gitinject 0.1.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (164) hide show
  1. gitinject/__init__.py +1 -0
  2. gitinject/__main__.py +5 -0
  3. gitinject/analyzer.py +67 -0
  4. gitinject/attacks/__init__.py +27 -0
  5. gitinject/attacks/autoinject.py +165 -0
  6. gitinject/attacks/base.py +33 -0
  7. gitinject/attacks/static.py +25 -0
  8. gitinject/cli.py +768 -0
  9. gitinject/data/research/scenarios/claude_skills_injection.md +96 -0
  10. gitinject/data/research/scenarios/cline_issue_body_injection.md +93 -0
  11. gitinject/data/research/scenarios/codex_agents_md_injection.md +109 -0
  12. gitinject/data/research/scenarios/dos_request_flood.md +133 -0
  13. gitinject/data/research/scenarios/dropped/ci_log_injection_workflow_poisoning.md +138 -0
  14. gitinject/data/research/scenarios/dropped/claude_md_instructions_injection.md +158 -0
  15. gitinject/data/research/scenarios/dropped/supply_chain_token_pivot.md +101 -0
  16. gitinject/data/research/scenarios/gemini_api_key_exfiltration.md +68 -0
  17. gitinject/data/research/scenarios/gemini_api_key_exfiltration_replication.md +0 -0
  18. gitinject/data/research/scenarios/gemini_md_instructions_injection.md +131 -0
  19. gitinject/data/research/scenarios/nsfw_api_key_block.md +114 -0
  20. gitinject/data/research/scenarios/pr_token_exfiltration_via_git_config.md +117 -0
  21. gitinject/data/research/scenarios/supply_chain_malicious_code.md +135 -0
  22. gitinject/evaluators.py +169 -0
  23. gitinject/evidence.py +72 -0
  24. gitinject/gl_runner.py +163 -0
  25. gitinject/resources.py +30 -0
  26. gitinject/run_context.py +72 -0
  27. gitinject/run_record.py +113 -0
  28. gitinject/runner.py +1024 -0
  29. gitinject/scanner/__init__.py +22 -0
  30. gitinject/scanner/baselines/__init__.py +0 -0
  31. gitinject/scanner/baselines/actionlint_runner.py +44 -0
  32. gitinject/scanner/baselines/zizmor_runner.py +35 -0
  33. gitinject/scanner/diagnostics.py +174 -0
  34. gitinject/scanner/hypothesis_generator.py +164 -0
  35. gitinject/scanner/live_validator.py +284 -0
  36. gitinject/scanner/llm_ranker.py +120 -0
  37. gitinject/scanner/memory.py +239 -0
  38. gitinject/scanner/primitives.py +236 -0
  39. gitinject/scanner/prompt_extractor.py +134 -0
  40. gitinject/scanner/recipe_scenario.py +203 -0
  41. gitinject/scanner/report_generator.py +230 -0
  42. gitinject/scanner/types.py +179 -0
  43. gitinject/scenario_base.py +147 -0
  44. gitinject/scenario_loader.py +77 -0
  45. gitinject/scenarios/__init__.py +0 -0
  46. gitinject/scenarios/benign/documentation_out_of_sync/contents/math_utils.py +3 -0
  47. gitinject/scenarios/benign/documentation_out_of_sync/contents/pydantic/v1/utils.py +21 -0
  48. gitinject/scenarios/benign/documentation_out_of_sync/scenario.py +57 -0
  49. gitinject/scenarios/benign/issue_deduplication_utility/scenario.py +76 -0
  50. gitinject/scenarios/benign/repository_onboarding_qa/contents/README.md +3 -0
  51. gitinject/scenarios/benign/repository_onboarding_qa/scenario.py +52 -0
  52. gitinject/scenarios/benign/secrets_false_positive/contents/tests/test_auth.py +14 -0
  53. gitinject/scenarios/benign/secrets_false_positive/scenario.py +58 -0
  54. gitinject/scenarios/benign/test_coverage_gap/contents/src/requests/auth_extra.py +33 -0
  55. gitinject/scenarios/benign/test_coverage_gap/scenario.py +56 -0
  56. gitinject/scenarios/benign/vulnerability_fix_verification/contents/src/flask/utils.py +15 -0
  57. gitinject/scenarios/benign/vulnerability_fix_verification/scenario.py +57 -0
  58. gitinject/scenarios/benign/vulnerable_code_review/contents/examples/tutorial/flaskr/db_utils.py +18 -0
  59. gitinject/scenarios/benign/vulnerable_code_review/scenario.py +55 -0
  60. gitinject/scenarios/benign/weekly_activity_summary/scenario.py +83 -0
  61. gitinject/scenarios/malicious/agents_md_approval_manipulation/contents/AGENTS.md +25 -0
  62. gitinject/scenarios/malicious/agents_md_approval_manipulation/contents/src/flask/csrf.py +151 -0
  63. gitinject/scenarios/malicious/agents_md_approval_manipulation/contents/tests/test_csrf.py +71 -0
  64. gitinject/scenarios/malicious/agents_md_approval_manipulation/scenario.py +121 -0
  65. gitinject/scenarios/malicious/claude_md_instructions_injection/contents/CLAUDE.md +23 -0
  66. gitinject/scenarios/malicious/claude_md_instructions_injection/contents/scripts/deploy_check.sh +29 -0
  67. gitinject/scenarios/malicious/claude_md_instructions_injection/scenario.py +93 -0
  68. gitinject/scenarios/malicious/cline_issue_body_injection/scenario.py +132 -0
  69. gitinject/scenarios/malicious/codex_agents_md_injection/contents/AGENTS.md +36 -0
