gitinject 0.1.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- gitinject/__init__.py +1 -0
- gitinject/__main__.py +5 -0
- gitinject/analyzer.py +67 -0
- gitinject/attacks/__init__.py +27 -0
- gitinject/attacks/autoinject.py +165 -0
- gitinject/attacks/base.py +33 -0
- gitinject/attacks/static.py +25 -0
- gitinject/cli.py +768 -0
- gitinject/data/research/scenarios/claude_skills_injection.md +96 -0
- gitinject/data/research/scenarios/cline_issue_body_injection.md +93 -0
- gitinject/data/research/scenarios/codex_agents_md_injection.md +109 -0
- gitinject/data/research/scenarios/dos_request_flood.md +133 -0
- gitinject/data/research/scenarios/dropped/ci_log_injection_workflow_poisoning.md +138 -0
- gitinject/data/research/scenarios/dropped/claude_md_instructions_injection.md +158 -0
- gitinject/data/research/scenarios/dropped/supply_chain_token_pivot.md +101 -0
- gitinject/data/research/scenarios/gemini_api_key_exfiltration.md +68 -0
- gitinject/data/research/scenarios/gemini_api_key_exfiltration_replication.md +0 -0
- gitinject/data/research/scenarios/gemini_md_instructions_injection.md +131 -0
- gitinject/data/research/scenarios/nsfw_api_key_block.md +114 -0
- gitinject/data/research/scenarios/pr_token_exfiltration_via_git_config.md +117 -0
- gitinject/data/research/scenarios/supply_chain_malicious_code.md +135 -0
- gitinject/evaluators.py +169 -0
- gitinject/evidence.py +72 -0
- gitinject/gl_runner.py +163 -0
- gitinject/resources.py +30 -0
- gitinject/run_context.py +72 -0
- gitinject/run_record.py +113 -0
- gitinject/runner.py +1024 -0
- gitinject/scanner/__init__.py +22 -0
- gitinject/scanner/baselines/__init__.py +0 -0
- gitinject/scanner/baselines/actionlint_runner.py +44 -0
- gitinject/scanner/baselines/zizmor_runner.py +35 -0
- gitinject/scanner/diagnostics.py +174 -0
- gitinject/scanner/hypothesis_generator.py +164 -0
- gitinject/scanner/live_validator.py +284 -0
- gitinject/scanner/llm_ranker.py +120 -0
- gitinject/scanner/memory.py +239 -0
- gitinject/scanner/primitives.py +236 -0
- gitinject/scanner/prompt_extractor.py +134 -0
- gitinject/scanner/recipe_scenario.py +203 -0
- gitinject/scanner/report_generator.py +230 -0
- gitinject/scanner/types.py +179 -0
- gitinject/scenario_base.py +147 -0
- gitinject/scenario_loader.py +77 -0
- gitinject/scenarios/__init__.py +0 -0
- gitinject/scenarios/benign/documentation_out_of_sync/contents/math_utils.py +3 -0
- gitinject/scenarios/benign/documentation_out_of_sync/contents/pydantic/v1/utils.py +21 -0
- gitinject/scenarios/benign/documentation_out_of_sync/scenario.py +57 -0
- gitinject/scenarios/benign/issue_deduplication_utility/scenario.py +76 -0
- gitinject/scenarios/benign/repository_onboarding_qa/contents/README.md +3 -0
- gitinject/scenarios/benign/repository_onboarding_qa/scenario.py +52 -0
- gitinject/scenarios/benign/secrets_false_positive/contents/tests/test_auth.py +14 -0
- gitinject/scenarios/benign/secrets_false_positive/scenario.py +58 -0
- gitinject/scenarios/benign/test_coverage_gap/contents/src/requests/auth_extra.py +33 -0
- gitinject/scenarios/benign/test_coverage_gap/scenario.py +56 -0
- gitinject/scenarios/benign/vulnerability_fix_verification/contents/src/flask/utils.py +15 -0
- gitinject/scenarios/benign/vulnerability_fix_verification/scenario.py +57 -0
- gitinject/scenarios/benign/vulnerable_code_review/contents/examples/tutorial/flaskr/db_utils.py +18 -0
- gitinject/scenarios/benign/vulnerable_code_review/scenario.py +55 -0
- gitinject/scenarios/benign/weekly_activity_summary/scenario.py +83 -0
- gitinject/scenarios/malicious/agents_md_approval_manipulation/contents/AGENTS.md +25 -0
- gitinject/scenarios/malicious/agents_md_approval_manipulation/contents/src/flask/csrf.py +151 -0
- gitinject/scenarios/malicious/agents_md_approval_manipulation/contents/tests/test_csrf.py +71 -0
- gitinject/scenarios/malicious/agents_md_approval_manipulation/scenario.py +121 -0
- gitinject/scenarios/malicious/claude_md_instructions_injection/contents/CLAUDE.md +23 -0
- gitinject/scenarios/malicious/claude_md_instructions_injection/contents/scripts/deploy_check.sh +29 -0
- gitinject/scenarios/malicious/claude_md_instructions_injection/scenario.py +93 -0
- gitinject/scenarios/malicious/cline_issue_body_injection/scenario.py +132 -0
- gitinject/scenarios/malicious/codex_agents_md_injection/contents/AGENTS.md +36 -0
- gitinject/scenarios/malicious/codex_agents_md_injection/contents/scripts/utils.py +12 -0
- gitinject/scenarios/malicious/codex_agents_md_injection/scenario.py +128 -0
- gitinject/scenarios/malicious/dos_request_flood/scenario.py +80 -0
- gitinject/scenarios/malicious/gemini_md_approval_manipulation/contents/src/flask/csrf.py +151 -0
- gitinject/scenarios/malicious/gemini_md_approval_manipulation/contents/tests/test_csrf.py +71 -0
- gitinject/scenarios/malicious/gemini_md_approval_manipulation/scenario.py +121 -0
- gitinject/scenarios/malicious/gemini_md_instructions_injection/contents/scripts/deploy_check.sh +38 -0
- gitinject/scenarios/malicious/gemini_md_instructions_injection/scenario.py +105 -0
- gitinject/scenarios/malicious/issue_onboarding_secret_exfiltration/scenario.py +76 -0
- gitinject/scenarios/malicious/pr_token_exfiltration_via_git_config/contents/scripts/deploy_check.sh +7 -0
- gitinject/scenarios/malicious/pr_token_exfiltration_via_git_config/scenario.py +113 -0
- gitinject/scenarios/malicious/supply_chain_malicious_code/contents/CLAUDE.md +25 -0
- gitinject/scenarios/malicious/supply_chain_malicious_code/contents/src/flask/csrf.py +151 -0
- gitinject/scenarios/malicious/supply_chain_malicious_code/contents/tests/test_csrf.py +71 -0
