I was talking to a client last week who was getting nervous. They manage a handful of WordPress sites built with Bedrock, and the manual update process was starting to feel like a liability. Every couple of weeks it was the same routine: SSH in, run composer update, test, and deploy. It isn’t hard, but it’s easy to forget, and a forgotten update is how sites get hacked. They wanted a hands-off way to keep the sites updated, something that would handle it without them thinking about it.
This is a super common problem with a Composer-based workflow. Bedrock disables the default WordPress auto-updater because it hands over all dependency management to Composer. That’s a good thing for stability, but it puts the update burden squarely on your shoulders. The solution is to automate the Composer part of the equation.
Building a hands-off update workflow
For this you need a few tools: your code on GitHub, a service to check for updates, and a CI/CD pipeline to handle deployment. Dependabot, now free and built into GitHub, watches for outdated dependencies. When it finds one, it’ll open a pull request. CircleCI then picks up that PR, runs a quick check, and merges it, which triggers deployment. At least that was the plan.
My first run at this was confusing. I had Dependabot set to open a PR and auto-merge it once created. The PR opened, everything looked right, and then it just sat there with no merge. It turns out Dependabot won’t merge blindly: it needs a “passing” status check from a CI tool before it proceeds. That’s a safety feature to avoid shipping broken code, but it isn’t obvious at first why your auto-merge isn’t happening.
The fix was to add a simple test workflow to our CircleCI configuration. It doesn’t have to be complicated; for many sites, just installing the dependencies to confirm the lock file is valid is enough. That gives Dependabot the passing check it needs. I saw this approach over at carlalexander.ca and adapted it for my typical client setup.
version: 2
jobs:
test:
docker:
- image: circleci/php:7.3
steps:
- checkout
- run:
name: Install dependencies
command: composer install
- run:
name: Run tests
command: composer test # Bedrock includes a basic test command
deploy:
docker:
- image: circleci/php:7.3
steps:
- checkout
- run:
name: Install and run deployer
command: |
composer global require deployer/deployer:^6.4
~/.composer/vendor/bin/dep deploy
workflows:
version: 2
test_and_deploy:
jobs:
- test
- deploy:
requires:
- test
filters:
branches:
only:
- masterWhat this setup gets you
The point of this isn’t to save effort. It removes human error from the single most important security task you have as a site owner. Once it’s running, your site gets patched the moment an update is available, instead of whenever you remember to log in.
- Consistency: Updates are checked and applied on a schedule, not randomly.
- Security: It closes the window between a vulnerability announcement and your site getting patched.
- Peace of mind: you can trust that the core of your site is always up to date.
Look, this stuff gets complicated fast. If you’re tired of debugging someone else’s mess and just want your site to work, drop my team a line. We’ve probably seen it before.
