manuxi/sulu-bulk-actions-bundle
A Sulu CMS bundle that adds bulk actions to admin list views, letting editors select multiple records and run actions such as delete, publish, or custom operations at once. Extensible action registration supports tailored editorial workflows.
Architecture fit. The package follows a handler/DI pattern that a TPM should recognize as an extension-point architecture: ContentEntityBulkActionHandler is the single implementation surface, now parameterized by collaborators (content manager, domain event collector, trash manager, domain event classes) rather than hard-wired behavior. copy_locale is expressed as an interface contract (LocaleCopyHandlerInterface), which means locale-copy behavior is opt-in per entity rather than a global capability — good for a phased rollout, but it also means feature parity across entities (articles, snippets, testimonials, events) is intentionally uneven and must be communicated to stakeholders as such. The default action registry (delete) is configuration-driven via sulu_bulk_actions.delete_enabled, which is the right shape for a TPM: a single toggle with a role-permission gate layered on top.
Integration feasibility. Three items drive effort. First, services moved from services.xml to Resources/config/services.yaml, and symfony/yaml is now a hard requirement — any environment with a locked Composer baseline or a "no new transitive deps" policy needs an approval. Second, the constructor signature of ContentEntityBulkActionHandler changed; the last three arguments are optional, so direct instantiation still compiles, but any subclass, decorator, or service definition that passes arguments positionally is at risk. Third, delete now mirrors controller semantics (trash → remove → collect "removed"), which is a behavior contract, not a cosmetic change: downstream activity-log and search-index consumers will see new events for bulk paths.
Technical risk. The highest-severity item is the default flip of sulu_bulk_actions.delete_enabled to true. A destructive bulk action becomes available on upgrade to every role holding "Delete" in the "Bulk actions" context, with no operator opt-in. The second is the constructor change landing in a minor release — a semver question worth raising with the maintainer. Third, publishing/unpublishing for testimonials and events now collects published/unpublished events that previously were not emitted, so activity-log volume and search-index write load will change for existing installs without any code change by us.
Key questions.
published/unpublished domain events newly duplicative for any existing listener (double-indexing, duplicate activity entries)?symfony/yaml already present transitively in our lockfile, or is this a new install artifact?copy_locale restricted to drafts, and does it require locales to be pre-configured per webspace?delete_enabled for existing installations?Stack fit. This is a Symfony/Sulu bundle, not a Laravel package. In a Laravel-centric estate it is only directly consumable inside a Sulu application; anywhere else it is a reference implementation for the handler/permission/config pattern rather than a dependency. That framing should be explicit before any engineering time is committed, because it changes the cost model from "composer update" to "separate application surface."
Migration path. Treat the upgrade as a four-part change, not a version bump: (1) dependency and container changes — add symfony/yaml, re-express any service overrides previously declared against services.xml in YAML, and verify container compilation; (2) code changes — audit for subclasses, decorators, and manual instantiations of ContentEntityBulkActionHandler and update constructor argument order; (3) configuration and permission review — decide delete_enabled policy per environment and audit which roles hold "Delete" in the "Bulk actions" context; (4) behavioral validation — confirm trash availability per entity and verify activity log and search index behavior under bulk publish/unpublish/delete.
Compatibility. Validate the version matrix (PHP, Symfony, Sulu core, trash bundle, content manager) before committing. The trash manager and domain event classes are optional constructor arguments, so a null-passing configuration will compile but will silently degrade auditability — that should be a deliberate, documented choice, not a default. Locale copy depends on per-webspace locale configuration and operates on drafts; entities without configured target locales will not benefit.
Sequencing. Ship in this order: dependency and YAML service migration behind a green container build → constructor audit and fixes → permission and config review with an explicit decision on the delete default → staging deployment with delete_enabled: false to validate non-destructive paths and event emission → targeted enablement for a pilot role → production rollout with a rollback plan (config flip back to false is the fast lever, container recompile is the slow one). Do not enable bulk delete in production in the same change window as the constructor refactor; separating them keeps the blast radius attributable.
Maintenance. YAML service definitions are more merge-conflict-prone than XML for teams that override vendor services, and they add a schema-validation failure mode at container build time. Keep all customizations in application-level config rather than patching vendor files, and pin the version so a subsequent patch release cannot re-flip a behavioral default underneath you.
Support. This release introduces a user-visible destructive capability. Expect a new ticket class: accidental bulk deletion. Two things must exist before enablement — a documented restore path via the trash bundle, and a support runbook that names the permission and context ("Delete" / "Bulk actions") so agents can diagnose "the button is missing" reports, which will now have three distinct causes: role permission, list context, and the delete_enabled toggle.
Scaling. Bulk delete and bulk copy_locale are request-scoped operations over unbounded result sets. Large selections will translate into long request durations, elevated memory, and write amplification on the database, plus additional activity-log and search-index writes now that removal and publish/unpublish events are collected. If the product exposes "select all matching filter" rather than "select visible page," this needs chunking or async processing before it reaches production volumes.
Failure modes. (1) Trash bundle absent → bulk delete is irreversible with no recovery path. (2) Domain event collector or event classes passed as null → operations succeed but produce no audit trail, which is the worst failure mode because it is silent. (3) Search index not updated on bulk publish/unpublish in older versions is now fixed, but the fix means index write load increases; conversely, any custom listener relying on the previous absence of these events may now double-count. (4) Missing symfony/yaml → container build failure at deploy, not at test, if the dependency was only satisfied transitively in dev. (5) The delete_enabled: false escape hatch hides the action but does not remove the permission, so a later flip re-exposes it without a permissions re-review.
Ramp-up. Delete behavior is documented in both English and German (docs/delete.*.md), which lowers the onboarding cost for operators. Engineering ramp-up is concentrated in three concepts the team must internalize: the permission-context model for bulk actions, trash-versus-hard-delete semantics per entity, and the domain event contract that now spans both controller and bulk paths. Budget a short internal walkthrough for support and content-ops before enabling the delete default in production; the technical change is small, but the operational surface it opens is not.
How can I help you explore Laravel packages today?