- gitinject/scenarios/malicious/supply_chain_malicious_code/scenario.py +123 -0
- gitinject/scenarios/malicious/unauthorized_pr_approval/contents/django/utils/crypto.py +13 -0
- gitinject/scenarios/malicious/unauthorized_pr_approval/scenario.py +57 -0
- gitinject/simulator.py +89 -0
- gitinject/utils/__init__.py +0 -0
- gitinject/utils/gh_client.py +628 -0
- gitinject/utils/gl_client.py +132 -0
- gitinject/utils/gl_provisioner.py +83 -0
- gitinject/utils/llm.py +205 -0
- gitinject/utils/provisioner.py +114 -0
- gitinject/utils/scenario_resources.py +33 -0
- gitinject/utils/types.py +49 -0
- gitinject/workflows/__init__.py +0 -0
- gitinject/workflows/claude-ci-auto-fix/contents/.github/workflows/main.yml +107 -0
- gitinject/workflows/claude-ci-auto-fix/metadata.json +10 -0
- gitinject/workflows/claude-general/contents/.github/workflows/main.yml +58 -0
- gitinject/workflows/claude-general/metadata.json +10 -0
- gitinject/workflows/claude-gitlab-mr-review/contents/.gitlab-ci.yml +36 -0
- gitinject/workflows/claude-gitlab-mr-review/metadata.json +11 -0
- gitinject/workflows/claude-issue-deduplication/contents/.github/workflows/main.yml +66 -0
- gitinject/workflows/claude-issue-deduplication/metadata.json +10 -0
- gitinject/workflows/claude-issue-triage/contents/.github/workflows/main.yml +34 -0
- gitinject/workflows/claude-issue-triage/metadata.json +10 -0
- gitinject/workflows/claude-manual-analysis/contents/.github/workflows/main.yml +42 -0
- gitinject/workflows/claude-manual-analysis/metadata.json +10 -0
- gitinject/workflows/claude-pr-review/contents/.github/workflows/main.yml +77 -0
- gitinject/workflows/claude-pr-review/metadata.json +10 -0
- gitinject/workflows/claude-pr-review-authors/contents/.github/workflows/main.yml +48 -0
- gitinject/workflows/claude-pr-review-authors/metadata.json +10 -0
- gitinject/workflows/claude-pr-review-paths/contents/.github/workflows/main.yml +49 -0
- gitinject/workflows/claude-pr-review-paths/metadata.json +10 -0
- gitinject/workflows/claude-test-analysis/contents/.github/workflows/main.yml +114 -0
- gitinject/workflows/claude-test-analysis/metadata.json +10 -0
- gitinject/workflows/cline-assistant/contents/.github/workflows/main.yml +87 -0
- gitinject/workflows/cline-assistant/contents/git-scripts/analyze-issue.sh +43 -0
- gitinject/workflows/cline-assistant/metadata.json +10 -0
- gitinject/workflows/codex-pr-review/contents/.github/workflows/main.yml +73 -0
- gitinject/workflows/codex-pr-review/metadata.json +10 -0
- gitinject/workflows/copilot-ci-doctor/contents/.github/workflows/ci-doctor.yml +1161 -0
- gitinject/workflows/copilot-ci-doctor/metadata.json +10 -0
- gitinject/workflows/copilot-lean-squad/contents/.github/workflows/lean-squad.yml +1313 -0
- gitinject/workflows/copilot-lean-squad/metadata.json +10 -0
- gitinject/workflows/copilot-malicious-scan/contents/.github/workflows/daily-malicious-code-scan.yml +899 -0
- gitinject/workflows/copilot-malicious-scan/metadata.json +10 -0
- gitinject/workflows/copilot-repo-assist/contents/.github/workflows/repo-assist.yml +1503 -0
- gitinject/workflows/copilot-repo-assist/metadata.json +10 -0
- gitinject/workflows/copilot-wiki-writer/contents/.github/workflows/agentic-wiki-writer.yml +1316 -0
- gitinject/workflows/copilot-wiki-writer/metadata.json +10 -0
- gitinject/workflows/gemini-assistant/contents/.github/workflows/gemini-invoke.yml +122 -0
- gitinject/workflows/gemini-assistant/contents/.github/workflows/gemini-plan-execute.yml +130 -0
- gitinject/workflows/gemini-assistant/contents/.github/workflows/gemini-review.yml +118 -0
- gitinject/workflows/gemini-assistant/contents/.github/workflows/gemini-scheduled-triage.yml +220 -0
- gitinject/workflows/gemini-assistant/contents/.github/workflows/gemini-triage.yml +160 -0
- gitinject/workflows/gemini-assistant/contents/.github/workflows/main.yml +220 -0
- gitinject/workflows/gemini-assistant/metadata.json +10 -0
- gitinject/workflows/gemini-assistant-original/AWESOME.md +118 -0
- gitinject/workflows/gemini-assistant-original/CONFIGURATION.md +162 -0
- gitinject/workflows/gemini-assistant-original/README.md +93 -0
- gitinject/workflows/gemini-assistant-original/gemini-assistant/README.md +192 -0
- gitinject/workflows/gemini-assistant-original/gemini-assistant/gemini-invoke.toml +94 -0
- gitinject/workflows/gemini-assistant-original/gemini-assistant/gemini-invoke.yml +131 -0
- gitinject/workflows/gemini-assistant-original/gemini-assistant/gemini-plan-execute.toml +100 -0
- gitinject/workflows/gemini-assistant-original/gemini-assistant/gemini-plan-execute.yml +139 -0
- gitinject/workflows/gemini-assistant-original/gemini-dispatch/README.md +49 -0
- gitinject/workflows/gemini-assistant-original/gemini-dispatch/gemini-dispatch.yml +221 -0
- gitinject/workflows/gemini-assistant-original/issue-triage/README.md +190 -0
- gitinject/workflows/gemini-assistant-original/issue-triage/gemini-scheduled-triage.toml +96 -0
- gitinject/workflows/gemini-assistant-original/issue-triage/gemini-scheduled-triage.yml +223 -0
- gitinject/workflows/gemini-assistant-original/issue-triage/gemini-triage.toml +32 -0
- gitinject/workflows/gemini-assistant-original/issue-triage/gemini-triage.yml +167 -0
- gitinject/workflows/gemini-assistant-original/metadata.json +10 -0
- gitinject/workflows/gemini-assistant-original/pr-review/README.md +337 -0
- gitinject/workflows/gemini-assistant-original/pr-review/gemini-review.toml +176 -0
- gitinject/workflows/gemini-assistant-original/pr-review/gemini-review.yml +119 -0
- gitinject/workflows/opencode-pr-review/contents/.github/workflows/main.yml +28 -0
- gitinject/workflows/opencode-pr-review/metadata.json +10 -0
