action.yml

name: Spice Cloud Deploy
description: Deploy Spice.ai Cloud apps with OAuth client credentials and optional SQL/NSQL/search/chat/MCP smoke tests.
author: Spice AI

branding:
  icon: upload-cloud
  color: blue

inputs:
  client-id:
    description: |
      OAuth client ID for the Spice Cloud Management API.
      Create one at https://spice.ai under Profile → OAuth Clients.
    required: true
  client-secret:
    description: |
      OAuth client secret. Store as a repository or environment secret
      (e.g. `secrets.SPICE_CLIENT_SECRET`); never inline.
    required: true
  app-id:
    description: Numeric Spice Cloud app ID. Either `app-id` or `app-name` is required.
    required: false
  app-name:
    description: |
      Spice Cloud app name. Used to look up `app-id` when not provided.
      Required when `create-app-if-missing` is true.
    required: false
  create-app-if-missing:
    description: Create the app if it does not exist. Requires `app-name`.
    required: false
    default: "false"
  org:
    description: |
      Spice Cloud organization slug. Used to construct the `app-url` output
      (`https://spice.ai/<org>/<app-name>`). When unset, the action falls back
      to the owner part of `GITHUB_REPOSITORY` — which matches the Spice org
      slug for personal orgs and for orgs created from a connected GitHub
      organization. Set this explicitly only when your Spice org slug differs
      from the GitHub repo owner.
    required: false
  region:
    description: |
      Spice Cloud region (e.g. `us-east-1`, `us-west-2`).
      Required when `create-app-if-missing` is true. For existing apps the
      region is read from the API and this input is informational only.
    required: false
  visibility:
    description: Visibility for new apps (`public` or `private`). Only used with `create-app-if-missing`.
    required: false
    default: private
  tags:
    description: |
      App tags as a YAML or JSON map. Merged with existing tags on each run.

      YAML form (recommended):
        tags: |
          environment: production
          team: data-platform
          commit: <commit-sha>

      JSON form:
        tags: '{"environment":"production","team":"data-platform"}'

      Lines beginning with `#` are treated as comments.
    required: false
  spicepod:
    description: |
      Path to a Spicepod manifest. When the file exists, its contents are pushed to
      the app via `PUT /v1/apps/{appId}` before the deployment is triggered.
    required: false
    default: spicepod.yaml
  working-directory:
    description: Working directory. Relative paths in `spicepod` are resolved against this.
    required: false
    default: .
  image-tag:
    description: Runtime image tag override for this deployment (e.g. `1.5.0-models`).
    required: false
  channel:
    description: Update channel for this deployment (`stable`, `preview`, `nightly`, `internal`).
    required: false
  replicas:
    description: Number of replicas for this deployment (1-10).
    required: false
  branch:
    description: Git branch attributed to the deployment. Defaults to the `GITHUB_REF_NAME` environment variable.
    required: false
  commit-sha:
    description: Git commit SHA attributed to the deployment. Defaults to the `GITHUB_SHA` environment variable.
    required: false
  commit-message:
    description: Commit message for the deployment. Defaults to the head-commit message of the GitHub event.
    required: false
  debug:
    description: Enable debug mode on the deployment.
    required: false
    default: "false"
  secrets:
    description: |
      App secrets to upsert before deploy, as a YAML or JSON map. Values are
      added to the runner's secret-mask list so they don't appear in logs.

      YAML form (recommended):
        secrets: |
          OPENAI_API_KEY: <openai-api-key>
          PG_PASSWORD: <pg-password>

      JSON form:
        secrets: '{"OPENAI_API_KEY":"<openai-api-key>","PG_PASSWORD":"<pg-password>"}'

