ONR-152 | Add workflow step to generate per-template DB seeds for trials

[rujutaghanekar]

Motivation

The goal is to reduce Drupal site:install time from ~157s → ≤30s for trial site creation on Acquia cloud platform.

Proposed changes

Approach A — DB Dump in dist Branch (PRIMARY)

• We are proposing this for now considering a 2-3 day short deadline
• Long term approach will be Approach B
• Approach C will be considered if A or B don't work

How It Will Work

build-artifact.yml (every 8h on drupal-cms-project main):
  for each TEMPLATE in [drupal_cms_starter, drupal_cms_blog, ...]:
    drush site:install recipes/contrib/${TEMPLATE}
    drush cr
    drush sql:dump --gzip → seeds/${TEMPLATE}.sql.gz

CRC (preprovisioning):
  git clone dist branch → push to app git repo
  → seeds/*.sql.gz arrive at /var/www/html/seeds/ after code deploy

Runtime (SiteInstallTrialsTask per env — dev/test/prod):
  drush sql:drop
  gunzip seeds/${TEMPLATE}.sql.gz | drush sql:cli
  drush overrides (private_key, site UUID, site name, admin pass)
  drush recipe acquia_trials   ← re-apply for any runtime-only config
  drush cr

Alternatives considered

Three approaches are viable after analysis (S3 dropped — aws CLI not present on Drupal customer pod image):

Approach	Runtime target	2-3 day feasible?	Recommendation
A — DB dump in dist branch	5–8s	✅ YES	✅ PRIMARY — start here
B-EFS — DB dump on shared EFS	6–10s	⚠️ ~4–5 days	Backup if A has scale issues
C — N apps pre-installed per template	2–5s	❌ 7–10 days	Future scale consideration

Hash Salt — Decision & Impact

Question	Answer
Where is hash_salt at runtime?	/mnt/env-config/environment.json → read by Acquia Drupal Recommended Settings settings.php
Is salt stored in the DB?	No — file/env-var only
Does dump contain salt?	No — salt.txt is .gitignore'd in build-artifact.yml
Impact of salt mismatch on hydrated fresh env?	None — no sessions, no signed tokens, no pending password-reset links exist on a freshly hydrated env
Action needed at runtime?	drush state:delete system.private_key -y → forces Drupal to regenerate derived private key using the env's runtime salt on first request

Runtime Drush Override Commands

Approaches A & B-EFS (after dump restore)

set -e
cd /var/www/html

# 1. Drop existing DB and restore template dump
drush sql:drop -y
gunzip -c seeds/${TEMPLATE}.sql.gz | drush sql:cli
# For B-EFS: gunzip -c /mnt/trials-seeds/${TEMPLATE}.sql.gz | drush sql:cli

# 2. Regenerate cryptographic private key (uses env runtime salt from environment.json)
drush state:delete system.private_key -y

# 3. Regenerate Drupal site UUID (prevents config-sync UUID collisions across trials)
drush config:set system.site uuid "$(cat /proc/sys/kernel/random/uuid)" -y

# 4. Set customer site name from $SITE_NAME env var injected by HAPI task
drush config:set system.site name "${SITE_NAME}" -y

# 5. Reset admin password to random value (admin UI login not used for trials)
drush user:password admin "$(openssl rand -base64 32)"

# 6. Apply custom trials recipe (per-subscription customizations)
php ./vendor/drush/drush/drush.php recipe ./recipes/custom/acquia_trials

# 7. Cache rebuild
drush cr

Testing steps

Pending