Self Update Laravel Package

Getting Started

Start by installing the package via Composer:

composer require consolidation/self-update

Next, create an updater class that extends Consolidation\SelfUpdate\UpdaterInterface or use the built-in Consolidation\SelfUpdate\Updater. Configure it with your PHAR’s current version and remote release endpoint (e.g., a GitHub releases API or JSON manifest). Implement a simple CLI command to trigger updates:

use Consolidation\SelfUpdate\Updater;

$updater = new Updater($currentVersion, $pharPath, $remoteUrl);
$updater->check(); // Returns true if update available
if ($updater->update()) {
    // Success — restart or notify
}

For first-time use, add an update or self-update command to your main application and test with a local or staged manifest.

Implementation Patterns

• Integrate into Application::registerCommands(): Add SelfUpdateCommand as a built-in command, making updates discoverable.
• Strategy Pattern for Distributors: Use GitHubStrategy, ZipStrategy, or implement custom ones (e.g., S3, internal repo) via Updater::setStrategy().
• Safe Update Workflow: Always call update() only after check() + user confirmation. Use RollbackAwareInterface for atomic PHAR swaps (copy to temp, rename, signal success).
• Graceful Degradation: Wrap update logic in try-catch; fallback to manual instructions on failure.
• Version Pinning/Canary Releases: Pass extra flags (e.g., --stable, --beta) to select release channels by overriding the strategy’s getReleaseUrl().
• CI/CD Integration: Embed update checks in install or post-update-cmd scripts to pre-download updates in deployment pipelines.

Gotchas and Tips

• Phar Extension Disabled: Ensure phar.readonly = Off in php.ini for in-place PHAR replacement; otherwise use --force or fallback to copy()-based update.
• File Permissions: On shared hosts, verify write permissions on PHAR and temp directory; use sys_get_temp_dir() for fallback.
• HTTP Headers & TLS: Some strategies require custom headers (e.g., Authorization: token xxx for private repos); override createHttpClient() or pass a custom Guzzle client.
• Signature Verification: By default, no signature checks occur. Extend StrategyInterface to add phar.signatures or GPG verification for security-critical deployments.
• Version Comparison: Use version_compare() internally—avoid string comparisons for semantic versioning edge cases (e.g., 1.10 vs 1.9).
• Rollbacks: Leverage Updater::rollback() if your strategy preserves previous artifacts (e.g., GitHub releases retain old PHARs).
• User Feedback: Hook into ProgressInterface to show download %; provide verbose (-vvv) output for low-level logging.