From f39b90c917aa3a14d350edc09ddc131416f51726 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Tue, 9 May 2023 16:52:39 -0400
Subject: [PATCH 01/38] Install go binaries globally in ddev #172

---
 scaffold/ddev/web-build/Dockerfile.drainpipe  |   8 +
 .../install-local-php-security-checker.sh     | 381 +++++++++++++++++
 scaffold/ddev/web-build/install-task.sh       | 387 ++++++++++++++++++
 src/ScaffoldInstallerPlugin.php               |  12 +
 .../src/Functional/InstallerScaffoldTest.php  |   1 +
 5 files changed, 789 insertions(+)
 create mode 100644 scaffold/ddev/web-build/Dockerfile.drainpipe
 create mode 100755 scaffold/ddev/web-build/install-local-php-security-checker.sh
 create mode 100755 scaffold/ddev/web-build/install-task.sh

diff --git a/scaffold/ddev/web-build/Dockerfile.drainpipe b/scaffold/ddev/web-build/Dockerfile.drainpipe
new file mode 100644
index 000000000..6b2b87bf2
--- /dev/null
+++ b/scaffold/ddev/web-build/Dockerfile.drainpipe
@@ -0,0 +1,8 @@
+COPY install-task.sh /usr/local/bin
+RUN chmod +x /usr/local/bin/install-task.sh
+# Also update .github/workflows/ValidateTaskfile.yml if changing version.
+RUN install-task.sh -b /usr/local/bin -d v3.24.0
+
+COPY install-local-php-security-checker.sh /usr/local/bin
+RUN chmod +x /usr/local/bin/install-local-php-security-checker.sh
+RUN install-local-php-security-checker.sh -b /usr/local/bin -d v2.0.6
diff --git a/scaffold/ddev/web-build/install-local-php-security-checker.sh b/scaffold/ddev/web-build/install-local-php-security-checker.sh
new file mode 100755
index 000000000..863524d16
--- /dev/null
+++ b/scaffold/ddev/web-build/install-local-php-security-checker.sh
@@ -0,0 +1,381 @@
+#!/bin/sh
+set -e
+# Code generated by godownloader on 2021-01-12T13:40:40Z.
+#
+# godownloader is no longer maintained. This file has been copied from task's
+# install script and edited to support local-php-security-checker.
+#
+
+usage() {
+  this=$1
+  cat <<EOF
+$this: download go binaries for fabpot/local-php-security-checker
+
+Usage: $this [-b] bindir [-d] [tag]
+  -b sets bindir or installation directory, Defaults to ./bin
+  -d turns on debug logging
+   [tag] is a tag from
+   https://github.com/fabpot/local-php-security-checker/releases
+   If tag is missing, then the latest will be used.
+
+ Generated by godownloader
+  https://github.com/goreleaser/godownloader
+
+EOF
+  exit 2
+}
+
+parse_args() {
+  #BINDIR is ./bin unless set be ENV
+  # over-ridden by flag below
+
+  BINDIR=${BINDIR:-./bin}
+  while getopts "b:dh?x" arg; do
+    case "$arg" in
+      b) BINDIR="$OPTARG" ;;
+      d) log_set_priority 10 ;;
+      h | \?) usage "$0" ;;
+      x) set -x ;;
+    esac
+  done
+  shift $((OPTIND - 1))
+  TAG=$1
+}
+# this function wraps all the destructive operations
+# if a curl|bash cuts off the end of the script due to
+# network, either nothing will happen or will syntax error
+# out preventing half-done work
+execute() {
+  tmpdir=$(mktemp -d)
+  log_debug "downloading files into ${tmpdir}"
+  http_download "${tmpdir}/${TARBALL}" "${TARBALL_URL}"
+  http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
+  hash_sha256_verify "${tmpdir}/${TARBALL}" "${tmpdir}/${CHECKSUM}"
+  srcdir="${tmpdir}"
+  (cd "${tmpdir}" && mv -v local-php-security-checker* local-php-security-checker)
+  test ! -d "${BINDIR}" && install -d "${BINDIR}"
+  for binexe in $BINARIES; do
+    if [ "$OS" = "windows" ]; then
+      binexe="${binexe}.exe"
+    fi
+    install "${srcdir}/${binexe}" "${BINDIR}/"
+    log_info "installed ${BINDIR}/${binexe}"
+  done
+  rm -rf "${tmpdir}"
+}
+get_binaries() {
+  case "$PLATFORM" in
+    darwin/amd64) BINARIES="local-php-security-checker" ;;
+    darwin/arm64) BINARIES="local-php-security-checker" ;;
+    darwin/armv5) BINARIES="local-php-security-checker" ;;
+    darwin/armv6) BINARIES="local-php-security-checker" ;;
+    darwin/armv7) BINARIES="local-php-security-checker" ;;
+    linux/386) BINARIES="local-php-security-checker" ;;
+    linux/amd64) BINARIES="local-php-security-checker" ;;
+    linux/arm64) BINARIES="local-php-security-checker" ;;
+    linux/armv5) BINARIES="local-php-security-checker" ;;
+    linux/armv6) BINARIES="local-php-security-checker" ;;
+    linux/armv7) BINARIES="local-php-security-checker" ;;
+    windows/386) BINARIES="local-php-security-checker" ;;
+    windows/amd64) BINARIES="local-php-security-checker" ;;
+    windows/arm64) BINARIES="local-php-security-checker" ;;
+    windows/armv5) BINARIES="local-php-security-checker" ;;
+    windows/armv6) BINARIES="local-php-security-checker" ;;
+    windows/armv7) BINARIES="local-php-security-checker" ;;
+    *)
+      log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
+      exit 1
+      ;;
+  esac
+}
+tag_to_version() {
+  if [ -z "${TAG}" ]; then
+    log_info "checking GitHub for latest tag"
+  else
+    log_info "checking GitHub for tag '${TAG}'"
+  fi
+  REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true
+  if test -z "$REALTAG"; then
+    log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details"
+    exit 1
+  fi
+  # if version starts with 'v', remove it
+  TAG="$REALTAG"
+  VERSION=${TAG#v}
+}
+adjust_os() {
+  # adjust archive name based on OS
+  true
+}
+adjust_arch() {
+  # adjust archive name based on ARCH
+  true
+}
+
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+https://github.com/client9/shlib - portable posix shell functions
+Public domain - http://unlicense.org
+https://github.com/client9/shlib/blob/master/LICENSE.md
+but credit (and pull requests) appreciated.
+------------------------------------------------------------------------
+EOF
+is_command() {
+  command -v "$1" >/dev/null
+}
+echoerr() {
+  echo "$@" 1>&2
+}
+log_prefix() {
+  echo "$0"
+}
+_logp=6
+log_set_priority() {
+  _logp="$1"
+}
+log_priority() {
+  if test -z "$1"; then
+    echo "$_logp"
+    return
+  fi
+  [ "$1" -le "$_logp" ]
+}
+log_tag() {
+  case $1 in
+    0) echo "emerg" ;;
+    1) echo "alert" ;;
+    2) echo "crit" ;;
+    3) echo "err" ;;
+    4) echo "warning" ;;
+    5) echo "notice" ;;
+    6) echo "info" ;;
+    7) echo "debug" ;;
+    *) echo "$1" ;;
+  esac
+}
+log_debug() {
+  log_priority 7 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
+}
+log_info() {
+  log_priority 6 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
+}
+log_err() {
+  log_priority 3 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
+}
+log_crit() {
+  log_priority 2 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
+}
+uname_os() {
+  os=$(uname -s | tr '[:upper:]' '[:lower:]')
+  case "$os" in
+    cygwin_nt*) os="windows" ;;
+    mingw*) os="windows" ;;
+    msys_nt*) os="windows" ;;
+  esac
+  echo "$os"
+}
+uname_arch() {
+  arch=$(uname -m)
+  case $arch in
+    x86_64) arch="amd64" ;;
+    x86) arch="386" ;;
+    i686) arch="386" ;;
+    i386) arch="386" ;;
+    aarch64) arch="arm64" ;;
+    armv5*) arch="arm" ;;
+    armv6*) arch="arm" ;;
+    armv7*) arch="arm" ;;
+  esac
+  echo ${arch}
+}
+uname_os_check() {
+  os=$(uname_os)
+  case "$os" in
+    darwin) return 0 ;;
+    dragonfly) return 0 ;;
+    freebsd) return 0 ;;
+    linux) return 0 ;;
+    android) return 0 ;;
+    nacl) return 0 ;;
+    netbsd) return 0 ;;
+    openbsd) return 0 ;;
+    plan9) return 0 ;;
+    solaris) return 0 ;;
+    windows) return 0 ;;
+  esac
+  log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
+  return 1
+}
+uname_arch_check() {
+  arch=$(uname_arch)
+  case "$arch" in
+    386) return 0 ;;
+    amd64) return 0 ;;
+    arm64) return 0 ;;
+    arm) return 0 ;;
+    ppc64) return 0 ;;
+    ppc64le) return 0 ;;
+    mips) return 0 ;;
+    mipsle) return 0 ;;
+    mips64) return 0 ;;
+    mips64le) return 0 ;;
+    s390x) return 0 ;;
+    amd64p32) return 0 ;;
+  esac
+  log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
+  return 1
+}
+untar() {
+  tarball=$1
+  case "${tarball}" in
+    *.tar.gz | *.tgz) tar --no-same-owner -xzf "${tarball}" ;;
+    *.tar) tar --no-same-owner -xf "${tarball}" ;;
+    *.zip) unzip "${tarball}" ;;
+    *)
+      log_err "untar unknown archive format for ${tarball}"
+      return 1
+      ;;
+  esac
+}
+http_download_curl() {
+  local_file=$1
+  source_url=$2
+  header=$3
+  if [ -z "$header" ]; then
+    code=$(curl -w '%{http_code}' -sL -o "$local_file" "$source_url")
+  else
+    code=$(curl -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
+  fi
+  if [ "$code" != "200" ]; then
+    log_debug "http_download_curl received HTTP status $code"
+    return 1
+  fi
+  return 0
+}
+http_download_wget() {
+  local_file=$1
+  source_url=$2
+  header=$3
+  if [ -z "$header" ]; then
+    wget -q -O "$local_file" "$source_url"
+  else
+    wget -q --header "$header" -O "$local_file" "$source_url"
+  fi
+}
+http_download() {
+  log_debug "http_download $2"
+  if is_command curl; then
+    http_download_curl "$@"
+    return
+  elif is_command wget; then
+    http_download_wget "$@"
+    return
+  fi
+  log_crit "http_download unable to find wget or curl"
+  return 1
+}
+http_copy() {
+  tmp=$(mktemp)
+  http_download "${tmp}" "$1" "$2" || return 1
+  body=$(cat "$tmp")
+  rm -f "${tmp}"
+  echo "$body"
+}
+github_release() {
+  owner_repo=$1
+  version=$2
+  test -z "$version" && version="latest"
+  giturl="https://github.com/${owner_repo}/releases/${version}"
+  json=$(http_copy "$giturl" "Accept:application/json")
+  test -z "$json" && return 1
+  version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
+  test -z "$version" && return 1
+  echo "$version"
+}
+hash_sha256() {
+  TARGET=${1:-/dev/stdin}
+  if is_command gsha256sum; then
+    hash=$(gsha256sum "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command sha256sum; then
+    hash=$(sha256sum "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command shasum; then
+    hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command openssl; then
+    hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f a
+  else
+    log_crit "hash_sha256 unable to find command to compute sha-256 hash"
+    return 1
+  fi
+}
+hash_sha256_verify() {
+  TARGET=$1
+  checksums=$2
+  if [ -z "$checksums" ]; then
+    log_err "hash_sha256_verify checksum file not specified in arg2"
+    return 1
+  fi
+  BASENAME=${TARGET##*/}
+  want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
+  if [ -z "$want" ]; then
+    log_err "hash_sha256_verify unable to find checksum for '${TARGET}' in '${checksums}'"
+    return 1
+  fi
+  got=$(hash_sha256 "$TARGET")
+  if [ "$want" != "$got" ]; then
+    log_err "hash_sha256_verify checksum for '$TARGET' did not verify ${want} vs $got"
+    return 1
+  fi
+}
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+End of functions from https://github.com/client9/shlib
+------------------------------------------------------------------------
+EOF
+
+PROJECT_NAME="local-php-security-checker"
+OWNER=fabpot
+REPO="local-php-security-checker"
+BINARY=local-php-security-checker
+FORMAT=
+OS=$(uname_os)
+ARCH=$(uname_arch)
+PREFIX="$OWNER/$REPO"
+
