Using drupal-scaffold correctly
I use the patch method mentioned on https://www.drupal.org/docs/develop/using-composer/using-drupals-composer-scaffold#toc_4 

e.g:

"name": "my/project",
...
"scripts": {
  "post-drupal-scaffold-cmd": [
    "cd docroot &amp;&amp; patch -p1 &lt;../patches/htaccess-ssl.patch"
  ]
}


Then if the core file changes it will either merge correctly or the patch will fail and you'll see that in your composer command and can make the relevant changes to your patch