GitHub pull request previews

SandyWP for GitHub creates an account-owned, temporary WordPress sandbox from the exact head commit of an open pull request. It is available on paid plans and uses the connected account's normal site quota.

Connect and choose repositories

Open Account → GitHub and click Connect GitHub.
Choose a GitHub user or organization and grant access to all or selected repositories.
Back in SandyWP, refresh repositories and edit one. Preview commands are disabled until you explicitly enable them.

Configure deployment

Plugin: copies into wp-content/plugins/<folder> and activates it.
Theme: copies into wp-content/themes/<folder> and activates it.
wp-content folder: copies into wp-content/<folder>; activation does not apply.

The source path is a relative repository subdirectory. V1 does not run npm, Composer, or other build steps: commit runtime assets or select an already-installable subdirectory.

Plain previews use SandyWP's current default environment: latest stable WordPress and the default PHP version. A requested Blueprint uses the environment saved in that Blueprint.

Allow account blueprints

In each repository's settings, select the account blueprints collaborators may request. This is an allow-list: GitHub commenters cannot browse the account's blueprints or invoke one that was not selected by the SandyWP account owner.

There is no default blueprint. A plain @sandywp-bot deploy keeps the normal blank-WordPress behavior. When a blueprint is requested, SandyWP creates the WordPress base from that blueprint first, then installs the pull request's plugin, theme, or wp-content code.

Commands

@sandywp-bot create a new site
@sandywp-bot deploy
@sandywp-bot deploy, blueprint: gogh
@sandywp-bot deploy using blueprint: gogh
@sandywp-bot deploy use blueprint: gogh
@sandywp-bot login
@sandywp-bot delete
@sandywp-bot help

Only repository owners, members, and collaborators may run commands. deploy <branch> is rejected because the pull request head is authoritative. Listing account sites is unavailable in GitHub.

Lifecycle and quota

A preview stays available while its pull request is open. Merging or closing the pull request automatically requests normal SandyWP cleanup; @sandywp-bot delete removes it earlier. Creating uses one ordinary site slot, and redeploying a new SHA into the existing preview preserves its URL and database without using another slot.

wp-admin access

Every repository may choose Never, Only when requested, or With every successful preview. Never is the default.

The wp-admin URL is a reusable bearer link that grants access while it remains valid. GitHub may copy comments into notifications, API responses, and logs. Anyone with the URL can enter wp-admin.

On a public repository, enabling a login link exposes wp-admin access to everyone on the internet. Use it only for disposable previews that contain no sensitive data.

Changing policy affects future output; it cannot retract copies already delivered by GitHub.

Updates and cleanup

Repeating a command at the same SHA returns the existing result. A new SHA normally redeploys into the existing site. An explicit request for a different blueprint or a newer revision replaces the preview site so blueprint state is never layered unpredictably. A later plain deploy keeps whichever preview base is already active. @sandywp-bot delete and pull-request close use the ordinary site cleanup lifecycle. GitHub comment failures never block physical cleanup.

Private repositories and forks

Private repositories use a short-lived GitHub App installation token—no manual deploy key. Public fork PRs fetch the base repository's refs/pull/<number>/head. Private fork behavior depends on organization policy and must be verified for the repository before relying on it.

Troubleshooting

Message	What to do
Repository disabled	Enable it under Account → GitHub and confirm App access remains active.
Blueprint unavailable	The account owner must select that blueprint in this repository's SandyWP settings.
No free slots	Delete an existing sandbox or change plan.
Source path missing	Configure a committed directory that contains installable code.
Activation failed	Confirm the destination contains a valid plugin or theme.
Source moved	Run `@sandywp-bot deploy` again after the PR head settles.
No wp-admin link	Open the repository settings and check Add login link.

Disconnect and persistent Git Deployment

Disconnecting stops commands immediately. Choose deletion during disconnect to remove active previews; otherwise delete them explicitly or close their pull requests. Uninstall/manage repository access on GitHub. PR Preview is ephemeral and PR-scoped; Git Deployment keeps one long-lived sandbox connected to a repository.