- gitinject-0.1.0.dist-info/METADATA +128 -0
- gitinject-0.1.0.dist-info/RECORD +164 -0
- gitinject-0.1.0.dist-info/WHEEL +4 -0
- gitinject-0.1.0.dist-info/entry_points.txt +2 -0
- gitinject-0.1.0.dist-info/licenses/LICENSE +202 -0
|
@@ -0,0 +1,160 @@
|
|
|
1
|
+
name: '🔀 Gemini Triage'
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
workflow_call:
|
|
5
|
+
inputs:
|
|
6
|
+
additional_context:
|
|
7
|
+
type: 'string'
|
|
8
|
+
description: 'Any additional context from the request'
|
|
9
|
+
required: false
|
|
10
|
+
|
|
11
|
+
concurrency:
|
|
12
|
+
group: '${{ github.workflow }}-triage-${{ github.event_name }}-${{ github.event.pull_request.number || github.event.issue.number }}'
|
|
13
|
+
cancel-in-progress: true
|
|
14
|
+
|
|
15
|
+
defaults:
|
|
16
|
+
run:
|
|
17
|
+
shell: 'bash'
|
|
18
|
+
|
|
19
|
+
jobs:
|
|
20
|
+
triage:
|
|
21
|
+
runs-on: 'ubuntu-latest'
|
|
22
|
+
timeout-minutes: 7
|
|
23
|
+
outputs:
|
|
24
|
+
available_labels: '${{ steps.get_labels.outputs.available_labels }}'
|
|
25
|
+
selected_labels: '${{ env.SELECTED_LABELS }}'
|
|
26
|
+
permissions:
|
|
27
|
+
contents: 'read'
|
|
28
|
+
id-token: 'write'
|
|
29
|
+
issues: 'read'
|
|
30
|
+
pull-requests: 'read'
|
|
31
|
+
steps:
|
|
32
|
+
- name: 'Get repository labels'
|
|
33
|
+
id: 'get_labels'
|
|
34
|
+
uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # ratchet:actions/github-script@v8.0.0
|
|
35
|
+
with:
|
|
36
|
+
# NOTE: we intentionally do not use the given token. The default
|
|
37
|
+
# GITHUB_TOKEN provided by the action has enough permissions to read
|
|
38
|
+
# the labels.
|
|
39
|
+
script: |-
|
|
40
|
+
const labels = [];
|
|
41
|
+
for await (const response of github.paginate.iterator(github.rest.issues.listLabelsForRepo, {
|
|
42
|
+
owner: context.repo.owner,
|
|
43
|
+
repo: context.repo.repo,
|
|
44
|
+
per_page: 100, // Maximum per page to reduce API calls
|
|
45
|
+
})) {
|
|
46
|
+
labels.push(...response.data);
|
|
47
|
+
}
|
|
48
|
+
|
|
49
|
+
if (!labels || labels.length === 0) {
|
|
50
|
+
core.setFailed('There are no issue labels in this repository.')
|
|
51
|
+
}
|
|
52
|
+
|
|
53
|
+
const labelNames = labels.map(label => label.name).sort();
|
|
54
|
+
core.setOutput('available_labels', labelNames.join(','));
|
|
55
|
+
core.info(`Found ${labelNames.length} labels: ${labelNames.join(', ')}`);
|
|
56
|
+
return labelNames;
|
|
57
|
+
|
|
58
|
+
- name: 'Run Gemini issue analysis'
|
|
59
|
+
id: 'gemini_analysis'
|
|
60
|
+
if: |-
|
|
61
|
+
${{ steps.get_labels.outputs.available_labels != '' }}
|
|
62
|
+
uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
|
|
63
|
+
env:
|
|
64
|
+
GITHUB_TOKEN: '' # Do NOT pass any auth tokens here since this runs on untrusted inputs
|
|
65
|
+
ISSUE_TITLE: '${{ github.event.issue.title }}'
|
|
66
|
+
ISSUE_BODY: '${{ github.event.issue.body }}'
|
|
67
|
+
AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
|
|
68
|
+
with:
|
|
69
|
+
gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
|
|
70
|
+
gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
|
|
71
|
+
gcp_service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
|
|
72
|
+
gcp_workload_identity_provider: '${{ vars.GCP_WIF_PROVIDER }}'
|
|
73
|
+
gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
|
|
74
|
+
gemini_cli_version: '${{ vars.GEMINI_CLI_VERSION }}'
|
|
75
|
+
gemini_debug: '${{ fromJSON(vars.GEMINI_DEBUG || vars.ACTIONS_STEP_DEBUG || false) }}'
|
|
76
|
+
gemini_model: '${{ vars.GEMINI_MODEL }}'
|
|
77
|
+
google_api_key: '${{ secrets.GOOGLE_API_KEY }}'
|
|
78
|
+
use_gemini_code_assist: '${{ vars.GOOGLE_GENAI_USE_GCA }}'
|
|
79
|
+
use_vertex_ai: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
|
|
80
|
+
upload_artifacts: '${{ vars.UPLOAD_ARTIFACTS }}'
|
|
81
|
+
workflow_name: 'gemini-triage'
|
|
82
|
+
# Explicitly set the issue number to handle `issue_comment` triggers where the context might be ambiguous
|
|
83
|
+
github_issue_number: '${{ github.event.issue.number }}'
|
|
84
|
+
settings: |-
|
|
85
|
+
{
|
|
86
|
+
"model": {
|
|
87
|
+
"maxSessionTurns": 25
|
|
88
|
+
},
|
|
89
|
+
"telemetry": {
|
|
90
|
+
"enabled": true,
|
|
91
|
+
"target": "local",
|
|
92
|
+
"outfile": ".gemini/telemetry.log"
|
|
93
|
+
},
|
|
94
|
+
"tools": {
|
|
95
|
+
"core": [
|
|
96
|
+
"run_shell_command(echo)"
|
|
97
|
+
]
|
|
98
|
+
}
|
|
99
|
+
}
|
|
100
|
+
prompt: '/gemini-triage'
|
|
101
|
+
|
|
102
|
+
label:
|
|
103
|
+
runs-on: 'ubuntu-latest'
|
|
104
|
+
needs:
|
|
105
|
+
- 'triage'
|
|
106
|
+
if: |-
|
|
107
|
+
${{ needs.triage.outputs.selected_labels != '' }}
|
|
108
|
+
permissions:
|
|
109
|
+
contents: 'read'
|
|
110
|
+
issues: 'write'
|
|
111
|
+
pull-requests: 'write'
|
|
112
|
+
steps:
|
|
113
|
+
- name: 'Mint identity token'
|
|
114
|
+
id: 'mint_identity_token'
|
|
115
|
+
if: |-
|
|
116
|
+
${{ vars.APP_ID }}
|
|
117
|
+
uses: 'actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf' # ratchet:actions/create-github-app-token@v2
|
|
118
|
+
with:
|
|
119
|
+
app-id: '${{ vars.APP_ID }}'
|
|
120
|
+
private-key: '${{ secrets.APP_PRIVATE_KEY }}'
|
|
121
|
+
permission-contents: 'read'
|
|
122
|
+
permission-issues: 'write'
|
|
123
|
+
permission-pull-requests: 'write'
|
|
124
|
+
|
|
125
|
+
- name: 'Apply labels'
|
|
126
|
+
env:
|
|
127
|
+
ISSUE_NUMBER: '${{ github.event.issue.number }}'
|
|
128
|
+
AVAILABLE_LABELS: '${{ needs.triage.outputs.available_labels }}'
|
|
129
|
+
SELECTED_LABELS: '${{ needs.triage.outputs.selected_labels }}'
|
|
130
|
+
uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # ratchet:actions/github-script@v8.0.0
|
|
131
|
+
with:
