Add initial Spice Cloud Deploy GitHub Action

.gitattributes

@@ -0,0 +1,3 @@
+dist/** linguist-generated=true
+* text=auto eol=lf
+*.sh text eol=lf

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,28 @@
+name: Bug report
+description: Report a problem with the Spice Cloud Deploy Action.
+labels: [bug]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Describe the unexpected behavior, including the exact action version (`@v1`, `@v1.2.3`, etc.).
+    validations:
+      required: true
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Workflow snippet
+      description: Paste the relevant `uses:` block (redact secrets).
+      render: yaml
+  - type: textarea
+    id: logs
+    attributes:
+      label: Action logs
+      description: Paste the failing job log (redact tokens, API keys, hostnames).
+      render: text
+  - type: input
+    id: runner
+    attributes:
+      label: Runner
+      placeholder: ubuntu-latest / self-hosted / etc.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,16 @@
+name: Feature request
+description: Suggest an enhancement to the Spice Cloud Deploy Action.
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What workflow are you trying to build, and what's currently in the way?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: How would you like this to work? Include desired inputs/outputs if relevant.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Summary
+
+<!-- What does this change do, and why? -->
+
+## Checklist
+
+- [ ] `npm run all` passes locally
+- [ ] `dist/index.js` is up to date (`npm run build`)
+- [ ] `CHANGELOG.md` updated under `## [Unreleased]`
+- [ ] Tests added or updated for behavior changes
+- [ ] Action inputs/outputs documented in `README.md` and `action.yml`

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      production:
+        dependency-type: production
+      development:
+        dependency-type: development
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,62 @@
+name: CI
+
+on:
+  push:
+    branches: [trunk, main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Lint, typecheck, test, build
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+
+      - run: npm run lint
+        if: matrix.os == 'ubuntu-latest'
+
+      - run: npm run typecheck
+
+      - run: npm test
+
+      - run: npm run build
+
+      - name: Verify dist/ is in sync
+        if: matrix.os == 'ubuntu-latest'
+        shell: bash
+        run: |
+          if ! git diff --exit-code --quiet dist/; then
+            echo "::error::dist/ is out of sync. Run 'npm run build' and commit the result."
+            git --no-pager diff dist/ | head -100
+            exit 1
+          fi
+
+  audit:
+    name: npm audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm audit --omit=dev

.github/workflows/release.yml

@@ -0,0 +1,65 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+
+      - name: Verify dist/ is committed
+        shell: bash
+        run: |
+          npm run build
+          if ! git diff --exit-code --quiet dist/; then
+            echo "::error::dist/ is stale on this tag. Re-tag after running 'npm run build'."
+            exit 1
+          fi
+
+      - name: Move floating major-version tag
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF##*/}"
+          major="${tag%%.*}"
+          echo "Moving ${major} to ${tag}"
+          git tag -f "${major}" "${tag}"
+          git push --force origin "refs/tags/${major}"
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF##*/}"
+          notes_file="$(mktemp)"
+          if [ -f CHANGELOG.md ]; then
+            awk -v ver="${tag#v}" '
+              /^## \[?'"${tag#v}"'\]?/ { capture=1; next }
+              /^## / && capture { exit }
+              capture { print }
+            ' CHANGELOG.md > "$notes_file"
+          fi
+          if [ ! -s "$notes_file" ]; then
+            echo "Release ${tag}" > "$notes_file"
+          fi
+          gh release create "$tag" --title "$tag" --notes-file "$notes_file"