+# use in logging routines
+log_prefix() {
+	echo "$PREFIX"
+}
+PLATFORM="${OS}/${ARCH}"
+GITHUB_DOWNLOAD=https://github.com/${OWNER}/${REPO}/releases/download
+
+uname_os_check "$OS"
+uname_arch_check "$ARCH"
+
+parse_args "$@"
+
+get_binaries
+
+tag_to_version
+
+adjust_os
+
+adjust_arch
+
+log_info "found version: ${VERSION} for ${TAG}/${OS}/${ARCH}"
+
+NAME=${BINARY}_${VERSION}_${OS}_${ARCH}
+TARBALL=${NAME}
+TARBALL_URL=${GITHUB_DOWNLOAD}/${TAG}/${TARBALL}
+CHECKSUM=checksums.txt
+CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
+
+
+execute
diff --git a/scaffold/ddev/web-build/install-task.sh b/scaffold/ddev/web-build/install-task.sh
new file mode 100755
index 000000000..46df0cd6a
--- /dev/null
+++ b/scaffold/ddev/web-build/install-task.sh
@@ -0,0 +1,387 @@
+#!/bin/sh
+set -e
+# Code generated by godownloader on 2021-01-12T13:40:40Z. DO NOT EDIT.
+#
+
+usage() {
+  this=$1
+  cat <<EOF
+$this: download go binaries for go-task/task
+
+Usage: $this [-b] bindir [-d] [tag]
+  -b sets bindir or installation directory, Defaults to ./bin
+  -d turns on debug logging
+   [tag] is a tag from
+   https://github.com/go-task/task/releases
+   If tag is missing, then the latest will be used.
+
+ Generated by godownloader
+  https://github.com/goreleaser/godownloader
+
+EOF
+  exit 2
+}
+
+parse_args() {
+  #BINDIR is ./bin unless set be ENV
+  # over-ridden by flag below
+
+  BINDIR=${BINDIR:-./bin}
+  while getopts "b:dh?x" arg; do
+    case "$arg" in
+      b) BINDIR="$OPTARG" ;;
+      d) log_set_priority 10 ;;
+      h | \?) usage "$0" ;;
+      x) set -x ;;
+    esac
+  done
+  shift $((OPTIND - 1))
+  TAG=$1
+}
+# this function wraps all the destructive operations
+# if a curl|bash cuts off the end of the script due to
+# network, either nothing will happen or will syntax error
+# out preventing half-done work
+execute() {
+  tmpdir=$(mktemp -d)
+  log_debug "downloading files into ${tmpdir}"
+  http_download "${tmpdir}/${TARBALL}" "${TARBALL_URL}"
+  http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
+  hash_sha256_verify "${tmpdir}/${TARBALL}" "${tmpdir}/${CHECKSUM}"
+  srcdir="${tmpdir}"
+  (cd "${tmpdir}" && untar "${TARBALL}")
+  test ! -d "${BINDIR}" && install -d "${BINDIR}"
+  for binexe in $BINARIES; do
+    if [ "$OS" = "windows" ]; then
+      binexe="${binexe}.exe"
+    fi
+    install "${srcdir}/${binexe}" "${BINDIR}/"
+    log_info "installed ${BINDIR}/${binexe}"
+  done
+  rm -rf "${tmpdir}"
+}
+get_binaries() {
+  case "$PLATFORM" in
+    darwin/amd64) BINARIES="task" ;;
+    darwin/arm64) BINARIES="task" ;;
+    darwin/armv5) BINARIES="task" ;;
+    darwin/armv6) BINARIES="task" ;;
+    darwin/armv7) BINARIES="task" ;;
+    linux/386) BINARIES="task" ;;
+    linux/amd64) BINARIES="task" ;;
+    linux/arm64) BINARIES="task" ;;
+    linux/armv5) BINARIES="task" ;;
+    linux/armv6) BINARIES="task" ;;
+    linux/armv7) BINARIES="task" ;;
+    windows/386) BINARIES="task" ;;
+    windows/amd64) BINARIES="task" ;;
+    windows/arm64) BINARIES="task" ;;
+    windows/armv5) BINARIES="task" ;;
+    windows/armv6) BINARIES="task" ;;
+    windows/armv7) BINARIES="task" ;;
+    *)
+      log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
+      exit 1
+      ;;
+  esac
+}
+tag_to_version() {
+  if [ -z "${TAG}" ]; then
+    log_info "checking GitHub for latest tag"
+  else
+    log_info "checking GitHub for tag '${TAG}'"
+  fi
+  REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true
+  if test -z "$REALTAG"; then
+    log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details"
+    exit 1
+  fi
+  # if version starts with 'v', remove it
+  TAG="$REALTAG"
+  VERSION=${TAG#v}
+}
+adjust_format() {
+  # change format (tar.gz or zip) based on OS
+  case ${OS} in
+    windows) FORMAT=zip ;;
+  esac
+  true
+}
+adjust_os() {
+  # adjust archive name based on OS
+  true
+}
+adjust_arch() {
+  # adjust archive name based on ARCH
+  true
+}
+
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+https://github.com/client9/shlib - portable posix shell functions
+Public domain - http://unlicense.org
+https://github.com/client9/shlib/blob/master/LICENSE.md
+but credit (and pull requests) appreciated.
+------------------------------------------------------------------------
+EOF
+is_command() {
+  command -v "$1" >/dev/null
+}
+echoerr() {
+  echo "$@" 1>&2
+}
+log_prefix() {
+  echo "$0"
+}
+_logp=6
+log_set_priority() {
+  _logp="$1"
+}
+log_priority() {
+  if test -z "$1"; then
+    echo "$_logp"
+    return
+  fi
+  [ "$1" -le "$_logp" ]
+}
+log_tag() {
+  case $1 in
+    0) echo "emerg" ;;
+    1) echo "alert" ;;
+    2) echo "crit" ;;
+    3) echo "err" ;;
+    4) echo "warning" ;;
+    5) echo "notice" ;;
+    6) echo "info" ;;
+    7) echo "debug" ;;
+    *) echo "$1" ;;
+  esac
+}
+log_debug() {
+  log_priority 7 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
+}
+log_info() {
+  log_priority 6 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
+}
+log_err() {
+  log_priority 3 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
+}
+log_crit() {
+  log_priority 2 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
+}
+uname_os() {
+  os=$(uname -s | tr '[:upper:]' '[:lower:]')
+  case "$os" in
+    cygwin_nt*) os="windows" ;;
+    mingw*) os="windows" ;;
+    msys_nt*) os="windows" ;;
+  esac
+  echo "$os"
+}
+uname_arch() {
+  arch=$(uname -m)
+  case $arch in
+    x86_64) arch="amd64" ;;
+    x86) arch="386" ;;
+    i686) arch="386" ;;
+    i386) arch="386" ;;
+    aarch64) arch="arm64" ;;
+    armv5*) arch="arm" ;;
+    armv6*) arch="arm" ;;
+    armv7*) arch="arm" ;;
+  esac
+  echo ${arch}
+}
+uname_os_check() {
+  os=$(uname_os)
+  case "$os" in
+    darwin) return 0 ;;
+    dragonfly) return 0 ;;
+    freebsd) return 0 ;;
+    linux) return 0 ;;
+    android) return 0 ;;
+    nacl) return 0 ;;
+    netbsd) return 0 ;;
+    openbsd) return 0 ;;
+    plan9) return 0 ;;
+    solaris) return 0 ;;
+    windows) return 0 ;;
+  esac
+  log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
+  return 1
+}
+uname_arch_check() {
+  arch=$(uname_arch)
+  case "$arch" in
+    386) return 0 ;;
+    amd64) return 0 ;;
+    arm64) return 0 ;;
+    arm) return 0 ;;
+    ppc64) return 0 ;;
+    ppc64le) return 0 ;;
+    mips) return 0 ;;
+    mipsle) return 0 ;;
+    mips64) return 0 ;;
+    mips64le) return 0 ;;
+    s390x) return 0 ;;
+    amd64p32) return 0 ;;
+  esac
+  log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
+  return 1
+}
+untar() {
+  tarball=$1
+  case "${tarball}" in
+    *.tar.gz | *.tgz) tar --no-same-owner -xzf "${tarball}" ;;
+    *.tar) tar --no-same-owner -xf "${tarball}" ;;
+    *.zip) unzip "${tarball}" ;;
+    *)
+      log_err "untar unknown archive format for ${tarball}"
+      return 1
+      ;;
+  esac
+}
+http_download_curl() {
+  local_file=$1
+  source_url=$2
+  header=$3
+  if [ -z "$header" ]; then
+    code=$(curl -w '%{http_code}' -sL -o "$local_file" "$source_url")
+  else
+    code=$(curl -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
+  fi
+  if [ "$code" != "200" ]; then
+    log_debug "http_download_curl received HTTP status $code"
+    return 1
+  fi
+  return 0
+}
+http_download_wget() {
+  local_file=$1
+  source_url=$2
+  header=$3
+  if [ -z "$header" ]; then
+    wget -q -O "$local_file" "$source_url"
+  else
+    wget -q --header "$header" -O "$local_file" "$source_url"
+  fi
+}
+http_download() {
+  log_debug "http_download $2"
+  if is_command curl; then
+    http_download_curl "$@"
+    return
+  elif is_command wget; then
+    http_download_wget "$@"
+    return
+  fi
+  log_crit "http_download unable to find wget or curl"
+  return 1
+}
+http_copy() {
+  tmp=$(mktemp)
+  http_download "${tmp}" "$1" "$2" || return 1
+  body=$(cat "$tmp")
+  rm -f "${tmp}"
+  echo "$body"
+}
+github_release() {
+  owner_repo=$1
+  version=$2
+  test -z "$version" && version="latest"
+  giturl="https://github.com/${owner_repo}/releases/${version}"
+  json=$(http_copy "$giturl" "Accept:application/json")
+  test -z "$json" && return 1
+  version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
+  test -z "$version" && return 1
+  echo "$version"
+}
+hash_sha256() {
+  TARGET=${1:-/dev/stdin}
+  if is_command gsha256sum; then
+    hash=$(gsha256sum "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command sha256sum; then
+    hash=$(sha256sum "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command shasum; then
+    hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command openssl; then
+    hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f a
+  else
+    log_crit "hash_sha256 unable to find command to compute sha-256 hash"
+    return 1
+  fi
+}
+hash_sha256_verify() {
+  TARGET=$1
+  checksums=$2
+  if [ -z "$checksums" ]; then
+    log_err "hash_sha256_verify checksum file not specified in arg2"
+    return 1
+  fi
+  BASENAME=${TARGET##*/}
+  want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
+  if [ -z "$want" ]; then
+    log_err "hash_sha256_verify unable to find checksum for '${TARGET}' in '${checksums}'"
+    return 1
+  fi
+  got=$(hash_sha256 "$TARGET")
+  if [ "$want" != "$got" ]; then
+    log_err "hash_sha256_verify checksum for '$TARGET' did not verify ${want} vs $got"
+    return 1
+  fi
+}
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+End of functions from https://github.com/client9/shlib
+------------------------------------------------------------------------
+EOF
+
+PROJECT_NAME="task"
+OWNER=go-task
+REPO="task"
+BINARY=task
+FORMAT=tar.gz
+OS=$(uname_os)
+ARCH=$(uname_arch)
+PREFIX="$OWNER/$REPO"
+
+# use in logging routines
+log_prefix() {
+	echo "$PREFIX"
+}
+PLATFORM="${OS}/${ARCH}"
+GITHUB_DOWNLOAD=https://github.com/${OWNER}/${REPO}/releases/download
+
+uname_os_check "$OS"
+uname_arch_check "$ARCH"
+
+parse_args "$@"
+
+get_binaries
+
+tag_to_version
+
+adjust_format
+
+adjust_os
+
+adjust_arch
+
+log_info "found version: ${VERSION} for ${TAG}/${OS}/${ARCH}"
+
+NAME=${BINARY}_${OS}_${ARCH}
+TARBALL=${NAME}.${FORMAT}
+TARBALL_URL=${GITHUB_DOWNLOAD}/${TAG}/${TARBALL}
+CHECKSUM=task_checksums.txt
+CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
+
+
+execute
diff --git a/src/ScaffoldInstallerPlugin.php b/src/ScaffoldInstallerPlugin.php
index 2099478c9..d3b490275 100644
--- a/src/ScaffoldInstallerPlugin.php
+++ b/src/ScaffoldInstallerPlugin.php
@@ -80,6 +80,7 @@ public function onPostInstallCmd(Event $event)
         $this->installTaskfile();
         $this->installGitignore();
         $this->installDdevCommand();
+        $this->installDdevTask();
         $this->installCICommands();
         $this->installEnvSupport();
     }
@@ -94,6 +95,7 @@ public function onPostUpdateCmd(Event $event)
         $this->installTaskfile();
         $this->installGitignore();
         $this->installDdevCommand();
+        $this->installDdevTask();
         $this->installCICommands();
         $this->installEnvSupport();
     }
@@ -183,6 +185,16 @@ private function installEnvSupport(): void
         }
     }
 
