LEP Pusher releasesself-updates

LEP Pusher installs and updates a WordPress theme directly from a GitHub repository. WordPress connects to GitHub over outbound HTTPS, so you do not need SSH deployment access or GitHub Actions runner IP allow-lists.

The plugin supports WordPress 6.2+ and PHP 7.4+.

Configure LEP Pusher to deploy a GitHub theme

After installing and activating LEP Pusher, open WordPress Admin → Appearance → LEP Pusher.

1. Configure the repository

Enter the following values:

• GitHub owner: The user or organization that owns the theme repository, for example lep-vos.
• Repository: The repository name without .git, for example client-theme.
• Branch or tag: The branch or tag to deploy, usually main.
• Installed theme slug: The stable WordPress theme-directory name, for example client-theme.
• Theme subdirectory: Leave this empty when style.css is in the repository root. For a monorepo, enter the path containing the theme's style.css, for example wp-content/themes/client-theme.
• GitHub token: Leave this empty for a public theme repository. For a private repository, use a fine-grained personal access token restricted to that repository with Contents: read permission.

Click Verify and save. LEP Pusher will confirm that WordPress can access the repository.

Click Pull and deploy now to perform the first deployment. The downloaded theme must have a valid style.css at the configured path.

2. Enable automatic deployments

After saving the settings, LEP Pusher displays a Webhook URL and Webhook secret. Copy both values.

In the GitHub repository that contains the theme:

1. Open Settings → Webhooks → Add webhook.
2. Paste the LEP Pusher Webhook URL into Payload URL.
3. Select application/json as the Content type.
4. Paste the LEP Pusher Webhook secret into Secret.
5. Select Just the push event.
6. Ensure Active is enabled and click Add webhook.

When code is pushed to the configured branch, GitHub sends a signed request to WordPress. LEP Pusher verifies the signature, repository, branch, and delivery ID before queuing the deployment.

The WordPress REST API must be publicly reachable at the displayed webhook URL. You do not need to expose SSH or allow-list GitHub runner IP addresses.

3. Verify the webhook

GitHub sends a ping after the webhook is created. It should appear with a successful response under the webhook's Recent Deliveries tab.

Push a small change to the configured branch and confirm that:

• The GitHub webhook delivery receives a successful response.
• The theme changes appear on the WordPress site.
• Appearance → LEP Pusher shows the new commit SHA and deployment time.

If an automatic deployment fails, the error is displayed on the LEP Pusher settings page.

Optional: keep secrets in wp-config.php

For production sites, secrets can be kept out of the WordPress options table:

define( 'LEP_PUSHER_GITHUB_TOKEN', 'github_pat_...' );
define( 'LEP_PUSHER_WEBHOOK_SECRET', 'a-long-random-secret' );

The GitHub token is only needed for private theme repositories. Use a different webhook secret for each WordPress installation.

Install LEP Pusher manually

The first installation is performed with the release ZIP:

1. Open the lep-vos/lep-pusher Releases page.
2. Open the latest stable release.
3. Download the attached lep-pusher.zip file. Do not download GitHub's automatically generated “Source code” archives.
4. Sign in to WordPress as an administrator.
5. Open Plugins → Add Plugin → Upload Plugin.
6. Choose lep-pusher.zip and click Install Now.
7. When installation finishes, click Activate Plugin.
8. Continue with Configure LEP Pusher to deploy a GitHub theme.

LEP Pusher checks the public lep-vos/lep-pusher GitHub Releases feed through WordPress's native plugin updater. Later versions appear under Plugins and Dashboard → Updates. Administrators can click Update now or enable automatic updates for LEP Pusher.

Release checks are cached for approximately six hours. Use Dashboard → Updates → Check again to request a fresh check sooner.

Publish a new LEP Pusher version

This section is for LEP Pusher maintainers. Theme developers do not need to publish a new plugin version when they change a theme—the theme webhook handles those deployments.

First repository publication

The official update repository is the public lep-vos/lep-pusher repository. For a brand-new empty repository, run these commands from the LEP Pusher project directory:

git init
git add .
git commit -m "Initial LEP Pusher release"
git branch -M main
git remote add origin https://github.com/lep-vos/lep-pusher.git
git push -u origin main
git tag v0.3.0
git push origin v0.3.0

The tag must match the Version header and LEP_PUSHER_VERSION in lep-pusher.php. Pushing the matching tag starts the release workflow and publishes the first lep-pusher.zip asset.

Publish subsequent versions

1. Change both version declarations in lep-pusher.php, for example from 0.3.0 to 0.4.0:

   * Version:           0.4.0
   define( 'LEP_PUSHER_VERSION', '0.4.0' );

2. Commit and push the release change:

   git add lep-pusher.php README.md src .github
   git commit -m "Release LEP Pusher 0.4.0"
   git push origin main

3. Create and push the matching tag:

   git tag v0.4.0
   git push origin v0.4.0

4. Open GitHub → lep-vos/lep-pusher → Actions and wait for Publish plugin release to finish.

5. Open Releases and verify that the new release contains an attached lep-pusher.zip asset.

The workflow in .github/workflows/release.yml rejects mismatched tags, builds the correct WordPress directory structure, and creates release notes. No additional access token or deployment secret is required: it uses the repository's built-in GITHUB_TOKEN with contents: write permission.

If the workflow fails with a permissions error, open Repository Settings → Actions → General → Workflow permissions, select Read and write permissions, and run the failed workflow again.

Deployment and security behavior

• GitHub API and archive requests use HTTPS.
• Private repository access needs only Contents: read permission.
• WordPress's Theme_Upgrader performs theme installation and replacement.
• GitHub's generated archive directory is normalized to the configured stable theme slug.
• Only administrators with the update_themes capability can change settings or deploy manually.
• Admin actions are protected by WordPress nonces.
• Webhooks are authenticated with HMAC-SHA256 and constant-time signature comparison.
• Events for other repositories or branches and duplicate delivery IDs are ignored.
• Automatic deployments run through WP-Cron, with a deployment lock to prevent concurrent replacements.

Build an installable ZIP locally

From the directory containing the lep-pusher project folder:

zip -r lep-pusher.zip lep-pusher \
  -x 'lep-pusher/.git/*' \
  -x 'lep-pusher/.github/*' \
  -x 'lep-pusher/lep-pusher.zip' \
  -x 'lep-pusher/.env' \
  -x 'lep-pusher/.env.*'

The ZIP must contain a top-level lep-pusher/ directory. GitHub's automatically generated source archives are not used for plugin updates because their directory names are generated from the repository and tag.

Roadmap

The current release supports one GitHub-backed theme per WordPress installation. Potential future additions include multiple repositories, detailed deployment logs, rollback snapshots, staged releases, and GitHub App authentication with short-lived installation tokens.