Deploying WordPress from GitLab CI/CD

stages: [build, test, deploy, migrate, cutover, verify]default:  image: wordpress:cli-php8.3  interruptible: true  retry:    max: 2    when: [runner_system_failure, stuck_or_timeout_failure]workflow:  rules:    - if: $CI_PIPELINE_SOURCE == "merge_request_event"    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCHvariables:  STAGING_HOST: deploy@staging.example.com  PROD_HOST: deploy@example.com  WP_PATH: /var/www/example.com/current# Short-lived OIDC token instead of a long-lived secret in project settings..oidc: &oidc  id_tokens:    VAULT_ID_TOKEN:      aud: https://vault.example.combuild:  stage: build  script:    - composer install --no-dev --prefer-dist --optimize-autoloader    - npm ci && npm run build  artifacts:    paths: [wp-content/themes/acme/dist, vendor]    expire_in: 1 weeklint:  stage: test  needs: [build]  script:    - vendor/bin/phpcs --standard=WordPress wp-content/themes/acme    - vendor/bin/phpstan analyse --memory-limit=1Gdeploy:production:  stage: deploy  <<: *oidc  needs: [build, lint]  # Serialises every job in this group: a second pipeline queues instead of  # interleaving with a half-finished release.  resource_group: production  environment:    name: production    url: https://example.com  rules:    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH  script:    - ./ci/ssh-agent.sh    # Note the trailing slash and the exclude. Uploads are never touched.    - rsync -az --delete --exclude 'wp-content/uploads' ./ "$PROD_HOST:$WP_PATH/"    - ssh "$PROD_HOST" "cd $WP_PATH && wp core verify-checksums"migrate:database:  stage: migrate  <<: *oidc  needs: [deploy:production]  resource_group: production  rules:    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH      when: manual      allow_failure: false  script:    - ./ci/migrate-db.sh  artifacts:    paths: [backups/]    when: always    expire_in: 30 dayscutover:dns:  stage: cutover  needs: [migrate:database]  resource_group: production  rules:    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH      when: manual      allow_failure: false  script:    - ./ci/cloudflare-cutover.shverify:  stage: verify  needs: [cutover:dns]  script:    - ./ci/smoke-test.sh

a:2:{s:4:"logo";s:27:"https://staging.example.com";}

#!/usr/bin/env bashset -euo pipefailSTAMP="$(date -u +%Y%m%dT%H%M%SZ)"mkdir -p backups# 1. Snapshot production FIRST. This file is the rollback; if anything below#    fails, it is the only way back.ssh "$PROD_HOST" "cd $WP_PATH && wp db export - --add-drop-table" \  | gzip > "backups/prod-${STAMP}.sql.gz"# 2. Export staging.ssh "$STAGING_HOST" "cd $WP_PATH && wp db export - --add-drop-table" \  | gzip > "backups/staging-${STAMP}.sql.gz"# 3. Import it over production.gunzip -c "backups/staging-${STAMP}.sql.gz" \  | ssh "$PROD_HOST" "cd $WP_PATH && wp db import -"# 4. Rewrite the domain. --precise runs the replace through PHP instead of#    MySQL so serialised values are handled; --skip-columns=guid because a#    GUID is a permanent identifier, not a URL, and feed readers key off it.ssh "$PROD_HOST" "cd $WP_PATH && \  wp search-replace 'staging.example.com' 'example.com' \    --all-tables \    --precise \    --recurse-objects \    --skip-columns=guid \    --report-changed-only"# 5. Staging leftovers that must not reach production.ssh "$PROD_HOST" "cd $WP_PATH && \  wp option update blog_public 1 && \  wp cache flush && \  wp rewrite flush --hard"# 6. Prove it worked before the pipeline moves on.ssh "$PROD_HOST" "cd $WP_PATH && wp option get home" | grep -qx 'https://example.com'

#!/usr/bin/env bashset -euo pipefailAPI="https://api.cloudflare.com/client/v4"AUTH=(-H "Authorization: Bearer ${CF_API_TOKEN}" -H "Content-Type: application/json")# Cloudflare answers 200 with success:false for some failures, so the exit code# alone is not enough. Every response gets checked.cf() { curl -sS --fail-with-body "${AUTH[@]}" "$@" | tee /dev/stderr | jq -e '.success' >/dev/null; }# Record ids are not stable across environments; look it up by name and type.RECORD_ID="$(curl -sS "${AUTH[@]}" \  "${API}/zones/${CF_ZONE_ID}/dns_records?type=A&name=example.com" \  | jq -er '.result[0].id')"# ttl 1 means "automatic". While proxied it is academic: Cloudflare answers# from the edge, so the change takes effect as soon as this returns.cf -X PATCH "${API}/zones/${CF_ZONE_ID}/dns_records/${RECORD_ID}" \  --data "$(jq -nc --arg ip "$PROD_IP" '{    type: "A",    name: "example.com",    content: $ip,    ttl: 1,    proxied: true,    comment: "cutover \($ENV.CI_COMMIT_SHORT_SHA)"  }')"cf -X POST "${API}/zones/${CF_ZONE_ID}/purge_cache" \  --data '{"purge_everything": true}'

#!/usr/bin/env bashset -euo pipefailBASE="https://example.com"# Status, final URL after redirects, and a string only the new build renders.code="$(curl -sS -o /tmp/home.html -w '%{http_code}' -L "${BASE}/?cb=${CI_JOB_ID}")"[[ "$code" == "200" ]] || { echo "homepage returned ${code}"; exit 1; }grep -q 'data-build="'"${CI_COMMIT_SHORT_SHA}"'"' /tmp/home.html# A logged-out page should never be served with a session cookie attached.curl -sSI "${BASE}/" | grep -qi 'wordpress_logged_in' && { echo "session leak"; exit 1; }# The database really is pointing at production.ssh "$PROD_HOST" "cd $WP_PATH && wp option get siteurl" | grep -qx "$BASE"