Fix Gemini PR review trust workspace issue#3780
Conversation
RissyRan
requested review from
bvandermoon,
gobbleturk,
khatwanimohit,
parambole,
richjames0 and
shralex
as code owners
|
🤖 Hi @RissyRan, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
|
🤖 Hi @RissyRan, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
This Pull Request refactors the Gemini code review workflow to use a more structured JSON-based context instead of environment variable interpolation, which is a positive change. It also updates several configurations, including the actions/checkout version and tool permissions.
🔍 General Feedback
- Context Handling: The transition to
@{.gemini/context.json}for input data is a significant improvement in how instructions receive PR context. - Security: Adding
persist-credentials: 'false'to the checkout step is a good security practice. - Version Pinning: Please verify the usage of
actions/checkout@v6, asv4is currently the stable version. - Permissions: The shift to unrestricted shell commands (
allowCommands: ["*"]) should be carefully evaluated against the principle of least privilege.
|
🤖 Hi @RissyRan, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
There was a problem hiding this comment.
This Pull Request successfully addresses the "trust workspace" issue in the Gemini PR review workflow by setting GEMINI_CLI_TRUST_WORKSPACE: 'true' and refactoring how context is passed to the CLI. The transition to using a JSON file for structured data and updating the workflow configuration to the latest CLI schema are positive improvements.
🔍 General Feedback
- Security Hardening: While the move to JSON is good, the method of creating the JSON file using shell expansion poses a minor injection risk. Using
jq'senvobject directly is recommended. - Configuration Alignment: The update to the
shelltool configuration and the addition of thecode-reviewextension align well with current best practices for the Gemini CLI. - Consistency: Consider a follow-up PR to unify the
actions/checkoutversion across all workflows in the repository.
|
🤖 Hi @RissyRan, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
There was a problem hiding this comment.
This Pull Request aims to fix workspace trust issues for Gemini PR reviews and improves how prompt context is prepared. The transition to a JSON-based context file and the updated policy structure are positive improvements for security and maintainability.
🔍 General Feedback
- Security: The use of
GEMINI_CLI_TRUST_WORKSPACE: 'true'is appropriate for this context, but ensure that the workspace is indeed trusted. - Dependency Management: Be cautious with version tags for GitHub Actions; always prefer stable, verified releases (like
v4for checkout). - Policy: The shift from a generic
corepolicy to a specificshellcapability with explicit environment variables and commands is a great security improvement.
There was a problem hiding this comment.
This Pull Request aims to fix workspace trust issues for Gemini PR reviews and improves how prompt context is prepared. The transition to a JSON-based context file and the updated policy structure are positive improvements for security and maintainability.
🔍 General Feedback
- Security: The use of
GEMINI_CLI_TRUST_WORKSPACE: 'true'is appropriate for this context, but ensure that the workspace is indeed trusted. - Dependency Management: Be cautious with version tags for GitHub Actions; always prefer stable, verified releases (like
v4for checkout). - Policy: The shift from a generic
corepolicy to a specificshellcapability with explicit environment variables and commands is a great security improvement.
There was a problem hiding this comment.
This Pull Request aims to fix workspace trust issues for Gemini PR reviews and improves how prompt context is prepared. The transition to a JSON-based context file and the updated policy structure are positive improvements for security and maintainability.
🔍 General Feedback
- Security: The use of
GEMINI_CLI_TRUST_WORKSPACE: 'true'is appropriate for this context, but ensure that the workspace is indeed trusted. - Dependency Management: Be cautious with version tags for GitHub Actions; always prefer stable, verified releases (like
v4for checkout). - Policy: The shift from a generic
corepolicy to a specificshellcapability with explicit environment variables and commands is a great security improvement.
There was a problem hiding this comment.
This Pull Request aims to fix workspace trust issues for Gemini PR reviews and improves how prompt context is prepared. The transition to a JSON-based context file and the updated policy structure are positive improvements for security and maintainability.
🔍 General Feedback
- Security: The use of
GEMINI_CLI_TRUST_WORKSPACE: 'true'is appropriate for this context, but ensure that the workspace is indeed trusted. - Dependency Management: Be cautious with version tags for GitHub Actions; always prefer stable, verified releases (like
v4for checkout). - Policy: The shift from a generic
corepolicy to a specificshellcapability with explicit environment variables and commands is a great security improvement.
|
🤖 Hi @RissyRan, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
There was a problem hiding this comment.
This Pull Request addresses the workspace trust issues and improves the security posture of the Gemini PR review workflow. The transition to a JSON-based context injection method is a cleaner and more structured approach than using multiple shell-based echo commands.
🔍 General Feedback
- Security Improvements: The addition of
GEMINI_CLI_TRUST_WORKSPACE: 'true'and the use ofpersist-credentials: 'false'are good security practices. - Context Injection: Moving towards a structured
.gemini/context.jsonfile simplifies the prompt definition and reduces reliance on shell environment variables. - Policy Granularity: The update to the shell tool policy is a positive step towards more restrictive and secure tool execution.
5 participants
Description
Fix Gemini PR review trust workspace issue, and also added
Prepare prompt contextstep following by example.Tests
Checklist
Before submitting this PR, please make sure (put X in square brackets):
gemini-reviewlabel.