Automation & CI
Deployments
Materialize an exact local env file or sync decrypted values to Laravel Forge, Vapor, or Cloud with dry-run planning and scoped automation access.
Deployment safety
Always validate and dry-run the selected environment before enabling provider writes:
$ ghostable validate --env production --json
$ ghostable deploy production --dry-run --json
Local device deployments from a production-like environment require OS user confirmation. Non-interactive deployment systems use a scoped GHOSTABLE_CI_TOKEN credential instead.
Provider semantics
-
Dry run - Builds a local plan from decrypted Ghostable state without invoking or querying the provider CLI. It cannot prove provider authentication, remote state, or a successful write.
-
Forge and Vapor - Pull the current remote env file, merge Ghostable values, and push it back. Remote keys absent from Ghostable are preserved; Ghostable does not prune them.
-
Laravel Cloud - Sets each selected key individually. Other remote keys are preserved, and no delete operation is performed.
-
Temporary files - Forge and Vapor use restrictive temporary env files scheduled for removal on success or error. A terminated process or host failure can still leave OS temporary storage behind.
Before a real deployment, install and authenticate a trusted provider CLI outside the application repository. Confirm that its own list or authentication command works in the same shell or runner. A successful Ghostable dry run does not perform that provider preflight.
Local env files
With no provider target, deploy writes the selected environment to .env and replaces the file by default so stale values cannot survive from a previous deployment.
$ ghostable deploy production --dry-run
$ ghostable deploy production
$ ghostable deploy local production --file .env --backup
$ ghostable deploy local staging --merge --only APP_KEY --only DATABASE_URL
Use the explicit local target when deployTarget in the manifest points at a provider but a script still needs a file. Pass --merge only when preserving unrelated existing keys is intentional.
Laravel Forge
Forge deployment requires an authenticated Laravel Forge CLI on PATH unless --dry-run is used:
$ ghostable deploy laravel-forge production --forge-site example.com --dry-run
$ ghostable deploy laravel-forge production --forge-site example.com
Ghostable pulls the site's current env file with forge env:pull, merges selected Ghostable values into a restrictive temporary file, then pushes it with forge env:push. Use --only to limit keys.
Laravel Vapor
Vapor deployment requires an authenticated Vapor CLI on PATH unless dry-running. Review Vapor's environment-variable commands before enabling the job:
$ ghostable deploy laravel-vapor production --dry-run
$ ghostable deploy laravel-vapor production --vapor-env prod-us
Ghostable merges values into Vapor's temporary environment file and invokes vapor env:push. The Vapor environment defaults to the Ghostable environment name.
Laravel Cloud
Cloud deployment requires an authenticated Laravel Cloud CLI on PATH unless dry-running:
$ ghostable deploy laravel-cloud production --dry-run
$ ghostable deploy laravel-cloud production --cloud-env production-us --only APP_KEY --only DATABASE_URL
Ghostable calls cloud environment:variables with --action=set for each selected key. Matching variables are updated and missing variables are added. The Cloud environment defaults to the Ghostable environment name.
Deployment scripts
Install dependencies, load the token from protected storage, deploy values, and only then run commands that consume the environment:
$ npm ci
$ export GHOSTABLE_CI_TOKEN="$(cat $HOME/.ghostable-ci-token)"
$ npx ghostable deploy laravel-forge production --forge-site example.com
$ npm run build
$ $FORGE_PHP artisan migrate --force
Store token files outside the application directory with restrictive permissions, and never print the token or generated plaintext.