Headless Mode & CI/CD

name: Gemini PR Review

on:
  pull_request:
    types: [opened, synchronize]

permissions:
  contents: read          # read the diff
  pull-requests: write    # post comments

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      # ── 1. Check out the PR branch ──────────────────────────────────────
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0     # full history so we can diff against base

      # ── 2. Install and authenticate Gemini CLI ──────────────────────────
      - name: Set up Gemini CLI
        uses: google-github-actions/gemini-cli-action@v1
        with:
          # Store your Gemini API key as a GitHub secret
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}

      # ── 3. Run the diff review ──────────────────────────────────────────
      - name: Review PR diff
        id: review
        run: |
          DIFF=$(git diff origin/${{ github.base_ref }}...HEAD)
          PROMPT="You are a senior code reviewer. Review the following PR diff.
          Return a JSON object:
          {
            \"summary\": \"one paragraph\",
            \"issues\": [{\"severity\":\"HIGH|MEDIUM|LOW\",\"file\":\"...\",\"line\":1,\"message\":\"...\"}],
            \"approvalRecommendation\": \"APPROVE|REQUEST_CHANGES|COMMENT\"
          }
          Diff:
          $DIFF"

          RESULT=$(echo "" | gemini -p "$PROMPT" --output-format json --model gemini-2.0-flash --no-interactive)
          # Strip outer envelope
          INNER=$(echo "$RESULT" | jq -r '.response' | sed 's/^```json//;s/```$//')
          echo "review_json=$INNER" >> $GITHUB_OUTPUT

      # ── 4. Format and post the comment ──────────────────────────────────
      - name: Post review comment
        uses: actions/github-script@v7
        with:
          script: |
            const review = JSON.parse(`${{ steps.review.outputs.review_json }}`);
            let body = `## Gemini Code Review\n\n**Recommendation: \`${review.approvalRecommendation}\`**\n\n${review.summary}\n\n`;

            if (review.issues.length > 0) {
              body += `### Issues Found\n\n`;
              for (const issue of review.issues) {
                const emoji = issue.severity === 'HIGH' ? '🔴' : issue.severity === 'MEDIUM' ? '🟡' : '🟢';
                body += `${emoji} **${issue.severity}** — \`${issue.file}:${issue.line}\` — ${issue.message}\n\n`;
              }
            } else {
              body += `No issues found. ✅\n`;
            }

            body += `\n*Reviewed by Gemini CLI ${new Date().toISOString()}*`;

            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body
            });

#!/usr/bin/env pwsh
# Nightly dependency security audit — runs via Windows Task Scheduler
# Saves a report to C:\Reports\gemini-audit-YYYY-MM-DD.json

param(
    [string]$ReportDir = "C:\Reports",
    [string]$EmailTo   = ""           # optional: address for alert emails
)

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"
$Today = Get-Date -Format "yyyy-MM-dd"

# ── 1. Ensure report directory exists ──────────────────────────────────
New-Item -ItemType Directory -Force -Path $ReportDir | Out-Null

# ── 2. Gather package manifests from current working directory ─────────
$manifests = @()
if (Test-Path "package.json")       { $manifests += "package.json" }
if (Test-Path "requirements.txt")   { $manifests += "requirements.txt" }
if (Test-Path "pyproject.toml")     { $manifests += "pyproject.toml" }
if (Test-Path "Gemfile")            { $manifests += "Gemfile" }

if ($manifests.Count -eq 0) {
    Write-Warning "No package manifests found in $(Get-Location)"
    exit 0
}

$combinedContent = ""
foreach ($file in $manifests) {
    $combinedContent += "=== $file ===`n"
    $combinedContent += (Get-Content $file -Raw)
    $combinedContent += "`n`n"
}

# ── 3. Run Gemini audit ────────────────────────────────────────────────
$prompt = @"
You are a security auditor. Review the following package manifests for:
1. Packages with known CVEs published in the last 90 days
2. Packages pinned to versions older than 1 year with active security advisories
3. Packages with unusual version patterns suggesting supply chain risk

Return ONLY this JSON (no markdown fences):
{
  "auditDate": "$Today",
  "highRisk": [{"package":"","version":"","reason":"","cve":""}],
  "mediumRisk": [{"package":"","version":"","reason":""}],
  "summary": "",
  "upgradeCount": 0
}

Manifests:
$combinedContent
"@

Write-Host "[$Today] Running Gemini dependency audit..."
$raw = ($combinedContent | gemini -p $prompt --output-format json --model gemini-2.0-flash --no-interactive)
$envelope  = $raw | ConvertFrom-Json
$innerText = $envelope.response -replace '```json\s*','' -replace '\s*```',''
$report    = $innerText | ConvertFrom-Json

# ── 4. Save report ────────────────────────────────────────────────────
$reportPath = Join-Path $ReportDir "gemini-audit-$Today.json"
$report | ConvertTo-Json -Depth 10 | Out-File -FilePath $reportPath -Encoding UTF8
Write-Host "Report saved: $reportPath"

# ── 5. Alert on high-risk findings ────────────────────────────────────
if ($report.highRisk.Count -gt 0) {
    Write-Warning "HIGH RISK: $($report.highRisk.Count) package(s) require immediate attention"
    $report.highRisk | ForEach-Object { Write-Warning "  - $($_.package) $($_.version): $($_.reason)" }

    if ($EmailTo) {
        # Requires SMTP relay configured in Windows — adjust server/port as needed
        Send-MailMessage -To $EmailTo -From "gemini-audit@$(hostname)" `
            -Subject "[$Today] Gemini Dependency Audit: $($report.highRisk.Count) HIGH risk findings" `
            -Body $report.summary `
            -SmtpServer "localhost"
    }
    exit 1   # non-zero exit triggers Task Scheduler "on failure" action
}

Write-Host "Audit complete. $($report.upgradeCount) upgrade(s) recommended. No HIGH risk findings."
exit 0

# Run once as Administrator to register the nightly audit task
$scriptPath = "$PSScriptRoot\scripts\nightly-audit.ps1"
$action  = New-ScheduledTaskAction -Execute "pwsh.exe" -Argument "-NonInteractive -File `"$scriptPath`""
$trigger = New-ScheduledTaskTrigger -Daily -At "02:00AM"
$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 10) -RunOnlyIfNetworkAvailable
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest

Register-ScheduledTask `
    -TaskName   "GeminiNightlyAudit" `
    -Action     $action `
    -Trigger    $trigger `
    -Settings   $settings `
    -Principal  $principal `
    -Description "Nightly Gemini CLI dependency security audit" `
    -Force

Write-Host "Scheduled task registered. Next run: 02:00 AM daily."