| api-key | Primitive API key. Org-scoped; must belong to the org you are deploying into. Pass via a GitHub secret reference (see README for the usage example) — never hard-code. Masked in logs. | yes | — |
| api-base-url | Primitive API base URL. Defaults to production. Set to a non-production URL if you are deploying against a custom environment. | no | https://api.primitive.dev/v1 |
| name | Function name. Lowercase letters, digits, dashes, underscores; max 64 chars. Idempotent within the org. | yes | — |
| code-path | Path to the pre-built ESM bundle (e.g. `dist/handler.js`). The build is the caller's responsibility; this Action only uploads. Exactly one of `code-path` and `files-path` is required. | no | — |
| source-map-path | Optional path to the bundle's source map. When present, surfaces readable stack traces in the dashboard's invocation logs. Only valid with `code-path`. | no | — |
| files-path | Path to a source directory for managed build mode. The Action walks the directory, applies the default + caller ignore patterns, and sends the resulting `{relative-path: contents}` map as the `files` field. The directory MUST contain a `package.json` at the root. Requires the `functions_managed_build` entitlement on the org. Exactly one of `code-path` and `files-path` is required. | no | — |
| ignore | Additional ignore patterns layered on top of the default list (`node_modules`, `.git`, `.github`, `dist`, `build`, `.next`, `.turbo`, `.vercel`, `coverage`, `.DS_Store`, `.env`, `.env.local`, `.env.*`). One pattern per line. Each pattern is matched against basenames anywhere in the tree. Supports exact names (`secrets.txt`) or simple globs (`*.log`, `*.test.ts`). `#` comments and blank lines allowed. Only used with `files-path`. | no | "" |
| secrets | JSON object of custom function_secrets to upsert before deploy. Values are masked in logs. Example: `{"OPENAI_API_KEY":"sk-…","FEATURE_FLAG":"on"}`. Pass an empty object (or omit) to leave existing secrets untouched. | no | {} |
| redeploy-on-secret-change | When `true` and at least one secret was upserted, call `/v1/functions/{id}/redeploy` after the upsert so the new bindings are wired into the runtime. Default `true`. Safe to leave on; the redeploy is a no-op when nothing changed. | no | true |
| expected-org-id | Optional safety guard. When set, the Action calls `/v1/whoami` before any write and aborts if the API key's org differs from this value. Strongly recommended in production workflows to prevent a leaked-key cross-org incident. | no | — |