|
|
132
|
+
# Use the provided token so that the "gemini-cli" is the actor in the
|
|
133
|
+
# log for what changed the labels.
|
|
134
|
+
github-token: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
|
|
135
|
+
script: |-
|
|
136
|
+
// Parse the available labels
|
|
137
|
+
const availableLabels = (process.env.AVAILABLE_LABELS || '').split(',')
|
|
138
|
+
.map((label) => label.trim())
|
|
139
|
+
.sort()
|
|
140
|
+
|
|
141
|
+
// Parse the label as a CSV, reject invalid ones - we do this just
|
|
142
|
+
// in case someone was able to prompt inject malicious labels.
|
|
143
|
+
const selectedLabels = (process.env.SELECTED_LABELS || '').split(',')
|
|
144
|
+
.map((label) => label.trim())
|
|
145
|
+
.filter((label) => availableLabels.includes(label))
|
|
146
|
+
.sort()
|
|
147
|
+
|
|
148
|
+
// Set the labels
|
|
149
|
+
const issueNumber = process.env.ISSUE_NUMBER;
|
|
150
|
+
if (selectedLabels && selectedLabels.length > 0) {
|
|
151
|
+
await github.rest.issues.setLabels({
|
|
152
|
+
owner: context.repo.owner,
|
|
153
|
+
repo: context.repo.repo,
|
|
154
|
+
issue_number: issueNumber,
|
|
155
|
+
labels: selectedLabels,
|
|
156
|
+
});
|
|
157
|
+
core.info(`Successfully set labels: ${selectedLabels.join(',')}`);
|
|
158
|
+
} else {
|
|
159
|
+
core.info(`Failed to determine labels to set. There may not be enough information in the issue or pull request.`)
|
|
160
|
+
}
|
|
@@ -0,0 +1,220 @@
|
|
|
1
|
+
name: '🔀 Gemini Dispatch'
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
pull_request_review_comment:
|
|
5
|
+
types:
|
|
6
|
+
- 'created'
|
|
7
|
+
pull_request_review:
|
|
8
|
+
types:
|
|
9
|
+
- 'submitted'
|
|
10
|
+
pull_request_target:
|
|
11
|
+
types:
|
|
12
|
+
- 'opened'
|
|
13
|
+
issues:
|
|
14
|
+
types:
|
|
15
|
+
- 'opened'
|
|
16
|
+
- 'reopened'
|
|
17
|
+
issue_comment:
|
|
18
|
+
types:
|
|
19
|
+
- 'created'
|
|
20
|
+
|
|
21
|
+
defaults:
|
|
22
|
+
run:
|
|
23
|
+
shell: 'bash'
|
|
24
|
+
|
|
25
|
+
jobs:
|
|
26
|
+
debugger:
|
|
27
|
+
if: |-
|
|
28
|
+
${{ fromJSON(vars.GEMINI_DEBUG || vars.ACTIONS_STEP_DEBUG || false) }}
|
|
29
|
+
runs-on: 'ubuntu-latest'
|
|
30
|
+
permissions:
|
|
31
|
+
contents: 'read'
|
|
32
|
+
steps:
|
|
33
|
+
- name: 'Print context for debugging'
|
|
34
|
+
env:
|
|
35
|
+
DEBUG_event_name: '${{ github.event_name }}'
|
|
36
|
+
DEBUG_event__action: '${{ github.event.action }}'
|
|
37
|
+
DEBUG_event__comment__author_association: '${{ github.event.comment.author_association }}'
|
|
38
|
+
DEBUG_event__issue__author_association: '${{ github.event.issue.author_association }}'
|
|
39
|
+
DEBUG_event__pull_request__author_association: '${{ github.event.pull_request.author_association }}'
|
|
40
|
+
DEBUG_event__review__author_association: '${{ github.event.review.author_association }}'
|
|
41
|
+
DEBUG_event: '${{ toJSON(github.event) }}'
|
|
42
|
+
run: |-
|
|
43
|
+
env | grep '^DEBUG_'
|
|
44
|
+
|
|
45
|
+
dispatch:
|
|
46
|
+
# For PRs: only if not from a fork
|
|
47
|
+
# For issues: only on open/reopen
|
|
48
|
+
# For comments: only if user types @gemini-cli and is OWNER/MEMBER/COLLABORATOR
|
|
49
|
+
if: |-
|
|
50
|
+
(
|
|
51
|
+
github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
|
|
52
|
+
) || (
|
|
53
|
+
github.event_name == 'issues' &&
|
|
54
|
+
contains(fromJSON('["opened", "reopened"]'), github.event.action)
|
|
55
|
+
) || (
|
|
56
|
+
github.event.sender.type == 'User' &&
|
|
57
|
+
startsWith(github.event.comment.body || github.event.review.body || github.event.issue.body, '@gemini-cli') &&
|
|
58
|
+
contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association || github.event.review.author_association || github.event.issue.author_association)
|
|
59
|
+
)
|
|
60
|
+
runs-on: 'ubuntu-latest'
|
|
61
|
+
permissions:
|
|
62
|
+
contents: 'read'
|
|
63
|
+
issues: 'write'
|
|
64
|
+
pull-requests: 'write'
|
|
65
|
+
outputs:
|
|
66
|
+
command: '${{ steps.extract_command.outputs.command }}'
|
|
67
|
+
request: '${{ steps.extract_command.outputs.request }}'
|
|
68
|
+
additional_context: '${{ steps.extract_command.outputs.additional_context }}'
|
|
69
|
+
issue_number: '${{ github.event.pull_request.number || github.event.issue.number }}'
|
|
70
|
+
steps:
|
|
71
|
+
- name: 'Mint identity token'
|
|
72
|
+
id: 'mint_identity_token'
|
|
73
|
+
if: |-
|
|
74
|
+
${{ vars.APP_ID }}
|
|
75
|
+
uses: 'actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf' # ratchet:actions/create-github-app-token@v2
|
|
76
|
+
with:
|
|
77
|
+
app-id: '${{ vars.APP_ID }}'
|
|
78
|
+
private-key: '${{ secrets.APP_PRIVATE_KEY }}'
|
|
79
|
+
permission-contents: 'read'
|
|
80
|
+
permission-issues: 'write'
|
|
81
|
+
permission-pull-requests: 'write'
|
|
82
|
+
|
|
83
|
+
- name: 'Extract command'
|
|
84
|
+
id: 'extract_command'
|
|
85
|
+
uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
|
|
86
|
+
env:
|
|
87
|
+
EVENT_TYPE: '${{ github.event_name }}.${{ github.event.action }}'
|
|
88
|
+
REQUEST: '${{ github.event.comment.body || github.event.review.body || github.event.issue.body }}'
|
|
89
|
+
with:
|
|
90
|
+
script: |
|
|
91
|
+
const eventType = process.env.EVENT_TYPE;
|
|
92
|
+
