Deploy & Test
Controlled GitHub workflows from WordPress
Deploy & Test lets trusted WordPress users trigger configured GitHub Actions deploy and test workflows, follow their status, review test summaries, and inspect an audit trail—without direct GitHub access or personal access tokens.
I am the sole creator and took the project from problem definition and workflow design through WordPress/PHP implementation, GitHub integration, testing, documentation, packaging, and public release.
The problem
WordPress teams may manage content and site operations inside the CMS while their deployment and automated testing workflows live in GitHub. A trusted site manager may need to run an approved action, but should not need repository access, workflow configuration permissions, or personal access tokens.
Putting a button in WordPress is only the visible part of the problem. A release-related interface also needs to control access, validate the target, prevent competing workflows, explain state, handle failures safely, and preserve a useful trace.
The workflow I built
An Administrator configures Preview and Production workflows, permitted repositories, refs, environments, actions, and whether Deploy, Tests, or both are enabled. Sensitive GitHub App values remain in server configuration rather than database-backed plugin settings.
An authorized Administrator or Editor can then run a preview, production, or test action. WordPress creates a short-lived installation token, dispatches the configured workflow, polls for status, renders test-summary artifacts, and records the operation in the audit log.
Designing the operating boundaries
Failure and misuse scenarios were treated as product requirements.
Separate configuration from operation
Administrators manage connections, operating modes, and cleanup settings. Editors can run approved actions without changing the integration; Subscribers cannot access the plugin.
Validate before dispatch
Repository, ref, workflow, environment, and action values are validated before they can reach the GitHub integration boundary.
Prevent competing actions
Immediate UI feedback and server-side locks block rapid duplicates and cross-action concurrency while a workflow is active.
Make outcomes traceable
Status panels connect an action to its GitHub run, while the audit log records the actor, action, status, time, and safe details.
Deploy, test, and review
The workflow runs a controlled deployment, starts automated tests, restores the available actions after completion, and returns test evidence to WordPress.
Validation at the appropriate layer
The test strategy assigns each risk to the smallest reliable layer instead of forcing every check through one slow end-to-end path.
Local WordPress
Activation, configuration, roles, audit retention, and uninstall behavior.
Mocked GitHub API
Dispatch contracts, errors, timeouts, malformed responses, locks, and artifact boundaries.
PHPUnit
Permissions, validation, authentication, output security, credential leakage, status, and cleanup.
Playwright
10 isolated admin journeys covering role access, workflow and configuration behavior, and stored-content security.
QA sandbox
Real GitHub App authentication, dispatch, polling, concurrency, and artifact downloads away from production.
Separately, the manual baseline contains 28 scenarios covering successful and failing workflows, malformed configuration and artifacts, API errors, concurrency, native updates, feature modes, and uninstall behavior.
When testing changed the product
Foundation testing found that test actions remained unavailable after completion until the user manually refreshed the page. Refreshing also returned the interface to Deploy status instead of preserving Test status.
I recorded the behavior, tracked it in issue #1, implemented the fix through pull request #2, and added regression coverage. The fix shipped in v1.0.3 and remains part of the current release.
Packaging and release validation
The downloadable ZIP is tested as the release artifact, including installation and the native WordPress update path from verified stable GitHub Releases.
- Dependency audit and WordPress Coding Standards
- WordPress/PHP compatibility and Plugin Check
- Packaged ZIP installation, activation, and native-update verification
- PHPUnit and 10 Playwright tests
The current release was published through this gated process after an early compatibility-gate failure was corrected.
View public workflow evidenceOutcome
Deploy & Test is a public plugin with a downloadable release, native update discovery, and an inspectable implementation and delivery process. Trusted WordPress users can operate configured Preview, Production, and test workflows within explicit access, credential, concurrency, status, evidence, and audit boundaries.
The project demonstrates end-to-end ownership across WordPress/PHP implementation, GitHub integration, permissions, failure handling, regression coverage, packaging, and release.