  70. gitinject/scenarios/malicious/codex_agents_md_injection/contents/scripts/utils.py +12 -0
  71. gitinject/scenarios/malicious/codex_agents_md_injection/scenario.py +128 -0
  72. gitinject/scenarios/malicious/dos_request_flood/scenario.py +80 -0
  73. gitinject/scenarios/malicious/gemini_md_approval_manipulation/contents/src/flask/csrf.py +151 -0
  74. gitinject/scenarios/malicious/gemini_md_approval_manipulation/contents/tests/test_csrf.py +71 -0
  75. gitinject/scenarios/malicious/gemini_md_approval_manipulation/scenario.py +121 -0
  76. gitinject/scenarios/malicious/gemini_md_instructions_injection/contents/scripts/deploy_check.sh +38 -0
  77. gitinject/scenarios/malicious/gemini_md_instructions_injection/scenario.py +105 -0
  78. gitinject/scenarios/malicious/issue_onboarding_secret_exfiltration/scenario.py +76 -0
  79. gitinject/scenarios/malicious/pr_token_exfiltration_via_git_config/contents/scripts/deploy_check.sh +7 -0
  80. gitinject/scenarios/malicious/pr_token_exfiltration_via_git_config/scenario.py +113 -0
  81. gitinject/scenarios/malicious/supply_chain_malicious_code/contents/CLAUDE.md +25 -0
  82. gitinject/scenarios/malicious/supply_chain_malicious_code/contents/src/flask/csrf.py +151 -0
  83. gitinject/scenarios/malicious/supply_chain_malicious_code/contents/tests/test_csrf.py +71 -0
  84. gitinject/scenarios/malicious/supply_chain_malicious_code/scenario.py +123 -0
  85. gitinject/scenarios/malicious/unauthorized_pr_approval/contents/django/utils/crypto.py +13 -0
  86. gitinject/scenarios/malicious/unauthorized_pr_approval/scenario.py +57 -0
  87. gitinject/simulator.py +89 -0
  88. gitinject/utils/__init__.py +0 -0
  89. gitinject/utils/gh_client.py +628 -0
  90. gitinject/utils/gl_client.py +132 -0
  91. gitinject/utils/gl_provisioner.py +83 -0
  92. gitinject/utils/llm.py +205 -0
  93. gitinject/utils/provisioner.py +114 -0
  94. gitinject/utils/scenario_resources.py +33 -0
  95. gitinject/utils/types.py +49 -0
  96. gitinject/workflows/__init__.py +0 -0
  97. gitinject/workflows/claude-ci-auto-fix/contents/.github/workflows/main.yml +107 -0
  98. gitinject/workflows/claude-ci-auto-fix/metadata.json +10 -0
  99. gitinject/workflows/claude-general/contents/.github/workflows/main.yml +58 -0
  100. gitinject/workflows/claude-general/metadata.json +10 -0
  101. gitinject/workflows/claude-gitlab-mr-review/contents/.gitlab-ci.yml +36 -0
  102. gitinject/workflows/claude-gitlab-mr-review/metadata.json +11 -0
  103. gitinject/workflows/claude-issue-deduplication/contents/.github/workflows/main.yml +66 -0
  104. gitinject/workflows/claude-issue-deduplication/metadata.json +10 -0
  105. gitinject/workflows/claude-issue-triage/contents/.github/workflows/main.yml +34 -0
  106. gitinject/workflows/claude-issue-triage/metadata.json +10 -0
  107. gitinject/workflows/claude-manual-analysis/contents/.github/workflows/main.yml +42 -0
  108. gitinject/workflows/claude-manual-analysis/metadata.json +10 -0
  109. gitinject/workflows/claude-pr-review/contents/.github/workflows/main.yml +77 -0
  110. gitinject/workflows/claude-pr-review/metadata.json +10 -0
  111. gitinject/workflows/claude-pr-review-authors/contents/.github/workflows/main.yml +48 -0
  112. gitinject/workflows/claude-pr-review-authors/metadata.json +10 -0
  113. gitinject/workflows/claude-pr-review-paths/contents/.github/workflows/main.yml +49 -0
  114. gitinject/workflows/claude-pr-review-paths/metadata.json +10 -0
  115. gitinject/workflows/claude-test-analysis/contents/.github/workflows/main.yml +114 -0
  116. gitinject/workflows/claude-test-analysis/metadata.json +10 -0
  117. gitinject/workflows/cline-assistant/contents/.github/workflows/main.yml +87 -0
  118. gitinject/workflows/cline-assistant/contents/git-scripts/analyze-issue.sh +43 -0
  119. gitinject/workflows/cline-assistant/metadata.json +10 -0
  120. gitinject/workflows/codex-pr-review/contents/.github/workflows/main.yml +73 -0
  121. gitinject/workflows/codex-pr-review/metadata.json +10 -0
  122. gitinject/workflows/copilot-ci-doctor/contents/.github/workflows/ci-doctor.yml +1161 -0
  123. gitinject/workflows/copilot-ci-doctor/metadata.json +10 -0
  124. gitinject/workflows/copilot-lean-squad/contents/.github/workflows/lean-squad.yml +1313 -0
  125. gitinject/workflows/copilot-lean-squad/metadata.json +10 -0
  126. gitinject/workflows/copilot-malicious-scan/contents/.github/workflows/daily-malicious-code-scan.yml +899 -0
  127. gitinject/workflows/copilot-malicious-scan/metadata.json +10 -0
  128. gitinject/workflows/copilot-repo-assist/contents/.github/workflows/repo-assist.yml +1503 -0
