all-dependencies

# Security only — when the goal is just to patch advisories
ssh web composer audit
ssh web composer update --with-all-dependencies $(ssh web composer audit --format=json | jq -r '.advisories | keys | .[]')
```

## Phase 4: Database Updates

```bash
ssh web drush updatedb -y
ssh web drush cache:rebuild
```

## Phase 5: Configuration Sync

```bash
ssh web drush config:status
ssh web drush config:export -y
```

## Phase 6: Verification

```bash
ssh web drush core:status
ssh web drush watchdog:show --severity=error --count=10
ssh web drush core:requirements

# Run custom module tests if any exist (Form ROOT shown; if no project phpunit.xml,
# use the canonical Form CORE pattern from the drupal-testing skill):
ssh web ./vendor/bin/phpunit $DDEV_DOCROOT/modules/custom --testdox 2>/dev/null || echo "No tests"
```

## Phase 7: Present Summary

**DO NOT commit automatically.** Present changes for user review with:
- List of updated packages (from → to)
- Database updates executed
- Config changes exported
- Suggested commit message

## Rollback Procedure

Git restore commands must be run BY THE USER (agents cannot run `git checkout` — see git-workflow rule). Give the user step 1, then run steps 2-4 yourself:

```bash
# 1. ASK THE USER to run on the host:
#    git checkout composer.json composer.lock config/sync/

# 2. Restore composer packages
ssh web composer install

# 3. Restore database (if needed)
ssh web bash -c 'gunzip -c /tmp/pre-update-backup.sql.gz | drush sql:cli'

# 4. Clear caches
ssh web drush cache:rebuild
```

## Error Handling

### Composer Conflicts

```bash
# Find what blocks the update:
ssh web composer why-not drupal/package_name:^X.Y
```

Then either update the blocking package FIRST (`ssh web composer update  --with-all-dependencies`) or report the conflict to the user. NEVER use `--ignore-platform-reqs` or `--force` as a workaround.

### Database Update Failures

Run the Rollback Procedure above (restore DB from the verified backup, then have the user reset composer files).

## Command Reference

| Task | Command |
|------|---------|
| Check outdated | `ssh web composer outdated --direct` |
| Security audit | `ssh web composer audit` |
| Update all | `ssh web composer update --with-all-dependencies` |
| Update core | `ssh web composer update "drupal/core-*" --with-all-dependencies` |
| Backup DB | `ssh web drush sql:dump --result-file=/tmp/backup.sql --gzip` |
| Check requirements | `ssh web drush core:requirements` |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [trebormc](https://github.com/trebormc)
- **Source:** [trebormc/drupal-ai-agents](https://github.com/trebormc/drupal-ai-agents)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-trebormc-drupal-ai-agents-drupal-update
- Seller: https://agentstack.voostack.com/s/trebormc
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.