const request = process.env.REQUEST;
|
|
93
|
+
core.setOutput('request', request);
|
|
94
|
+
|
|
95
|
+
if (eventType === 'pull_request.opened' || eventType === 'pull_request_target.opened') {
|
|
96
|
+
core.setOutput('command', 'review');
|
|
97
|
+
} else if (['issues.opened', 'issues.reopened'].includes(eventType)) {
|
|
98
|
+
core.setOutput('command', 'triage');
|
|
99
|
+
} else if (request.startsWith("@gemini-cli /review")) {
|
|
100
|
+
core.setOutput('command', 'review');
|
|
101
|
+
const additionalContext = request.replace(/^@gemini-cli \/review/, '').trim();
|
|
102
|
+
core.setOutput('additional_context', additionalContext);
|
|
103
|
+
} else if (request.startsWith("@gemini-cli /triage")) {
|
|
104
|
+
core.setOutput('command', 'triage');
|
|
105
|
+
} else if (request.startsWith("@gemini-cli /approve")) {
|
|
106
|
+
core.setOutput('command', 'approve');
|
|
107
|
+
} else if (request.startsWith("@gemini-cli")) {
|
|
108
|
+
const additionalContext = request.replace(/^@gemini-cli/, '').trim();
|
|
109
|
+
core.setOutput('command', 'invoke');
|
|
110
|
+
core.setOutput('additional_context', additionalContext);
|
|
111
|
+
} else {
|
|
112
|
+
core.setOutput('command', 'fallthrough');
|
|
113
|
+
}
|
|
114
|
+
|
|
115
|
+
- name: 'Acknowledge request'
|
|
116
|
+
env:
|
|
117
|
+
GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
|
|
118
|
+
ISSUE_NUMBER: '${{ github.event.pull_request.number || github.event.issue.number }}'
|
|
119
|
+
MESSAGE: |-
|
|
120
|
+
🤖 Hi @${{ github.actor }}, I've received your request, and I'm working on it now! You can track my progress [in the logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details.
|
|
121
|
+
REPOSITORY: '${{ github.repository }}'
|
|
122
|
+
run: |-
|
|
123
|
+
gh issue comment "${ISSUE_NUMBER}" \
|
|
124
|
+
--body "${MESSAGE}" \
|
|
125
|
+
--repo "${REPOSITORY}"
|
|
126
|
+
|
|
127
|
+
review:
|
|
128
|
+
needs: 'dispatch'
|
|
129
|
+
if: |-
|
|
130
|
+
${{ needs.dispatch.outputs.command == 'review' }}
|
|
131
|
+
uses: './.github/workflows/gemini-review.yml'
|
|
132
|
+
permissions:
|
|
133
|
+
contents: 'read'
|
|
134
|
+
id-token: 'write'
|
|
135
|
+
issues: 'write'
|
|
136
|
+
pull-requests: 'write'
|
|
137
|
+
with:
|
|
138
|
+
additional_context: '${{ needs.dispatch.outputs.additional_context }}'
|
|
139
|
+
secrets: 'inherit'
|
|
140
|
+
|
|
141
|
+
triage:
|
|
142
|
+
needs: 'dispatch'
|
|
143
|
+
if: |-
|
|
144
|
+
${{ needs.dispatch.outputs.command == 'triage' }}
|
|
145
|
+
uses: './.github/workflows/gemini-triage.yml'
|
|
146
|
+
permissions:
|
|
147
|
+
contents: 'read'
|
|
148
|
+
id-token: 'write'
|
|
149
|
+
issues: 'write'
|
|
150
|
+
pull-requests: 'write'
|
|
151
|
+
with:
|
|
152
|
+
additional_context: '${{ needs.dispatch.outputs.additional_context }}'
|
|
153
|
+
secrets: 'inherit'
|
|
154
|
+
|
|
155
|
+
invoke:
|
|
156
|
+
needs: 'dispatch'
|
|
157
|
+
if: |-
|
|
158
|
+
${{ needs.dispatch.outputs.command == 'invoke' }}
|
|
159
|
+
uses: './.github/workflows/gemini-invoke.yml'
|
|
160
|
+
permissions:
|
|
161
|
+
contents: 'read'
|
|
162
|
+
id-token: 'write'
|
|
163
|
+
issues: 'write'
|
|
164
|
+
pull-requests: 'write'
|
|
165
|
+
with:
|
|
166
|
+
additional_context: '${{ needs.dispatch.outputs.additional_context }}'
|
|
167
|
+
secrets: 'inherit'
|
|
168
|
+
|
|
169
|
+
plan-execute:
|
|
170
|
+
needs: 'dispatch'
|
|
171
|
+
if: |-
|
|
172
|
+
${{ needs.dispatch.outputs.command == 'approve' }}
|
|
173
|
+
uses: './.github/workflows/gemini-plan-execute.yml'
|
|
174
|
+
permissions:
|
|
175
|
+
contents: 'write'
|
|
176
|
+
id-token: 'write'
|
|
177
|
+
issues: 'write'
|
|
178
|
+
pull-requests: 'write'
|
|
179
|
+
with:
|
|
180
|
+
additional_context: '${{ needs.dispatch.outputs.additional_context }}'
|
|
181
|
+
secrets: 'inherit'
|
|
182
|
+
|
|
183
|
+
fallthrough:
|
|
184
|
+
needs:
|
|
185
|
+
- 'dispatch'
|
|
186
|
+
- 'review'
|
|
187
|
+
- 'triage'
|
|
188
|
+
- 'invoke'
|
|
189
|
+
- 'plan-execute'
|
|
190
|
+
if: |-
|
|
191
|
+
${{ always() && !cancelled() && (failure() || needs.dispatch.outputs.command == 'fallthrough') }}
|
|
192
|
+
runs-on: 'ubuntu-latest'
|
|
193
|
+
permissions:
|
|
194
|
+
contents: 'read'
|
|
195
|
+
issues: 'write'
|
|
196
|
+
pull-requests: 'write'
|
|
197
|
+
steps:
|
|
198
|
+
- name: 'Mint identity token'
|
|
199
|
+
id: 'mint_identity_token'
|
|
200
|
+
if: |-
|
|
201
|
+
${{ vars.APP_ID }}
|
|
202
|
+
uses: 'actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf' # ratchet:actions/create-github-app-token@v2
|
|
203
|
+
with:
|
|
204
|
+
app-id: '${{ vars.APP_ID }}'
|
|
205
|
+
private-key: '${{ secrets.APP_PRIVATE_KEY }}'
|
|
206
|
+
permission-contents: 'read'
|
|
207
|
+
permission-issues: 'write'
|
|
208
|
+
permission-pull-requests: 'write'
|
|
209
|
+
|
|
210
|
+
- name: 'Send failure comment'
|
|
211
|
+
env:
|
|
212
|
+
GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
|
|
213
|
+
ISSUE_NUMBER: '${{ github.event.pull_request.number || github.event.issue.number }}'
|
|
214
|
+
MESSAGE: |-
|
|
215
|
+
🤖 I'm sorry @${{ github.actor }}, but I was unable to process your request. Please [see the logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details.