  129. gitinject/workflows/copilot-repo-assist/metadata.json +10 -0
  130. gitinject/workflows/copilot-wiki-writer/contents/.github/workflows/agentic-wiki-writer.yml +1316 -0
  131. gitinject/workflows/copilot-wiki-writer/metadata.json +10 -0
  132. gitinject/workflows/gemini-assistant/contents/.github/workflows/gemini-invoke.yml +122 -0
  133. gitinject/workflows/gemini-assistant/contents/.github/workflows/gemini-plan-execute.yml +130 -0
  134. gitinject/workflows/gemini-assistant/contents/.github/workflows/gemini-review.yml +118 -0
  135. gitinject/workflows/gemini-assistant/contents/.github/workflows/gemini-scheduled-triage.yml +220 -0
  136. gitinject/workflows/gemini-assistant/contents/.github/workflows/gemini-triage.yml +160 -0
  137. gitinject/workflows/gemini-assistant/contents/.github/workflows/main.yml +220 -0
  138. gitinject/workflows/gemini-assistant/metadata.json +10 -0
  139. gitinject/workflows/gemini-assistant-original/AWESOME.md +118 -0
  140. gitinject/workflows/gemini-assistant-original/CONFIGURATION.md +162 -0
  141. gitinject/workflows/gemini-assistant-original/README.md +93 -0
  142. gitinject/workflows/gemini-assistant-original/gemini-assistant/README.md +192 -0
  143. gitinject/workflows/gemini-assistant-original/gemini-assistant/gemini-invoke.toml +94 -0
  144. gitinject/workflows/gemini-assistant-original/gemini-assistant/gemini-invoke.yml +131 -0
  145. gitinject/workflows/gemini-assistant-original/gemini-assistant/gemini-plan-execute.toml +100 -0
  146. gitinject/workflows/gemini-assistant-original/gemini-assistant/gemini-plan-execute.yml +139 -0
  147. gitinject/workflows/gemini-assistant-original/gemini-dispatch/README.md +49 -0
  148. gitinject/workflows/gemini-assistant-original/gemini-dispatch/gemini-dispatch.yml +221 -0
  149. gitinject/workflows/gemini-assistant-original/issue-triage/README.md +190 -0
  150. gitinject/workflows/gemini-assistant-original/issue-triage/gemini-scheduled-triage.toml +96 -0
  151. gitinject/workflows/gemini-assistant-original/issue-triage/gemini-scheduled-triage.yml +223 -0
  152. gitinject/workflows/gemini-assistant-original/issue-triage/gemini-triage.toml +32 -0
  153. gitinject/workflows/gemini-assistant-original/issue-triage/gemini-triage.yml +167 -0
  154. gitinject/workflows/gemini-assistant-original/metadata.json +10 -0
  155. gitinject/workflows/gemini-assistant-original/pr-review/README.md +337 -0
  156. gitinject/workflows/gemini-assistant-original/pr-review/gemini-review.toml +176 -0
  157. gitinject/workflows/gemini-assistant-original/pr-review/gemini-review.yml +119 -0
  158. gitinject/workflows/opencode-pr-review/contents/.github/workflows/main.yml +28 -0
  159. gitinject/workflows/opencode-pr-review/metadata.json +10 -0
  160. gitinject-0.1.0.dist-info/METADATA +128 -0
  161. gitinject-0.1.0.dist-info/RECORD +164 -0
  162. gitinject-0.1.0.dist-info/WHEEL +4 -0
  163. gitinject-0.1.0.dist-info/entry_points.txt +2 -0
  164. gitinject-0.1.0.dist-info/licenses/LICENSE +202 -0
@@ -0,0 +1,160 @@
1
+ name: '🔀 Gemini Triage'
2
+
3
+ on:
4
+ workflow_call:
5
+ inputs:
6
+ additional_context:
7
+ type: 'string'
8
+ description: 'Any additional context from the request'
9
+ required: false
10
+
11
+ concurrency:
12
+ group: '${{ github.workflow }}-triage-${{ github.event_name }}-${{ github.event.pull_request.number || github.event.issue.number }}'
13
+ cancel-in-progress: true
14
+
15
+ defaults:
16
+ run:
17
+ shell: 'bash'
18
+
19
+ jobs:
20
+ triage:
21
+ runs-on: 'ubuntu-latest'
22
+ timeout-minutes: 7
23
+ outputs:
24
+ available_labels: '${{ steps.get_labels.outputs.available_labels }}'
25
+ selected_labels: '${{ env.SELECTED_LABELS }}'
26
+ permissions:
27
+ contents: 'read'
28
+ id-token: 'write'
29
+ issues: 'read'
30
+ pull-requests: 'read'
31
+ steps:
32
+ - name: 'Get repository labels'
33
+ id: 'get_labels'
34
+ uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # ratchet:actions/github-script@v8.0.0
35
+ with:
36
+ # NOTE: we intentionally do not use the given token. The default
37
+ # GITHUB_TOKEN provided by the action has enough permissions to read
38
+ # the labels.
39
+ script: |-
40
+ const labels = [];
41
+ for await (const response of github.paginate.iterator(github.rest.issues.listLabelsForRepo, {
42
+ owner: context.repo.owner,
43
+ repo: context.repo.repo,
44
+ per_page: 100, // Maximum per page to reduce API calls
45
+ })) {
46
+ labels.push(...response.data);
47
+ }
48
+
49
+ if (!labels || labels.length === 0) {
50
+ core.setFailed('There are no issue labels in this repository.')
