pushery / production-preflight-for-laravel

v0.1.0 2026-10-30 18:52 UTC

Requires

• php: ^8.4
• ext-json: *
• illuminate/console: ^13.0
• illuminate/contracts: ^13.0
• illuminate/database: ^13.0
• illuminate/support: ^13.0
• spatie/laravel-health: ^1.0
• symfony/process: ^7.0 || ^8.0

Requires (Dev)

• fakerphp/faker: ^1.24
• larastan/larastan: ^3.9.3
• laravel/ai: ^1.0
• laravel/boost: ^2.9
• laravel/mcp: ^1.0
• laravel/pao: ^1.1
• laravel/pint: ^1.0
• orchestra/testbench: ^11.0
• pestphp/pest: ^5.2.1
• pestphp/pest-plugin-agent: ^5.0
• pestphp/pest-plugin-browser: ^5.2
• pestphp/pest-plugin-evals: ^5.1
• pestphp/pest-plugin-laravel: ^5.0
• pestphp/pest-plugin-phpstan: ^5.0
• pestphp/pest-plugin-type-coverage: ^5.0
• phpstan/phpstan: ^2.3.0
• pushery/sqlens-for-laravel: ^0.31
• rector/rector: ^2.7.0
• spaze/phpstan-disallowed-calls: ^4.12
• symfony/yaml: ^7.4.17 || ^8.1.5

MIT

• Pushery

• php
• security
• laravel
• deployment
• production
• env
• preflight
• laravel-health

Published on Packagist.org on 2026-10-30 22:09 UTC

README

Production Preflight for Laravel

Laravel production checks for what passes every test: unsafe settings, a .env that loads other values than it shows, and installs running on stale state.

Documentation

Full documentation at docs.pushery.com/production-preflight-for-laravel. This README is the quick start; the guides, the configuration reference and the upgrade notes live there.

Requirements

• PHP 8.4+
• Laravel 13+

Tested on PostgreSQL and MySQL 8.4, the databases Laravel Cloud runs (serverless Postgres and MySQL 8.4 LTS), so it runs there out of the box. The fast suite runs on SQLite.

Tested on PHP 8.4 — the floor of the declared range, because a >= promise is only proven by running on the boundary — and on PHP 8.5, so the upper half of ^8.4 is exercised here rather than first by a consumer.

Installation

composer require pushery/production-preflight-for-laravel

The service provider is registered automatically through package discovery. The package builds on laravel-health, which Composer installs alongside.

Usage

A misconfigured production application rarely fails: APP_DEBUG=true serves pages, MAIL_MAILER=log accepts every message, and a key set twice in .env is valid syntax. This package checks for those states in the deploy, so they never go live, and on a schedule, because half of them appear afterwards.

Stop a deploy on a finding. In the deploy script, with set -e, after composer install and config:cache:

php artisan preflight --deploy

It exits with 0 when no check failed, 1 when one did, and 2 when a check could not look. Warnings are printed and let the deploy through.

Report in operation through laravel-health, in the boot method of a service provider:

use Pushery\ProductionPreflight\Preflight;
use Spatie\Health\Facades\Health;

Health::checks(Preflight::checks());

Lint a .env file on its own, in a pipeline or on a schedule:

php artisan env:lint .env.production

Twenty-seven checks cover the .env file (keys set twice, keys missing against the example, placeholders, a cut-off #), the configuration (debug mode, the application key, mail that goes nowhere, test-mode payment keys, queue, session and cache drivers) and the installation (a stale configuration cache, workers that missed queue:restart, pending migrations, exposed secrets). No check passes when it could not look, and no value of the application reaches a log, a notification or a stored result. The documentation lists every check and its verdict.

Configuration

Publish the configuration file:

php artisan vendor:publish --tag=production-preflight-config

This writes config/production-preflight.php, where every option is documented inline. A check that does not fit an application is acknowledged there by its key, with the reason, which then stands in every report:

'acknowledged' => [
    'queue-connection' => 'One person uses this installation; jobs run in the request on purpose.',
],

Testing

The test suite is not part of the published package: the tests and their PHPUnit configuration stay in the development repository, so a clone of this repository has no composer test. CONTRIBUTING.md says how a change is tested on its way in.

Security

Please review the security policy and report vulnerabilities privately rather than opening a public issue.

Built by Pushery

This package is built and maintained by Pushery — a Berlin-based studio building Laravel applications, SaaS products, and open-source tools.

Building a Laravel UI? WireKit is Pushery's open-source Livewire component kit. Browse the rest of our work at pushery.com.

License

The MIT License (MIT). See LICENSE for details.