DeployForge

From GitHub to production. Automatically.

DeployForge is the second stage of the PushForge → DeployForge workflow. PushForge handles Local → GitHub, while DeployForge handles GitHub → Production (frontend → Vercel, backend → Render).

Install

pip install deployforge

Or with pipx (recommended):

pipx install deployforge

DeployForge is a single, cross-platform CLI — it works on Windows, macOS, and Linux.

Quick Start

# 1. Push your code with PushForge
pushforge

# 2. Deploy with DeployForge
deployforge

DeployForge automatically:

1. Analyzes your project structure (Next.js, Vite, FastAPI, Express, Django…)
2. Creates a deployment plan (what goes to Vercel, what goes to Render)
3. Runs security preflight checks (scans for leaked secrets)
4. Deploys backend → Render, frontend → Vercel
5. Wires environment variables (NEXT_PUBLIC_API_URL, FRONTEND_URL, CORS_ORIGIN)
6. Sets up CORS on the backend
7. Verifies all deployments and prints live URLs

Commands

Options

--dry-run              Show what DeployForge would do without making changes
--non-interactive      Skip confirmations (CI-friendly)
--skip-security        Disable the security preflight gate
--debug                Show debug detail for troubleshooting
--timeout INT          Deployment wait timeout in seconds (default: 900)
--plan TEXT            Render plan: free | starter | pro (default: starter)

How It Works with PushForge

+-------------------+     +-------------------+     +-------------------+
|   Your Machine    |     |      GitHub       |     |    Production     |
|                   |     |                   |     |                   |
|  PushForge ───────┼────►│   Source Code     │     |  Vercel (frontend)│
|  Local → GitHub   │     |                   │     |  Render (backend) │
|                   |     │  DeployForge ─────┼────►│  Live URLs        │
+-------------------+     |  GitHub → Prod    |     +-------------------+
                          +-------------------+

You don't need PushForge installed to use DeployForge — it detects Git repositories automatically. But the two tools are designed to work together seamlessly.

Authentication

DeployForge reads provider tokens from environment variables (in order):

Tokens can also be stored securely in your OS keyring via:

deployforge config --set vercel_token
deployforge config --set render_api_key

Credentials are never stored in project files or printed in logs. Only SHA-256 fingerprints are recorded.

Configuration

DeployForge creates .deployforge/config.yml when you run deployforge init:

frontend:
  provider: vercel
  directory: frontend

backend:
  provider: render
  runtime: python
  directory: backend

Environment variables from .env files are automatically wired:

• NEXT_PUBLIC_API_URL → set to the backend Render URL
• FRONTEND_URL → set to the frontend Vercel URL (on the backend)
• CORS is configured automatically

Security

DeployForge runs a security preflight before deployment:

• Scans for API keys, tokens, passwords in tracked files
• Blocks deployment if high-entropy strings or credential patterns are found (configurable)
• Never transmits or stores secrets — only fingerprints them locally

Disable with --skip-security for trusted codebases.

Development

# Clone and set up
git clone https://github.com/aasz253/DeployForge.git
cd DeployForge
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"

# Run tests
pytest

# Lint & type-check
ruff check src tests
mypy src

# Format
ruff format src tests

License

MIT — see LICENSE.

Security Policy

See SECURITY.md for credential handling and disclosure.