Gemini CLI in GitHub Actions

name: AI PR Review

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  review:
    runs-on: ubuntu-latest
    # Only run on non-draft PRs
    if: github.event.pull_request.draft == false

    permissions:
      contents: read       # checkout
      pull-requests: write # post PR comment

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0   # full history for accurate diff

      - name: AI PR Review
        uses: google-github-actions/run-gemini-cli@v1
        with:
          # @ mentions work relative to the checkout root
          prompt: |
            @. Review this pull request for:
            1. Correctness — logic errors, off-by-one bugs, null pointer risks
            2. Security vulnerabilities — OWASP Top 10, hardcoded secrets, injection
            3. Breaking changes — API surface changes, removed exports, schema migrations
            4. Test coverage — are new branches and edge cases tested?

            Format your findings as GitHub Flavored Markdown.
            Start with a one-paragraph summary. Then list findings
            per file with severity (HIGH / MEDIUM / LOW) and
            a specific line reference where possible.

            If no significant issues are found, say so clearly.
          gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          # Use Flash for cost efficiency in CI
          model: gemini-2.0-flash

name: AI Issue Triage

on:
  issues:
    types: [opened]

jobs:
  triage:
    runs-on: ubuntu-latest
    permissions:
      issues: write   # add labels + post comment
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Triage Issue
        uses: google-github-actions/run-gemini-cli@v1
        with:
          prompt: |
            A new GitHub issue has been opened:

            Title: ${{ github.event.issue.title }}
            Body: ${{ github.event.issue.body }}

            Classify this issue:
            1. TYPE: one of bug / feature-request / question / documentation / duplicate
            2. PRIORITY: P0 (production down), P1 (high), P2 (normal), P3 (low)
            3. LABELS: comma-separated list of applicable labels from:
               bug, enhancement, documentation, question, needs-info,
               good-first-issue, help-wanted, wontfix
            4. COMMENT: If the issue is a bug report that lacks steps to reproduce,
               system info, or expected vs actual behavior — draft a polite comment
               asking for the missing information. Otherwise output "NONE".

            Output ONLY a JSON object in this exact format, no markdown:
            {
              "type": "...",
              "priority": "...",
              "labels": ["...", "..."],
              "comment": "..." or null
            }
          gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          model: gemini-2.0-flash

name: Gemini CLI Comment Trigger

on:
  issue_comment:
    types: [created]

jobs:
  gemini-review:
    # Only run on PR comments (not issue comments)
    if: |
      github.event.issue.pull_request &&
      contains(github.event.comment.body, '@gemini-cli')

    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write

    steps:
      - uses: actions/checkout@v4
        with:
          # Checkout the PR branch, not main
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Extract skill from comment
        id: extract-skill
        run: |
          COMMENT="${{ github.event.comment.body }}"
          # Extract the skill name after @gemini-cli
          SKILL=$(echo "$COMMENT" | grep -oP '(?<=@gemini-cli\s)/\S+' | head -1)
          echo "skill=${SKILL:-/review}" >> "$GITHUB_OUTPUT"

      - name: Run Gemini CLI Skill
        uses: google-github-actions/run-gemini-cli@v1
        with:
          prompt: |
            A developer requested: ${{ steps.extract-skill.outputs.skill }}

            @. Apply the requested skill to this pull request and post your
            findings as a detailed Markdown review comment. Reference specific
            files and line numbers where relevant.
          gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          model: gemini-2.0-flash

name: Weekly AI Security Scan

on:
  schedule:
    - cron: '0 8 * * 1'   # Every Monday at 08:00 UTC
  workflow_dispatch:        # Also allow manual trigger

jobs:
  security-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write   # upload SARIF results

    steps:
      - uses: actions/checkout@v4

      - name: Run OWASP Security Scan
        uses: google-github-actions/run-gemini-cli@v1
        id: scan
        with:
          prompt: |
            @src/ Perform a comprehensive security audit of this codebase.

            Check every file for the following OWASP Top 10 categories:
            - A01 Broken Access Control
            - A02 Cryptographic Failures (weak algorithms, hardcoded secrets)
            - A03 Injection (SQL, command, LDAP, XPath)
            - A05 Security Misconfiguration (debug flags, default credentials)
            - A06 Vulnerable Components (outdated imports)
            - A07 Authentication/Session Failures (weak tokens, no expiry)
            - A09 Logging Failures (sensitive data in logs)

            Output ONLY a JSON array. Each element must have:
            {
              "file": "relative/path/to/file.js",
              "line": 42,
              "severity": "critical|high|medium|low",
              "owasp_category": "A03",
              "description": "SQL query built with string concatenation",
              "recommendation": "Use parameterized queries instead"
            }

            If no vulnerabilities found, output an empty array: []
          gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
          # Use Pro model for deeper security analysis
          model: gemini-2.0-pro
          output_file: security-findings.json

      - name: Upload to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: security-findings.json

      - name: AI PR Review (with retry)
        uses: google-github-actions/run-gemini-cli@v1
        id: review
        continue-on-error: true
        with:
          prompt: "@. Review this PR for correctness and security."
          gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          model: gemini-2.0-flash

      - name: Handle rate limit — post notice
        if: steps.review.outcome == 'failure'
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '> AI review temporarily unavailable (rate limit). A human reviewer will cover this PR.'
            })