WP Manifestindependent plugin directory
manifest / updates / github-plugin-sync

GitHub Plugin Sync

Pull and push WordPress plugins from GitHub repositories. Auto-install, update, and activate plugins from any branch (public or private).

by MagePeople Team · github.com/magepeopleteam/github-plugin-sync · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/magepeopleteam/github-plugin-sync/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/magepeopleteam/github-plugin-sync ↗

Pull, update, and push WordPress plugins from GitHub repositories — public or private — directly from the WordPress admin. Works with or without Git installed on the server (automatic ZIP‑download + GitHub REST API fallback for shared/cPanel hosting).

  • Version: 1.5.2
  • Requires WordPress: 5.6+
  • Requires PHP: 8.0+
  • License: GPL‑2.0‑or‑later
  • Author: MagePeople Team

Features

  • Pull & install a plugin from any GitHub repo/branch into wp-content/plugins, with optional auto‑activation.
  • Push local changes back to GitHub — commit to an existing branch or create a new one.
  • Two transport modes, auto‑detected:
    • Git mode — uses the server git binary (fastest, full history).
    • No‑Git mode — ZIP download for pull + GitHub REST API for push, so it works on cPanel/shared hosting where exec() and git are unavailable.
  • Private repositories via a GitHub Personal Access Token (PAT).
  • Change review — see changed / new / removed files before you push.
  • Operation history — every pull/push, with branch, commit, user, and result.
  • Environment diagnostics — a Settings panel that tells you exactly what's available (Git, exec, ZipArchive, writable plugins dir) and how to enable push/pull.

Requirements

Capability Needs
Pull (recommended) PHP ZipArchive or server git + exec()
Pull (Git mode) git binary + one of exec / shell_exec / proc_open
Push (no Git) GitHub PAT with repo scope
Push (Git mode) git binary + exec() + a previously pulled repo (.git present)
Any operation wp-content/plugins writable by the web server

Installation

  1. Copy the github-plugin-sync folder into wp-content/plugins/ (or upload the ZIP via Plugins → Add New → Upload).
  2. Activate GitHub Plugin Sync.
  3. Open GitHub Sync in the admin menu.
  4. (Optional) In Settings, add a GitHub Personal Access Token with the repo scope to access private repositories and to enable Push on servers without Git.

Usage

Pull a plugin

  1. Quick Pull tab → search/select a repository (or type owner/repo).
  2. Choose a branch and target folder → Pull & Install / Update.
  3. With auto‑activate on, the plugin is activated automatically.

Push your changes

  1. On a saved repo, click Changes to review modified files.
  2. Click Commit & Push → pick an existing branch or create a new one → enter a commit message → push.

Security

  • All admin actions require the manage_options capability and a nonce (check_ajax_referer).
  • All request input is sanitized (sanitize_text_field, sanitize_file_name, sanitize_key, sanitize_textarea_field) and all output is escaped (esc_html / esc_attr); JS rendering uses an HTML‑escaping helper.
  • GitHub tokens are encrypted at rest (AES‑256‑CBC, key derived from AUTH_KEY) and are never printed back into the page.
  • Shell commands (Git mode) pass every argument through escapeshellarg(), branch names are validated against ^[A-Za-z0-9._/-]+$, and target folders are restricted to wp-content/plugins via sanitize_file_name().
  • Token values are redacted from any command output shown in the UI.

Operational note: in Git mode the token is written into the repo's .git/config (standard git remote behaviour). Keep .git directories non‑public on your server, or use No‑Git (API) mode, which never persists the token to disk.

Distribution & WordPress.org

This plugin installs and updates other plugins from GitHub (a source other than WordPress.org) and can use server shell access. WordPress.org Plugin Directory Guideline 8 does not allow plugins that install/update software from non‑WordPress.org servers, so — like Git Updater and similar tools — this plugin is distributed via GitHub, not the WordPress.org directory. See SECURITY-AUDIT.md for the full review.

Frequently Asked Questions

Does it work on shared/cPanel hosting without Git? Yes. If ZipArchive is available it pulls via GitHub ZIP download, and with a PAT it pushes via the GitHub REST API — no git or exec() required.

Where is my token stored? Encrypted (AES‑256‑CBC) in the gps_settings option in your database. It is never echoed back to the browser.

Can it access private repositories? Yes — add a Personal Access Token with the repo scope in Settings.

Changelog

1.5.2

  • Initial public release: pull/push, Git + No‑Git (ZIP/API) modes, private‑repo support, change review, history, environment diagnostics.

License

GPL‑2.0‑or‑later — https://www.gnu.org/licenses/gpl-2.0.html