51
+ }
52
+
53
+ const labelNames = labels.map(label => label.name).sort();
54
+ core.setOutput('available_labels', labelNames.join(','));
55
+ core.info(`Found ${labelNames.length} labels: ${labelNames.join(', ')}`);
56
+ return labelNames;
57
+
58
+ - name: 'Run Gemini issue analysis'
59
+ id: 'gemini_analysis'
60
+ if: |-
61
+ ${{ steps.get_labels.outputs.available_labels != '' }}
62
+ uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
63
+ env:
64
+ GITHUB_TOKEN: '' # Do NOT pass any auth tokens here since this runs on untrusted inputs
65
+ ISSUE_TITLE: '${{ github.event.issue.title }}'
66
+ ISSUE_BODY: '${{ github.event.issue.body }}'
67
+ AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
68
+ with:
69
+ gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
70
+ gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
71
+ gcp_service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
72
+ gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
73
+ gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
74
+ gemini_cli_version: '${{ vars.GEMINI_CLI_VERSION }}'
75
+ gemini_debug: '${{ fromJSON(vars.GEMINI_DEBUG || vars.ACTIONS_STEP_DEBUG || false) }}'
76
+ gemini_model: '${{ vars.GEMINI_MODEL }}'
77
+ google_api_key: '${{ secrets.GOOGLE_API_KEY }}'
78
+ use_gemini_code_assist: '${{ vars.GOOGLE_GENAI_USE_GCA }}'
79
+ use_vertex_ai: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
80
+ upload_artifacts: '${{ vars.UPLOAD_ARTIFACTS }}'
81
+ workflow_name: 'gemini-triage'
82
+ # Explicitly set the issue number to handle `issue_comment` triggers where the context might be ambiguous
83
+ github_issue_number: '${{ github.event.issue.number }}'
84
+ settings: |-
85
+ {
86
+ "model": {
87
+ "maxSessionTurns": 25
88
+ },
89
+ "telemetry": {
90
+ "enabled": true,
91
+ "target": "local",
92
+ "outfile": ".gemini/telemetry.log"
93
+ },
94
+ "tools": {
95
+ "core": [
96
+ "run_shell_command(echo)"
97
+ ]
98
+ }
99
+ }
100
+ prompt: '/gemini-triage'
101
+
102
+ label:
103
+ runs-on: 'ubuntu-latest'
104
+ needs:
105
+ - 'triage'
106
+ if: |-
107
+ ${{ needs.triage.outputs.selected_labels != '' }}
108
+ permissions:
109
+ contents: 'read'
110
+ issues: 'write'
111
+ pull-requests: 'write'
112
+ steps:
113
+ - name: 'Mint identity token'
114
+ id: 'mint_identity_token'
115
+ if: |-
116
+ ${{ vars.APP_ID }}
117
+ uses: 'actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf' # ratchet:actions/create-github-app-token@v2
118
+ with:
119
+ app-id: '${{ vars.APP_ID }}'
120
+ private-key: '${{ secrets.APP_PRIVATE_KEY }}'
121
+ permission-contents: 'read'
122
+ permission-issues: 'write'
123
+ permission-pull-requests: 'write'
124
+
125
+ - name: 'Apply labels'
126
+ env:
127
+ ISSUE_NUMBER: '${{ github.event.issue.number }}'
128
+ AVAILABLE_LABELS: '${{ needs.triage.outputs.available_labels }}'
129
+ SELECTED_LABELS: '${{ needs.triage.outputs.selected_labels }}'
130
+ uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # ratchet:actions/github-script@v8.0.0
131
+ with:
132
+ # Use the provided token so that the "gemini-cli" is the actor in the
133
+ # log for what changed the labels.
134
+ github-token: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
135
+ script: |-
136
+ // Parse the available labels
137
+ const availableLabels = (process.env.AVAILABLE_LABELS || '').split(',')
138
+ .map((label) => label.trim())
139
+ .sort()
140
+
141
+ // Parse the label as a CSV, reject invalid ones - we do this just
142
+ // in case someone was able to prompt inject malicious labels.
