█

AI/TLDR

Gemini CLI GitHub Action

Google's GitHub Action that runs Gemini CLI on your repository — PR reviews, issue triage and @gemini-cli mentions

GitHub★ 2.1k
AI SDLC AutomationOpen source
Latest
0.1.22
Updated
24 Apr 2026
Language
TypeScript
License
Apache-2.0

What's new

0.1.2224 Apr 2026

GHSA-wpqr-6v78-jr5g (CVSS 10, critical) hardened workspace trust and tool allowlisting. Headless runs no longer auto-trust the workspace folder, so a malicious `.gemini/` directory in an untrusted pull request can no longer load env vars and run code; `--yolo` now honours tool allowlists. Fixed at 0.1.22 in the action and 0.39.1 in @google/gemini-cli; both are breaking changes.

our coverage →changeset ↗

Overview

run-gemini-cli is Google's GitHub Action for putting Gemini CLI into a repository's workflows. It works two ways: as an autonomous agent triggered by events or schedules — review every pull request, triage new issues, run a nightly job — and as an on-demand collaborator you summon from a comment by mentioning `@gemini-cli` with a request.

The repository ships pre-built workflows rather than leaving you to assemble one. A dispatch workflow (`gemini-dispatch.yml`) routes an event or a comment command to the right job; the others cover issue triage, pull-request review and a general Gemini CLI assistant. Copy them into `.github/workflows`, or let Gemini CLI write them for you with its `/setup-github` command.

Because it runs the CLI, it inherits the CLI's extensibility: Gemini's tool calling can drive other command-line tools such as `gh`, and a `GEMINI.md` file in the repository supplies project-specific instructions and context. Authentication covers both a Gemini API key from Google AI Studio and the GitHub side of the workflow.

Running an agent on pull requests from strangers is the risky case, and the project treats it as such — the security advisory below is worth reading before you point this at untrusted contributions.

What it does

  • Event- and schedule-triggered automation: review pull requests, triage issues, run nightly analysis
  • On-demand collaboration by mentioning `@gemini-cli` (or `@gemini-cli /review`, `/triage`) in an issue or PR comment
  • Pre-built workflows — dispatch, issue triage, PR review and a general assistant — copied into your repository
  • `/setup-github` in the Gemini CLI writes the workflow files for you
  • Project context from a `GEMINI.md` file, and tool calling into other CLIs such as the GitHub CLI
  • Configurable inputs, outputs, repository variables and secrets, with observability hooks documented

Getting started

You need a Gemini API key and a couple of files in the repository. These steps follow the README's quick start.

Store the API key as a repository secret

Get a key from Google AI Studio, then add it under Settings → Secrets and variables → Actions with the name GEMINI_API_KEY.

texttext
GEMINI_API_KEY

Ignore the generated files

Keep the CLI's settings directory and GitHub App credentials out of version control.

texttext
# gemini-cli settings
.gemini/

# GitHub App credentials
gha-creds-*.json

Add the workflows

Either run the setup command inside the CLI, or copy the examples by hand — `gemini-dispatch.yml` must be included, since it triggers the others.

bashbash
gemini
# then, inside the CLI:
/setup-github

Use it

Open a pull request and wait for the review, or ask for one from a comment.

texttext
@gemini-cli /review
@gemini-cli /triage
@gemini-cli write unit tests for this component

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

When to use it

  • Give every pull request a first-pass automated review before a human looks at it
  • Triage and label incoming issues on a schedule instead of by hand
  • Let contributors ask for an explanation, a fix or tests from inside a PR thread
  • Run repository-wide analysis nightly with project rules supplied by a checked-in GEMINI.md

How Gemini CLI GitHub Action compares

Gemini CLI GitHub Action alongside other open-source ai sdlc automation tools AI/TLDR tracks, ranked by GitHub stars.

ToolStarsWhat it does
Multica★ 50.4kSelf-hostable workspace where coding agents are assigned issues like teammates: 26 agent CLIs, runtimes you own, a replayable execution log per run, and review gates before anything ships.
GPT-Pilot★ 33.7kAutonomous AI developer that breaks down an app description into tasks, writes and runs code incrementally, and asks clarifying questions to produce a working production application.
oh-my-codex (OMX)★ 33.2kA workflow layer for the OpenAI Codex CLI that adds agent teams, git-worktree isolation, hooks and HUDs behind a set of canonical plan, code-review and QA commands.
Vibe Kanban★ 28.1kVibe Kanban lets you plan tasks on a kanban board, run coding agents like Claude Code and Codex in isolated workspaces, then review their diffs and ship pull requests.
Beads★ 27.3kA Dolt-backed dependency-graph issue tracker for coding agents: hash IDs avoid multi-agent collisions, `bd ready` surfaces unblocked work, and `bd remember` keeps durable project memory.
Archon★ 23.5kA workflow engine for AI coding agents: describe plan, implement, validate, review and PR phases as YAML, and every run repeats them in its own git worktree.
Keploy★ 18.5kAn API testing tool that records real traffic with eBPF — including database and queue calls — and replays it as deterministic tests and data mocks, with no SDK to import and no code changes.
Gemini CLI GitHub Action★ 2.1kGoogle's GitHub Action that runs Gemini CLI on your repository — PR reviews, issue triage and @gemini-cli mentions