Running a high-performance e-commerce platform requires precision. Manual deployments introduce human error, environment drift, and unpredictable downtime. With the release of Shopware 6.7, which enforces stricter PHP compatibility, modernized asset compilation, and tighter Symfony configuration validation, automating your deployment pipeline has shifted from a convenience to an architectural necessity. GitHub Actions provides a native, scalable CI/CD engine that integrates seamlessly with your existing repository, enabling repeatable, zero-surprise releases.
This guide walks through building a production-ready workflow tailored specifically for Shopware 6.7 and beyond, focusing on maintainability, security, and framework-specific optimizations.
Prerequisites & Architecture Overview
Before writing your workflow, ensure your environment is ready:
- A GitHub repository containing your Shopware 6.7 codebase (or a properly forked custom store)
- A target deployment server with SSH access, or a Git-compatible hosting provider
- PHP 8.3+ installed locally for dependency resolution consistency
- GitHub Secrets configured for
SERVER_IP,SSH_PRIVATE_KEY,DB_PASSWORD, andAPP_SECRET
Shopware 6.7 deploys as a standard Symfony application at its core. The build process requires Composer to resolve dependencies, Node.js to compile frontend assets via Webpack Encore, and Shopware’s console commands to warm caches and symlink assets. A well-structured workflow should separate these concerns into discrete, idempotent steps.
The Deployment Workflow
Create .github/workflows/deploy.yml in your repository root:
name: Shopware 6.7 Production Deploy
on:
push:
branches: [ main ]
workflow_dispatch:
jobs:
deploy:
runs-on: ubuntu-latest
env:
TARGET_IP: ${{ secrets.SERVER_IP }}
DEPLOY_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
SHOPWARE_ENV: production
DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Configure PHP 8.3 environment
uses: shivammathur/setup-php@v2
with:
php-version: '8.3'
extensions: curl, mbstring, json, pdo_mysql, xml, zip, intl, opcache
ini-values: memory_limit=1G, max_execution_time=60
- name: Install PHP dependencies
run: |
composer install --no-dev --optimize-autoloader --classmap-authoritative --no-interaction
composer dump-env prod
- name: Prepare Node.js & compile storefront assets
uses: actions/setup-node@v4
with:
node-version: '20'
run: |
npm ci --ignore-scripts
bin/build-js.sh production
find public/assets -name '*.js.map' -delete
- name: Warm Symfony & Shopware caches
run: |
bin/console cache:warmup --no-interaction
bin/console doctrine:schema:update --force --em=default
- name: Upload artifacts to server
uses: appleboy/[email protected]
with:
host: ${{ env.TARGET_IP }}
username: deploy
key: ${{ env.DEPLOY_KEY }}
source: ".*, app, config, custom, public, bin, vendor"
target: /var/www/shopware
strip_components: 1
rm: true
- name: Execute post-deployment hooks
uses: appleboy/[email protected]
with:
host: ${{ env.TARGET_IP }}
username: deploy
key: ${{ env.DEPLOY_KEY }}
script: |
cd /var/www/shopware
bin/console system:install --basic-setup --create-database --bootstrap-db-password "$DB_PASSWORD" || true
bin/console cache:clear --env=prod
bin/console assets:install public --symlink
bin/console maintenance-mode disable
systemctl restart php8.3-fpm
Step-by-Step Explanation & Shopware 6.7 Context
Triggers & Security Isolation
The workflow triggers on pushes to main or manual dispatch via the GitHub UI. Manual triggers are crucial for emergency hotfixes without bypassing branch protection rules. All sensitive values flow through env blocks, preventing accidental log leakage. Never commit .env.local files; instead, inject environment variables at runtime or use a secrets manager compatible with your hosting provider.
PHP & Dependency Resolution
Shopware 6.7 mandates PHP 8.3 and deprecates several legacy extension behaviors. The setup-php action explicitly loads required extensions and enforces memory limits that match production allocations. Using --optimize-autoloader --classmap-authoritative generates a highly optimized classmap, reducing runtime autoloading overhead by up to 40% on large custom stores. The composer dump-env prod step locks configuration values into .env.prod.local, ensuring environment-specific variables remain immutable across deployment iterations.
Asset Compilation & Modern Frontend Pipeline
Shopware 6.7 ships with an upgraded Webpack Encore configuration. The storefront, administration, and PWA bundles now require strict Node 20+ compatibility. Running npm ci guarantees reproducible builds by using the exact versions from package-lock.json. Executing bin/build-js.sh production minifies, tree-shakes, and generates content-hashed files for CDN cache invalidation. Deleting .js.map files post-build reduces artifact size and prevents source code exposure in production.
Cache Warming & Database Alignment
Symfony’s cache warmup pre-compiles routing, configuration, and service containers. Shopware 6.7 introduces stricter configuration validation, meaning uncached routes will trigger 500 errors on the first request. The doctrine:schema:update --force step ensures migration consistency, though in production environments you should run migrations separately during a maintenance window to avoid lock contention.
Deployment & Post-Processing
The SCP step transfers only essential directories. strip_components: 1 flattens the relative path structure to match your server’s document root. For zero-downtime strategies, consider replacing SCP with Deployer’s swap_symlinks pattern or Kubernetes rolling deployments. The post-deployment hook gracefully handles fresh installations (|| true prevents pipeline failure on existing databases), clears warm caches, re-symlinks assets, disables maintenance mode, and restarts PHP-FPM to release file descriptors.
Production Readiness & Best Practices
- Branch Protection & PR-Driven Workflows: Block direct
mainpushes. Require pull requests with status checks passing before merge. This creates an audit trail and allows staging previews. - Secret Rotation Strategy: GitHub Secrets should be rotated quarterly. Use environment-specific secret scopes (staging vs production) to isolate credentials across deployment targets.
- Testing Integration: Add a parallel job that runs
bin/phpunitand storefront unit tests. Shopware 6.7’s test infrastructure expectsphp.xmlto remain committed; never delete framework test files during customizations. - Rollback Capabilities: Store deployment timestamps as Git tags (
v2025.01.15) and maintain your server’s previous version in/var/www/shopware.prev. In case of cache or migration drift, swap directories instantly and trigger a rollback job. - Monitoring & Cache Validation: Post-deploy, verify
bin/console system:config:show --env=prodmatches expected values. Monitor asset version hashes via Shopware’s admin dashboard to detect stale CDN references or failed Encore compilation.
Conclusion
Automating Shopware 6.7 deployments with GitHub Actions transforms fragile, manual release processes into reliable, auditable pipelines. By aligning your workflow with the framework’s modern PHP requirements, strict configuration validation, and optimized build tooling, you eliminate environment drift and accelerate release velocity. Start with this foundational workflow, inject your own caching strategies, testing gates, and monitoring hooks, and scale your CI/CD architecture alongside your e-commerce platform. Consistent deployments aren’t just about speed—they’re about stability, security, and the trust your customers place in your storefront.