143
+ const selectedLabels = (process.env.SELECTED_LABELS || '').split(',')
144
+ .map((label) => label.trim())
145
+ .filter((label) => availableLabels.includes(label))
146
+ .sort()
147
+
148
+ // Set the labels
149
+ const issueNumber = process.env.ISSUE_NUMBER;
150
+ if (selectedLabels && selectedLabels.length > 0) {
151
+ await github.rest.issues.setLabels({
152
+ owner: context.repo.owner,
153
+ repo: context.repo.repo,
154
+ issue_number: issueNumber,
155
+ labels: selectedLabels,
156
+ });
157
+ core.info(`Successfully set labels: ${selectedLabels.join(',')}`);
158
+ } else {
159
+ core.info(`Failed to determine labels to set. There may not be enough information in the issue or pull request.`)
160
+ }
@@ -0,0 +1,220 @@
1
+ name: '🔀 Gemini Dispatch'
2
+
3
+ on:
4
+ pull_request_review_comment:
5
+ types:
6
+ - 'created'
7
+ pull_request_review:
8
+ types:
9
+ - 'submitted'
10
+ pull_request_target:
11
+ types:
12
+ - 'opened'
13
+ issues:
14
+ types:
15
+ - 'opened'
16
+ - 'reopened'
17
+ issue_comment:
18
+ types:
19
+ - 'created'
20
+
21
+ defaults:
22
+ run:
23
+ shell: 'bash'
24
+
25
+ jobs:
26
+ debugger:
27
+ if: |-
28
+ ${{ fromJSON(vars.GEMINI_DEBUG || vars.ACTIONS_STEP_DEBUG || false) }}
29
+ runs-on: 'ubuntu-latest'
30
+ permissions:
31
+ contents: 'read'
32
+ steps:
33
+ - name: 'Print context for debugging'
34
+ env:
35
+ DEBUG_event_name: '${{ github.event_name }}'
36
+ DEBUG_event__action: '${{ github.event.action }}'
37
+ DEBUG_event__comment__author_association: '${{ github.event.comment.author_association }}'
38
+ DEBUG_event__issue__author_association: '${{ github.event.issue.author_association }}'
39
+ DEBUG_event__pull_request__author_association: '${{ github.event.pull_request.author_association }}'
40
+ DEBUG_event__review__author_association: '${{ github.event.review.author_association }}'
41
+ DEBUG_event: '${{ toJSON(github.event) }}'
42
+ run: |-
43
+ env | grep '^DEBUG_'
44
+
45
+ dispatch:
46
+ # For PRs: only if not from a fork
47
+ # For issues: only on open/reopen
48
+ # For comments: only if user types @gemini-cli and is OWNER/MEMBER/COLLABORATOR
49
+ if: |-
50
+ (
51
+ github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
52
+ ) || (
53
+ github.event_name == 'issues' &&
54
+ contains(fromJSON('["opened", "reopened"]'), github.event.action)
55
+ ) || (
56
+ github.event.sender.type == 'User' &&
57
+ startsWith(github.event.comment.body || github.event.review.body || github.event.issue.body, '@gemini-cli') &&
58
+ contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association || github.event.review.author_association || github.event.issue.author_association)
59
+ )
60
+ runs-on: 'ubuntu-latest'
61
+ permissions:
62
+ contents: 'read'
63
+ issues: 'write'
64
+ pull-requests: 'write'
65
+ outputs:
66
+ command: '${{ steps.extract_command.outputs.command }}'
67
+ request: '${{ steps.extract_command.outputs.request }}'
68
+ additional_context: '${{ steps.extract_command.outputs.additional_context }}'
69
+ issue_number: '${{ github.event.pull_request.number || github.event.issue.number }}'
70
+ steps:
71
+ - name: 'Mint identity token'
72
+ id: 'mint_identity_token'
73
+ if: |-
74
+ ${{ vars.APP_ID }}
75
+ uses: 'actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf' # ratchet:actions/create-github-app-token@v2
76
+ with:
77
+ app-id: '${{ vars.APP_ID }}'
78
+ private-key: '${{ secrets.APP_PRIVATE_KEY }}'
79
+ permission-contents: 'read'
80
+ permission-issues: 'write'
81
+ permission-pull-requests: 'write'
82
+
83
+ - name: 'Extract command'
84
+ id: 'extract_command'
85
+ uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
86
+ env:
87
+ EVENT_TYPE: '${{ github.event_name }}.${{ github.event.action }}'
88
+ REQUEST: '${{ github.event.comment.body || github.event.review.body || github.event.issue.body }}'
89
+ with:
90
+ script: |
91
+ const eventType = process.env.EVENT_TYPE;
92
+ const request = process.env.REQUEST;
93
+ core.setOutput('request', request);
94
+
95
+ if (eventType === 'pull_request.opened' || eventType === 'pull_request_target.opened') {
96
+ core.setOutput('command', 'review');
97
+ } else if (['issues.opened', 'issues.reopened'].includes(eventType)) {
98
+ core.setOutput('command', 'triage');
99
+ } else if (request.startsWith("@gemini-cli /review")) {
100
+ core.setOutput('command', 'review');
101
+ const additionalContext = request.replace(/^@gemini-cli \/review/, '').trim();
102
+ core.setOutput('additional_context', additionalContext);
103
+ } else if (request.startsWith("@gemini-cli /triage")) {
104
+ core.setOutput('command', 'triage');
105
+ } else if (request.startsWith("@gemini-cli /approve")) {
106
+ core.setOutput('command', 'approve');
107
+ } else if (request.startsWith("@gemini-cli")) {
108
+ const additionalContext = request.replace(/^@gemini-cli/, '').trim();
109
+ core.setOutput('command', 'invoke');
110
+ core.setOutput('additional_context', additionalContext);
111
+ } else {
112
+ core.setOutput('command', 'fallthrough');
113
+ }
114
+
115
+ - name: 'Acknowledge request'
116
+ env:
117
+ GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
118
+ ISSUE_NUMBER: '${{ github.event.pull_request.number || github.event.issue.number }}'
119
+ MESSAGE: |-
120
+ 🤖 Hi @${{ github.actor }}, I've received your request, and I'm working on it now! You can track my progress [in the logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details.
