Dependencies
Commit package.json plus its lockfile for Node.js, or requirements.txt/pyproject.toml for Python. The repository must fully describe the install.
GitHub deployment guide
Deploy a Discord bot
from a commit you can trace.
A good GitHub deployment is more than cloning a repository. It connects one commit to one dependency install, one secret set, one start command, and one visible result.
Repository contract
Make the repository complete without putting secrets inside it.
Start command
Define exactly one production command and run it locally from a clean checkout. Remove assumptions about an editor, open terminal, or global package.
Ignored secrets
Keep .env and credential files in .gitignore. Use a checked-in .env.example containing names and safe placeholders, never live values.
Actionable output
Log meaningful startup milestones and errors without printing tokens, authorization headers, or complete environment objects.
Release path
The six-step GitHub-to-bot workflow.
Test a clean clone
Clone into a fresh directory, install only declared dependencies, set temporary local environment variables, and run the documented start command.
Connect the repository with minimal access
Prefer a GitHub App or narrowly scoped integration that can read the selected repository and receive only the events needed for deployment.
Add production secrets on the host
Create the Discord token and other environment variables in the hosting control plane. Do not copy a development .env file into the repository.
Deploy one known commit
Record the commit SHA, dependency-install result, build output, start command, and process exit status so the release can be traced.
Verify before enabling auto-deploys
Confirm the bot connects and handles real commands. Then enable push-triggered releases for the intended production branch.
Plan the failure path
A failed install or startup should leave the prior healthy release untouched when possible, with enough output to explain what failed.
Webhook safety
A push notification is input from the internet.
GitHub webhooks notify a deployment service when selected repository events occur. GitHub recommends using a webhook secret and validating each delivery before acting on it.
A deployment receiver should verify the signature, check the event type, confirm the expected repository and branch, and make repeated deliveries safe. See GitHub's webhook overview and delivery-validation guide.
Never print the Discord token or webhook secret into build logs. Logs should identify which setting is missing without revealing its value.
Keep reading
Finish the production checklist.
bothoster.dev/discord-js-hosting
discord.js repository
Check Node versions, lockfiles, scripts, and environment variables.
Read more →bothoster.dev/discord-py-hostingdiscord.py repository
Check Python versions, dependencies, entry points, and intents.
Read more →bothoster.dev/guides/keep-discord-bot-online-24-724/7 operations
Add restart behavior, failure visibility, and safer updates.
Read more →Next step
Push code. See exactly what deploys.
Join BotHoster early access for a bot-focused GitHub deployment flow with less infrastructure ceremony.