Run pull request review and issue triage with the run-gemini-cli GitHub Action, authenticate through Workload Identity Federation without a stored key, and keep merge approval with your reviewers. Limit which pull requests it reviews, and alert when a review never posts.
When you need this
- Pull requests wait on reviewers, and checks differ from one reviewer to the next.
- Security review happens late or not at all on routine changes.
- You want issues labeled and routed before engineers read the queue.
- Your team holds an existing Code Assist subscription or bills Gemini through Google Cloud.
Evaluation criteria
Authenticate without a long-lived key
Which credential does the workflow hold?
Look forUse Workload Identity Federation to Google Cloud, with use_vertex_ai or use_gemini_code_assist set on the action. A Gemini API key stored as a secret is the quick-start route. An unpaid key runs under unpaid-services terms, so use a paid key for private code. Move pipelines that use use_gemini_code_assist to Vertex AI before your Code Assist contract ends.
Choose the workflows
Which jobs should the agent run?
Look forPick from pull request review on open or on an @gemini-cli /review comment, issue triage on new issues, and the on-demand assistant. Start with review on request, and turn on automatic review once its comments lead to changes (GILD recommendation).
Write the review instructions
What should the reviewer check, in which language and format?
Look forWrite your review rules in a GEMINI.md and in custom command files under .github/commands, in the language your reviewers use. Start security checks from the prompts in the open-source Security extension.
Bound the volume
Which pull requests should it skip?
Look forExclude Renovate and Dependabot pull requests so the daily request cap goes to changes people wrote, and add a label that reruns review on demand.
Alert when a review does not post
How do you know the agent actually reviewed the pull request?
Look forAdd a check that fails when the job ends without a review comment. In September 2025 a user reported that the review workflow finished green without posting anything, because the model tried to ask a question that a CI run cannot answer.
Keep merge decisions with people
What can the agent approve or change?
Look forKeep branch protection, restricted pull request approvers, and pinned action versions, as the action's best practices recommend. Review the action logs and enable OpenTelemetry for an audit trail.
Questions to ask vendors
- Which Google Cloud project and identity does each repository's workflow use?
- Which pull requests does the agent review automatically, and which only on request?
- Who maintains the review instructions, and where are they versioned?
- Which agent comments led to code changes in the last month?
Red flags
- An unpaid Gemini API key reviewing private code.
- Agent review counted as the required approval on a protected branch.
- Unpinned action versions in workflows with write permissions.
- Comment counts offered as the measure of value.
Products in this piece
Sources
- Official documentation
- 7
- Public source
- 1
- google-github-actions/run-gemini-cli on GitHub
- Gemini CLI docs: Headless mode
- Gemini CLI docs: Project context (GEMINI.md)
- Gemini CLI docs: Terms and privacy
- Gemini CLI docs: Observability with OpenTelemetry
- Gemini Code Assist docs: Gemini CLI
- GitHub issue 278 on run-gemini-cli: review workflow succeeds without posting a review (Sep 15, 2025)
- Gemini Code Assist docs: Gemini Code Assist Standard and Enterprise subscriptions