+    private function installDdevTask(): void
+    {
+        if (file_exists('./.ddev/config.yaml')) {
+            $vendor = $this->config->get('vendor-dir');
+            $webBuildPath = $vendor . '/lullabot/drainpipe/scaffold/ddev/web-build/';
+            $fs = new Filesystem();
+            $fs->copy($webBuildPath, './.ddev/web-build');
+        }
+    }
+
     /**
      * Install DDEV Commands.
      */
diff --git a/tests/src/Functional/InstallerScaffoldTest.php b/tests/src/Functional/InstallerScaffoldTest.php
index 714f0d0a4..03c18adb2 100644
--- a/tests/src/Functional/InstallerScaffoldTest.php
+++ b/tests/src/Functional/InstallerScaffoldTest.php
@@ -42,6 +42,7 @@ public function testGitIgnore(): void
 
     public function testBinaries(): void
     {
+        $this->assertFileExists('/usr/local/bin/task');
         $this->assertFileExists(self::PROJECT_PATH.'/vendor/bin/task');
     }
 }

From 0d4b874435ae2c71b6f48e343900fed6b2b6814a Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Tue, 9 May 2023 16:59:47 -0400
Subject: [PATCH 02/38] Disable binaries when set in composer.json

---
 README.md               |  2 ++
 src/BinaryInstaller.php | 17 +++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/README.md b/README.md
index f89b7bda3..02ab5bbbe 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,8 @@ for a Drupal site, including:
 ```sh
 composer config extra.drupal-scaffold.gitignore true
 composer config --json extra.drupal-scaffold.allowed-packages "[\"lullabot/drainpipe\", \"lullabot/drainpipe-dev\"]"
+composer config --json extra.drainpipe.global-binaries.task "true"
+composer config --json extra.drainpipe.global-binaries.local-php-security-checker "true"
 composer require lullabot/drainpipe
 composer require lullabot/drainpipe-dev --dev
 ```
diff --git a/src/BinaryInstaller.php b/src/BinaryInstaller.php
index 5c9ddc99d..e0419d8f5 100644
--- a/src/BinaryInstaller.php
+++ b/src/BinaryInstaller.php
@@ -54,6 +54,11 @@ class BinaryInstaller implements PluginInterface, EventSubscriberInterface
      */
     protected $processor;
 
+    /**
+     * @var array
+     */
+    private $extra;
+
     /**
      * {@inheritdoc}
      */
@@ -61,6 +66,7 @@ public function activate(Composer $composer, IOInterface $io)
     {
         $this->io = $io;
         $this->config = $composer->getConfig();
+        $this->extra = $composer->getPackage()->getExtra();
         $this->platform = strtolower(\PHP_OS_FAMILY);
         $uname = strtolower(php_uname('v'));
         if (false !== strpos($uname, 'arm64')) {
@@ -140,6 +146,17 @@ public function onPostUpdateCmd(Event $event)
     public function installBinaries(Event $event)
     {
         foreach ($this->binaries as $binary => $info) {
+            if (isset($this->extra['drainpipe']['global-binaries'])) {
+                $global_binaries = $this->extra['drainpipe']['global-binaries'];
+                if (isset($global_binaries[$binary]) && $global_binaries[$binary]) {
+                    continue;
+                }
+                $this->io->warning('Downloading binaries to vendor/bin is deprecated and will be removed in Drainpipe 3.0.');
+                $this->io->warning('Run the following composer command and update any CI scripts to use the commands installed in /usr/local/bin to migrate.');
+                $this->io->warning('composer config --json extra.drainpipe.global-binaries.task "true"');
+                $this->io->warning('composer config --json extra.drainpipe.global-binaries.local-php-security-checker "true"');
+            }
+
             $platform = $this->platform;
             $processor = $this->processor;
 

From bfd219d4748a76e3a20730806614189e453953fa Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Tue, 9 May 2023 17:02:19 -0400
Subject: [PATCH 03/38] Tests

---
 .../composer.json                             | 28 +++++++++++
 .../InstallerScaffoldGlobalBinariesTest.php   | 50 +++++++++++++++++++
 .../src/Functional/InstallerScaffoldTest.php  |  2 +
 3 files changed, 80 insertions(+)
 create mode 100644 tests/fixtures/drainpipe-test-project-global-binaries/composer.json
 create mode 100644 tests/src/Functional/InstallerScaffoldGlobalBinariesTest.php

diff --git a/tests/fixtures/drainpipe-test-project-global-binaries/composer.json b/tests/fixtures/drainpipe-test-project-global-binaries/composer.json
new file mode 100644
index 000000000..fec759714
--- /dev/null
+++ b/tests/fixtures/drainpipe-test-project-global-binaries/composer.json
@@ -0,0 +1,28 @@
+{
+  "name": "lullabot/drainpipe-test-project",
+  "type": "project",
+  "repositories": [
+    {
+      "type": "path",
+      "url": "../../../"
+    }
+  ],
+  "minimum-stability": "dev",
+  "prefer-stable": true,
+  "require": {
+    "lullabot/drainpipe": "*"
+  },
+  "config": {
+    "allow-plugins": {
+      "lullabot/drainpipe": true
+    }
+  },
+  "extra": {
+    "drainpipe": {
+      "global-binaries": {
+        "task": true,
+        "local-php-security-checker": true
+      }
+    }
+  }
+}
diff --git a/tests/src/Functional/InstallerScaffoldGlobalBinariesTest.php b/tests/src/Functional/InstallerScaffoldGlobalBinariesTest.php
new file mode 100644
index 000000000..130a60b57
--- /dev/null
+++ b/tests/src/Functional/InstallerScaffoldGlobalBinariesTest.php
@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Lullabot\Drainpipe\Tests\Functional;
+
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Process\Process;
+
+class InstallerScaffoldGlobalBinariesTest extends TestCase
+{
+    public const PROJECT_PATH = __DIR__.'/../../fixtures/drainpipe-test-project-global-binaries';
+
+    public static function setUpBeforeClass(): void
+    {
+        parent::setUpBeforeClass();
+        $composer = new Process(['composer', 'update'], self::PROJECT_PATH);
+        $composer->run();
+    }
+
+    public static function tearDownAfterClass(): void
+    {
+        parent::tearDownAfterClass();
+
+        if (file_exists(self::PROJECT_PATH.'/.gitignore')) {
+            unlink(self::PROJECT_PATH.'/.gitignore');
+        }
+        $clean = new Process(['git', 'clean', '-fdX'], self::PROJECT_PATH);
+        $clean->run();
+    }
+
+    public function testTaskfile(): void
+    {
+        $this->assertEquals(sha1_file(self::PROJECT_PATH.'/vendor/lullabot/drainpipe/scaffold/Taskfile.yml'), sha1_file(self::PROJECT_PATH.'/Taskfile.yml'));
+    }
+
+    public function testGitIgnore(): void
+    {
+        $gitignore = file_get_contents(self::PROJECT_PATH.'/.gitignore');
+        $this->assertStringContainsString('.task', $gitignore);
+    }
+
+    public function testBinaries(): void
+    {
+        $this->assertFileExists('/usr/local/bin/task');
+        $this->assertFileExists('/usr/local/bin/local-php-security-checker');
+        $this->assertFileDoesNotExist(self::PROJECT_PATH.'/vendor/bin/task');
+        $this->assertFileDoesNotExist(self::PROJECT_PATH.'/vendor/bin/local-php-security-checker');
+    }
+}
diff --git a/tests/src/Functional/InstallerScaffoldTest.php b/tests/src/Functional/InstallerScaffoldTest.php
index 03c18adb2..3b39c3c06 100644
--- a/tests/src/Functional/InstallerScaffoldTest.php
+++ b/tests/src/Functional/InstallerScaffoldTest.php
@@ -43,6 +43,8 @@ public function testGitIgnore(): void
     public function testBinaries(): void
     {
         $this->assertFileExists('/usr/local/bin/task');
+        $this->assertFileExists('/usr/local/bin/local-php-security-checker');
         $this->assertFileExists(self::PROJECT_PATH.'/vendor/bin/task');
+        $this->assertFileExists(self::PROJECT_PATH.'/vendor/bin/local-php-security-checker');
     }
 }

