Best way to update and patch many Magento installations

Updating a Magento shop with a security patch is an important but tedious task, often delegated to “the intern”. Several good howto’s exist on single-shop procedures, but what about many installations?
They impose specific problems:

1. Different versions require different patches, which you have to figure out per release. There are handy lookup tables (thanks John Knowles!), but it is still an error-prone process.
2. Patches can’t be downloaded automatically, thanks to Magento’s login-wall on its download page. So you need a way to distribute multiple (possibly distinct) sets of patches to multiple codebases.
3. Magento patches are distributed in shell script format, which is not the most convenient way to implement in a automated deployment pipeline.
   I have asked several high volume, professional agencies about their favorite release workflow and would like to share my findings with you.

The Solution: use Composer

In short, if you haven’t already, start using composer today! It’s the most popular professional release strategy at the moment. As Peter Jaap of Elgentos puts it:

“I’ve been moving all our extension to composer this week, it’s a PITA but when it’s done, it’s so awesome.”

Composer is a popular tool for including and maintaining dependencies of your PHP application. As such, it is a great system for managing Magento modules. For example, you can do this:

$ composer require "aoepeople/Aoe_Scheduler:0.4.3"

But it’s also a convenient solution for maintaining Magento core files. Aydin Hassan wrote a composer plugin to do just this. After configuring, you can do this:

$ composer require "aoepeople/Aoe_Scheduler:0.4.3"

And voila! Your Magento install will be updated to the latest major release (as configured).
Important requirement for this strategy, is that you have an up to date Magento repository with proper tags for patched versions. If you require Enterprise, you should build one yourself. Refer to this matrix of Magento versions and patches for versions vs patch requirements.
If you only have CE installations, the lazy and simple alternative is to use a trustworthy community supported repository. I would recommend the Firegento repo which has tags for community versions with all versions applied. Thanks Firegento guys!
A sample composer.json using Firegento would be (suggested by Aleksey Razbakov):

$ composer require "aoepeople/Aoe_Scheduler:0.4.3"

In this example, the required version

$ composer require "aoepeople/Aoe_Scheduler:0.4.3"

will update everything to the latest 1.9.x version (see composer docs on version strings handling).
Coming up: once you have the problem of automatically updating single shops sorted, how to apply this strategy to a whole bunch of them, possibly as part of your build pipeline? Here, tools like Ansible come to the rescue. All the secrets in the next blog.
Thanks to Peter O’Callaghan for proofreading.

Are you sure you’ve installed al the SUPEE patches? Check MageReport.com.

[widget id=”magereport_widget-4″ /]