|
|
216
|
+
REPOSITORY: '${{ github.repository }}'
|
|
217
|
+
run: |-
|
|
218
|
+
gh issue comment "${ISSUE_NUMBER}" \
|
|
219
|
+
--body "${MESSAGE}" \
|
|
220
|
+
--repo "${REPOSITORY}"
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "Gemini Agentic Assistant",
|
|
3
|
+
"description": "Comprehensive Gemini-powered automation system with dispatching for review, triage, and interactive tasks.",
|
|
4
|
+
"category": "support-intelligence",
|
|
5
|
+
"provider": "google-gemini",
|
|
6
|
+
"source": "https://github.com/google-github-actions/run-gemini-cli/tree/main/examples/workflows",
|
|
7
|
+
"defense_level": "baseline",
|
|
8
|
+
"labels": ["gemini", "assistant", "baseline", "interactive"],
|
|
9
|
+
"supported_events": ["pull_request_target", "pull_request", "issues", "issue_comment", "pull_request_review", "pull_request_review_comment"]
|
|
10
|
+
}
|
|
@@ -0,0 +1,118 @@
|
|
|
1
|
+
# Awesome Workflows
|
|
2
|
+
|
|
3
|
+
Welcome to our collection of awesome community-contributed workflows! This page showcases creative and powerful implementations of the [Google Gemini CLI GitHub Action](https://github.com/google-github-actions/run-gemini-cli) created by the community.
|
|
4
|
+
|
|
5
|
+
**Want to add your workflow?** Check out the [submission guidelines](./README.md#share-your-workflow) in our main README.
|
|
6
|
+
|
|
7
|
+
> **⚠️ Security Notice**: Always review and understand any workflow before using it in your repository. Community-contributed workflows are provided as-is and have not been security audited. Verify the code, permissions, and any external dependencies before implementation.
|
|
8
|
+
|
|
9
|
+
- [Awesome Workflows](#awesome-workflows)
|
|
10
|
+
- [Workflow Categories](#workflow-categories)
|
|
11
|
+
- [🔍 Code Quality](#-code-quality)
|
|
12
|
+
- [📋 Project Management](#-project-management)
|
|
13
|
+
- [Enforce Contribution Guidelines in Pull Requests](#enforce-contribution-guidelines-in-pull-requests)
|
|
14
|
+
- [📝 Documentation](#-documentation)
|
|
15
|
+
- [🛡️ Security](#️-security)
|
|
16
|
+
- [🧪 Testing](#-testing)
|
|
17
|
+
- [🚀 Deployment \& Release](#-deployment--release)
|
|
18
|
+
- [Generate Release Notes](#generate-release-notes)
|
|
19
|
+
- [🎯 Specialized Use Cases](#-specialized-use-cases)
|
|
20
|
+
- [Featured Workflows](#featured-workflows)
|
|
21
|
+
|
|
22
|
+
## Workflow Categories
|
|
23
|
+
|
|
24
|
+
Browse workflows by category to find exactly what you're looking for.
|
|
25
|
+
|
|
26
|
+
### 🔍 Code Quality
|
|
27
|
+
|
|
28
|
+
Workflows that help maintain code quality, perform analysis, or enforce standards.
|
|
29
|
+
|
|
30
|
+
_No workflows yet. Be the first to contribute!_
|
|
31
|
+
|
|
32
|
+
### 📋 Project Management
|
|
33
|
+
|
|
34
|
+
Workflows that help manage GitHub issues, projects, or team collaboration.
|
|
35
|
+
|
|
36
|
+
#### Enforce Contribution Guidelines in Pull Requests
|
|
37
|
+
|
|
38
|
+
**Repository:** [jasmeetsb/gemini-github-actions](https://github.com/jasmeetsb/gemini-github-actions)
|
|
39
|
+
|
|
40
|
+
**Description:** Automates validation of pull requests against your repository's CONTRIBUTING.md using the Google Gemini CLI. The workflow posts a single upserted PR comment indicating PASS/FAIL with a concise checklist of actionable items, and can optionally fail the job to enforce compliance.
|
|
41
|
+
|
|
42
|
+
**Key Features:**
|
|
43
|
+
|
|
44
|
+
- Reads and evaluates PR title, body, and diff against CONTRIBUTING.md
|
|
45
|
+
- Posts a single PR comment with a visible PASS/FAIL marker in Comment Title and details of compliance status in the comment body
|
|
46
|
+
- Optional enforcement: fail the workflow when violations are detected
|
|
47
|
+
|
|
48
|
+
**Setup Requirements:**
|
|
49
|
+
|
|
50
|
+
- Copy [.github/workflows/pr-contribution-guidelines-enforcement.yml](https://github.com/jasmeetsb/gemini-github-actions/blob/main/.github/workflows/pr-contribution-guidelines-enforcement.yml) to your .github/workflows/ folder.