From fcace4a67db72763cae72f257059c35d496041c3 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Tue, 9 May 2023 17:26:18 -0400
Subject: [PATCH 04/38] Update CI to use global binaries

---
 .github/workflows/DrainpipeDev.yml                 | 2 +-
 .github/workflows/test-production-build.yml        | 2 +-
 README.md                                          | 2 +-
 scaffold/ddev/task-command.sh                      | 2 +-
 scaffold/github/actions/pantheon/push/action.yml   | 2 +-
 scaffold/github/actions/pantheon/review/action.yml | 4 ++--
 scaffold/github/actions/pantheon/update/action.yml | 2 +-
 scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml   | 8 ++++----
 tasks/test.yml                                     | 4 ++--
 9 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/DrainpipeDev.yml b/.github/workflows/DrainpipeDev.yml
index 63e258c91..f58ea1ee9 100644
--- a/.github/workflows/DrainpipeDev.yml
+++ b/.github/workflows/DrainpipeDev.yml
@@ -47,4 +47,4 @@ jobs:
           ddev composer require lullabot/drainpipe --with-all-dependencies
 
       - name: Push drainpipe-dev
-        run: ddev exec "./vendor/bin/task deploy:git directory=/var/www/html/drainpipe/drainpipe-dev branch=${{ github.ref_name }} remote=https://${{ secrets.DRAINPIPE_DEV_GITHUB_TOKEN_USERNAME }}:${{ secrets.DRAINPIPE_DEV_GITHUB_TOKEN }}@github.com/lullabot/drainpipe-dev.git message=\"${{ github.event.head_commit.message }}\""
+        run: ddev exec "task deploy:git directory=/var/www/html/drainpipe/drainpipe-dev branch=${{ github.ref_name }} remote=https://${{ secrets.DRAINPIPE_DEV_GITHUB_TOKEN_USERNAME }}:${{ secrets.DRAINPIPE_DEV_GITHUB_TOKEN }}@github.com/lullabot/drainpipe-dev.git message=\"${{ github.event.head_commit.message }}\""
diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index 4423842d4..5143d6c00 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -48,4 +48,4 @@ jobs:
       - name: Run static tests
         run: |
           cd ../drupal
-          ./vendor/bin/task build
+          task build
diff --git a/README.md b/README.md
index 02ab5bbbe..c2c980db8 100644
--- a/README.md
+++ b/README.md
@@ -52,7 +52,7 @@ Task is just a single binary and has no other dependencies. It's also
 cross-platform with everything running through the same [shell interpreter](https://github.com/mvdan/sh).
 
 You can see what tasks are available after installation by running
-`./vendor/bin/task --list` or `ddev task --list` if you're running DDEV. To get
+`task --list` or `ddev task --list` if you're running DDEV. To get
 more information on a specific task e.g. what parameters it takes, you can run
 `task [task name] --summary`.
 
diff --git a/scaffold/ddev/task-command.sh b/scaffold/ddev/task-command.sh
index 42fa537fb..3226e39bc 100644
--- a/scaffold/ddev/task-command.sh
+++ b/scaffold/ddev/task-command.sh
@@ -4,4 +4,4 @@
 ## Usage: task
 ## Example: "ddev task build"
 
-./vendor/bin/task "$@"
+task "$@"
diff --git a/scaffold/github/actions/pantheon/push/action.yml b/scaffold/github/actions/pantheon/push/action.yml
index 026c4b65a..2fcca9342 100644
--- a/scaffold/github/actions/pantheon/push/action.yml
+++ b/scaffold/github/actions/pantheon/push/action.yml
@@ -32,5 +32,5 @@ runs:
         else
           drainpipe_exec "terminus connection:set ${{ inputs.site-name }}.${{ inputs.branch }} git --yes"
         fi
-        drainpipe_exec "./vendor/bin/task deploy:git directory=/tmp/release branch=${{ inputs.branch }} remote=ssh://codeserver.dev.$SITE_ID@codeserver.dev.$SITE_ID.drush.in:2222/~/repository.git message=\"${{ inputs.commit-message }}\""
+        drainpipe_exec "task deploy:git directory=/tmp/release branch=${{ inputs.branch }} remote=ssh://codeserver.dev.$SITE_ID@codeserver.dev.$SITE_ID.drush.in:2222/~/repository.git message=\"${{ inputs.commit-message }}\""
       shell: bash
diff --git a/scaffold/github/actions/pantheon/review/action.yml b/scaffold/github/actions/pantheon/review/action.yml
index 86993d6d5..dee822001 100644
--- a/scaffold/github/actions/pantheon/review/action.yml
+++ b/scaffold/github/actions/pantheon/review/action.yml
@@ -101,7 +101,7 @@ runs:
         source .github/actions/drainpipe/set-env/bash_aliases
         SITE_ID=$(drainpipe_exec "terminus site:lookup ${{ inputs.site-name }}")
         drainpipe_exec "terminus connection:set  ${{ inputs.site-name }}.pr-$DRAINPIPE_PR_NUMBER git --yes"
-        drainpipe_exec "./vendor/bin/task deploy:git directory=/tmp/release branch=pr-$DRAINPIPE_PR_NUMBER remote=ssh://codeserver.dev.$SITE_ID@codeserver.dev.$SITE_ID.drush.in:2222/~/repository.git message=\"${{ inputs.commit-message }}\" site=${{ inputs.site-name }}.pr-$DRAINPIPE_PR_NUMBER"
+        drainpipe_exec "task deploy:git directory=/tmp/release branch=pr-$DRAINPIPE_PR_NUMBER remote=ssh://codeserver.dev.$SITE_ID@codeserver.dev.$SITE_ID.drush.in:2222/~/repository.git message=\"${{ inputs.commit-message }}\" site=${{ inputs.site-name }}.pr-$DRAINPIPE_PR_NUMBER"
       shell: bash
 
     - name: Deploy to Pantheon
@@ -113,7 +113,7 @@ runs:
         if [ "${{ inputs.run-installer }}" == "true" ]; then
           drainpipe_exec "./vendor/bin/drush @${{ inputs.site-name }}.pr-$DRAINPIPE_PR_NUMBER --yes site:install --existing-config"
         else
-          drainpipe_exec "./vendor/bin/task drupal:update site=@${{ inputs.site-name }}.pr-$DRAINPIPE_PR_NUMBER"
+          drainpipe_exec "task drupal:update site=@${{ inputs.site-name }}.pr-$DRAINPIPE_PR_NUMBER"
         fi
         ENVIRONMENT_URL="https://pr-$DRAINPIPE_PR_NUMBER-${{ inputs.site-name }}.pantheonsite.io"
         # Lock Environment.
diff --git a/scaffold/github/actions/pantheon/update/action.yml b/scaffold/github/actions/pantheon/update/action.yml
index 431308b50..b2d824be5 100644
--- a/scaffold/github/actions/pantheon/update/action.yml
+++ b/scaffold/github/actions/pantheon/update/action.yml
@@ -29,6 +29,6 @@ runs:
         if [ "${{ inputs.run-installer }}" == "true" ]; then
           drainpipe_exec "./vendor/bin/drush @${{ inputs.site-name }}.${{ inputs.environment }} --yes site:install --existing-config"
         else
-          drainpipe_exec "./vendor/bin/task drupal:update site=@${{ inputs.site-name }}.${{ inputs.environment }}"
+          drainpipe_exec "task drupal:update site=@${{ inputs.site-name }}.${{ inputs.environment }}"
         fi
       shell: bash
diff --git a/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml b/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml
index 40ee869d7..b8c7345ef 100644
--- a/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml
+++ b/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml
@@ -9,9 +9,9 @@
       else
         terminus multidev:create $PANTHEON_SITE_NAME.dev mr-$CI_MERGE_REQUEST_IID --yes
       fi
-    - ./vendor/bin/task build
-    - ./vendor/bin/task snapshot:directory
-    - ./vendor/bin/task deploy:git
+    - task build
+    - task snapshot:directory
+    - task deploy:git
     # Wait for Pantheon to sync
     - sleep 30
     - terminus aliases --only $PANTHEON_SITE_NAME --yes
@@ -19,7 +19,7 @@
       if [ "$PANTHEON_MULTIDEV_RUN_INSTALLER" == "true" ]; then
         ./vendor/bin/drush @$PANTHEON_SITE_NAME.mr-$CI_MERGE_REQUEST_IID --yes site:install --existing-config
       else
-        ./vendor/bin/task site=@$PANTHEON_SITE_NAME.mr-$CI_MERGE_REQUEST_IID drupal:update
+        task site=@$PANTHEON_SITE_NAME.mr-$CI_MERGE_REQUEST_IID drupal:update
       fi
     - echo $CI_ENVIRONMENT_URL > environment_url.txt
 drainpipe_pantheon_drupal_review_app:
diff --git a/tasks/test.yml b/tasks/test.yml
index 068da945f..2e868010f 100644
--- a/tasks/test.yml
+++ b/tasks/test.yml
@@ -29,7 +29,7 @@ tasks:
       - cmd: |
           if [ "{{.format}}" == "junit" ]; then
             mkdir -p test_result
-            ./vendor/bin/local-php-security-checker --format=json > test_result/local-php-security-checker.json
+            local-php-security-checker --format=json > test_result/local-php-security-checker.json
           fi
         ignore_error: true
       - |
@@ -40,7 +40,7 @@ tasks:
             exit 1
           fi
         else
-          ./vendor/bin/local-php-security-checker
+          local-php-security-checker
         fi
       # JUnit output blocked on https://github.com/drush-ops/drush/issues/4817
       - ./vendor/bin/drush pm:security

