# Gemini CLI GitHub Action

> Google's GitHub Action that runs Gemini CLI on your repository — PR reviews, issue triage and @gemini-cli mentions

- Category: AI Coding / AI SDLC Automation
- Language: TypeScript
- Licence: Apache-2.0
- Repository: https://github.com/google-github-actions/run-gemini-cli
- Canonical page: https://ai-tldr.dev/tools/run-gemini-cli/
- Updated: 2026-04-24

## In short

Gemini CLI GitHub Action is Google's GitHub Action that runs Gemini CLI on your repository — PR reviews, issue triage and @gemini-cli mentions. It sits in the AI SDLC Automation category of the AI Coding tools and is open-source, written in TypeScript and licensed Apache-2.0. To get started: store the API key as a repository secret.

## Overview

run-gemini-cli is Google's GitHub Action for putting Gemini CLI into a repository's workflows. It works two ways: as an autonomous agent triggered by events or schedules — review every pull request, triage new issues, run a nightly job — and as an on-demand collaborator you summon from a comment by mentioning `@gemini-cli` with a request.

The repository ships pre-built workflows rather than leaving you to assemble one. A dispatch workflow (`gemini-dispatch.yml`) routes an event or a comment command to the right job; the others cover issue triage, pull-request review and a general Gemini CLI assistant. Copy them into `.github/workflows`, or let Gemini CLI write them for you with its `/setup-github` command.

Because it runs the CLI, it inherits the CLI's extensibility: Gemini's tool calling can drive other command-line tools such as `gh`, and a `GEMINI.md` file in the repository supplies project-specific instructions and context. Authentication covers both a Gemini API key from Google AI Studio and the GitHub side of the workflow.

Running an agent on pull requests from strangers is the risky case, and the project treats it as such — the security advisory below is worth reading before you point this at untrusted contributions.

## What it does

- Event- and schedule-triggered automation: review pull requests, triage issues, run nightly analysis
- On-demand collaboration by mentioning `@gemini-cli` (or `@gemini-cli /review`, `/triage`) in an issue or PR comment
- Pre-built workflows — dispatch, issue triage, PR review and a general assistant — copied into your repository
- `/setup-github` in the Gemini CLI writes the workflow files for you
- Project context from a `GEMINI.md` file, and tool calling into other CLIs such as the GitHub CLI
- Configurable inputs, outputs, repository variables and secrets, with observability hooks documented

## Getting started

You need a Gemini API key and a couple of files in the repository. These steps follow the README's quick start.

1. Store the API key as a repository secret

   Get a key from Google AI Studio, then add it under Settings → Secrets and variables → Actions with the name GEMINI_API_KEY.

```text
GEMINI_API_KEY
```

2. Ignore the generated files

   Keep the CLI's settings directory and GitHub App credentials out of version control.

```text
# gemini-cli settings
.gemini/

# GitHub App credentials
gha-creds-*.json
```

3. Add the workflows

   Either run the setup command inside the CLI, or copy the examples by hand — `gemini-dispatch.yml` must be included, since it triggers the others.

```bash
gemini
# then, inside the CLI:
/setup-github
```

4. Use it

   Open a pull request and wait for the review, or ask for one from a comment.

```text
@gemini-cli /review
@gemini-cli /triage
@gemini-cli write unit tests for this component
```

## When to use it

- Give every pull request a first-pass automated review before a human looks at it
- Triage and label incoming issues on a schedule instead of by hand
- Let contributors ask for an explanation, a fix or tests from inside a PR thread
- Run repository-wide analysis nightly with project rules supplied by a checked-in GEMINI.md

## Version history

- 2026-04-24 0.1.22: GHSA-wpqr-6v78-jr5g (CVSS 10, critical) hardened workspace trust and tool allowlisting. Headless runs no longer auto-trust the workspace folder, so a malicious `.gemini/` directory in an untrusted pull request can no longer load env vars and run code; `--yolo` now honours tool allowlists. Fixed at 0.1.22 in the action and 0.39.1 in @google/gemini-cli; both are breaking changes.