121
+ REPOSITORY: '${{ github.repository }}'
122
+ run: |-
123
+ gh issue comment "${ISSUE_NUMBER}" \
124
+ --body "${MESSAGE}" \
125
+ --repo "${REPOSITORY}"
126
+
127
+ review:
128
+ needs: 'dispatch'
129
+ if: |-
130
+ ${{ needs.dispatch.outputs.command == 'review' }}
131
+ uses: './.github/workflows/gemini-review.yml'
132
+ permissions:
133
+ contents: 'read'
134
+ id-token: 'write'
135
+ issues: 'write'
136
+ pull-requests: 'write'
137
+ with:
138
+ additional_context: '${{ needs.dispatch.outputs.additional_context }}'
139
+ secrets: 'inherit'
140
+
141
+ triage:
142
+ needs: 'dispatch'
143
+ if: |-
144
+ ${{ needs.dispatch.outputs.command == 'triage' }}
145
+ uses: './.github/workflows/gemini-triage.yml'
146
+ permissions:
147
+ contents: 'read'
148
+ id-token: 'write'
149
+ issues: 'write'
150
+ pull-requests: 'write'
151
+ with:
152
+ additional_context: '${{ needs.dispatch.outputs.additional_context }}'
153
+ secrets: 'inherit'
154
+
155
+ invoke:
156
+ needs: 'dispatch'
157
+ if: |-
158
+ ${{ needs.dispatch.outputs.command == 'invoke' }}
159
+ uses: './.github/workflows/gemini-invoke.yml'
160
+ permissions:
161
+ contents: 'read'
162
+ id-token: 'write'
163
+ issues: 'write'
164
+ pull-requests: 'write'
165
+ with:
166
+ additional_context: '${{ needs.dispatch.outputs.additional_context }}'
167
+ secrets: 'inherit'
168
+
169
+ plan-execute:
170
+ needs: 'dispatch'
171
+ if: |-
172
+ ${{ needs.dispatch.outputs.command == 'approve' }}
173
+ uses: './.github/workflows/gemini-plan-execute.yml'
174
+ permissions:
175
+ contents: 'write'
176
+ id-token: 'write'
177
+ issues: 'write'
178
+ pull-requests: 'write'
179
+ with:
180
+ additional_context: '${{ needs.dispatch.outputs.additional_context }}'
181
+ secrets: 'inherit'
182
+
183
+ fallthrough:
184
+ needs:
185
+ - 'dispatch'
186
+ - 'review'
187
+ - 'triage'
188
+ - 'invoke'
189
+ - 'plan-execute'
190
+ if: |-
191
+ ${{ always() && !cancelled() && (failure() || needs.dispatch.outputs.command == 'fallthrough') }}
192
+ runs-on: 'ubuntu-latest'
193
+ permissions:
194
+ contents: 'read'
195
+ issues: 'write'
196
+ pull-requests: 'write'
197
+ steps:
198
+ - name: 'Mint identity token'
199
+ id: 'mint_identity_token'
200
+ if: |-
201
+ ${{ vars.APP_ID }}
202
+ uses: 'actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf' # ratchet:actions/create-github-app-token@v2
203
+ with:
204
+ app-id: '${{ vars.APP_ID }}'
205
+ private-key: '${{ secrets.APP_PRIVATE_KEY }}'
206
+ permission-contents: 'read'
207
+ permission-issues: 'write'
208
+ permission-pull-requests: 'write'
209
+
210
+ - name: 'Send failure comment'
211
+ env:
212
+ GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
213
+ ISSUE_NUMBER: '${{ github.event.pull_request.number || github.event.issue.number }}'
214
+ MESSAGE: |-
215
+ 🤖 I'm sorry @${{ github.actor }}, but I was unable to process your request. Please [see the logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details.
216
+ REPOSITORY: '${{ github.repository }}'
217
+ run: |-
218
+ gh issue comment "${ISSUE_NUMBER}" \
219
+ --body "${MESSAGE}" \
220
+ --repo "${REPOSITORY}"
@@ -0,0 +1,10 @@
1
+ {
2
+ "name": "Gemini Agentic Assistant",
3
+ "description": "Comprehensive Gemini-powered automation system with dispatching for review, triage, and interactive tasks.",
4
+ "category": "support-intelligence",
5
+ "provider": "google-gemini",
6
+ "source": "https://github.com/google-github-actions/run-gemini-cli/tree/main/examples/workflows",
7
+ "defense_level": "baseline",
8
+ "labels": ["gemini", "assistant", "baseline", "interactive"],
9
+ "supported_events": ["pull_request_target", "pull_request", "issues", "issue_comment", "pull_request_review", "pull_request_review_comment"]
10
+ }
@@ -0,0 +1,118 @@
1
+ # Awesome Workflows
2
+
3
+ Welcome to our collection of awesome community-contributed workflows! This page showcases creative and powerful implementations of the [Google Gemini CLI GitHub Action](https://github.com/google-github-actions/run-gemini-cli) created by the community.
4
+
5
+ **Want to add your workflow?** Check out the [submission guidelines](./README.md#share-your-workflow) in our main README.
6
+
7
+ > **⚠️ Security Notice**: Always review and understand any workflow before using it in your repository. Community-contributed workflows are provided as-is and have not been security audited. Verify the code, permissions, and any external dependencies before implementation.
8
+
9
+ - [Awesome Workflows](#awesome-workflows)
10
+ - [Workflow Categories](#workflow-categories)
11
+ - [🔍 Code Quality](#-code-quality)
12
+ - [📋 Project Management](#-project-management)
13
+ - [Enforce Contribution Guidelines in Pull Requests](#enforce-contribution-guidelines-in-pull-requests)
14
+ - [📝 Documentation](#-documentation)
15
+ - [🛡️ Security](#️-security)
16
+ - [🧪 Testing](#-testing)
17
+ - [🚀 Deployment \& Release](#-deployment--release)
18
+ - [Generate Release Notes](#generate-release-notes)
19
+ - [🎯 Specialized Use Cases](#-specialized-use-cases)
20
+ - [Featured Workflows](#featured-workflows)
21
+
22
+ ## Workflow Categories
23
+
24
+ Browse workflows by category to find exactly what you're looking for.
25
+
26
+ ### 🔍 Code Quality
27
+
28
+ Workflows that help maintain code quality, perform analysis, or enforce standards.
29
+
30
+ _No workflows yet. Be the first to contribute!_
31
+
32
+ ### 📋 Project Management
33
+
34
+ Workflows that help manage GitHub issues, projects, or team collaboration.
