Deployment and CI

Secrets in WordPress: keep keys out of wp-config.php, git and backups A typical wp-config.php holds the database password, the salts, an SMTP password, payment and API keys. The file gets copied to staging, ends up in backups that are stored for years, and sometimes in a git repository. Each copy is a place where the…

Podman for WordPress: rootless containers and Compose files without the Docker daemon Docker runs a daemon as root, and anyone who can talk to it effectively has root on the machine. Podman runs containers without a central daemon and, by default, without root: the containers run as processes of the user who started them. It…

git bundle: move a repository without network access to the remote Some servers cannot reach GitHub: a client’s production network that allows only SSH from the agency’s jump host, an air-gapped intranet, a customer who receives code by file transfer. A git bundle is a single file that contains commits, branches and tags like a…

MySQL Clone Plugin: provision a staging database from production The MySQL Clone Plugin (MySQL 8.0.17+) copies a running MySQL instance at the physical level: the InnoDB data files are streamed to another server while the source keeps working. For a database of tens of gigabytes this is much faster than mysqldump and a restore, which…

Reusable workflows and composite actions for WordPress plugin CI An agency with ten plugins has ten copies of the same CI workflow: set up PHP, install Composer packages with caching, run PHPCS, PHPUnit against a WordPress test database, build the ZIP. A fix in one copy rarely reaches the other nine. GitHub Actions has two…

GitHub CLI (gh) for plugin release automation A plugin release on GitHub is a series of clicks: check that CI is green on the release commit, create the tag, write the release notes, upload the ZIP, maybe update a draft into a final release. The GitHub CLI gh does each of these in one command,…

Git tags and signed releases for a WordPress plugin A plugin release is a version number in three places (the plugin header, readme.txt‘s “Stable tag”, a constant in the code), a ZIP and, ideally, a tag in git that marks exactly which commit was released. When these drift apart, a support request for “version 2.4.1”…

A monorepo for several WordPress plugins An agency with five plugins and a shared library usually has six repositories. A change in the library means a release of the library, then a Composer update and a pull request in every plugin, and the integration tests run only after all of that. A monorepo puts all…

Zero-downtime WordPress deployment with rsync, SSH and a symlink Uploading a new theme version file by file means that for a few seconds the server has a mix of old and new files. A request in that moment loads a new template with an old functions file and ends in a fatal error. The fix…