- Is hpatoio/deploy-bundle a Laravel package?
- No. hpatoio/deploy-bundle is a Symfony 2 bundle ported from the Symfony 1.4 project:deploy task, and it ships a Bundle class, a DependencyInjection extension, and a console command registered through Symfony's bundle machinery. There is no Laravel service provider or Artisan command, so it does not install or run as a Laravel package. For Laravel you would need to fork and reimplement its deployment logic.
- Can I install hpatoio/deploy-bundle in a Laravel app with Composer?
- Direct installation is not realistic for a modern Laravel app. The bundle's 2016-era symfony/framework-bundle and symfony/console constraints will conflict with the Symfony component range used by current Laravel versions, so expect a dependency-resolution wall rather than a runtime bug. The 1.5.3 patch release is not evidence that the Composer constraints were modernized, so check composer.json before assuming compatibility.
- What does hpatoio/deploy-bundle actually do?
- It provides console commands that read a YAML deployment descriptor containing hosts, user, remote path, rsync flags, and post-deploy shell steps. It then shells out to rsync over SSH to perform the release. The model is framework-agnostic, but the Symfony bundle and DI scaffolding are incidental.
- What changed in hpatoio/deploy-bundle 1.5.3?
- The 1.5.3 release is a single patch-level line: Fixed variable interpolation. It touches the config-templating code path, which is the same area previously flagged as a command-injection vector. The changelog does not state whether it fixed placeholder resolution or shell argument escaping, so diff the interpolation helper before adopting it.
- How do I use hpatoio/deploy-bundle with Laravel Artisan?
- You cannot use it directly with Artisan because the package registers a Symfony console command through Symfony's bundle and DI system, not a Laravel service provider. The realistic path is to fork the package, remove the Symfony glue, keep the YAML config schema and rsync/SSH invocation, and re-express it as an Artisan command. That gives you a small, testable deployment command without the legacy Symfony dependency tree.
- What are the best alternatives to hpatoio/deploy-bundle for Laravel deployments?
- For Laravel, Deployer with lorisleiva/laravel-deployer already implements rsync/SSH releases, rollback-friendly release directories, and Laravel-specific tasks. Laravel Forge and Envoyer are managed options, and Envoyer specifically targets zero-downtime deployments. Those alternatives avoid the fork-and-maintain burden of a Symfony 2 bundle.
- Does hpatoio/deploy-bundle support modern Laravel and Symfony versions?
- The package is a Symfony 2 bundle and carries 2016-era dependency constraints; there is no indication that 1.5.3 modernized them. Modern Laravel depends on newer Symfony components, so Composer resolution will likely fail. Treat it as unsupported for current Laravel and Symfony releases unless you verify and patch its composer.json yourself.
- Is hpatoio/deploy-bundle safe to use in production?
- The technical risk is high. It has 33 stars, 0 dependents, no visible CVE monitoring, and no downstream community to absorb regressions, and its unpinned transitive dependencies from the PHP 5.x/7.0 era are a supply-chain liability in a deploy path. The 1.5.3 patch ships new code into that path with no test or CI evidence visible in the release notes. Any fork inherits command-injection exposure unless argument escaping is explicitly rewritten and tested.
- Does hpatoio/deploy-bundle support rollbacks, zero-downtime deploys, or multiple hosts?
- The documented model is rsync over SSH driven by a YAML descriptor, and the available evaluation does not establish symlink-based atomic releases, health checks, or parallel multi-host execution. In-place rsync means there is no rollback and there can be partial-deploy windows, and it is unclear whether --delete is exposed or guarded. Verify those behaviors before relying on it for production releases.
- How should I test or evaluate hpatoio/deploy-bundle before forking it?
- Start by diffing the 1.5.3 interpolation helper to determine whether it fixed placeholder lookup or shell argument escaping, because those are different defects with different severity. Then run the command against a disposable staging host and inspect the exact rsync and SSH commands it generates. Because no CI or test evidence is visible, add your own tests with a fake rsync/SSH layer before putting any fork into a production deploy path.