laravel-herd-worktrees — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited laravel-herd-worktrees (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run multiple branches of a Laravel project in parallel, each reachable at its own *.test URL through Laravel Herd, with isolated dependencies, env, database, and caches.
HEAD. Composer/Node deps, vendor/, node_modules/, storage/, and bootstrap/cache/ are per-worktree — never share via symlink.<dir>.test. Park the parent of all worktrees once and every new worktree gets a URL for free..env is untracked, so it must be re-created in each worktree. APP_URL, DB_DATABASE, cache prefixes must differ per worktree to prevent cross-branch bleed.vendor/, migrations, cache, or .env problems after switching worktrees.myapp-feat.test without manual Nginx/Valet config.Park the parent directory that holds the main checkout (worktrees become siblings of the main checkout, so they land in the same parked dir):
cd ~/Code # parent of your laravel project
herd parkVerify:
herd parkedEach immediate subdir is now <name>.test. Adding a worktree at ~/Code/myapp-feat makes myapp-feat.test resolve immediately.
If parking the parent is not desired (other non-Laravel dirs live there), use explicit herd link per worktree instead — see references/herd-commands.md.
Use the helper script. It creates the worktree, copies .env, rewrites APP_URL + DB_DATABASE + cache prefixes, installs deps, generates app key, and runs migrations.
bash scripts/worktree-new.sh <branch-suffix> <base-branch> [--driver sqlite|mysql|pgsql]Example:
bash scripts/worktree-new.sh feat-billing main --driver sqliteResult: ../myapp-feat-billing/ exists, myapp-feat-billing.test works, isolated DB.
See scripts/worktree-new.sh for the exact transformations applied to .env.
bash scripts/worktree-rm.sh <branch-suffix> [--drop-db]Runs git worktree remove, optionally drops the per-worktree DB, and herd unlinks if a manual link exists.
cd ../myapp-legacy
herd isolate [email protected]Site uses 8.1; sibling worktrees keep their isolated or default version. herd isolated lists all overrides. herd unisolate reverts.
| Concern | Rule |
|---|---|
vendor/ | Always per-worktree. Never symlink. |
node_modules/ | Always per-worktree. Never symlink. Use pnpm for fastest installs (content-addressable store). |
.env | Copy from main, rewrite APP_URL, DB_DATABASE, CACHE_PREFIX, SESSION_COOKIE, REDIS_PREFIX. |
APP_KEY | Run php artisan key:generate in each worktree. |
| Database | SQLite: per-worktree file. MySQL/Postgres: per-worktree DB name <app>_<suffix>. |
| Redis | Set unique REDIS_PREFIX (or different REDIS_DB index). |
storage/, bootstrap/cache/ | Per-worktree. Run php artisan optimize:clear after install. |
storage/app/public symlink | Re-run php artisan storage:link in the new worktree. |
Full rationale: references/isolation.md. DB strategy details (sharing seeds, schema dumps, fresh vs. migrate): references/db-strategies.md.
APP_KEY. siblings** — cookies leak between branches because they share the .test parent domain. Set a unique SESSION_COOKIE` per worktree.[a-z0-9-]).herd parked # confirm parent is parked
herd isolated # list per-site PHP overrides
herd which-php # PHP version Herd resolves for current dir
git worktree list # all worktrees + branches
ls -1 ../ | grep <app> # worktree dirs as Herd sees themIf a .test URL 404s: check herd parked includes the parent, dir name is lowercase, and php artisan route:list works inside the worktree.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.