Release and deployment

deploy builds a clean runtime tree from an explicit allowlist. It is an application package, not a copy of the current site.

Build a package

php8.4 bin/tinymash.php deploy /tmp/tinymash-release

The destination must not be the source tree or one of its parents. Use a new or empty destination and review every warning.

The package contains application code, local frontend assets, dependencies, samples, public root documentation, required notices, and empty runtime directories. It does not copy live configuration, users, content, drafts, media, plugin state, caches, logs, tests, temporary files, repository metadata, or internal project documents.

Active third-party plugins are included from the extension root. Third-party themes are included when present. Review license and compatibility before distributing an extension with a release.

Audit the package

php8.4 bin/tinymash.php deploy:audit /tmp/tinymash-release

Each package contains deploy-manifest.json with its managed-file hashes and required runtime directories. Audit reports missing, changed, unknown, or unsafe managed paths.

The manifest is an integrity inventory, not a signature. Keep a trusted copy outside the deployed tree when hostile modification is part of the threat model.

New installation

Copy the package to an empty target, point the web server at public/, set ownership, run setup, install cron, and verify the installation. Do not publish the package by overlaying it on an unrelated directory.

Existing installation

Do not copy new application files over the live tree. Removed PHP or asset files can otherwise remain active.

Prepare a clean sibling release with upgrade:prepare, stop all writers for the final state copy, switch directories, restore permissions, reload PHP-FPM, and run the post-upgrade checks. The Upgrading tinymash chapter gives the full sequence.

Host configuration remains outside the package. Preserve and review the virtual host, PHP-FPM pool, session name, PHP limits, cron, log rotation, TLS, HTTP Basic authentication, ownership, and service-manager configuration on every destination.