CI/CD for Laravel with GitHub Actions: A Practical Pipeline
.jpg)
Manual deployment — SSH in, pull the latest code, run migrations, hope nothing breaks — works until it doesn't. A CI/CD pipeline removes the guesswork: every push runs your tests automatically, and only code that passes gets deployed. Here's a complete, working GitHub Actions setup for a Laravel app.
The full workflow file
Create this at .github/workflows/deploy.yml:
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
test:
runs-on:ubuntu-latest
services:
mysql:
image:mysql:8.0
env:
MYSQL_ROOT_PASSWORD:secret
MYSQL_DATABASE:testing
ports:["3306:3306"]
steps:
- uses:actions/checkout@v4
- name:Setup PHP
uses:shivammathur/setup-php@v2
with:
php-version:'8.3'
extensions:mbstring, pdo_mysql, zip
- name:Install dependencies
run:composer install --no-progress --prefer-dist
- name:Copy .env
run:cp .env.example .env
- name:Generate app key
run:php artisan key:generate
- name:Run migrations
run:php artisan migrate --force
env:
DB_HOST:127.0.0.1
DB_DATABASE:testing
DB_USERNAME:root
DB_PASSWORD:secret
- name:Run tests
run:php artisan test
deploy:
needs:test
if:github.ref == 'refs/heads/main'
runs-on:ubuntu-latest
steps:
- name:Deploy via SSH
uses:appleboy/ssh-action@v1
with:
host:$@{{ secrets.DEPLOY_HOST }}
username:$@{{ secrets.DEPLOY_USER }}
key:$@{{ secrets.DEPLOY_SSH_KEY }}
script:|
cd /var/www/app
git pull origin main
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache
php artisan route:cache
php artisan queue:restart
What this pipeline actually does
main or pull request spins up a fresh MySQL service, installs dependencies, runs migrations, and runs the full test suitedeploy job only runs after needs: test passes, and only on main — pull requests get tested but never trigger a deploySetting up the secrets
In your GitHub repo, go to Settings → Secrets and variables → Actions and add:
DEPLOY_USER
DEPLOY_SSH_KEY
The SSH key should be a private key whose matching public key is already added to the server's ~/.ssh/authorized_keys for that user. Never commit these values directly into the YAML file or the repo.
Setting up CI/CD for a real production system, or want your deployment process reviewed for gaps? This is exactly the kind of work I do as part of DevOps services engagements.