DevOps Setup

Begin with the registered Instance

Register the Magento Application and its production, staging, or development Instance before connecting automated delivery workflows. Pair Magebean CLI Agent with that Instance—not with an Assessment—and protect its Instance-scoped token as a deployment secret.

Record the expected scan frequency and associate submissions with the deployed Revision. A new production Revision makes older results visibly stale and requires a current full scan.

Run verification at delivery boundaries

Pin a supported CLI release, identify the Magento root explicitly, select an approved CLI profile, disable interactive output, and preserve the exit status. Run against the exact checkout or artifact being released.

set -o pipefail
php magebean.phar scan \
  --path="$RELEASE_PATH" \
  --profile=basic \
  --no-interaction \
  --no-ansi \
  | tee magebean-scan.log

Do not append || true to hide a failed command. Define the release decision in the authorized pipeline policy and retain enough context to investigate the result.

Schedule recurring Instance verification

Use the approved host scheduler or CI system to run at the Instance’s expected frequency. Scheduled scans support Monitoring by detecting later failures, stale verification, and overdue scan conditions.

A scheduler runs the CLI in your environment. SaaS-initiated remote CLI execution is outside the MVP.

Preserve Scan Run and Revision context

Submit scans idempotently and identify the Instance, CLI version, full or partial scan type, target, profile, execution time, and deployment Revision. One Scan Result may update matching automated Items in multiple relevant active Assessments for the Instance.

A retained log is supporting material, not an Assessment approval and not proof that human-required Items pass. Every independent Assessment must process its automated and human-required Items again.

Keep operational boundaries explicit

• Do not expose Agent tokens or environment secrets in logs and artifacts.
• Do not treat a CI job, source-control check, or completed Ticket as independent remediation verification.
• Do not describe Jira, Linear, or GitHub issue synchronization as available.
• Use source-control providers to run your pipeline; Magebean does not synchronize Findings or Tickets with them in the MVP.