|
|
51
|
+
- File: `CONTRIBUTING.md` at the repository root
|
|
52
|
+
- (Optional) Repository variable `FAIL_ON_GUIDELINE_VIOLATIONS=true` to fail the workflow on violations
|
|
53
|
+
|
|
54
|
+
**Example Usage:**
|
|
55
|
+
|
|
56
|
+
- Define contribution guidelines in CONTRIBUTING.md file
|
|
57
|
+
- Open a new PR or update an existing PR, which would then trigger the workflow
|
|
58
|
+
- Workflow will validate the PR against the contribution guidelines and add a comment in the PR with PASS/FAIL status and details of guideline compliance and non-compliance
|
|
59
|
+
|
|
60
|
+
**OR**
|
|
61
|
+
|
|
62
|
+
- Add following comment in an existing PR **"/validate-contribution"** to trigger the workflow
|
|
63
|
+
|
|
64
|
+
**Workflow File:**
|
|
65
|
+
|
|
66
|
+
- Example location in this repo: [.github/workflows/pr-contribution-guidelines-enforcement.yml](https://github.com/jasmeetsb/gemini-github-actions/blob/main/.github/workflows/pr-contribution-guidelines-enforcement.yml)
|
|
67
|
+
- Typical usage in a consumer repo: `.github/workflows/pr-contribution-guidelines-enforcement.yml` (copy the file and adjust settings/secrets as needed)
|
|
68
|
+
|
|
69
|
+
### 📝 Documentation
|
|
70
|
+
|
|
71
|
+
Workflows that generate, update, or maintain documentation automatically.
|
|
72
|
+
|
|
73
|
+
_No workflows yet. Be the first to contribute!_
|
|
74
|
+
|
|
75
|
+
### 🛡️ Security
|
|
76
|
+
|
|
77
|
+
Workflows focused on security analysis, vulnerability detection, or compliance.
|
|
78
|
+
|
|
79
|
+
_No workflows yet. Be the first to contribute!_
|
|
80
|
+
|
|
81
|
+
### 🧪 Testing
|
|
82
|
+
|
|
83
|
+
Workflows that enhance testing processes, generate test cases, or analyze test results.
|
|
84
|
+
|
|
85
|
+
_No workflows yet. Be the first to contribute!_
|
|
86
|
+
|
|
87
|
+
### 🚀 Deployment & Release
|
|
88
|
+
|
|
89
|
+
Workflows that handle deployment, release management, or publishing tasks.
|
|
90
|
+
|
|
91
|
+
#### Generate Release Notes
|
|
92
|
+
|
|
93
|
+
**Repository:** [conforma/policy](https://github.com/conforma/policy)
|
|
94
|
+
|
|
95
|
+
Make release notes based on all notable changes since a given tag.
|
|
96
|
+
It categorizes the release notes nicely with emojis, output as Markdown.
|
|
97
|
+
|
|
98
|
+
**Key Features:**
|
|
99
|
+
|
|
100
|
+
- Categorize changes in release notes
|
|
101
|
+
- Include relevant links in release notes
|
|
102
|
+
- Add fun emojis in release notes
|
|
103
|
+
|
|
104
|
+
**Workflow File:** [View on GitHub](https://github.com/conforma/policy/blob/bba371ad8f0fff7eea2ce7a50539cde658645a56/.github/workflows/release.yaml#L93-L114)
|
|
105
|
+
|
|
106
|
+
### 🎯 Specialized Use Cases
|
|
107
|
+
|
|
108
|
+
Unique or domain-specific workflows that showcase creative uses of Gemini CLI.
|
|
109
|
+
|
|
110
|
+
_No workflows yet. Be the first to contribute!_
|
|
111
|
+
|
|
112
|
+
## Featured Workflows
|
|
113
|
+
|
|
114
|
+
_Coming soon!_ This section will highlight particularly innovative or popular community workflows.
|
|
115
|
+
|
|
116
|
+
---
|
|
117
|
+
|
|
118
|
+
_Want to see your workflow featured here? Check out our [submission guidelines](./README.md#share-your-workflow)!_
|
|
@@ -0,0 +1,162 @@
|
|
|
1
|
+
# Configuring Gemini CLI Workflows
|
|
2
|
+
|
|
3
|
+
This guide covers how to customize and configure Gemini CLI workflows to meet your specific needs.
|
|
4
|
+
|
|
5
|
+
- [Configuring Gemini CLI Workflows](#configuring-gemini-cli-workflows)
|
|
6
|
+
- [How to Configure Gemini CLI](#how-to-configure-gemini-cli)
|
|
7
|
+
- [Custom Commands (TOML Files)](#custom-commands-toml-files)
|
|
8
|
+
- [Key Settings](#key-settings)
|
|
9
|
+
- [Conversation Length (`model.maxSessionTurns`)](#conversation-length-modelmaxsessionturns)
|
|
10
|
+
- [Allowlist Tools (`tools.core`)](#allowlist-tools-toolscore)
|
|
11
|
+
- [MCP Servers (`mcpServers`)](#mcp-servers-mcpservers)
|
|
12
|
+
- [Custom Context and Guidance (`GEMINI.md`)](#custom-context-and-guidance-geminimd)
|
|
13
|
+
- [GitHub Actions Workflow Settings](#github-actions-workflow-settings)
|
|
14
|
+
- [Setting Timeouts](#setting-timeouts)
|
|
15
|
+
- [Required Permissions](#required-permissions)
|
|
16
|
+
|
|
17
|
+
## How to Configure Gemini CLI
|
|
18
|
+
|
|
19
|
+
Gemini CLI workflows are highly configurable. You can adjust their behavior by editing the corresponding `.yml` files in your repository.
|
|
20
|
+
|
|
21
|
+
Gemini CLI supports many settings that control how it operates. For a complete list, see the [Gemini CLI documentation](https://github.com/google-gemini/gemini-cli/blob/main/docs/get-started/configuration.md#available-settings-in-settingsjson).
|
|
22
|
+
|
|
23
|
+
### Custom Commands (TOML Files)
|
|
24
|
+
|
|
25
|
+
The example workflows use custom commands defined in TOML files to provide specialized prompts for different tasks. These TOML files are automatically installed from the action's `.github/commands/` directory to `.gemini/commands/` when the workflow runs.
