| host | Hostname or IP address of the SFTP server (e.g. sftp.example.com). Required in inline mode; in config mode it comes from the config file (connection.host). | no | — |
| port | SSH port of the server. Defaults to 22. Deliberately has no declared default value: the runner exports declared defaults unconditionally, which would wrongly trip the config-mode mutual-exclusion check. | no | — |
| username | Username used for authentication. Required in inline mode; in config mode it comes from the config file (connection.username). | no | — |
| password | Password used for authentication. Provide this or private-key (or both). Always store this in a GitHub Actions secret. As a credential, this input is used in both inline and config mode. | no | — |
| private-key | SSH private key (PEM/OpenSSH format) used for authentication. Always store this in a GitHub Actions secret. As a credential, this input is used in both inline and config mode. | no | — |
| passphrase | Passphrase for the private key, if it is encrypted. | no | — |
| host-key | Expected SHA256 fingerprint(s) of the server's host key, one per line (format "SHA256:..."). The connection is accepted if the server presents a key matching any of them, so you can simply pin all of your server's keys. Obtain the fingerprints with: ssh-keyscan <server> | ssh-keygen -lf - Without this input or known-hosts, the run fails unless allow-any-host-key is explicitly set. | no | — |
| known-hosts | Expected host key(s) in OpenSSH known_hosts format, e.g. the verbatim output of "ssh-keyscan <server>", or the server's lines from your own ~/.ssh/known_hosts. An alternative to host-key (no ssh-keygen conversion step); if both are set, a key matching either is accepted. Hashed entries and "[host]:port" entries for non-standard ports are supported. | no | — |
| allow-any-host-key | Set to "true" to explicitly skip host key verification. NOT recommended: without verification, a man-in-the-middle can intercept the deployment and the credentials. In v3 an unverified connection is no longer the silent default; this opt-in (or a pinned key) is required. | no | — |
| source | Local path to upload: a directory (uploaded recursively) or a single file. Required in inline mode, together with target. | no | — |
| target | Remote destination path, e.g. /var/www/html. Required in inline mode, together with source. | no | — |
| mode | How the remote target is reconciled: "overlay" (upload only, never delete; the default), "sync" (upload changed files and delete files no longer present locally, tracked via a manifest) or "clean" (wipe the remote target directory, then upload). | no | — |
| exclude | Gitignore-style exclude patterns, one per line (e.g. "*.log" or "node_modules/"). Prefix with "!" to re-include files. | no | — |
| config | Path to a YAML config file (version 3) that holds every non-secret setting: connection (including proxy), named deployments, safety limits and advanced tuning. Mutually exclusive with the inline connection and deployment inputs above; only credentials, dry-run and log-level may be combined with it. See docs/configuration.md. | no | — |
| proxy-password | Password for the jump host defined as connection.proxy in the config file. Always store this in a GitHub Actions secret. | no | — |
| proxy-private-key | SSH private key (PEM/OpenSSH format) for the jump host defined as connection.proxy in the config file. Always store this in a GitHub Actions secret. | no | — |
| proxy-passphrase | Passphrase for the jump host's private key, if it is encrypted. | no | — |
| dry-run | If "true", connect and log everything that would be uploaded or deleted without changing anything on the server. | no | false |
| log-level | How chatty the log output is. "normal" (the default) logs connection status, one compact summary per deployment, warnings and errors. "verbose" additionally logs one line per uploaded, deleted or skipped file. "debug" additionally explains every exclude decision (which pattern excluded which file). A dry run always logs per-file lines regardless of this input, since inspecting the plan is its whole point. | no | normal |
| build-mode | Removed in v3. The build mode is now selected automatically: release tags download the verified prebuilt binary, development refs build from source. | no | — |
| server | Removed in v3: renamed to 'host'. See docs/migration-v3.md. | no | — |
| host-key-fingerprint | Removed in v3: renamed to 'host-key'. See docs/migration-v3.md. | no | — |
| uploads | Removed in v3: use 'source' and 'target' for a single deployment, or a config file for multiple deployments. See docs/migration-v3.md. | no | — |
| config-file | Removed in v3: renamed to 'config' (new file format, version 3). See docs/migration-v3.md. | no | — |
| strategy | Removed in v3: renamed to 'mode'. See docs/migration-v3.md. | no | — |
| ignore | Removed in v3: renamed to 'exclude'. See docs/migration-v3.md. | no | — |
| ignore-from | Removed in v3: put the patterns in 'exclude' or in the config file. See docs/migration-v3.md. | no | — |
| max-deletes | Removed in v3: moved to 'safety.max_deletes' in the config file. See docs/migration-v3.md. | no | — |
| delete | Removed in v2: use 'mode: clean'. See docs/migration-v3.md. | no | — |
| concurrency | Removed in v3: moved to 'advanced.concurrency' in the config file. See docs/migration-v3.md. | no | — |
| sftp-request-concurrency | Removed in v3: moved to 'advanced.request_concurrency' in the config file. See docs/migration-v3.md. | no | — |
| retries | Removed in v3: moved to 'advanced.retries' in the config file. See docs/migration-v3.md. | no | — |
| timeout | Removed in v3: moved to 'advanced.timeout' in the config file. See docs/migration-v3.md. | no | — |
| stall-timeout | Removed in v3: moved to 'advanced.stall_timeout' in the config file. See docs/migration-v3.md. | no | — |
| sync-fast-path | Removed in v3: moved to 'sync.fast_path' in the config file. See docs/migration-v3.md. | no | — |
| skip-unchanged | Removed in v3: moved to 'advanced.skip_unchanged' in the config file. See docs/migration-v3.md. | no | — |
| manifest-name | Removed in v3: moved to 'sync.manifest' in the config file. See docs/migration-v3.md. | no | — |
| dir-mode | Removed in v3: moved to 'permissions.directories' in the config file. See docs/migration-v3.md. | no | — |
| file-mode | Removed in v3: moved to 'permissions.files' in the config file. See docs/migration-v3.md. | no | — |
| preserve-times | Removed in v3: moved to 'permissions.preserve_times' in the config file. See docs/migration-v3.md. | no | — |
| proxy-server | Removed in v3: moved to 'connection.proxy.host' in the config file. See docs/migration-v3.md. | no | — |
| proxy-port | Removed in v3: moved to 'connection.proxy.port' in the config file. See docs/migration-v3.md. | no | — |
| proxy-username | Removed in v3: moved to 'connection.proxy.username' in the config file. See docs/migration-v3.md. | no | — |
| proxy-host-key-fingerprint | Removed in v3: moved to 'connection.proxy.host_key' in the config file. See docs/migration-v3.md. | no | — |
| proxy-known-hosts | Removed in v3: moved to 'connection.proxy.known_hosts' in the config file. See docs/migration-v3.md. | no | — |