1+ name : AI Code Reviewer
2+
3+ on :
4+ issue_comment :
5+ types : [created]
6+
7+ permissions :
8+ contents : read
9+ pull-requests : write
10+ issues : write
11+
12+ jobs :
13+ gemini-code-review :
14+ runs-on : ubuntu-latest
15+ if : |
16+ github.event.issue.pull_request &&
17+ contains(github.event.comment.body, '/gemini-review')
18+ steps :
19+ - name : PR Info
20+ env :
21+ # Assign untrusted inputs to environment variables first
22+ COMMENT_BODY : ${{ github.event.comment.body }}
23+ ISSUE_NUM : ${{ github.event.issue.number }}
24+ REPO : ${{ github.repository }}
25+ # Use shell variables ("$VAR") instead of template tags
26+ run : |
27+ echo "Comment: $COMMENT_BODY"
28+ echo "Issue Number: $ISSUE_NUM"
29+ echo "Repository: $REPO"
30+
31+ - name : Checkout Repo
32+ uses : actions/checkout@v3
33+ with :
34+ fetch-depth : 0
35+ ref : refs/pull/${{ github.event.issue.number }}/head
36+
37+ - name : Get PR Details
38+ id : pr
39+ env :
40+ GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
41+ REPO : ${{ github.repository }}
42+ ISSUE_NUM : ${{ github.event.issue.number }}
43+ # Use env vars for the API call to prevent injection
44+ # Use quotes around variables to prevent word splitting
45+ run : |
46+ PR_JSON=$(gh api "repos/$REPO/pulls/$ISSUE_NUM")
47+ echo "head_sha=$(echo "$PR_JSON" | jq -r .head.sha)" >> $GITHUB_OUTPUT
48+ echo "base_sha=$(echo "$PR_JSON" | jq -r .base.sha)" >> $GITHUB_OUTPUT
49+
50+ - uses : truongnh1992/gemini-ai-code-reviewer@main
51+ with :
52+ GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
53+ GEMINI_API_KEY : ${{ secrets.GEMINI_API_KEY }}
54+ GEMINI_MODEL : gemini-2.5-flash
55+ EXCLUDE : " *.md,*.txt,package-lock.json"
0 commit comments