Core patching and version controlling across multiple versions of the same site

Question

How can I propagate core updates from an installation of a Drupal site to other installations of the same site?

I maintain a private Drupal site which the owners now want to make public. As a result, there are concerns about hacking due to lapses in the core.

In addition, there is a DEV, STAGING and a LIVE version of this site. Nothing makes it to the LIVE site without having being tested in staging and those changes always initiate in the DEV site.

Code changes are only made within the sites/all directory, nothing in Drupal core is tampered with. The changes are version controlled via GIT. So I push up changes to the sites/all files and subdirectories to STAGING and then the LIVE sites.

This is where my problem begins: how can I patch the core code for the DEV site and propagate those changes to my STAGING and LIVE sites?

I am aware, I can of course apply the patches directly on STAGING and LIVE but those two sites are very tightly controlled by firewalls so they don't have unrestricted access to the Internet like DEV does.

Can I only accomplish this by using more version control and push up core OR is there another way?

Answer 1

Drupal has a good guide for this. A general summary for updating would be:

1. Delete everything except sites
2. Unpack the latest Drupal in the same place
3. Run the updater via update.php.
4. Check for breakage.
5. Update modules if necessary. They'll most likely be outdated too.

When all is good, commit all the updated code. Ideally you'd have separate commits for the core update, and for each module you updated. Then push up your code to your remote repo.

Now over to your environments, you simply do a git pull. If your remote repo is the filesystem of the remote environment (i.e. Acquia, Pantheon), then pulling isn't required. Set the site to maintenance mode, and run the updater. Ideally, you'll have this automated. If you use Drush, then it's just the following commands:

drush vset maintenance_mode 1 # enable maintenance mode
git pull                      # pull in the latest code
drush updb                    # perform updates
drush vset maintenance_mode 0 # disable maintenance mode