source the drupal/core-vendor-hardening plugin from the drupal project, or document why not

I should say also that in working on 🐛 Wrong DRUPAL_ROOT with non-standard code structure Needs work , I've added a Composer repository for this to the project root composer.json and it works fine.

Do you mean the scaffold plugin? Because drupal/core-vendor-hardening is right there:

        {
            "type": "path",
            "url": "composer/Plugin/VendorHardening"
        },

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened → , as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule → and the Allowed changes during the Drupal core release cycle → .

Drupal 9.5.0-beta2 → and Drupal 10.0.0-beta2 → were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule → and the Allowed changes during the Drupal core release cycle → .

Drupal 9.4.0-alpha1 → was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule → and the Allowed changes during the Drupal core release cycle → .

Drupal 9.3.0-rc1 → was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule → and the Allowed changes during the Drupal core release cycle → .

Drupal 9.2.0-alpha1 → will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule → and the Allowed changes during the Drupal core release cycle → .

But "composer/Plugin/Scaffold" isn't there.

I think core itself doesn't use the scaffold plugin direct, that's why it is omitted. It's an artifact built from core via meta package, but not used by core.

This feels like a task.

So there's some discrepancy in the summary and title about which package we're talking about.

But:

If you say composer create-project drupal/recommended-project you'll get a project composer.json that doesn't use the path repositories. The same for drupal/legacy-project.

drupal/drupal does look like the issue summary, however: https://git.drupalcode.org/project/drupal/-/blame/11.x/composer.json?ref...

I believe this is because the drupal/drupal package is specifically for doing local development of core, and no other purpose. For core dev you're supposed to clone the repo and say composer install. Since the entire file system is laid out already in the repo, there's no need to use the scaffold plugin, so it is not included in the require section, and therefore also not included in the repositories section.

I'm not sure where to document this. I don't see a change record that says 'drupal/drupal is for dev only,' so maybe that's a good candidate, or maybe it already exists and I couldn't find it.