Michelangelo van Dam has a new post to his site sharing some of his ideas about the importance of documentation and how it relates to the overall security posture of a project.

In my previous post I described 10 steps we should take to improve security of web applications. In this article I'm going to describe the purpose of documenting a project and what information should be included.

He starts off with some thoughts about the purpose of documentation, how it can't ever really be considered complete, and the importance of its structure. He offers a few suggestions about effective documentation structure and how it can be formatted to make it easier to grow over time without getting too unwieldy. He then comes back around to the security aspect of project documentation. This includes information about the servers the system is running on, the services that are running and details about which secrets are used (but not the secrets themselves!).

He finishes up the post covering various technologies that can be used to help automate your project and make sure that it is well structured and easy to keep in sync with your documentation.

In a new tutorial on the Laravel News site, the author (Eric Barnes) shows you how to create a Laravel command that will send a daily email newsletter with the help of the Campaign Monitor service.

Here on Laravel News, we offer multiple ways of staying up to date with new content. Everything from auto-sharing to all the social media channels, a read-only Telegram channel, a weekly newsletter and last March we started offering a daily email digest.

To send the daily email we utilize the Laravel scheduler and Campaign Monitor so it’s completely automated. In this tutorial let’s look at how its all setup and how you can easily add this to your site to start sending out automated emails.

The tutorial starts by helping you get the Campaign Monitor SDK package installed (via Composer) and configured to use their API with your own key. Next it walks you through the creation of the console command to hook into the Scheduler for automated sending. It includes the code you'll need to find the data (in this case the latest blog posts) and the email method to send the information to the Campaign Monitor API. There's a brief mention of the creation of the HTML for the newsletter based on the Zurb Foundation and the configuration change to add the command to the scheduler for execution.

In a new post to his site Cees-Jan Kiewiet covers a new library he discovered - Cigar - and how to use it for smoke testing a ReactPHP application. Smoke testing (or "sanity testing") is the evaluation of the major functionality of an application rather than individual pieces of code.

Last week I came across Cigar, a smoke testing tool by Matt Brunt. Which, to me, is great stepping stone for my personal projects/sites to integration tests. In this post we not only go into Cigar, but also how to start your HTTP ReactPHP application, run cigar against it, and shut it down again. (Note that it doesn't have to be a ReactPHP application it can also be a NodeJS app, or PHP's build in webserver you use for testing.)

He then walks through the process of installing Cigar and creating the initial configuration file of endpoints to test (along with expected statuses). He then shows how to automate things further and creates a bash script that starts the ReactPHP application, runs the tests then shuts the application down. It's a simple script but can help save a few keystrokes every time the tests are run.

Cal Evans has posted the second part of his series as he works through the installation and configuration of the Mautic PHP-based marketing automation tool. In this part of the series he focuses on cron jobs.

This time we are talking about the cron jobs necessary to make Mautic run. Mautic has several commands that are necessary to execute that are not web based. They are run from the command line manually (dumb idea) or using a scheduler like cron on Linux. As with my “Installing Mautic” post, this post is only interesting to those of you self-hosting Mautic.

There is a great manual page on this titles “Cron Jobs”. It tells you a lot of what I’ll tell you here. If you haven’t read it yet, I highly recommend you start there.

He talks about each of the four jobs that, if you're using the system yourself, will want to run often: one for handling segments, two for campaigns and another for sending messages. He also talks about the main problem he ran into during his work with the cron jobs - permissions issues. He shares how he resolved this issue with an extra line in his crontab (after changing the user they ran as) and ends with some extra advice against wide open permissions.

Cal Evans has continued his series covering Mautic, the PHP based self-hosted marketing automation platform. This is step one in the process with his previous post in the series introducing Mautic and why he's trying it out.

This is the second post in a series titled “My Journey into Mautic”. If you are starting here, you might get an incomplete picture, you may want to check out the previous articles.

There are two things that really confuse me about Mautic, properly configuring an Email Service Provider (ESP), and segmenting & tagging. We’ll tackle the latter one in a later post, but the former is an important topic. It is also one that I do not fully understand. What is presented here is what I have learned through trial and error. it my be partially or wholly incorrect. If you find something that I’ve gotten wrong, please, by all means, correct me in the comments.

He starts by defining what an ESP service is and what it's useful for. While he had done the self-hosted email server in the past, he recommends paying for a service these days, deciding for his needs on Mailgun. He covers the difference between transactional and broadcast emails followed by the setup process he followed to get Mailgun up and working with his Mautic install.

Cal Evans, in a search to help make the marketing efforts for some of his products easier, has kicked off a series showing how to install and configure the PHP-based Mautic marketing automation platform.