From ccc440f213cbcf0326c3ebc3db11a851fe8f08dd Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Tue, 9 May 2023 17:37:25 -0400
Subject: [PATCH 05/38] Use the local task for this test

---
 .github/workflows/test-production-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index 5143d6c00..4423842d4 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -48,4 +48,4 @@ jobs:
       - name: Run static tests
         run: |
           cd ../drupal
-          task build
+          ./vendor/bin/task build

From 020e64033051d7728ad1fefedab77aedd7468894 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Tue, 9 May 2023 17:39:49 -0400
Subject: [PATCH 06/38] Remove asserts for global binaries in test not run in
 ddev

---
 tests/src/Functional/InstallerScaffoldTest.php | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tests/src/Functional/InstallerScaffoldTest.php b/tests/src/Functional/InstallerScaffoldTest.php
index 3b39c3c06..bcb7d03f5 100644
--- a/tests/src/Functional/InstallerScaffoldTest.php
+++ b/tests/src/Functional/InstallerScaffoldTest.php
@@ -42,8 +42,6 @@ public function testGitIgnore(): void
 
     public function testBinaries(): void
     {
-        $this->assertFileExists('/usr/local/bin/task');
-        $this->assertFileExists('/usr/local/bin/local-php-security-checker');
         $this->assertFileExists(self::PROJECT_PATH.'/vendor/bin/task');
         $this->assertFileExists(self::PROJECT_PATH.'/vendor/bin/local-php-security-checker');
     }

From d417b04c87f3f39114bdd4b7562676969e31e401 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Tue, 9 May 2023 17:41:25 -0400
Subject: [PATCH 07/38] Missed these ones

---
 tests/src/Functional/InstallerScaffoldGlobalBinariesTest.php | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tests/src/Functional/InstallerScaffoldGlobalBinariesTest.php b/tests/src/Functional/InstallerScaffoldGlobalBinariesTest.php
index 130a60b57..ea3524f70 100644
--- a/tests/src/Functional/InstallerScaffoldGlobalBinariesTest.php
+++ b/tests/src/Functional/InstallerScaffoldGlobalBinariesTest.php
@@ -42,8 +42,6 @@ public function testGitIgnore(): void
 
     public function testBinaries(): void
     {
-        $this->assertFileExists('/usr/local/bin/task');
-        $this->assertFileExists('/usr/local/bin/local-php-security-checker');
         $this->assertFileDoesNotExist(self::PROJECT_PATH.'/vendor/bin/task');
         $this->assertFileDoesNotExist(self::PROJECT_PATH.'/vendor/bin/local-php-security-checker');
     }

From e7263f95b84c6e7672552c4d59c105b306603dc0 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Wed, 10 May 2023 08:10:01 -0400
Subject: [PATCH 08/38] Remove local-php-security-checker as it is a
 drainpipe-dev dependency

---
 tests/src/Functional/InstallerScaffoldTest.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/src/Functional/InstallerScaffoldTest.php b/tests/src/Functional/InstallerScaffoldTest.php
index bcb7d03f5..714f0d0a4 100644
--- a/tests/src/Functional/InstallerScaffoldTest.php
+++ b/tests/src/Functional/InstallerScaffoldTest.php
@@ -43,6 +43,5 @@ public function testGitIgnore(): void
     public function testBinaries(): void
     {
         $this->assertFileExists(self::PROJECT_PATH.'/vendor/bin/task');
-        $this->assertFileExists(self::PROJECT_PATH.'/vendor/bin/local-php-security-checker');
     }
 }

From 17ce53d65c42222be6e5a673c9a76c876cd64949 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Wed, 10 May 2023 08:59:54 -0400
Subject: [PATCH 09/38] Fix wrong deprecation version

---
 src/BinaryInstaller.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/BinaryInstaller.php b/src/BinaryInstaller.php
index e0419d8f5..add38acc9 100644
--- a/src/BinaryInstaller.php
+++ b/src/BinaryInstaller.php
@@ -151,7 +151,7 @@ public function installBinaries(Event $event)
                 if (isset($global_binaries[$binary]) && $global_binaries[$binary]) {
                     continue;
                 }
-                $this->io->warning('Downloading binaries to vendor/bin is deprecated and will be removed in Drainpipe 3.0.');
+                $this->io->warning('Downloading binaries to vendor/bin is deprecated and will be removed in Drainpipe 4.0.');
                 $this->io->warning('Run the following composer command and update any CI scripts to use the commands installed in /usr/local/bin to migrate.');
                 $this->io->warning('composer config --json extra.drainpipe.global-binaries.task "true"');
                 $this->io->warning('composer config --json extra.drainpipe.global-binaries.local-php-security-checker "true"');

From c34b353992fc250155fe782913e3408eedd5e4fb Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 12 May 2023 14:11:43 -0400
Subject: [PATCH 10/38] Use the binary name in the warning message

---
 src/BinaryInstaller.php | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/BinaryInstaller.php b/src/BinaryInstaller.php
index add38acc9..0e9564706 100644
--- a/src/BinaryInstaller.php
+++ b/src/BinaryInstaller.php
@@ -153,8 +153,7 @@ public function installBinaries(Event $event)
                 }
                 $this->io->warning('Downloading binaries to vendor/bin is deprecated and will be removed in Drainpipe 4.0.');
                 $this->io->warning('Run the following composer command and update any CI scripts to use the commands installed in /usr/local/bin to migrate.');
-                $this->io->warning('composer config --json extra.drainpipe.global-binaries.task "true"');
-                $this->io->warning('composer config --json extra.drainpipe.global-binaries.local-php-security-checker "true"');
+                $this->io->warning(sprintf('composer config --json extra.drainpipe.global-binaries.%s "true"', $binary));
             }
 
             $platform = $this->platform;

From 7788519176f998feb8f07fe6b95abf32ebd611b6 Mon Sep 17 00:00:00 2001
From: Sally Young <git@justa.fish>
Date: Mon, 12 Jun 2023 12:00:25 +0100
Subject: [PATCH 11/38] Update production build test and add note to README to
 make task a global binary for DDEV

---
 .github/workflows/test-production-build.yml   | 44 +++++++++++++++++--
 README.md                                     |  9 ++++
 .../Taskfile.yml                              |  0
 .../composer.json                             |  0
 4 files changed, 49 insertions(+), 4 deletions(-)
 rename tests/{fixtures.drainpipe-test-build => fixtures/drainpipe-test-production-build}/Taskfile.yml (100%)
 rename tests/{fixtures.drainpipe-test-build => fixtures/drainpipe-test-production-build}/composer.json (100%)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index 4423842d4..910f239f7 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -17,7 +17,7 @@ jobs:
             composer-flags: --prefer-lowest --prefer-stable
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - uses: shivammathur/setup-php@v2
         with:
@@ -41,11 +41,47 @@ jobs:
           cd ../
           mkdir drupal
           cd drupal
-          cp ${GITHUB_WORKSPACE}/tests/fixtures.drainpipe-test-build/composer.json .
-          cp ${GITHUB_WORKSPACE}/tests/fixtures.drainpipe-test-build/Taskfile.yml .
+          cp ${GITHUB_WORKSPACE}/tests/fixtures/drainpipe-test-production-build/composer.json .
+          cp ${GITHUB_WORKSPACE}/tests/fixtures/drainpipe-test-production-build/Taskfile.yml .
           composer update ${{ matrix.composer-flags }}
 
