• OAuth client credentials — no long-lived personal tokens. Generate an OAuth client in the Spice Cloud Portal and store the secret in your repo's secrets.
• One step, full lifecycle — resolve or create the app, push your spicepod.yaml, upsert app secrets, trigger the deployment, and (optionally) wait for it to finish.
• Post-deploy smoke tests — verify the freshly-deployed runtime answers SQL, NSQL, search, chat-completion, and MCP requests before declaring the workflow green. SQL/NSQL/health probes use the official @spiceai/spice SDK.
• Tags, region, replicas, channel — all the dials you'd expect, plus deployment metadata (branch, commit_sha, commit_message) auto-populated from the GitHub event.
• Cross-platform — Node 24 JavaScript action; runs on ubuntu-latest, macos-latest, and windows-latest runners.

name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: spicehq/spice-cloud-deploy-action@v1
        with:
          client-id:     ${{ secrets.SPICE_CLIENT_ID }}
          client-secret: ${{ secrets.SPICE_CLIENT_SECRET }}
          app-name:      my-app
          spicepod:      spicepod.yaml
          test-sql:      SELECT 1

The action returns once the deployment is succeeded (or fails the job if it's failed / timed-out).

1. Sign in to the Spice.ai Portal.
2. Open Profile → OAuth Clients and click Create.
3. Grant the scopes you need (see the table below). The action will fail with 403 Forbidden if a required scope is missing.
4. Copy the client ID and client secret — the secret is shown only once.
5. In your GitHub repo (or org), add two secrets: SPICE_CLIENT_ID and SPICE_CLIENT_SECRET.

The action exchanges the client credentials at https://spice.ai/api/oauth/token for a short-lived bearer token (cached for the run).

Grant exactly the scopes for the features you use. The "All-in" row at the bottom is what you'd typically pick for a CI client that does everything this action supports.

Avoid the * wildcard scope in production — it grants apps:delete, secrets:read (decrypted via the portal), and members:*, which this action never needs.

- uses: spicehq/spice-cloud-deploy-action@v1
  with:
    client-id:             ${{ secrets.SPICE_CLIENT_ID }}
    client-secret:         ${{ secrets.SPICE_CLIENT_SECRET }}
    app-name:              analytics
    region:                us-east-1
    create-app-if-missing: true
    visibility:            private
    tags: |
      environment: production
      team: data-platform
      commit: ${{ github.sha }}

tags accepts either a YAML block mapping (shown above) or a JSON object string (e.g. tags: '{"environment":"production","team":"data-platform"}'). Tags are merged into the app's existing tags on every run.

Tag value rule: the Spice Cloud API allows only alphanumerics and _@-. The action validates this locally so you fail fast with a clear error instead of a 400 Bad Request on the server.

Auto-captured tags: when GITHUB_REPOSITORY is set (always true on GitHub-hosted runners), the action adds a repository tag derived from that env var, with / rewritten to _ so the value passes API validation. Setting repository: explicitly in your tags overrides the auto-captured value.

- uses: spicehq/spice-cloud-deploy-action@v1
  with:
    client-id:     ${{ secrets.SPICE_CLIENT_ID }}
    client-secret: ${{ secrets.SPICE_CLIENT_SECRET }}
    app-name:      analytics
    secrets: |
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      PG_PASSWORD: ${{ secrets.PG_PASSWORD }}
    test-sql: SELECT count(*) FROM taxi_trips

- uses: spicehq/spice-cloud-deploy-action@v1
  with:
    client-id:     ${{ secrets.SPICE_CLIENT_ID }}
    client-secret: ${{ secrets.SPICE_CLIENT_SECRET }}
    app-name:      analytics
    test-chat:     "Summarize today's top 3 trips"
    test-chat-model: gpt-4o-mini
    test-search: |
      {"datasets":["docs"],"text":"refund policy","limit":3}
    test-mcp-tool: list_resources
    test-mcp-arguments: '{"limit":5}'

on:
  pull_request:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: spicehq/spice-cloud-deploy-action@v1
        with:
          client-id:     ${{ secrets.SPICE_CLIENT_ID }}
          client-secret: ${{ secrets.SPICE_CLIENT_SECRET }}
          app-name: ${{ github.event_name == 'pull_request' && format('analytics-pr-{0}', github.event.number) || 'analytics' }}
          region: us-east-1
          create-app-if-missing: true
          channel: ${{ github.event_name == 'pull_request' && 'preview' || 'stable' }}

- id: deploy
  uses: spicehq/spice-cloud-deploy-action@v1
  with:
    client-id:     ${{ secrets.SPICE_CLIENT_ID }}
    client-secret: ${{ secrets.SPICE_CLIENT_SECRET }}
    app-name:      analytics

- name: Comment on the PR
  if: github.event_name == 'pull_request'
  uses: actions/github-script@v7
  with:
    script: |
      const url = '${{ steps.deploy.outputs.app-url }}';
      const status = '${{ steps.deploy.outputs.deployment-status }}';
      github.rest.issues.createComment({
        ...context.repo,
        issue_number: context.issue.number,
        body: `Spice Cloud: **${status}** → ${url}`
      });

1. Authenticate. The action POSTs client_id/client_secret to https://spice.ai/api/oauth/token with grant_type=client_credentials and caches the bearer token for the run.
2. Resolve or create the app. If app-id is given, it's fetched directly. Otherwise the action looks up app-name via GET /v1/apps. With create-app-if-missing: true, a missing app is created in the requested region.
3. Sync metadata. Tags from the tags input are merged into the app's existing tags via PUT /v1/apps/{id}.
4. Push the Spicepod. When spicepod.yaml exists at working-directory, its contents are pushed to the app via PUT /v1/apps/{id} (spicepod field).
5. Upsert secrets. Each KEY=VALUE line in secrets is sent to POST /v1/apps/{id}/secrets (upsert).
6. Trigger the deployment. POST /v1/apps/{id}/deployments with branch, commit_sha, commit_message, plus any image-tag/channel/replicas overrides.
7. Poll until terminal. GET /v1/apps/{id}/deployments is polled every poll-interval-seconds up to timeout-seconds.
8. Smoke-test. When the deployment succeeds, the action fetches the app's primary API key, instantiates a SpiceClient against the regional runtime URL (https://<region>-prod-aws-data.spiceai.io), waits for isSpiceReady(), and runs each configured probe.

The Action job step summary records the deployment metadata and a per-probe pass/fail table.

Wondering which scopes to grant the OAuth client? See the Scope cheat sheet above.

• Runs on ubuntu-latest, macos-latest, and windows-latest (Node 24 JavaScript action).
• Bundles the @spiceai/spice SDK in HTTP mode — no Apache Arrow Flight gRPC dependencies are required at runtime.
• Compatible with self-hosted runners that allow outbound HTTPS to spice.ai, api.spice.ai, and the regional *-prod-aws-data.spiceai.io host.

npm install
npm run lint
npm run typecheck
npm test
npm run build       # produces dist/index.js

The dist/ folder is committed — GitHub Actions runs the bundled JavaScript directly and does not install dependencies on the runner.

1. Land changes on trunk. CI must be green and dist/ must be up to date.
2. Tag a SemVer release: git tag v1.2.3 && git push origin v1.2.3.
3. The release workflow updates the floating v1 tag and publishes a GitHub release.

Consumers should pin to a major (@v1) for ongoing patches or to an exact tag (@v1.2.3) for reproducible builds.

Apache 2.0 — see LICENSE.