      Lines beginning with `#` are treated as comments. Secret values can
      contain any characters; only the secret name is constrained (must
      start with a letter or underscore, alphanumeric + underscores only).
    required: false
  wait-for-completion:
    description: Poll the deployment until it succeeds or fails.
    required: false
    default: "true"
  timeout-seconds:
    description: Maximum number of seconds to wait when `wait-for-completion` is true.
    required: false
    default: "600"
  poll-interval-seconds:
    description: Seconds between deployment status polls.
    required: false
    default: "10"
  test-sql:
    description: |
      SQL query to execute against the deployed runtime as a smoke test
      (uses the `@spiceai/spice` SDK with HTTP fallback).
    required: false
  test-nsql:
    description: |
      Natural-language query to send to `/v1/nsql` (text-to-SQL) as a smoke test.
      Uses the `@spiceai/spice` SDK.
    required: false
  test-chat:
    description: |
      Either a plain prompt string (sent as a single user message) or a JSON body
      to POST to `/v1/chat/completions` (OpenAI-compatible).
    required: false
  test-chat-model:
    description: Model to use for `test-chat` and `test-nsql` (when applicable).
    required: false
  test-search:
    description: |
      JSON body to POST to `/v1/search`.

      Example:
        test-search: '{"datasets":["my_dataset"],"text":"hello world"}'
    required: false
  test-mcp-tool:
    description: Name of an MCP tool to invoke against `/v1/mcp` as a smoke test.
    required: false
  test-mcp-arguments:
    description: JSON-encoded arguments object passed as `params.arguments` to the MCP tool call.
    required: false
  test-warmup-seconds:
    description: |
      Maximum seconds to wait for the runtime to become ready (`isSpiceReady()`)
      before running probes. Set to 0 to skip the warmup wait.
    required: false
    default: "60"
  test-timeout-seconds:
    description: Per-probe HTTP timeout in seconds.
    required: false
    default: "30"
  dataset-ready-timeout-seconds:
    description: |
      Maximum seconds to wait for every dataset reported by `GET /v1/datasets?status=true`
      to reach a terminal-ok state (`ready`, `disabled`, or `refreshing`) before running
      runtime probes. The action fails the job immediately if any dataset enters `error`,
      or if the timeout elapses while datasets are still pending — regardless of
      `fail-on-test-error`, which only governs runtime-probe results. To disable the
      dataset check entirely, set this to `0`.
    required: false
    default: "300"
  runtime-url:
    description: |
      Override the runtime HTTP base URL probes connect to. When unset, the
      URL is derived from the resolved app's region as
      `https://<region>-prod-aws-data.spiceai.io` (e.g.
      `https://us-east-1-prod-aws-data.spiceai.io`).
    required: false
  flight-url:
    description: |
      Override the Apache Arrow Flight gRPC endpoint the SQL probe connects
      to (`host:port`, optionally prefixed with `grpc+tls://`). When unset,
      it's derived from the app's region as
      `<region>-prod-aws-flight.spiceai.io:443` (e.g.
      `us-west-2-prod-aws-flight.spiceai.io:443`). Set this if your app
      uses a custom Flight host.
    required: false
  fail-on-test-error:
    description: Fail the action when any probe fails. Set to `false` to record failures without failing the job.
    required: false
    default: "true"
  api-url:
    description: Base URL for the Spice Cloud Management API.
    required: false
    default: https://api.spice.ai
  oauth-token-url:
    description: OAuth token endpoint URL.
    required: false
    default: https://spice.ai/api/oauth/token
  scope:
    description: Optional OAuth scope to request when exchanging client credentials (space-separated).
    required: false

outputs:
  app-id:
    description: Resolved numeric app ID.
  app-name:
    description: Resolved app name.
  app-url:
    description: Public URL of the app (`https://<app-name>.spice.ai`).
  deployment-id:
    description: ID of the created deployment.
  deployment-status:
    description: Final deployment status (`queued`, `in_progress`, `succeeded`, `failed`).
  deployment-created-at:
    description: ISO 8601 timestamp the deployment was created.
  test-results:
    description: JSON array of `{ name, ok, durationMs, detail?, error? }` for each runtime probe.
  datasets:
    description: JSON array of `{ name, status, from?, error?, error_message? }` from `GET /v1/datasets?status=true` after deployment.

runs:
  using: node24
  main: dist/index.js