Introduction - Slipway

Slipway: one config, three pipelines

Slipway is a Laravel package that treats config/slipway.php as the single source of truth for your pipeline. The provider YAML files are generated from it, committed, and guarded: if somebody edits a workflow by hand (or forgets to regenerate it), CI fails.

// config/slipway.php
return [
    'drivers' => ['github' => true, 'gitlab' => true],
    'php'     => ['8.3', '8.4'],

    'stages' => [
        'quality' => ['pint', 'larastan', 'composer-audit', 'secret-scan'],
        'test'    => ['matrix' => true, 'steps' => ['pest' => ['services' => ['mysql']]]],
        'build'   => ['build-artifact'],
    ],

    'environments' => [
        'staging'    => ['branch' => 'main', 'via' => 'ssh', 'rollback' => true,
                         'verify' => ['url_secret' => 'STAGING_URL'], 'options' => ['host' => 'staging.example.com', 'user' => 'deploy', 'path' => '/var/www/staging']],
        'production' => ['after' => 'staging', 'approval' => true, 'via' => 'ssh', 'rollback' => true,
                         'verify' => ['url_secret' => 'PRODUCTION_URL'], 'options' => ['host' => 'app.example.com', 'user' => 'deploy', 'path' => '/var/www/app']],
    ],

    'policies' => ['tests-before-deploy', 'approval-for-production', 'rollback-for-production'],
    'secrets'  => ['SSH_PRIVATE_KEY', 'SSH_KNOWN_HOSTS', 'STAGING_URL', 'PRODUCTION_URL'],
];

php artisan slipway:compile   # writes .github/workflows/slipway.yml and .gitlab-ci.yml
php artisan slipway:check     # fails if the committed YAML is stale (CI runs this for you)

Why

Problem with hand-written pipelines	What Slipway does
YAML drifts between providers and between repositories	One PHP config, one deterministic compiler. Same input, same bytes.
Someone edits the workflow in a hurry and nobody reviews it properly	A `slipway-guard` job fails the build when the YAML differs from the config.
Secrets end up in YAML, logs or shell history	Secrets are referenced by name only. A scanner checks the config and the generated output. Values are never printed.
”We deploy on Fridays and hope”	Build once, deploy that same artifact to every environment, health-check it, roll back automatically.
Safety rules live in a wiki	Policies such as `tests-before-deploy` fail compilation if a change would weaken them.
Provider lock-in	Switch or add a provider with one line. Unsupported features are reported, or are errors in `strict` mode.

Quickstart

Install Slipway, pick a preset, compile, and commit the generated YAML.

Configuration

Every config key, with defaults and meaning.

Deployment

Build once, promote the same artifact, verify, and roll back.

Extending

Add steps, deployers, policies, and providers without forking.