-      - name: Run static tests
+      - name: Run production build
         run: |
           cd ../drupal
           ./vendor/bin/task build
+
+  Test-Production-Build-DDEV-Global-Binary:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          path: drainpipe
+
+      - uses: ./drainpipe/scaffold/github/actions/common/set-env
+
+      - name: Install DDEV
+        uses: ./drainpipe/scaffold/github/actions/common/ddev
+        with:
+          git-name: Drainpipe Bot
+          git-email: no-reply@example.com
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
+          ssh-known-hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
+
+      - name: Setup Project
+        run: |
+          cp drainpipe/tests/fixtures/drainpipe-test-production-build/composer.json .
+          cp drainpipe/tests/fixtures/drainpipe-test-production-build/Taskfile.yml .
+          ddev config --auto
+          ddev start
+          ddev composer config extra.drainpipe.global-binaries.task true
+          ddev composer config extra.drainpipe.global-binaries.local-php-security-checker true
+          ddev composer install
+
+      - name: Install Drupal
+        run: |
+          ddev drush site:install minimal -y
+          echo "\$settings['config_sync_directory'] = '../config';" >> web/sites/default/settings.php
+          ddev drush config:export -y
+
+      - name: Run production build
+        run: ddev task build
diff --git a/README.md b/README.md
index c2c980db8..49f1cc001 100644
--- a/README.md
+++ b/README.md
@@ -36,6 +36,15 @@ composer config extra.drupal-scaffold.gitignore true
 composer config --json extra.drupal-scaffold.allowed-packages "[\"lullabot/drainpipe\", \"lullabot/drainpipe-dev\"]"
 composer config --json extra.drainpipe.global-binaries.task "true"
 composer config --json extra.drainpipe.global-binaries.local-php-security-checker "true"
+```
+
+If using DDEV (highly recommended!), additionally set `task` to be a global binary:
+```sh
+ddev composer config extra.drainpipe.global-binaries.task true
+```
+
+Finally, require `drainpipe` and `drainpipe-dev`
+```sh
 composer require lullabot/drainpipe
 composer require lullabot/drainpipe-dev --dev
 ```
diff --git a/tests/fixtures.drainpipe-test-build/Taskfile.yml b/tests/fixtures/drainpipe-test-production-build/Taskfile.yml
similarity index 100%
rename from tests/fixtures.drainpipe-test-build/Taskfile.yml
rename to tests/fixtures/drainpipe-test-production-build/Taskfile.yml
diff --git a/tests/fixtures.drainpipe-test-build/composer.json b/tests/fixtures/drainpipe-test-production-build/composer.json
similarity index 100%
rename from tests/fixtures.drainpipe-test-build/composer.json
rename to tests/fixtures/drainpipe-test-production-build/composer.json

From ca4a349f4972be9fa8a34ab162e1b720758e9320 Mon Sep 17 00:00:00 2001
From: Sally Young <git@justa.fish>
Date: Mon, 12 Jun 2023 12:05:00 +0100
Subject: [PATCH 12/38] Configure path to Drainpipe

---
 .github/workflows/test-production-build.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index 910f239f7..eacf8673b 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -75,6 +75,7 @@ jobs:
           ddev start
           ddev composer config extra.drainpipe.global-binaries.task true
           ddev composer config extra.drainpipe.global-binaries.local-php-security-checker true
+          ddev composer config repositories.drainpipe --json '{"type": "path", "url": "drainpipe", "options": {"symlink": false}}'
           ddev composer install
 
       - name: Install Drupal

From 7bac73c5b636b11cbb84f19a4014a09f6f6efadb Mon Sep 17 00:00:00 2001
From: Sally Young <git@justa.fish>
Date: Mon, 12 Jun 2023 12:15:51 +0100
Subject: [PATCH 13/38] Configure path to Drainpipe

---
 .github/workflows/test-production-build.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index eacf8673b..daf89c20c 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -69,13 +69,10 @@ jobs:
 
       - name: Setup Project
         run: |
-          cp drainpipe/tests/fixtures/drainpipe-test-production-build/composer.json .
+          cp drainpipe/tests/fixtures/drainpipe-test-production-build/composer-ddev-global-binary.json composer.json
           cp drainpipe/tests/fixtures/drainpipe-test-production-build/Taskfile.yml .
           ddev config --auto
           ddev start
-          ddev composer config extra.drainpipe.global-binaries.task true
-          ddev composer config extra.drainpipe.global-binaries.local-php-security-checker true
-          ddev composer config repositories.drainpipe --json '{"type": "path", "url": "drainpipe", "options": {"symlink": false}}'
           ddev composer install
 
       - name: Install Drupal

From 700fbeb40351d4cd0a0d5585b4be306ffd135cfd Mon Sep 17 00:00:00 2001
From: Sally Young <git@justa.fish>
Date: Mon, 12 Jun 2023 12:18:33 +0100
Subject: [PATCH 14/38] Add missing composer.json

---
 .../composer-ddev-global-binary.json          | 109 ++++++++++++++++++
 1 file changed, 109 insertions(+)
 create mode 100644 tests/fixtures/drainpipe-test-production-build/composer-ddev-global-binary.json

diff --git a/tests/fixtures/drainpipe-test-production-build/composer-ddev-global-binary.json b/tests/fixtures/drainpipe-test-production-build/composer-ddev-global-binary.json
new file mode 100644
index 000000000..bfeb36481
--- /dev/null
+++ b/tests/fixtures/drainpipe-test-production-build/composer-ddev-global-binary.json
@@ -0,0 +1,109 @@
+{
+  "name": "drupal/recommended-project",
+  "description": "Project template for Drupal 9 projects with a relocated document root",
+  "type": "project",
+  "license": "GPL-2.0-or-later",
+  "homepage": "https://www.drupal.org/project/drupal",
+  "support": {
+    "docs": "https://www.drupal.org/docs/user_guide/en/index.html",
+    "chat": "https://www.drupal.org/node/314178"
+  },
+  "repositories": [
+    {
+      "type": "path",
+      "url": "drainpipe",
+      "options": {
+        "symlink": false
+      }
+    },
+    {
+      "type": "composer",
+      "url": "https://packages.drupal.org/8"
+    }
+  ],
+  "require": {
+    "composer/installers": "^1.9",
+    "drupal/core": "^8.9|^9.2",
+    "drupal/core-composer-scaffold": "^8.9|^9.2",
+    "drupal/core-project-message": "^8.9|^9.2",
+    "drupal/core-recommended": "^8.9|^9.2",
+    "lullabot/drainpipe": "*"
+  },
+  "conflict": {
+    "drupal/drupal": "*"
+  },
+  "minimum-stability": "dev",
+  "prefer-stable": true,
+  "config": {
+    "sort-packages": true,
+    "allow-plugins": {
+      "composer/installers": true,
+      "drupal/core-composer-scaffold": true,
+      "drupal/core-project-message": true,
+      "lullabot/drainpipe": true
+    }
+  },
+  "extra": {
+    "drainpipe": {
+      "global-binaries": {
+        "task": true,
+        "local-php-security-checker": true
+      }
+    },
+    "drupal-scaffold": {
+      "locations": {
+        "web-root": "web/"
+      }
+    },
+    "installer-paths": {
+      "web/core": [
+        "type:drupal-core"
+      ],
+      "web/libraries/{$name}": [
+        "type:drupal-library"
+      ],
+      "web/modules/contrib/{$name}": [
+        "type:drupal-module"
+      ],
+      "web/profiles/contrib/{$name}": [
+        "type:drupal-profile"
+      ],
+      "web/themes/contrib/{$name}": [
+        "type:drupal-theme"
+      ],
+      "drush/Commands/contrib/{$name}": [
+        "type:drupal-drush"
+      ],
+      "web/modules/custom/{$name}": [
+        "type:drupal-custom-module"
+      ],
+      "web/profiles/custom/{$name}": [
+        "type:drupal-custom-profile"
+      ],
+      "web/themes/custom/{$name}": [
+        "type:drupal-custom-theme"
+      ]
+    },
+    "drupal-core-project-message": {
+      "include-keys": [
+        "homepage",
+        "support"
+      ],
+      "post-create-project-cmd-message": [
+        "<bg=blue;fg=white>                                                         </>",
+        "<bg=blue;fg=white>  Congratulations, you’ve installed the Drupal codebase  </>",
+        "<bg=blue;fg=white>  from the drupal/recommended-project template!          </>",
+        "<bg=blue;fg=white>                                                         </>",
+        "",
+        "<bg=yellow;fg=black>Next steps</>:",
+        "  * Install the site: https://www.drupal.org/docs/8/install",
+        "  * Read the user guide: https://www.drupal.org/docs/user_guide/en/index.html",
+        "  * Get support: https://www.drupal.org/support",
+        "  * Get involved with the Drupal community:",
+        "      https://www.drupal.org/getting-involved",
+        "  * Remove the plugin that prints this message:",
+        "      composer remove drupal/core-project-message"
+      ]
+    }
+  }
+}

From 092c25111f0c6e074a7c9d40abc1f970aa7a3e57 Mon Sep 17 00:00:00 2001
From: Sally Young <git@justa.fish>
Date: Mon, 12 Jun 2023 13:12:30 +0100
Subject: [PATCH 15/38] Restart DDEV

---
 .github/workflows/test-production-build.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index daf89c20c..5bea2f5b7 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -74,6 +74,7 @@ jobs:
           ddev config --auto
           ddev start
           ddev composer install
+          ddev restart
 
       - name: Install Drupal
         run: |

From d937e1d4e87ef85a10b175c07f73856ded64b707 Mon Sep 17 00:00:00 2001
From: Sally Young <git@justa.fish>
Date: Mon, 12 Jun 2023 13:17:50 +0100
Subject: [PATCH 16/38] tmate

---
 .github/workflows/test-production-build.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index 5bea2f5b7..dae3a2c0a 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -76,6 +76,9 @@ jobs:
           ddev composer install
           ddev restart
 
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+
       - name: Install Drupal
         run: |
           ddev drush site:install minimal -y

From 601e3aca963c8be17b84ec97e76de7a5503b0464 Mon Sep 17 00:00:00 2001
From: Sally Young <git@justa.fish>
Date: Mon, 12 Jun 2023 13:21:44 +0100
Subject: [PATCH 17/38] tmate

---
 .github/workflows/test-production-build.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index dae3a2c0a..5bea2f5b7 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -76,9 +76,6 @@ jobs:
           ddev composer install
           ddev restart
 
-      - name: Setup tmate session
-        uses: mxschmitt/action-tmate@v3
-
       - name: Install Drupal
         run: |
           ddev drush site:install minimal -y

From 5255f575af3ac46b9b4df5cceb30b00c64afe065 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Mon, 12 Jun 2023 12:03:08 -0400
Subject: [PATCH 18/38] fix php project type not including drush

---
 .github/workflows/test-production-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index 5bea2f5b7..bc6d93e17 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -71,7 +71,7 @@ jobs:
         run: |
           cp drainpipe/tests/fixtures/drainpipe-test-production-build/composer-ddev-global-binary.json composer.json
           cp drainpipe/tests/fixtures/drainpipe-test-production-build/Taskfile.yml .
-          ddev config --auto
+          ddev config --project-type=drupal9
           ddev start
           ddev composer install