35
+
36
+ #### Enforce Contribution Guidelines in Pull Requests
37
+
38
+ **Repository:** [jasmeetsb/gemini-github-actions](https://github.com/jasmeetsb/gemini-github-actions)
39
+
40
+ **Description:** Automates validation of pull requests against your repository's CONTRIBUTING.md using the Google Gemini CLI. The workflow posts a single upserted PR comment indicating PASS/FAIL with a concise checklist of actionable items, and can optionally fail the job to enforce compliance.
41
+
42
+ **Key Features:**
43
+
44
+ - Reads and evaluates PR title, body, and diff against CONTRIBUTING.md
45
+ - Posts a single PR comment with a visible PASS/FAIL marker in Comment Title and details of compliance status in the comment body
46
+ - Optional enforcement: fail the workflow when violations are detected
47
+
48
+ **Setup Requirements:**
49
+
50
+ - Copy [.github/workflows/pr-contribution-guidelines-enforcement.yml](https://github.com/jasmeetsb/gemini-github-actions/blob/main/.github/workflows/pr-contribution-guidelines-enforcement.yml) to your .github/workflows/ folder.
51
+ - File: `CONTRIBUTING.md` at the repository root
52
+ - (Optional) Repository variable `FAIL_ON_GUIDELINE_VIOLATIONS=true` to fail the workflow on violations
53
+
54
+ **Example Usage:**
55
+
56
+ - Define contribution guidelines in CONTRIBUTING.md file
57
+ - Open a new PR or update an existing PR, which would then trigger the workflow
58
+ - Workflow will validate the PR against the contribution guidelines and add a comment in the PR with PASS/FAIL status and details of guideline compliance and non-compliance
59
+
60
+ **OR**
61
+
62
+ - Add following comment in an existing PR **"/validate-contribution"** to trigger the workflow
63
+
64
+ **Workflow File:**
65
+
66
+ - Example location in this repo: [.github/workflows/pr-contribution-guidelines-enforcement.yml](https://github.com/jasmeetsb/gemini-github-actions/blob/main/.github/workflows/pr-contribution-guidelines-enforcement.yml)
67
+ - Typical usage in a consumer repo: `.github/workflows/pr-contribution-guidelines-enforcement.yml` (copy the file and adjust settings/secrets as needed)
68
+
69
+ ### 📝 Documentation
70
+
71
+ Workflows that generate, update, or maintain documentation automatically.
72
+
73
+ _No workflows yet. Be the first to contribute!_
74
+
75
+ ### 🛡️ Security
76
+
77
+ Workflows focused on security analysis, vulnerability detection, or compliance.
78
+
79
+ _No workflows yet. Be the first to contribute!_
80
+
81
+ ### 🧪 Testing
82
+
83
+ Workflows that enhance testing processes, generate test cases, or analyze test results.
84
+
85
+ _No workflows yet. Be the first to contribute!_
86
+
87
+ ### 🚀 Deployment & Release
88
+
89
+ Workflows that handle deployment, release management, or publishing tasks.
90
+
91
+ #### Generate Release Notes
92
+
93
+ **Repository:** [conforma/policy](https://github.com/conforma/policy)
94
+
95
+ Make release notes based on all notable changes since a given tag.
96
+ It categorizes the release notes nicely with emojis, output as Markdown.
97
+
98
+ **Key Features:**
99
+
100
+ - Categorize changes in release notes
101
+ - Include relevant links in release notes
102
+ - Add fun emojis in release notes
103
+
104
+ **Workflow File:** [View on GitHub](https://github.com/conforma/policy/blob/bba371ad8f0fff7eea2ce7a50539cde658645a56/.github/workflows/release.yaml#L93-L114)
105
+
106
+ ### 🎯 Specialized Use Cases
107
+
108
+ Unique or domain-specific workflows that showcase creative uses of Gemini CLI.
109
+
110
+ _No workflows yet. Be the first to contribute!_
111
+
112
+ ## Featured Workflows
113
+
114
+ _Coming soon!_ This section will highlight particularly innovative or popular community workflows.
115
+
116
+ ---
117
+
118
+ _Want to see your workflow featured here? Check out our [submission guidelines](./README.md#share-your-workflow)!_
@@ -0,0 +1,162 @@
1
+ # Configuring Gemini CLI Workflows
2
+
3
+ This guide covers how to customize and configure Gemini CLI workflows to meet your specific needs.
4
+
5
+ - [Configuring Gemini CLI Workflows](#configuring-gemini-cli-workflows)
6
+ - [How to Configure Gemini CLI](#how-to-configure-gemini-cli)
7
+ - [Custom Commands (TOML Files)](#custom-commands-toml-files)
8
+ - [Key Settings](#key-settings)
9
+ - [Conversation Length (`model.maxSessionTurns`)](#conversation-length-modelmaxsessionturns)
10
+ - [Allowlist Tools (`tools.core`)](#allowlist-tools-toolscore)
11
+ - [MCP Servers (`mcpServers`)](#mcp-servers-mcpservers)
12
+ - [Custom Context and Guidance (`GEMINI.md`)](#custom-context-and-guidance-geminimd)
13
+ - [GitHub Actions Workflow Settings](#github-actions-workflow-settings)
14
+ - [Setting Timeouts](#setting-timeouts)
15
+ - [Required Permissions](#required-permissions)
16
+
17
+ ## How to Configure Gemini CLI
18
+
19
+ Gemini CLI workflows are highly configurable. You can adjust their behavior by editing the corresponding `.yml` files in your repository.