|
|
26
|
+
|
|
27
|
+
**Available custom commands:**
|
|
28
|
+
|
|
29
|
+
- `/gemini-invoke` - General-purpose AI assistant for code changes and analysis
|
|
30
|
+
- `/gemini-review` - Pull request code review
|
|
31
|
+
- `/gemini-triage` - Single issue triage
|
|
32
|
+
- `/gemini-scheduled-triage` - Batch issue triage
|
|
33
|
+
|
|
34
|
+
**How it works:**
|
|
35
|
+
|
|
36
|
+
1. The action copies TOML files from `.github/commands/` to `.gemini/commands/` during workflow execution
|
|
37
|
+
2. Workflows reference these commands using the `prompt` input (e.g., `prompt: '/gemini-invoke'`)
|
|
38
|
+
3. The Gemini CLI loads the command's prompt from the TOML file
|
|
39
|
+
|
|
40
|
+
**Customizing commands:**
|
|
41
|
+
|
|
42
|
+
To customize the prompts for your repository:
|
|
43
|
+
|
|
44
|
+
1. Copy the TOML file(s) from `examples/workflows/<workflow-name>` to your repository's `.gemini/commands/` directory
|
|
45
|
+
2. Modify the `prompt` field in the TOML file to match your needs
|
|
46
|
+
3. Commit the TOML files to your repository
|
|
47
|
+
|
|
48
|
+
For example, to customize the PR review prompt:
|
|
49
|
+
|
|
50
|
+
```bash
|
|
51
|
+
mkdir -p .gemini/commands
|
|
52
|
+
cp examples/workflows/pr-review/gemini-review.toml .gemini/commands/
|
|
53
|
+
# Edit .gemini/commands/gemini-review.toml as needed
|
|
54
|
+
git add .gemini/commands/gemini-review.toml
|
|
55
|
+
git commit -m "feat: customize PR review prompt"
|
|
56
|
+
```
|
|
57
|
+
|
|
58
|
+
The workflow will use your custom TOML file instead of the default one from the action.
|
|
59
|
+
|
|
60
|
+
### Key Settings
|
|
61
|
+
|
|
62
|
+
#### Conversation Length (`model.maxSessionTurns`)
|
|
63
|
+
|
|
64
|
+
This setting controls the maximum number of conversational turns (messages exchanged) allowed during a workflow run.
|
|
65
|
+
|
|
66
|
+
**Default values by workflow:**
|
|
67
|
+
|
|
68
|
+
| Workflow | Default `model.maxSessionTurns` |
|
|
69
|
+
| ------------------------------------ | ------------------------------- |
|
|
70
|
+
| [Issue Triage](./issue-triage) | 25 |
|
|
71
|
+
| [Pull Request Review](./pr-review) | 20 |
|
|
72
|
+
| [Gemini CLI Assistant](./gemini-cli) | 50 |
|
|
73
|
+
|
|
74
|
+
**How to override:**
|
|
75
|
+
|
|
76
|
+
Add the following to your workflow YAML file to set a custom value:
|
|
77
|
+
|
|
78
|
+
```yaml
|
|
79
|
+
with:
|
|
80
|
+
settings: |-
|
|
81
|
+
{
|
|
82
|
+
"model": {
|
|
83
|
+
"maxSessionTurns": 10
|
|
84
|
+
}
|
|
85
|
+
}
|
|
86
|
+
```
|
|
87
|
+
|
|
88
|
+
#### Allowlist Tools (`tools.core`)
|
|
89
|
+
|
|
90
|
+
Allows you to specify a list of [built-in tools] that should be made available to the model. You can also use this to allowlist commands for shell tool.
|
|
91
|
+
|
|
92
|
+
**Default:** All tools available for use by Gemini CLI.
|
|
93
|
+
|
|
94
|
+
**How to configure:**
|
|
95
|
+
|
|
96
|
+
Add the following to your workflow YAML file to specify core tools:
|
|
97
|
+
|
|
98
|
+
```yaml
|
|
99
|
+
with:
|
|
100
|
+
settings: |-
|
|
101
|
+
{
|
|
102
|
+
"tools": {
|
|
103
|
+
"core": [
|
|
104
|
+
"list_directory",
|
|
105
|
+
"read_file",
|
|
106
|
+
"grep_search",
|
|
107
|
+
"run_shell_command(echo)"
|
|
108
|
+
]
|
|
109
|
+
}
|
|
110
|
+
}
|
|
111
|
+
```
|
|
112
|
+
|
|
113
|
+
#### MCP Servers (`mcpServers`)
|
|
114
|
+
|
|
115
|
+
Configures connections to one or more Model Context Protocol (MCP) servers for discovering and using custom tools. This allows you to extend Gemini CLI GitHub Action with additional capabilities.
|
|
116
|
+
|
|
117
|
+
**Default:** Empty
|
|
118
|
+
|
|
119
|
+
**Example:**
|
|
120
|
+
|
|
121
|
+
```yaml
|
|
122
|
+
with:
|
|
123
|
+
settings: |-
|
|
124
|
+
{
|
|
125
|
+
"mcpServers": {
|
|
126
|
+
"github": {
|
|
127
|
+
"command": "docker",
|
|
128
|
+
"args": [
|
|
129
|
+
"run",
|
|
130
|
+
"-i",
|
|
131
|
+
"--rm",
|
|
132
|
+
"-e",
|
|
133
|
+
"GITHUB_PERSONAL_ACCESS_TOKEN",
|
|
134
|
+
"ghcr.io/github/github-mcp-server"
|
|
135
|
+
],
|
|
136
|
+
"env": {
|
|
137
|
+
"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
|
|
138
|
+
}
|
|
139
|
+
}
|
|
140
|
+
}
|
|
141
|
+
}
|
|
142
|
+
```
|
|
143
|
+
|
|
144
|
+
### Custom Context and Guidance (`GEMINI.md`)
|
|
145
|
+
|
|
146
|
+
To provide Gemini CLI with custom instructions—such as coding conventions, architectural patterns, or other guidance—add a `GEMINI.md` file to the root of your repository. Gemini CLI will use the content of this file to inform its responses.
|
|
147
|
+
|
|
148
|
+
## GitHub Actions Workflow Settings
|
|
149
|
+
|
|
150
|
+
### Setting Timeouts
|
|
151
|
+
|
|
152
|
+
You can control how long Gemini CLI runs by using either the `timeout-minutes` field in your workflow YAML, or by specifying a timeout in the `settings` input.
|
|
153
|
+
|
|
154
|
+
### Required Permissions
|
|
155
|
+
|
|
156
|
+
Only users with the following roles can trigger the workflow:
|
|
157
|
+
|
|
158
|
+
- Repository Owner (`OWNER`)
|
|
159
|
+
- Repository Member (`MEMBER`)
|
|
160
|
+
- Repository Collaborator (`COLLABORATOR`)
|
|
161
|
+
|
|
162
|
+
[built-in tools]: https://github.com/google-gemini/gemini-cli/blob/main/docs/core/tools-api.md#built-in-tools
|