laravel-cicd

When to activate

• Creating a GitHub Actions workflow for a Laravel project from scratch
• Migrating a manual deployment process to automated CI/CD
• "How do I speed up my Laravel pipeline?" in a GitHub Actions context
• Adding Composer or NPM caching to an existing workflow
• Configuring PHPUnit or Pest to run in CI with a real database
• Setting up matrix builds for multiple PHP versions
• Adding security scanning (SAST) to PR validation
• Managing environment variables and secrets in GitHub Actions
• Configuring zero-downtime deployment to production
• Any mention of Laravel Forge, Envoyer, Octane, Horizon, or queues in a CI/CD context

Rules — Non-negotiable

1. Secrets never go in workflow .yml files. All sensitive values — DB passwords, API keys, APP_KEY — must come from GitHub Secrets injected as environment variables. Never hardcoded, never in plain env: at repo level.

2. Deploy only from main after all checks pass. No manual deploys that bypass the pipeline. Deploy job must need: the test and security jobs.

3. Cache vendor/ and node_modules/ on every pipeline. A pipeline without caching wastes 60–90 seconds per run on package downloads.

4. Tests run against a real database. SQLite in-memory is acceptable only for unit tests. Feature tests must use MySQL or PostgreSQL via service containers.

5. .env files are never committed. Use .env.ci or inline env: blocks with secrets. Never copy .env.example and commit real values.

Pipeline Structure

Push / PR → Quality Gates (parallel) → Build Assets → Deploy (gated)
                ├── PHPUnit / Pest
                ├── Static Analysis (Larastan)
                └── Security Scan (SAST)

Canonical workflow skeleton

# .github/workflows/ci.yml
name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  tests:
    name: Tests
    runs-on: ubuntu-latest
    # ... (see Tests job below)

  static-analysis:
    name: Static Analysis
    runs-on: ubuntu-latest
    # ... (see Static Analysis below)

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    # ... (see Security Scan below)

  build-assets:
    name: Build Assets
    runs-on: ubuntu-latest
    needs: [tests, static-analysis, security-scan]
    # ... (see Build Assets below)

  deploy:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: [build-assets]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    # ... (see Deploy below)