commit ff9386c53b8640b15bf031ca0bf71c1c0c6cf661
Author: ci <ci@gitea.512.dev>
Date:   Sat Sep 5 16:41:26 2026 +0000

    Published from yuki-talos action/deploy

diff --git a/action.yml b/action.yml
new file mode 100644
index 0000000..e00dba3
--- /dev/null
+++ b/action.yml
@@ -0,0 +1,40 @@
+# ══════════════════════════════════════════════════════════════════
+#  BREAKING CHANGE? BUMP THE MAJOR IN cue/cluster/cluster.cue
+# ══════════════════════════════════════════════════════════════════
+# Everything pinning `@v1` gets this the moment it publishes. A change
+# a consumer cannot absorb needs a new major, or it breaks them.
+# ══════════════════════════════════════════════════════════════════
+
+name: deploy
+description: Render a CUE package and apply it, waiting for every workload to become ready.
+
+inputs:
+  name:
+    description: Application name. Defaults to the repository name.
+    required: false
+  timeout:
+    description: How long a workload has to become ready before the deploy fails.
+    required: false
+    default: 2m
+  path:
+    description: The CUE package to render.
+    required: false
+    default: .deploy
+  image:
+    description: The image to deploy, as name@sha256:digest. Pass build-image's `image` output.
+    required: false
+
+runs:
+  using: docker
+
+  # By digest, pinned at bootstrap and moved by a reviewed commit. A tag here
+  # would let whoever can push to `ci` run code in every pipeline in the
+  # cluster, holding that pipeline's deploy credential.
+  image: docker://gitea.512.dev/ci/toolbox@sha256:b854a995771816ba81a49656d246aab6c2688fe4a3490be6edc81487baa5f1cb
+
+  entrypoint: /usr/local/lib/actions/deploy-app.sh
+  env:
+    PLUGIN_NAME: ${{ inputs.name }}
+    PLUGIN_TIMEOUT: ${{ inputs.timeout }}
+    PLUGIN_PATH: ${{ inputs.path }}
+    PLUGIN_IMAGE: ${{ inputs.image }}