Rewrite deploy action as a native Node action with simplified v2 UX

[githubsaturn]

Summary

Introduces the focused v2 interface on top of #19:

- uses: actions/checkout@v6

- uses: caprover/deploy-from-github@v2
  with:
    server: https://captain.example.com
    app: my-api
    token: ${{ secrets.CAPROVER_APP_TOKEN }}

The default mode packages the committed contents of checked-out HEAD and submits them through the app-token deployment endpoint.

Deployment modes

• Source: archives HEAD; working-directory supports monorepos and places that directory's contents at the tar root
• Image: sends a schema v2 captain definition and uses checked-out HEAD as deployment metadata, falling back to GITHUB_SHA when no repository is available
• Prepared tar: uploads the path supplied through tar-file, resolved inside the GitHub workspace

The action rejects image with tar-file and rejects a non-default working-directory in either explicit mode.

Breaking changes from v1

• removes branch
• checked-out HEAD becomes the default deployment source
• removes the implicit ./deploy.tar fallback
• existing archives require tar-file: ./deploy.tar
• generated and uncommitted files require an explicit prepared tar

Existing v1 tags remain unchanged.

Documentation

The README is organized around quick start, image deployment with docker/build-push-action, monorepos, prepared tar files, inputs, private registries, and v1 migration.

Tests

25 tests cover input validation, mutually exclusive modes, source and image commit metadata, monorepo archive roots, explicit tar uploads, API headers, trailing server slashes, useful API errors, special-character paths, temporary archive cleanup, interrupted responses, SHA fallback behavior, and normalized workspace-root paths.

Manual verification

Ran the committed dist/index.js through all three modes against a local CapRover-compatible HTTP server:

• source deployment from a nested monorepo directory
• image deployment with commit metadata
• prepared tar deployment with spaces in its path

Verified the endpoint, authentication headers, multipart requests, image definition, metadata, logs, and accepted-response handling.

This PR is stacked on #19. After #19 merges, retarget this PR to main.

Review fixes

• uses checked-out HEAD for image metadata, with GITHUB_SHA as the no-checkout fallback
• accepts equivalent workspace-root spellings such as ./
• includes the updated base action's execution, transport, dependency, and audit fixes

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• main
• master

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: fba0a0fd-b9c5-4ab0-b804-213968ceb813

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}