Skip to content
GitHub Action for deploying a WordPress site using using PHP's
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.

⚠️ Note: To use this GitHub Action, you must have access to GitHub Actions. GitHub Actions are currently only available in public beta. You can apply for Github Actions beta access here.

This action is a part of GitHub Actions Library created by rtCamp.

Deploy WordPress - GitHub Action

A GitHub Action to deploy WordPress on a server using PHP's project.

Please note that, this action expects git repo structure in a certain way. Your webroot should include content inside wp-content except uploads. You may use our WordPress Skeleton as a base, or restructre existing project to fit in.

During deployment, by default this action will download WordPress, put the content of the repo in wp-content directory and then deploy the entire WordPress setup on the deploy path specified in hosts.yml.

hosts.yml is Deployer's inventory file.


  1. Create a .github/main.workflow in your GitHub repo, if one doesn't exist already.
  2. Add the following code to the main.workflow file.
workflow "Deploying WordPress Site" {
  resolves = ["Deploy"]
  on = "push"

action "Deploy" {
  uses = "rtCamp/action-deploy-wordpress@master"
  secrets = ["SSH_PRIVATE_KEY"]
  1. Create SSH_PRIVATE_KEY secret using GitHub Action's Secret and store the private key that you use use to ssh to server(s) defined in hosts.yml.
  2. Create .github/hosts.yml inventory file, based on Deployer inventory file format. Make sure you explictly define GitHub branch mapping. Only the GitHub branches mapped in hosts.yml will be deployed, rest will be filtered out. Here is a sample hosts.yml.

Environment Variables

This GitHub action's behavior can be customized using following environment variables:

Variable Default Possible Values Purpose
MU_PLUGINS_URL null vip, any git repo url If value is vip, then action will clone VIP's MU plugins as mu-plugins folder. If you want to specifiy a non-VIP mu-plugins repo, you can provide a publicly accessible mu-plugins repo URL as the value.
WP_VERSION latest Any valid WordPress version If you specify a WordPress version, then that speicifc WordPress version will be downloaded, instead of latest WordPress version.

Server Setup

The expects server setup in a particular way.

Using EasyEngine v4

New Site

  1. Pass flag --public-dir=current during site creation.
  2. Delete the current folder using rm -r /opt/easyengine/sites/

The current folder will be automatically created by Deployer during execution.

Existing Site

  1. Open file /opt/easyengine/sites/
  2. Replace /var/www/htdocs with /var/www/htdocs/current.
  3. Run ee site reload
  4. Move wp-config.php to htdocs. You can use following command:
mv /opt/easyengine/sites/ /opt/easyengine/sites/

Not using EasyEngine

  1. Make sure your web server points to current subdirectory inside original webroot. Make sure current subdirectory do NOT exist actually.
  2. You may need to reload your webserver.
  3. You may need to change location of wp-config.php as we need in above section.

Hashicorp Vault (Optional)

This GitHub action supports Hashicorp Vault. This comes in handy if you manage multiple servers and providing SSH_PRIVATE_KEY as GitHub secret per project becomes cumbersome.

To enable Hashicorp Vault support, please define following GitHub secrets:

Variable Purpose Example Vaule
VAULT_ADDR Vault server address
VAULT_TOKEN Vault token s.gIX5MKov9TUp7iiIqhrP1HgN

You will need to change secrets line in main.workflow file to look like below.

workflow "Deploying WordPress Site using vault" {
  resolves = ["Deploy"]
  on = "push"

action "Deploy" {
  uses = "rtCamp/action-deploy-wordpress@master"
  secrets = ["VAULT_ADDR", "VAULT_TOKEN"]

GitHub action uses VAULT_TOKEN to connect to VAULT_ADDR to retrieve Signed SSH Certificates and uses it for deployment.

Please remember that you must configure each of your target deployment server to accept ssh connection via signed certificate using Vault beforehand. Ususally, you need to run following commands once per server:

export VAULT_ADDR=''
export VAULT_TOKEN='s.gIX5MKov9TUp7iiIqhrP1HgN'

# Add the public key to all target host's SSH configuration.
curl -o /etc/ssh/trusted-user-ca-keys.pem "$VAULT_ADDR/v1/ssh-client-signer/public_key"

# Add the path where the public key contents are stored to the SSH configuration file as the TrustedUserCAKeys option.
echo "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem" >> /etc/ssh/sshd_config

# Restart ssh service. This may differ according to the OS.
systemctl restart ssh

Overriding default deployement behavior

Create a file at location .github/deploy/deploy.php in your git repo to provide your own script.

Please note that it will completely override this action's original deploy.php. So if you need some portion of original deploy.php, you need to copy that to your own .github/deploy/deploy.php.


MIT © 2019 rtCamp

You can’t perform that action at this time.