           ddev restart

From c0fff90da3994698f62e785e1a88b97dd0c91f3c Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Wed, 13 Sep 2023 15:01:31 -0400
Subject: [PATCH 19/38] Fix wrong path to task

---
 scaffold/tugboat/steps/2-update.sh.twig | 2 +-
 scaffold/tugboat/steps/3-build.sh.twig  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/scaffold/tugboat/steps/2-update.sh.twig b/scaffold/tugboat/steps/2-update.sh.twig
index befb6bf57..11268c60e 100644
--- a/scaffold/tugboat/steps/2-update.sh.twig
+++ b/scaffold/tugboat/steps/2-update.sh.twig
@@ -4,7 +4,7 @@ set -eux
 echo "Updating..."
 
 composer install
-./vendor/bin/task {{ sync_command }}
+task {{ sync_command }}
 
 # Set file permissions such that Drupal will not complain.
 chgrp -R www-data "${DOCROOT}/sites/default/files"
diff --git a/scaffold/tugboat/steps/3-build.sh.twig b/scaffold/tugboat/steps/3-build.sh.twig
index d99a38ae3..1615f6a09 100644
--- a/scaffold/tugboat/steps/3-build.sh.twig
+++ b/scaffold/tugboat/steps/3-build.sh.twig
@@ -3,5 +3,5 @@
 set -eux
 echo "Building..."
 
-./vendor/bin/task {{ build_command }}
-./vendor/bin/task drupal:update
+task {{ build_command }}
+task drupal:update

From 0e0f4ae9faaafd8a85f5805f91f16244004e1994 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 07:28:16 -0400
Subject: [PATCH 20/38] Update path to task command in test file

---
 .tugboat/steps/2-update.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.tugboat/steps/2-update.sh b/.tugboat/steps/2-update.sh
index ec0c3dfbc..39ad532ed 100755
--- a/.tugboat/steps/2-update.sh
+++ b/.tugboat/steps/2-update.sh
@@ -10,7 +10,7 @@ echo "Updating..."
 mv .tugboat .tugboat-tmp
 #drainpipe-end
 composer install
-./vendor/bin/task sync
+task sync
 
 # Set file permissions such that Drupal will not complain.
 chgrp -R www-data "${DOCROOT}/sites/default/files"

From 1ec70a2a0743ca21a06e4f35e220296129a03805 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 08:04:15 -0400
Subject: [PATCH 21/38] Make task path configurable in tugboat

---
 scaffold/tugboat/steps/2-update.sh.twig | 2 +-
 scaffold/tugboat/steps/3-build.sh.twig  | 4 ++--
 src/ScaffoldInstallerPlugin.php         | 1 +
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/scaffold/tugboat/steps/2-update.sh.twig b/scaffold/tugboat/steps/2-update.sh.twig
index 87e65c49d..f9de3ea27 100644
--- a/scaffold/tugboat/steps/2-update.sh.twig
+++ b/scaffold/tugboat/steps/2-update.sh.twig
@@ -7,7 +7,7 @@ set -eux
 echo "Updating..."
 
 composer install
-task {{ sync_command }}
+{{ task_path }} {{ sync_command }}
 
 # Set file permissions such that Drupal will not complain.
 chgrp -R www-data "${DOCROOT}/sites/default/files"
diff --git a/scaffold/tugboat/steps/3-build.sh.twig b/scaffold/tugboat/steps/3-build.sh.twig
index 87a6c83da..adab517a7 100644
--- a/scaffold/tugboat/steps/3-build.sh.twig
+++ b/scaffold/tugboat/steps/3-build.sh.twig
@@ -6,5 +6,5 @@
 set -eux
 echo "Building..."
 
-task {{ build_command }}
-task {{ update_command }}
+{{ task_path }} build
+{{ task_path }} update
diff --git a/src/ScaffoldInstallerPlugin.php b/src/ScaffoldInstallerPlugin.php
index 8f0601acf..685599caa 100644
--- a/src/ScaffoldInstallerPlugin.php
+++ b/src/ScaffoldInstallerPlugin.php
@@ -318,6 +318,7 @@ private function installCICommands(): void
                 'build_command' => 'build',
                 'update_command' => 'drupal:update',
                 'init' => [],
+                'task_path' => $this->extra['drainpipe']['global-binaries']['task'] ? 'task': './vendor/bin/task',
                 'task_version' => $binaryInstallerPlugin->getBinaryVersion('task'),
                 'pantheon' => isset($this->extra['drainpipe']['tugboat']['pantheon']),
             ];

From 85a6c9a95c95b9881ff8d75f9d3d53b738827e7b Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 08:17:12 -0400
Subject: [PATCH 22/38] Fix not creating settings.ddev.php

---
 .github/workflows/test-production-build.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index bc6d93e17..53b4de9c5 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -74,6 +74,8 @@ jobs:
           ddev config --project-type=drupal9
           ddev start
           ddev composer install
+          # ddev won't create settings.ddev.php until settings.php exists.
+          ddev config --project-type=drupal9
           ddev restart
 
       - name: Install Drupal

From 81573cabcf935fc3658caf9b4f55ec089fad3a25 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 08:23:37 -0400
Subject: [PATCH 23/38] Log commands as they are run

---
 .github/workflows/TestEnv.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/TestEnv.yml b/.github/workflows/TestEnv.yml
index 6a716b7df..e72066437 100644
--- a/.github/workflows/TestEnv.yml
+++ b/.github/workflows/TestEnv.yml
@@ -30,6 +30,7 @@ jobs:
 
       - name: Setup Project
         run: |
+          set -x
           ddev config --auto
           ddev start
           ddev composer config extra.drupal-scaffold.gitignore true

From ea1d9dcac2106859806344c8e01c103ab6bab7be Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 08:30:11 -0400
Subject: [PATCH 24/38] Fix missing ? for null coalesce

---
 src/ScaffoldInstallerPlugin.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ScaffoldInstallerPlugin.php b/src/ScaffoldInstallerPlugin.php
index 685599caa..e4120ac0b 100644
--- a/src/ScaffoldInstallerPlugin.php
+++ b/src/ScaffoldInstallerPlugin.php
@@ -318,7 +318,7 @@ private function installCICommands(): void
                 'build_command' => 'build',
                 'update_command' => 'drupal:update',
                 'init' => [],
-                'task_path' => $this->extra['drainpipe']['global-binaries']['task'] ? 'task': './vendor/bin/task',
+                'task_path' => $this->extra['drainpipe']['global-binaries']['task'] ?? 'task': './vendor/bin/task',
                 'task_version' => $binaryInstallerPlugin->getBinaryVersion('task'),
                 'pantheon' => isset($this->extra['drainpipe']['tugboat']['pantheon']),
             ];

From 233ff3de2af262c802584a293b2617f823c455ff Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 08:37:48 -0400
Subject: [PATCH 25/38] Add missing check

---
 src/ScaffoldInstallerPlugin.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ScaffoldInstallerPlugin.php b/src/ScaffoldInstallerPlugin.php
index e4120ac0b..edadfafa8 100644
--- a/src/ScaffoldInstallerPlugin.php
+++ b/src/ScaffoldInstallerPlugin.php
@@ -318,7 +318,7 @@ private function installCICommands(): void
                 'build_command' => 'build',
                 'update_command' => 'drupal:update',
                 'init' => [],
-                'task_path' => $this->extra['drainpipe']['global-binaries']['task'] ?? 'task': './vendor/bin/task',
+                'task_path' => ($this->extra['drainpipe']['global-binaries']['task'] ?? 'task') ? : './vendor/bin/task',
                 'task_version' => $binaryInstallerPlugin->getBinaryVersion('task'),
                 'pantheon' => isset($this->extra['drainpipe']['tugboat']['pantheon']),
             ];

From 94ed49eca8b74521737ca19e4942cd95c704bc31 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 08:40:39 -0400
Subject: [PATCH 26/38] Need more espresso apparently

---
 src/ScaffoldInstallerPlugin.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ScaffoldInstallerPlugin.php b/src/ScaffoldInstallerPlugin.php
index edadfafa8..c5f6aecad 100644
--- a/src/ScaffoldInstallerPlugin.php
+++ b/src/ScaffoldInstallerPlugin.php
@@ -318,7 +318,7 @@ private function installCICommands(): void
                 'build_command' => 'build',
                 'update_command' => 'drupal:update',
                 'init' => [],
-                'task_path' => ($this->extra['drainpipe']['global-binaries']['task'] ?? 'task') ? : './vendor/bin/task',
+                'task_path' => isset($this->extra['drainpipe']['global-binaries']['task']) && $this->extra['drainpipe']['global-binaries']['task'] ? 'task' : './vendor/bin/task',
                 'task_version' => $binaryInstallerPlugin->getBinaryVersion('task'),
                 'pantheon' => isset($this->extra['drainpipe']['tugboat']['pantheon']),
             ];

From 1924dc2c9dea6aa7a68e13e9da4d2e85e807abff Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 09:15:22 -0400
Subject: [PATCH 27/38] Restore default paths

---
 .tugboat/steps/2-update.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.tugboat/steps/2-update.sh b/.tugboat/steps/2-update.sh
index 39ad532ed..ec0c3dfbc 100755
--- a/.tugboat/steps/2-update.sh
+++ b/.tugboat/steps/2-update.sh
@@ -10,7 +10,7 @@ echo "Updating..."
 mv .tugboat .tugboat-tmp
 #drainpipe-end
 composer install
-task sync
+./vendor/bin/task sync
 
 # Set file permissions such that Drupal will not complain.
 chgrp -R www-data "${DOCROOT}/sites/default/files"

From 90319b3929bdeccd4a932bbaa59d98888a022468 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 09:17:57 -0400
Subject: [PATCH 28/38] Print composer.json for debugging

---
 .github/workflows/TestEnv.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/TestEnv.yml b/.github/workflows/TestEnv.yml
index e72066437..c532d9561 100644
--- a/.github/workflows/TestEnv.yml
+++ b/.github/workflows/TestEnv.yml
@@ -40,7 +40,7 @@ jobs:
           ddev composer config --no-plugins allow-plugins.lullabot/drainpipe true
           ddev composer config repositories.drainpipe --json "{\"type\": \"path\", \"url\": \"drainpipe\", \"options\": {\"symlink\": false}}"
           ddev composer config minimum-stability dev
-          cat composer.json | jq --indent 4 '."autoload-dev" = {"files": ["vendor/lullabot/drainpipe/scaffold/env/dotenv.php"]}' | tee composer.json > /dev/null
+          cat composer.json | jq --indent 4 '."autoload-dev" = {"files": ["vendor/lullabot/drainpipe/scaffold/env/dotenv.php"]}' | tee composer.json
           ddev composer update --lock
           ddev composer validate
           ddev composer require lullabot/drainpipe --with-all-dependencies

From 36f06cfe6c17671698756109edb6fbd0f6240763 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 09:20:13 -0400
Subject: [PATCH 29/38] Fix race condition between cat and tee

---
 .github/workflows/TestEnv.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/TestEnv.yml b/.github/workflows/TestEnv.yml
index c532d9561..61395c429 100644
--- a/.github/workflows/TestEnv.yml
+++ b/.github/workflows/TestEnv.yml
@@ -40,7 +40,10 @@ jobs:
           ddev composer config --no-plugins allow-plugins.lullabot/drainpipe true
           ddev composer config repositories.drainpipe --json "{\"type\": \"path\", \"url\": \"drainpipe\", \"options\": {\"symlink\": false}}"
           ddev composer config minimum-stability dev
-          cat composer.json | jq --indent 4 '."autoload-dev" = {"files": ["vendor/lullabot/drainpipe/scaffold/env/dotenv.php"]}' | tee composer.json
+          # cat + tee still has a race condition causing random failures.
+          # https://stackoverflow.com/a/68676400
+          cat composer.json | jq --indent 4 '."autoload-dev" = {"files": ["vendor/lullabot/drainpipe/scaffold/env/dotenv.php"]}' | tee composer.new.json
+          mv composer.new.json composer.json
