| client-id | OAuth client ID for the Spice Cloud Management API.
Create one at https://spice.ai under Profile → OAuth Clients.
| yes | — |
| client-secret | OAuth client secret. Store as a repository or environment secret
(e.g. `secrets.SPICE_CLIENT_SECRET`); never inline.
| yes | — |
| app-id | Numeric Spice Cloud app ID. Either `app-id` or `app-name` is required. | no | — |
| app-name | Spice Cloud app name. Used to look up `app-id` when not provided.
Required when `create-app-if-missing` is true.
| no | — |
| create-app-if-missing | Create the app if it does not exist. Requires `app-name`. | no | false |
| org | Spice Cloud organization slug. Used to construct the `app-url` output
(`https://spice.ai/<org>/<app-name>`). When unset, the action falls back
to the owner part of `GITHUB_REPOSITORY` — which matches the Spice org
slug for personal orgs and for orgs created from a connected GitHub
organization. Set this explicitly only when your Spice org slug differs
from the GitHub repo owner.
| no | — |
| region | Spice Cloud region (e.g. `us-east-1`, `us-west-2`).
Required when `create-app-if-missing` is true. For existing apps the
region is read from the API and this input is informational only.
| no | — |
| visibility | Visibility for new apps (`public` or `private`). Only used with `create-app-if-missing`. | no | private |
| tags | App tags as a YAML or JSON map. Merged with existing tags on each run.
YAML form (recommended):
tags: |
environment: production
team: data-platform
commit: <commit-sha>
JSON form:
tags: '{"environment":"production","team":"data-platform"}'
Lines beginning with `#` are treated as comments.
| no | — |
| spicepod | Path to a Spicepod manifest. When the file exists, its contents are pushed to
the app via `PUT /v1/apps/{appId}` before the deployment is triggered.
| no | spicepod.yaml |
| working-directory | Working directory. Relative paths in `spicepod` are resolved against this. | no | . |
| image-tag | Runtime image tag override for this deployment (e.g. `1.5.0-models`). | no | — |
| channel | Update channel for this deployment (`stable`, `preview`, `nightly`, `internal`). | no | — |
| replicas | Number of replicas for this deployment (1-10). | no | — |
| branch | Git branch attributed to the deployment. Defaults to the `GITHUB_REF_NAME` environment variable. | no | — |
| commit-sha | Git commit SHA attributed to the deployment. Defaults to the `GITHUB_SHA` environment variable. | no | — |
| commit-message | Commit message for the deployment. Defaults to the head-commit message of the GitHub event. | no | — |
| debug | Enable debug mode on the deployment. | no | false |
| secrets | App secrets to upsert before deploy, as a YAML or JSON map. Values are
added to the runner's secret-mask list so they don't appear in logs.
YAML form (recommended):
secrets: |
OPENAI_API_KEY: <openai-api-key>
PG_PASSWORD: <pg-password>
JSON form:
secrets: '{"OPENAI_API_KEY":"<openai-api-key>","PG_PASSWORD":"<pg-password>"}'
Lines beginning with `#` are treated as comments. Secret values can
contain any characters; only the secret name is constrained (must
start with a letter or underscore, alphanumeric + underscores only).
| no | — |
| wait-for-completion | Poll the deployment until it succeeds or fails. | no | true |
| timeout-seconds | Maximum number of seconds to wait when `wait-for-completion` is true. | no | 600 |
| poll-interval-seconds | Seconds between deployment status polls. | no | 10 |
| test-sql | SQL query to execute against the deployed runtime as a smoke test
(uses the `@spiceai/spice` SDK with HTTP fallback).
| no | — |
| test-nsql | Natural-language query to send to `/v1/nsql` (text-to-SQL) as a smoke test.
Uses the `@spiceai/spice` SDK.
| no | — |
| test-chat | Either a plain prompt string (sent as a single user message) or a JSON body
to POST to `/v1/chat/completions` (OpenAI-compatible).
| no | — |
| test-chat-model | Model to use for `test-chat` and `test-nsql` (when applicable). | no | — |
| test-search | JSON body to POST to `/v1/search`.
Example:
test-search: '{"datasets":["my_dataset"],"text":"hello world"}'
| no | — |
| test-mcp-tool | Name of an MCP tool to invoke against `/v1/mcp` as a smoke test. | no | — |
| test-mcp-arguments | JSON-encoded arguments object passed as `params.arguments` to the MCP tool call. | no | — |
| test-warmup-seconds | Maximum seconds to wait for the runtime to become ready (`isSpiceReady()`)
before running probes. Set to 0 to skip the warmup wait.
| no | 60 |
| test-timeout-seconds | Per-probe HTTP timeout in seconds. | no | 30 |
| dataset-ready-timeout-seconds | Maximum seconds to wait for every dataset reported by `GET /v1/datasets?status=true`
to reach a terminal-ok state (`ready`, `disabled`, or `refreshing`) before running
runtime probes. The action fails the job immediately if any dataset enters `error`,
or if the timeout elapses while datasets are still pending — regardless of
`fail-on-test-error`, which only governs runtime-probe results. To disable the
dataset check entirely, set this to `0`.
| no | 300 |
| runtime-url | Override the runtime HTTP base URL probes connect to. When unset, the
URL is derived from the resolved app's region as
`https://<region>-prod-aws-data.spiceai.io` (e.g.
`https://us-east-1-prod-aws-data.spiceai.io`).
| no | — |
| flight-url | Override the Apache Arrow Flight gRPC endpoint the SQL probe connects
to (`host:port`, optionally prefixed with `grpc+tls://`). When unset,
it's derived from the app's region as
`<region>-prod-aws-flight.spiceai.io:443` (e.g.
`us-west-2-prod-aws-flight.spiceai.io:443`). Set this if your app
uses a custom Flight host.
| no | — |
| fail-on-test-error | Fail the action when any probe fails. Set to `false` to record failures without failing the job. | no | true |
| api-url | Base URL for the Spice Cloud Management API. | no | https://api.spice.ai |
| oauth-token-url | OAuth token endpoint URL. | no | https://spice.ai/api/oauth/token |
| scope | Optional OAuth scope to request when exchanging client credentials (space-separated). | no | — |