Checks (0.x) reference

These pages document the check types available in the legacy 0.x checks: format. The format is fully supported and continues to run without changes — see Config versions for the format itself.

For new configurations, prefer the 1.x pipeline. The recipe catalogue shows the collect + analyse chain that reproduces each check below.

Unrecognised check keys are silently ignored

An unknown key under checks: is discarded without warning — the run reports zero checks and still exits 0, which is indistinguishable from a passing build. Copy the Check type value from each page exactly. Note in particular that filediff has no colon.

File checks

• file — assert files matching a pattern are absent
• filediff — assert a file matches a reference template

YAML / JSON checks

• yaml — assert key-value pairs in YAML files
• yamllint — assert files parse as valid YAML
• json — assert key-value pairs in JSON files

Drupal checks

• drush-yaml — assert Drupal config via Drush
• drupal-file-module — assert modules via filesystem
• drupal-db-module — assert modules via database
• drupal-admin-user — assert UID 1 roles
• drupal-db-permissions — assert role permissions
• drupal-db-user-tfa — assert users have TFA
• drupal-user-forbidden — assert an account absent
• drupal-role-permissions — assert role permissions
• drupal-user-role — assert role holders are allow-listed
• drupal-tracking-code — assert tracking code present

Code quality checks

• phpstan — run PHPStan and report issues
• sca:application_type — detect application framework

Infrastructure checks

• docker:base_image — assert approved base images
• crawler — assert pages return HTTP 200