madalynn/plum
Plum is a Laravel/PHP package by madalynn for handling money and currency values. It provides Eloquent casts, validation rules, and helpers to store, format, and convert monetary amounts safely and consistently, helping Laravel applications avoid common floating-point and formatting issues.
Architecture fit. Plum is a framework-agnostic, object-oriented PHP deployment library distributed via Composer — not a Laravel package. It exposes a recipe DSL (servers, roles/stages, tasks, copy/symlink strategies, before/after callbacks) built on top of Symfony Console, Process, Filesystem and EventDispatcher. It can be embedded in a Laravel codebase because Laravel is just a Composer project, but it ships no service provider, no config file, no Artisan commands and no Laravel-aware hooks. Treat it as a library you build a deploy script with, more like Deployer-as-a-library than Envoyer-as-a-product.
Integration feasibility. Low friction technically: composer require --dev madalynn/plum, write a plum.php bootstrap at repo root, invoke it from CI or a Composer script. The real gate is dependency resolution. The package's Symfony constraints and PHP floor are from the PHP 5.x/7.x era; modern Laravel (10/11) pulls Symfony 6/7 on PHP 8.2+. A composer require in a current Laravel skeleton is likely to fail or force a platform downgrade. This must be validated in a throwaway branch before any planning commitment.
Technical risk. High for the value delivered. 86 stars and zero dependents means no downstream ecosystem has validated the API surface; there is a single maintainer and no visible release cadence. The public API is pre-1.0 in spirit, so upgrades are effectively fork-and-fix. Secondary risks: opaque handling of SSH credentials/agent forwarding, reliance on host rsync/ssh2, and a symlink-based release model whose correctness (atomicity, locking, rollback) is entirely your responsibility.
Key questions.
Stack fit. Reasonable only as a require-dev dependency in the application repo, never as a runtime/production dependency. It fits a "deployment logic lives in version control, executed by CI" model. It does not fit a team that wants a supported, batteries-included tool; it is a build-your-own-deployer kit. For a Laravel shop already using Envoy or Deployer, Plum is a lateral move with strictly less community support.
Migration path. Do not rip out an existing pipeline. Sequence: (1) isolated spike in a scratch repo to prove Composer resolution and a working copy→symlink deploy against a staging host; (2) port one non-critical service's recipe to parity with the current process; (3) run both in parallel for several releases, comparing timings and failure behaviour; (4) only then decide adopt, fork, or discard. Keep the incumbent pipeline as the documented rollback path throughout.
Compatibility. Verify against the exact Laravel minor, PHP minor, and Symfony major in use. Check the presence of rsync, ssh, and the ssh2 extension on runners and target hosts. Pin to a specific commit SHA (not a version range) and commit composer.lock, because there is no meaningful semver guarantee.
Sequencing. Spike (1–2 days) → recipe parity on staging (3–5 days) → shadow production deploys (2–3 releases) → go/no-go. If the spike fails on dependency resolution — the most likely outcome — close the evaluation immediately and record the constraint conflict as the finding.
Maintenance. The dominant cost. With zero dependents and one maintainer, assume you will vendor a fork within 12 months. Budget roughly 10–20% of one engineer's time for fork upkeep (PHP/Symfony bumps, security patches, SSH behaviour changes), plus the recipe code itself. That is a large fixed cost for a tool whose job is rsync and a symlink swap.
Support. Community-only, no vendor, thin documentation — expect to read the source to answer most questions. You will need an internal runbook covering: how a release is cut, how to roll back (re-point the symlink, manually), where logs live, and what to do when a partial deploy leaves a dangling symlink or an orphaned release directory.
Scaling. Adequate for a handful of app servers deploying serially. There is no built-in orchestration for fleets, no parallel fan-out guarantees, no deploy queue and — critically — no deploy locking. Two concurrent CI runs against the same host will race on the current symlink. Above ~10 hosts or with multiple daily deploys, this becomes a correctness problem rather than a performance one.
Failure modes. Partial deploys (task fails midway, release directory left in an indeterminate state); dangling symlinks if the release dir is pruned; SSH timeouts surfacing as generic process errors; credential leakage if secrets are passed as CLI args rather than via agent/env; and silent breakage on PHP/Symfony upgrades because nothing else in the ecosystem is exercising the code paths. Each of these is yours to detect and mitigate — the library provides callbacks, not safeguards.
Ramp-up. A mid-level Laravel developer can produce a working recipe in 1–2 days by following examples, but 1–2 weeks to be genuinely comfortable owning the internals and debugging a failed production deploy under pressure. The object-oriented DSL is pleasant once understood and undocumented until then; onboarding cost is paid per engineer, not once.
Overall. Score 0.61 with 0.59 opportunity and zero dependents reads as watch, do not adopt. The correct TPM recommendation is a time-boxed spike to falsify the compatibility assumption, with a strong prior toward staying on Deployer or a CI-native rsync/Envoy pipeline. Adopt only if the spike passes cleanly and the team has a named owner willing to fork.
How can I help you explore Laravel packages today?