run-gemini-cli GitHub Action

run-gemini-cli is a GitHub Action that integrates Gemini into your development workflow via the Gemini CLI. It functions as both an autonomous agent for routine coding tasks and an on-demand collaborator.

You can use it to perform pull request reviews, triage issues, and perform code analysis or modifications by interacting with it conversationally (e.g., using @gemini-cli in comments) directly within your GitHub repositories.

The action requires authentication for both Google services and the GitHub API.

Google Authentication

Choose one of the following:

1. Gemini API Key: Simplest method for projects without Google Cloud integration.
2. Workload Identity Federation: Most secure method for authenticating to Google Cloud services.

GitHub Authentication

Choose one of the following:

1. Default GITHUB_TOKEN: Uses the standard token provided by the workflow.
2. Custom GitHub App (Recommended): Most secure and flexible method for authentication.

The evaluation directory is organized as follows:

• test-rig.ts: A utility for setting up temporary environments for the CLI.
• *.eval.ts: Individual benchmark files for specific workflows (e.g., issue-triage.eval.ts, pr-review.eval.ts, issue-fixer.eval.ts, gemini-assistant.eval.ts, gemini-scheduled-triage.eval.ts).
• data/*.jsonl: Gold-standard datasets used for each workflow benchmark.
• vitest.config.ts: Configuration for the Vitest runner.

The action provides several core capabilities:

• Automation: Trigger workflows based on GitHub events (like opening an issue) or on a schedule (like nightly runs).
• On-demand Collaboration: Trigger specific workflows by mentioning the Gemini CLI in issue or pull request comments (e.g., @gemini-cli /review).
• Extensible with Tools: Uses Gemini's tool-calling capabilities to interact with other command-line tools, such as the GitHub CLI (gh).
• Customizable: You can provide project-specific context and instructions by adding a GEMINI.md file to your repository.

To maintain security and reliability when using run-gemini-cli in automated workflows, follow these recommendations:

Repository Security

• Implement branch and tag protection.
• Restrict pull request approvers.

Workflow Configuration

• Use Workload Identity Federation for secure authentication to Google Cloud.
• Manage secrets effectively (e.g., using GitHub Secrets).
• Pin action versions to specific tags or SHAs to prevent unexpected changes from upstream updates.

Monitoring and Auditing

• Regularly review action logs.
• Enable OpenTelemetry for deeper insights into performance and behavior.

For simple use cases, the action can use the default GITHUB_TOKEN automatically provided by GitHub for each workflow run. The action falls back to this method if APP_ID and APP_PRIVATE_KEY secrets are not configured.

Limitations:

• Limited Permissions: The token has restricted permissions. You may need to explicitly grant permissions in your workflow file (e.g., contents: 'read', issues: 'write', pull-requests: 'write').
• Job-Scoped: Access is limited to the current repository and expires when the job finishes.

permissions:
  contents: 'read'
  issues: 'write'
  pull-requests: 'write'

To ensure workflow stability and security, always pin the run-gemini-cli action to a specific version rather than using a floating tag. This prevents unexpected breaking changes when new versions are released.

uses: google-github-actions/run-gemini-cli@v0

You can configure the Gemini CLI Action to send telemetry data (metrics, logs, and traces) to a Google Cloud project. This allows you to monitor performance and debug workflows using Google Cloud's native observability tools.

To enable this, you must provide a settings JSON object in your GitHub Actions workflow with the telemetry configuration set to enabled: true and target: "gcp".

- uses: 'google-github-actions/run-gemini-cli@v0'
  with:
    gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
    gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
    gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
    # Enable telemetry in settings
    settings: |- 
      {
        "telemetry": {
          "enabled": true,
          "target": "gcp"
        }
      }