helga-agentur / drush-policy-commands

v1.0.0 2026-11-04 15:56 UTC

Requires

• php: >=8.3

Conflicts

• drush/drush: <13.7

MIT

• drupal
• Policy
• Drush
• safeguard

Published on Packagist.org on 2026-11-04 16:05 UTC

README

Drush safeguards that refuse destructive commands against anything but local targets.

Command	Allowed
sql:drop	@*.local aliases, or no alias (@self) inside DDEV
sql:sync	target is a @*.local alias, or @self inside DDEV
core:rsync	target is a @*.local alias, or @self inside DDEV
site:install	@*.local aliases, or no alias (@self) inside DDEV

Everything else, including every stage, integration and live alias, is refused. The check also runs on the servers (without DDEV, @self is refused), so a server cannot drop or reinstall itself either.

Requirements

• Drush 13.7 or newer (enforced through a Composer conflict)
• PHP 8.3 or newer

Installation

composer require helga-agentur/drush-policy-commands

The package is auto-discovered by Drush through its PSR-4 Drush\Commands namespace; no further configuration is needed. It must be installed on the machine that runs the command (for sql:sync and core:rsync, the machine that initiates it).

Verifying the installation

Run a guarded command against a non-local alias. It must be refused before anything is executed:

drush @stage.xyz sql:drop
# Per .../PolicyCommands.php, sql:drop is not allowed against @stage.xyz.
# Allowed: @*.local, or no alias inside DDEV.

Further checks (replace the aliases with your own). Each must be refused:

drush @stage.xyz site:install
drush sql:sync @local.xyz @stage.xyz      # target is not local
drush core:rsync @self:%files @stage.xyz:%files

The same commands against a @*.local alias, or without an alias inside DDEV (ddev drush sql:drop), are allowed.

If a refused command runs anyway, check that the package is installed (composer show helga-agentur/drush-policy-commands) and that Drush is 13.7 or newer (drush --version). If the commands were not picked up after installing, clear Drush's command cache with drush cache:clear drush.

Changing the allowed aliases

The allowlist is the ALLOWED_ALIASES constant (fnmatch patterns) in src/Drush/Commands/PolicyCommands.php.