.github/workflows/test-action.yml

@@ -0,0 +1,36 @@
+name: Test action
+
+on:
+  workflow_dispatch:
+    inputs:
+      app-name:
+        description: Spice Cloud app name to deploy to.
+        required: true
+      region:
+        description: Region for create-if-missing.
+        default: us-west-2
+
+permissions:
+  contents: read
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    environment: spice-cloud
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Deploy + smoke test
+        uses: ./
+        with:
+          client-id:             ${{ secrets.SPICE_CLIENT_ID }}
+          client-secret:         ${{ secrets.SPICE_CLIENT_SECRET }}
+          app-name:              ${{ inputs.app-name }}
+          region:                ${{ inputs.region }}
+          create-app-if-missing: true
+          spicepod:              examples/spicepod.yaml
+          tags: |
+            source=spice-cloud-deploy-action
+            commit=${{ github.sha }}
+          test-sql:              SELECT 1
+          test-warmup-seconds:   120

.gitignore

@@ -0,0 +1,10 @@
+node_modules/
+lib/
+coverage/
+.env
+.env.*
+!.env.example
+.DS_Store
+*.log
+.vscode/
+.idea/

.nvmrc

@@ -0,0 +1 @@
+20

CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres
+to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.0.0] — 2026-05-02
+
+### Added
+- Initial release of the Spice Cloud Deploy Action.
+- OAuth 2.0 client credentials authentication against the Spice Cloud Management API.
+- Resolve apps by `app-id` or `app-name`, with optional `create-app-if-missing` flow.
+- App tag merging via `tags` input.
+- Optional Spicepod manifest push from `spicepod.yaml` before deploy.
+- Bulk app secret upsert from a multi-line `secrets` input (values masked in logs).
+- Deployment trigger with `branch`/`commit_sha`/`commit_message` auto-populated from the GitHub event.
+- Optional polling until the deployment reaches a terminal status.
+- Post-deploy smoke tests using the `@spiceai/spice` SDK (SQL via `sqlJson`, NSQL via `nsql`, ready check via `isSpiceReady`) plus raw HTTP probes for `/v1/chat/completions`, `/v1/search`, and `/v1/mcp`.
+- Region-aware runtime URL derivation (`https://<region>-prod-aws-data.spiceai.io`) and `runtime-url` override.
+- GitHub job step summary with deployment metadata and a per-probe pass/fail table.
+- Cross-platform support (`ubuntu-latest`, `macos-latest`, `windows-latest` Node 20 action).

CONTRIBUTING.md

@@ -0,0 +1,29 @@
+# Contributing
+
+Thanks for your interest in improving the Spice Cloud Deploy Action.
+
+## Development workflow
+
+1. Fork and clone the repo.
+2. Install Node 20 (see `.nvmrc`) and run `npm install`.
+3. Make your changes under `src/`. Run `npm run all` before opening a PR — it runs lint, typecheck, tests, and rebuilds `dist/`.
+4. **Commit `dist/index.js` and `dist/index.js.map`** with the rest of your change. CI verifies the bundled output matches `src/`.
+5. Update `CHANGELOG.md` under the `## [Unreleased]` section with a one-line entry per user-visible change.
+6. Update `README.md` and `action.yml` whenever you change inputs/outputs.
+
+## Test the action against a live Spice Cloud org
+
+The `Test action` workflow (`.github/workflows/test-action.yml`) deploys against a real Spice Cloud app using the `spice-cloud` GitHub Environment. It is gated on `workflow_dispatch` so you can trigger it from a fork/branch with the appropriate secrets configured.
+
+## Cutting a release
+
+1. Bump the version in `package.json` and add a `## [<version>]` section to `CHANGELOG.md`.
+2. Open a release PR, get it approved and merged.
+3. Tag the commit on `trunk`: `git tag v1.x.y && git push origin v1.x.y`.
+4. The release workflow updates the floating major-version tag (e.g. `v1`) and creates a GitHub release using the changelog notes.
+
+Consumers should pin to a major (`@v1`) for ongoing patches or to an exact tag (`@v1.x.y`) for reproducible builds.
+
+## Code style
+
+Linting and formatting are handled by [Biome](https://biomejs.dev) — `npm run lint` and `npm run format` are your friends. Source files live under `src/` and tests under `__tests__/`.