Deploy Nebari

This action deploys a Nebari platform from a config file using the nic CLI, and destroys it automatically when the job ends, even on failure or cancellation.

Specifically, the action:

• Acquires nic from a prebuilt binary (nic-binary) or from a release or Git ref (nic-version), verifying release downloads against their checksums and build provenance attestations (release tags must be v0.10.0 or newer because earlier releases have no attestation and are thus refused).
• Runs nic deploy with your config (or a built-in local kind default).
• Exports KUBECONFIG so every later step in the job runs against the deployed cluster.
• Waits for the deployment to converge: nebari-root Synced, every Argo CD Application Healthy, and that state stable across consecutive polls.
• Destroys the deployment in a post step when the job ends, even when the job failed or was cancelled.

Quickstart

Deploy the built-in default config (a local kind cluster with an auto-created local gitops repository) using the latest nic release:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: nebari-dev/deploy-nebari-action@main
        with:
          nic-version: latest

      # KUBECONFIG is exported so kubectl commands run against the deployed cluster.
      - run: kubectl get pods -A

Inputs

name	description	required	default
config	Path to the NIC config file, relative to the workspace. When unset, the action deploys its built-in default: a local kind cluster with an auto-created local gitops repository (see default-config.yaml in the action repository). Copy it into your repository as a starting point for a custom config.	false	""
nic-binary	Path to a local prebuilt nic binary. Set exactly one of nic-binary and nic-version.	false	""
nic-version	NIC version to acquire. Mutually exclusive with nic-binary. 'latest': download the latest release binary (checksum- and provenance-verified). 'vX.Y.Z': download that release binary (checksum- and provenance-verified). Must be v0.10.0 or newer; earlier releases have no provenance attestation and are refused. any other string: fetch that Git ref (branch, tag, or commit SHA) of nebari-dev/nebari-infrastructure-core and build from source (requires Go, e.g. via actions/setup-go).	false	""
wait	Wait for the deployment to converge after deploy (nebari-root Synced, all Argo CD Applications Healthy, stable across consecutive polls).	false	true
wait-timeout	Seconds to wait for Applications to converge.	false	1200
restart-budgets	Comma-separated namespace=count pairs overriding the per-namespace container restart budgets the wait uses to fail fast on crashloops (e.g. 'keycloak=12,cnpg-system=8'). Use *=count to override the budget for namespaces without a specific override. Only used when wait is true.	false	""
destroy	Destroy the deployment in the post step when the job ends.	false	true
force	Pass --force to nic destroy so teardown continues past individual resource failures.	false	true
token	GitHub token used to resolve and download NIC releases (nic-version mode).	false	${{ github.token }}

Outputs

name	description
kubeconfig	Path to a kubeconfig for the deployed cluster (also exported as KUBECONFIG).
nic-binary	Path to the nic binary used, for running further nic commands in later steps.

Usage

Custom config

Copy default-config.yaml into your repository as a starting point, edit it, and pass it via the config input.

Note that nic requires the config to declare exactly one repository: provider. The default config uses the local provider, which auto-creates a gitops repository on the runner. To have nic push to a remote repository instead, use the existing provider and supply credentials through an environment variable. See the NIC configuration examples.

repository:
  existing:
    url: 'git@github.com:my-org/my-gitops-repo.git'
    branch: main
    path: 'clusters/my-nebari'
    auth:
      ssh:
        env: GIT_SSH_PRIVATE_KEY
      # or, for HTTPS:
      # token:
      #   env: GIT_TOKEN

- uses: nebari-dev/deploy-nebari-action@main
  with:
    config: ci/nebari-config.yaml
    nic-version: latest
    wait-timeout: '1800'

Prebuilt binary

When a previous job already built nic (for example from the PR under test), pass the binary directly instead of a version:

- uses: actions/download-artifact@v6
  with:
    name: nic

- run: chmod +x nic

- uses: nebari-dev/deploy-nebari-action@main
  with:
    config: ci/nebari-config.yaml
    nic-binary: nic

Source build from a Git ref

Any nic-version that is not latest or a release tag is treated as a Git ref of nebari-infrastructure-core and built from source, which requires Go:

- uses: actions/setup-go@v6
  with:
    go-version-file: go.mod

- uses: nebari-dev/deploy-nebari-action@main
  with:
    nic-version: main

Keeping the deployment

Set destroy: false to leave the deployment running when the job ends, for example to debug a failing environment:

- uses: nebari-dev/deploy-nebari-action@main
  with:
    nic-version: latest
    destroy: false

Cloud deployments left running must be destroyed manually with nic destroy.