Those that know me know that I have an obsession with marketing. I mean I’m no good at it, but the topic fascinates me. Almost all of the podcasts I listen to on a regular basis are marketing related. One topic in particular that interests me is “Marketing Automation”. Marketing Automation covers a huge swath of topics and since I am not an expert at the, I won’t attempt to explain them.

[...] Because I am interested in Marketing Automation and want to start applying the techniques in the projects I run. I started looking around for vendors who could provide these services. What I found is that most SaaS vendors assume that everybody who wants to use their software has deep pockets.

Without these "deep pockets" (pricey services) at his disposal, Cal looked for other options and found the self-hosted Mautic instead. He starts with a definition of his requirements including that it should be Open Source, that it should integrate with WordPress and he can contribute back to the project. He ends the post by outlining his planned platform using Mautic, WordPress, Mailgun, Mailchimp and Ditigal Ocean.

Fabien Potencier has continued his series looking at Symfony 4 with a new post to his site today. This time he focuses on workflow automation and removing some of the daily application management tasks.

Symfony 4's most "innovative" feature is the way it drives the day-to-day application management. No more tedious copy/paste from README files. No more boilerplate code. Automation to the max. On a curated list of Composer packages.

He starts the post talking about Symfony Flex (the main engine behind Symfony 4) and how it can help with package management and installation/integration. He uses the sensiolabs/security-checker package as an example, showing how Flex understands the package and knows to run the checks on future composer install commands. He then digs into other areas Flex helps with:

• bundles
• configuration
• environment variables
• makefile tasks
• Composer scripts

...and a few others. Examples are provided for each of the sections in the composer.json configuration and the post finishes with an example of the full configuration file, putting everything together.

The Delicious Brains site has posted a new tutorial, the third part in their "Automating Local WordPress Setup" series, covering the automation of "the rest" of the setup steps. This includes virtual host setup, plugin installation and cleanup.

In my last post in the Automating Local WordPress Setup series, I created a WP-CLI package for quickly installing and uninstalling WordPress. I’ve been using this package for a while now, and have been itching to make it more useful for a typical development workflow.

[...] I also still catch myself doing things that I know should be automated. Things like deleting unnecessary data, removing the default themes/plugins, and installing new plugins, are things that can be automated to make development easier. In this post we’re going to take a look at some ways to make all that possible.

The article is then broken down into three sections with scripts/code that can help with these automations:

• Working with Virtual Hosts (and MAMP)
• Cleaning Up the Install (deleting extra themes, plugins, etc)
• Installing Frequently Used Plugins (your custom list based on a "plugin list" file

The post finishes out with a screencast showing this plugin installation that makes it easier to come up with easy to reproduce, simple to spin up WordPress environments.

The SitePoint PHP blog has posted a tutorial from Alex Bilbie that "re-introduces you to Jenkins", a popular build automation software, and how you can integrate it, and a new feature called "pipelines", into your processes.

As our applications become more complex – with Composer dependencies, Webpack build scripts, and per-environment variables – we inevitably reach a point where testing all of these different intricacies becomes slow and laborious, especially when you’re tearing down and rebuilding the entire environment for each test. Likewise, code style might deviate over time and creating a production ready deployment archive requires a specific set of steps to be followed.

He talks about some common tasks that might be involved in the build (installing Composer libs, running PHPUnit, etc) and how automating them can help prevent issues and make it less time consuming for your developers as they make changes. Along with the latest version of Jenkins (v2.0) they introduced the "pipelines plugin". Pipelines allow you to define multi-step configurations Jenkins then uses when the build is executed. He walks you through installing Jenkins, setting it up and creating your first job. They provide the example pipeline script to get you started. There's also a section talking about the Jenkinsfile and setting it up in the Jenkins job to automatically be used (instead of a config in-job).

He finishes the post looking at multibranch pipelines and some things "taking it further" by adding in other plugins, customized with their own section in the Jenkinsfile configuration.

Leonid Mamchenkov has posted a "quick and easy introduction" to PHPMD, the "PHP mess detector" tool. PHPMD automatically scans your code looking for potential issues including "suboptimal code, overcomplicated expressions and unused parameters, methods, properties".

PHP Mess Detector is yet another one of those tools that help to keep the code base manageable and clean. Here is how you can jump right in. It’s super easy. It only takes 6 steps.

He gives an example of it in use on a CakePHP plugin showing the process to install, execute and view the report it provides. He looks in detail at one of the issues it found, an unused local variable, and how he fixed the issue and pushed the result back to the main repository. He finishes up with some suggestions about ways to run the tool, integrating it into your automated workflow and using it on other Open Source projects to find "low hanging" issues to fix and contribute back.