           ddev composer update --lock
           ddev composer validate
           ddev composer require lullabot/drainpipe --with-all-dependencies

From e52e8b0e15c66a83505ae6b829ca6e4a06fa8650 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Fri, 29 Sep 2023 09:53:22 -0400
Subject: [PATCH 30/38] Use build and update command vars

---
 scaffold/tugboat/steps/3-build.sh.twig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scaffold/tugboat/steps/3-build.sh.twig b/scaffold/tugboat/steps/3-build.sh.twig
index adab517a7..0adbb4446 100644
--- a/scaffold/tugboat/steps/3-build.sh.twig
+++ b/scaffold/tugboat/steps/3-build.sh.twig
@@ -6,5 +6,5 @@
 set -eux
 echo "Building..."
 
-{{ task_path }} build
-{{ task_path }} update
+{{ task_path }} {{ build_command }}
+{{ task_path }} {{ update_command }}

From ca13661b86730a680608ed9e3a012bb66ef6283f Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Wed, 1 Nov 2023 10:21:10 -0400
Subject: [PATCH 31/38] Install task globally if needed in review apps jobs

---
 scaffold/github/workflows/PantheonReviewApps.yml | 6 ++++++
 scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/scaffold/github/workflows/PantheonReviewApps.yml b/scaffold/github/workflows/PantheonReviewApps.yml
index cc49356ff..2ae41d181 100644
--- a/scaffold/github/workflows/PantheonReviewApps.yml
+++ b/scaffold/github/workflows/PantheonReviewApps.yml
@@ -57,6 +57,12 @@ jobs:
           directory: /tmp/release
         run: |
           composer install
+          # Task is installed globally, not via composer.
+          if [ ! -f vendor/bin/task ]; then
+            .ddev/web-build/install-task.sh -b /usr/local/bin -d v3.24.0
+          fi
+          # This is a problem because if global binaries are enabled composer install
+          # won't add task
           task build
           task snapshot:directory directory=/tmp/release
 
diff --git a/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml b/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml
index 24a81788e..f524d1dc7 100644
--- a/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml
+++ b/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml
@@ -9,6 +9,11 @@
       else
         terminus multidev:create $PANTHEON_SITE_NAME.dev mr-$CI_MERGE_REQUEST_IID --yes
       fi
+    - |
+      # Task is installed globally, not via composer.
+      if [ ! -f vendor/bin/task ]; then
+        .ddev/web-build/install-task.sh -b /usr/local/bin -d v3.24.0
+      fi
     - task build
     - task snapshot:directory
     - task deploy:git

From 3629af05fc8d18c8ba76a4cf5eaed5eb2d9e6079 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew.berry@lullabot.com>
Date: Wed, 1 Nov 2023 10:21:56 -0400
Subject: [PATCH 32/38] Task version updated in main

---
 scaffold/ddev/web-build/Dockerfile.drainpipe     | 2 +-
 scaffold/github/workflows/PantheonReviewApps.yml | 2 +-
 scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/scaffold/ddev/web-build/Dockerfile.drainpipe b/scaffold/ddev/web-build/Dockerfile.drainpipe
index 6b2b87bf2..4cd441600 100644
--- a/scaffold/ddev/web-build/Dockerfile.drainpipe
+++ b/scaffold/ddev/web-build/Dockerfile.drainpipe
@@ -1,7 +1,7 @@
 COPY install-task.sh /usr/local/bin
 RUN chmod +x /usr/local/bin/install-task.sh
 # Also update .github/workflows/ValidateTaskfile.yml if changing version.
-RUN install-task.sh -b /usr/local/bin -d v3.24.0
+RUN install-task.sh -b /usr/local/bin -d v3.28.0
 
 COPY install-local-php-security-checker.sh /usr/local/bin
 RUN chmod +x /usr/local/bin/install-local-php-security-checker.sh
diff --git a/scaffold/github/workflows/PantheonReviewApps.yml b/scaffold/github/workflows/PantheonReviewApps.yml
index 2ae41d181..9071f9b81 100644
--- a/scaffold/github/workflows/PantheonReviewApps.yml
+++ b/scaffold/github/workflows/PantheonReviewApps.yml
@@ -59,7 +59,7 @@ jobs:
           composer install
           # Task is installed globally, not via composer.
           if [ ! -f vendor/bin/task ]; then
-            .ddev/web-build/install-task.sh -b /usr/local/bin -d v3.24.0
+            .ddev/web-build/install-task.sh -b /usr/local/bin -d v3.28.0
           fi
           # This is a problem because if global binaries are enabled composer install
           # won't add task
diff --git a/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml b/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml
index f524d1dc7..82dcac059 100644
--- a/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml
+++ b/scaffold/gitlab/PantheonReviewApps.gitlab-ci.yml
@@ -12,7 +12,7 @@
     - |
       # Task is installed globally, not via composer.
       if [ ! -f vendor/bin/task ]; then
-        .ddev/web-build/install-task.sh -b /usr/local/bin -d v3.24.0
+        .ddev/web-build/install-task.sh -b /usr/local/bin -d v3.28.0
       fi
     - task build
     - task snapshot:directory

From e4c86969bc04b4c3e81c5ac47be3634136d25c7b Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew@furrypaws.ca>
Date: Mon, 29 Jan 2024 18:53:36 -0500
Subject: [PATCH 33/38] Fix help text for migrating

---
 src/BinaryInstaller.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/BinaryInstaller.php b/src/BinaryInstaller.php
index 0e9564706..8501912c6 100644
--- a/src/BinaryInstaller.php
+++ b/src/BinaryInstaller.php
@@ -153,7 +153,7 @@ public function installBinaries(Event $event)
                 }
                 $this->io->warning('Downloading binaries to vendor/bin is deprecated and will be removed in Drainpipe 4.0.');
                 $this->io->warning('Run the following composer command and update any CI scripts to use the commands installed in /usr/local/bin to migrate.');
-                $this->io->warning(sprintf('composer config --json extra.drainpipe.global-binaries.%s "true"', $binary));
+                $this->io->warning('composer config --json --merge extra.drainpipe \'{"global-binaries": { "local-php-security-checker": true, "task": true } }\'');
             }
 
             $platform = $this->platform;

From 31a7d461d9acb3b4c2bbe103ea2e471a2c0420e1 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew@furrypaws.ca>
Date: Wed, 31 Jan 2024 09:08:41 -0500
Subject: [PATCH 34/38] Show warning even if entire extra section is missing

---
 src/BinaryInstaller.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/BinaryInstaller.php b/src/BinaryInstaller.php
index 8501912c6..ee8ef96b3 100644
--- a/src/BinaryInstaller.php
+++ b/src/BinaryInstaller.php
@@ -146,11 +146,15 @@ public function onPostUpdateCmd(Event $event)
     public function installBinaries(Event $event)
     {
         foreach ($this->binaries as $binary => $info) {
-            if (isset($this->extra['drainpipe']['global-binaries'])) {
+            $migrated_to_global = isset($this->extra['drainpipe']['global-binaries']);
+            if ($migrated_to_global) {
                 $global_binaries = $this->extra['drainpipe']['global-binaries'];
                 if (isset($global_binaries[$binary]) && $global_binaries[$binary]) {
                     continue;
                 }
+                $migrated_to_global = FALSE;
+            }
+            if (!$migrated_to_global) {
                 $this->io->warning('Downloading binaries to vendor/bin is deprecated and will be removed in Drainpipe 4.0.');
                 $this->io->warning('Run the following composer command and update any CI scripts to use the commands installed in /usr/local/bin to migrate.');
                 $this->io->warning('composer config --json --merge extra.drainpipe \'{"global-binaries": { "local-php-security-checker": true, "task": true } }\'');

From 502309fb167058c3bc2beef96f1c4a4d0fdab485 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew@furrypaws.ca>
Date: Fri, 15 Mar 2024 10:10:40 -0400
Subject: [PATCH 35/38] Move test fixture back to match main

---
 .../Taskfile.yml                                                  | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename tests/{fixtures/drainpipe-test-production-build => fixtures.drainpipe-test-build}/Taskfile.yml (100%)

diff --git a/tests/fixtures/drainpipe-test-production-build/Taskfile.yml b/tests/fixtures.drainpipe-test-build/Taskfile.yml
similarity index 100%
rename from tests/fixtures/drainpipe-test-production-build/Taskfile.yml
rename to tests/fixtures.drainpipe-test-build/Taskfile.yml

From b4fda8ef3eb17a68fc10088ab34a95dc5fcaa402 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew@furrypaws.ca>
Date: Fri, 15 Mar 2024 10:12:15 -0400
Subject: [PATCH 36/38] Revert "Move test fixture back to match main"

This reverts commit 502309fb167058c3bc2beef96f1c4a4d0fdab485.
---
 .../drainpipe-test-production-build}/Taskfile.yml                 | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename tests/{fixtures.drainpipe-test-build => fixtures/drainpipe-test-production-build}/Taskfile.yml (100%)

diff --git a/tests/fixtures.drainpipe-test-build/Taskfile.yml b/tests/fixtures/drainpipe-test-production-build/Taskfile.yml
similarity index 100%
rename from tests/fixtures.drainpipe-test-build/Taskfile.yml
rename to tests/fixtures/drainpipe-test-production-build/Taskfile.yml

From 71e2048b2492b43cbe146cf30b94095988918060 Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew@furrypaws.ca>
Date: Fri, 15 Mar 2024 10:12:47 -0400
Subject: [PATCH 37/38] Instead update the path we use for the cp

---
 .github/workflows/test-production-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index b37a9c003..ae0bd75fd 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -39,7 +39,7 @@ jobs:
           cd ../
           composer create-project drupal/recommended-project drupal --ignore-platform-req=ext-gd
           cd drupal
-          cp ${GITHUB_WORKSPACE}/tests/fixtures.drainpipe-test-build/Taskfile.yml .
+          cp drainpipe/tests/fixtures/drainpipe-test-production-build/Taskfile.yml .
           composer config extra.drupal-scaffold.gitignore true
           composer config --json extra.drupal-scaffold.allowed-packages '["lullabot/drainpipe"]'
           composer config --no-plugins allow-plugins.composer/installers true

From 7cf6505fac5d9421406ca3ad25179c0b0f1fe17c Mon Sep 17 00:00:00 2001
From: Andrew Berry <andrew@furrypaws.ca>
Date: Fri, 15 Mar 2024 10:20:31 -0400
Subject: [PATCH 38/38] We need this absolute path, or use a checkout dir

---
 .github/workflows/test-production-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-production-build.yml b/.github/workflows/test-production-build.yml
index ae0bd75fd..c5af1b4a4 100644
--- a/.github/workflows/test-production-build.yml
+++ b/.github/workflows/test-production-build.yml
@@ -39,7 +39,7 @@ jobs:
           cd ../
           composer create-project drupal/recommended-project drupal --ignore-platform-req=ext-gd
           cd drupal
-          cp drainpipe/tests/fixtures/drainpipe-test-production-build/Taskfile.yml .
+          cp ${GITHUB_WORKSPACE}/tests/fixtures/drainpipe-test-production-build/Taskfile.yml .
           composer config extra.drupal-scaffold.gitignore true
           composer config --json extra.drupal-scaffold.allowed-packages '["lullabot/drainpipe"]'
           composer config --no-plugins allow-plugins.composer/installers true