| media_uuid | The media UUID of a file already uploaded to SureCart. Triggers v1 mode. Mutually exclusive with release_tag. | no | "" |
| release_tag | GitHub release tag to publish. Accepts "latest". Triggers v2/v3 mode (the action downloads the matching release asset). The upload_target input decides R2 (v2) vs SureCart (v3). Mutually exclusive with media_uuid. | no | "" |
| upload_target | Where to upload the release asset when release_tag is used. "r2" (default) → upload to Cloudflare R2 and attach the external URL (v2; does NOT surface a version to WordPress). "surecart" → upload to SureCart so the version is recognised and the WP update prompt works (v3). | no | r2 |
| asset_pattern | Glob filter over release asset names. v2/v3 mode. In v3, narrow this to the plugin/theme zip(s) you ship as updates — a matched asset that is not a versioned update will fail the run. | no | *.zip |
| current_release_asset_pattern | Glob picking which asset (by name) becomes the current_release_download when set_as_current_release=true. Empty = first matched asset. v2/v3 mode. | no | "" |
| object_key_prefix | R2 object-key prefix. Final key is <prefix>/<asset-basename>-<sha16>.<ext>. v2 mode only. | no | releases |
| r2_account_id | Cloudflare R2 account ID. Required in v2 mode. | no | "" |
| r2_access_key_id | R2 S3-compatible access key. Required in v2 mode. | no | "" |
| r2_secret_access_key | R2 S3-compatible secret. Required in v2 mode. | no | "" |
| r2_bucket | R2 bucket name. Required in v2 mode. | no | "" |
| r2_public_base_url | Public URL base (e.g. https://dl.example.com — no trailing slash). Required in v2 mode. | no | "" |
| github_token | Token for reading the release and its assets (needed for private repos). Defaults to the workflow GITHUB_TOKEN. | no | ${{ github.token }} |
| release_ingest_timeout_seconds | v3 mode. Max seconds to wait for the version to be recognised after upload. Fails the run on timeout. | no | 30 |
| release_ingest_poll_interval_seconds | v3 mode. Seconds between checks while waiting for the version to be recognised. | no | 2 |
| expected_version | v3 mode (optional). If set, the run aborts unless the recognised version matches this exactly. | no | "" |
| product_uuids | Comma-separated list of SureCart product UUIDs to attach the Download(s) to. | yes | — |
| set_as_current_release | When true, PATCH each product so current_release_download points at the new Download. | no | false |
| duplicate_behavior | How to handle a duplicate (already-attached media or URL): "warn" (continue, reuse the existing Download id when surfaced) or "error" (fail). | no | warn |
| duplicate_media_behavior | DEPRECATED alias for duplicate_behavior. Kept for backwards compatibility with v1 callers. | no | "" |
| dry_run | When true, log the planned uploads + SureCart POST/PATCH calls without executing them. | no | false |
| surecart_api_token | SureCart API token (Bearer). | yes | — |