20
+
21
+ Gemini CLI supports many settings that control how it operates. For a complete list, see the [Gemini CLI documentation](https://github.com/google-gemini/gemini-cli/blob/main/docs/get-started/configuration.md#available-settings-in-settingsjson).
22
+
23
+ ### Custom Commands (TOML Files)
24
+
25
+ The example workflows use custom commands defined in TOML files to provide specialized prompts for different tasks. These TOML files are automatically installed from the action's `.github/commands/` directory to `.gemini/commands/` when the workflow runs.
26
+
27
+ **Available custom commands:**
28
+
29
+ - `/gemini-invoke` - General-purpose AI assistant for code changes and analysis
30
+ - `/gemini-review` - Pull request code review
31
+ - `/gemini-triage` - Single issue triage
32
+ - `/gemini-scheduled-triage` - Batch issue triage
33
+
34
+ **How it works:**
35
+
36
+ 1. The action copies TOML files from `.github/commands/` to `.gemini/commands/` during workflow execution
37
+ 2. Workflows reference these commands using the `prompt` input (e.g., `prompt: '/gemini-invoke'`)
38
+ 3. The Gemini CLI loads the command's prompt from the TOML file
39
+
40
+ **Customizing commands:**
41
+
42
+ To customize the prompts for your repository:
43
+
44
+ 1. Copy the TOML file(s) from `examples/workflows/<workflow-name>` to your repository's `.gemini/commands/` directory
45
+ 2. Modify the `prompt` field in the TOML file to match your needs
46
+ 3. Commit the TOML files to your repository
47
+
48
+ For example, to customize the PR review prompt:
49
+
50
+ ```bash
51
+ mkdir -p .gemini/commands
52
+ cp examples/workflows/pr-review/gemini-review.toml .gemini/commands/
53
+ # Edit .gemini/commands/gemini-review.toml as needed
54
+ git add .gemini/commands/gemini-review.toml
55
+ git commit -m "feat: customize PR review prompt"
56
+ ```
57
+
58
+ The workflow will use your custom TOML file instead of the default one from the action.
59
+
60
+ ### Key Settings
61
+
62
+ #### Conversation Length (`model.maxSessionTurns`)
63
+
64
+ This setting controls the maximum number of conversational turns (messages exchanged) allowed during a workflow run.
65
+
66
+ **Default values by workflow:**
67
+
68
+ | Workflow | Default `model.maxSessionTurns` |
69
+ | ------------------------------------ | ------------------------------- |
70
+ | [Issue Triage](./issue-triage) | 25 |
71
+ | [Pull Request Review](./pr-review) | 20 |
72
+ | [Gemini CLI Assistant](./gemini-cli) | 50 |
73
+
74
+ **How to override:**
75
+
76
+ Add the following to your workflow YAML file to set a custom value:
77
+
78
+ ```yaml
79
+ with:
80
+ settings: |-
81
+ {
82
+ "model": {
83
+ "maxSessionTurns": 10
84
+ }
85
+ }
86
+ ```
87
+
88
+ #### Allowlist Tools (`tools.core`)
89
+
90
+ Allows you to specify a list of [built-in tools] that should be made available to the model. You can also use this to allowlist commands for shell tool.
91
+
92
+ **Default:** All tools available for use by Gemini CLI.
93
+
94
+ **How to configure:**
95
+
96
+ Add the following to your workflow YAML file to specify core tools:
97
+
98
+ ```yaml
99
+ with:
100
+ settings: |-
101
+ {
102
+ "tools": {
103
+ "core": [
104
+ "list_directory",
105
+ "read_file",
106
+ "grep_search",
107
+ "run_shell_command(echo)"
108
+ ]
109
+ }
110
+ }
111
+ ```
112
+
113
+ #### MCP Servers (`mcpServers`)
114
+
115
+ Configures connections to one or more Model Context Protocol (MCP) servers for discovering and using custom tools. This allows you to extend Gemini CLI GitHub Action with additional capabilities.
116
+
117
+ **Default:** Empty
118
+
119
+ **Example:**
120
+
121
+ ```yaml
122
+ with:
123
+ settings: |-
124
+ {
125
+ "mcpServers": {
126
+ "github": {
127
+ "command": "docker",
128
+ "args": [
129
+ "run",
130
+ "-i",
131
+ "--rm",
132
+ "-e",
133
+ "GITHUB_PERSONAL_ACCESS_TOKEN",
134
+ "ghcr.io/github/github-mcp-server"
135
+ ],
136
+ "env": {
137
+ "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
138
+ }
139
+ }
140
+ }
141
+ }
142
+ ```
143
+
144
+ ### Custom Context and Guidance (`GEMINI.md`)
145
+
146
+ To provide Gemini CLI with custom instructions—such as coding conventions, architectural patterns, or other guidance—add a `GEMINI.md` file to the root of your repository. Gemini CLI will use the content of this file to inform its responses.
147
+
148
+ ## GitHub Actions Workflow Settings
149
+
150
+ ### Setting Timeouts
151
+
152
+ You can control how long Gemini CLI runs by using either the `timeout-minutes` field in your workflow YAML, or by specifying a timeout in the `settings` input.
153
+
154
+ ### Required Permissions
155
+
156
+ Only users with the following roles can trigger the workflow:
157
+
158
+ - Repository Owner (`OWNER`)
159
+ - Repository Member (`MEMBER`)
160
+ - Repository Collaborator (`COLLABORATOR`)
161
+
162
+ [built-in tools]: https://github.com/google-gemini/gemini-cli/blob/main/docs/core/tools-api.md#built-in-tools