Deployments | Ghostable CLI 3.x | Ghostable Menu Deployments Deployment safety ----------------- Always validate and dry-run the selected environment before enabling provider writes: Deployment preflight Copy ``` $ ghostable validate --env production --json $ ghostable deploy production --dry-run --json ``` Local device deployments from a production-like environment require OS user confirmation. Non-interactive deployment systems use a scoped `GHOSTABLE_CI_TOKEN` credential instead. The provider receives plaintext Ghostable decrypts locally, then passes plaintext to the destination. Provider credentials, provider storage, deployment logs, temporary files, and the runner are outside Ghostable's repository-encryption boundary. Provider semantics ------------------ `Dry run` Builds a local plan from decrypted Ghostable state without invoking or querying the provider CLI. It cannot prove provider authentication, remote state, or a successful write. `Forge and Vapor` Pull the current remote env file, merge Ghostable values, and push it back. Remote keys absent from Ghostable are preserved; Ghostable does not prune them. `Laravel Cloud` Sets each selected key individually. Other remote keys are preserved, and no delete operation is performed. `Temporary files` Forge and Vapor use restrictive temporary env files scheduled for removal on success or error. A terminated process or host failure can still leave OS temporary storage behind. Before a real deployment, install and authenticate a trusted provider CLI outside the application repository. Confirm that its own list or authentication command works in the same shell or runner. A successful Ghostable dry run does not perform that provider preflight. Local env files --------------- With no provider target, `deploy` writes the selected environment to `.env` and replaces the file by default so stale values cannot survive from a previous deployment. Local deployment Copy ``` $ ghostable deploy production --dry-run $ ghostable deploy production $ ghostable deploy local production --file .env --backup $ ghostable deploy local staging --merge --only APP_KEY --only DATABASE_URL ``` Use the explicit `local` target when `deployTarget` in the manifest points at a provider but a script still needs a file. Pass `--merge` only when preserving unrelated existing keys is intentional. Laravel Forge ------------- Forge deployment requires an authenticated [Laravel Forge CLI](https://forge.laravel.com/docs/cli) on `PATH` unless `--dry-run` is used: Deploy to Forge Copy ``` $ ghostable deploy laravel-forge production --forge-site example.com --dry-run $ ghostable deploy laravel-forge production --forge-site example.com ``` Ghostable pulls the site's current env file with `forge env:pull`, merges selected Ghostable values into a restrictive temporary file, then pushes it with `forge env:push`. Use `--only` to limit keys. Laravel Vapor ------------- Vapor deployment requires an authenticated Vapor CLI on `PATH` unless dry-running. Review Vapor's [environment-variable commands](https://docs.vapor.build/projects/environments) before enabling the job: Deploy to Vapor Copy ``` $ ghostable deploy laravel-vapor production --dry-run $ ghostable deploy laravel-vapor production --vapor-env prod-us ``` Ghostable merges values into Vapor's temporary environment file and invokes `vapor env:push`. The Vapor environment defaults to the Ghostable environment name. Laravel Cloud ------------- Cloud deployment requires an authenticated [Laravel Cloud CLI](https://cloud.laravel.com/docs/api/cli) on `PATH` unless dry-running: Deploy to Laravel Cloud Copy ``` $ ghostable deploy laravel-cloud production --dry-run $ ghostable deploy laravel-cloud production --cloud-env production-us --only APP_KEY --only DATABASE_URL ``` Ghostable calls `cloud environment:variables` with `--action=set` for each selected key. Matching variables are updated and missing variables are added. The Cloud environment defaults to the Ghostable environment name. Deployment scripts ------------------ Install dependencies, load the token from protected storage, deploy values, and only then run commands that consume the environment: Forge deployment script Copy ``` $ npm ci $ export GHOSTABLE_CI_TOKEN="$(cat $HOME/.ghostable-ci-token)" $ npx ghostable deploy laravel-forge production --forge-site example.com $ npm run build $ $FORGE_PHP artisan migrate --force ``` Store token files outside the application directory with restrictive permissions, and never print the token or generated plaintext. On this page [ ![Ghostable](https://ghostable.dev/images/logo-dark.svg) ![Ghostable](https://ghostable.dev/images/logo-light.svg) ](https://ghostable.dev) CLI 3.x [ CLI 3.x ](https://ghostable.dev/docs/3.x) [ Desktop ](https://ghostable.dev/docs/desktop) CLI 3.x introduction Documentation local first no login encrypted repository plaintext hosted service Installation Documentation brew homebrew npm npx linux windows PATH version update Start a new project Getting Started setup seed dotenv owner initialize Adopt an existing project Getting Started existing env import authoritative source adopt Onboard a team member Getting Started join request approve roles offboarding pull request Repository and storage Core Concepts .ghostable git conflict merge worktree private identity metadata Environments Core Concepts protected production preview staging push sync pull replace run mask-output Variables and promotions Core Concepts var promote copy context annotation key Access and devices Core Concepts identity reader writer grantor owner revoke rotate leave delete Daily development workflow Workflows pull diff validate review clean daily Review and secret scanning Workflows scan sarif github suppress secrets drift Hygiene and rotation Workflows rotation stale unused suppression environment key Automation credentials Automation & CI GHOSTABLE\_CI\_TOKEN ci deploy credential powershell revoke replace Continuous integration Automation & CI GitHub Actions fork pull request JSON stdout stderr exit codes mask-output Deployments Automation & CI Forge Vapor Cloud provider CLI dry-run preserve remote keys temporary files Validation Reference schema required nullable regex min max different\_from Command reference Reference --help --json NO\_COLOR flags aliases exit code automation Configuration Reference ghostable.yaml activity mode auditEnvironments scan ignores deployTarget dotenv syntax Security Reference cryptography XChaCha20 Poly1305 HKDF user presence threat model Backups & Offline Reference recovery offline restore clone key identity Agent integration Reference AGENTS.md capabilities allowlist coding agent Troubleshooting Reference no project found revoked identity stale policy user presence invalid CI token provider CLI git conflict diagnostics Ghostable Desktop overview Desktop Installation Desktop Projects and setup Desktop Interface tour Desktop Environments and variables Desktop Local environment files Desktop Validation and review Desktop Activity Desktop Access and automation Desktop Project settings Desktop Application settings Desktop Licensing and updates Desktop Security and storage Desktop Troubleshooting Desktop No results found