Skip to content

Refactor Github Action per b/485167538#19443

Merged
google-admin merged 4 commits intomainfrom
lsc-1771432667.928861
Feb 26, 2026
Merged

Refactor Github Action per b/485167538#19443
google-admin merged 4 commits intomainfrom
lsc-1771432667.928861

Conversation

@google-admin
Copy link
Contributor

@google-admin google-admin commented Feb 18, 2026

This is a http://go/LSC run by http://go/ghss to automatically refactor your Github Actions per http://b/485167538.

This is a PR to help you upgrade to the latest standards in Github Actions.

Please merge this PR to accept the changes. NOTE: if you do not accept this PR, it may be force merged by the GHSS team. See http://b/485167538 for more details.

@google-admin google-admin requested review from a team as code owners February 18, 2026 16:37
@gemini-code-assist
Copy link
Contributor

gemini-code-assist bot commented Feb 18, 2026

Summary of Changes

Hello @google-admin, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request systematically refactors several custom GitHub Actions by migrating the method of passing input variables to shell scripts. Instead of directly interpolating inputs.<input-name> within run steps, all relevant inputs are now explicitly defined as environment variables. This change aligns the actions with recommended GitHub Actions best practices, which enhances security by preventing potential shell injection vulnerabilities and improves the overall readability and maintainability of the workflow definitions.

Highlights

  • GitHub Actions Refactoring: Refactored all custom GitHub Actions to pass input variables to shell scripts via explicit environment variables, rather than direct interpolation.
  • Enhanced Security and Maintainability: Improved the security posture of the actions by mitigating potential shell injection vulnerabilities and increasing the clarity and maintainability of the action definitions.
  • Standardized Input Handling: Applied a consistent pattern for handling inputs across various actions, including those for creating pull requests, managing npm authentication tokens, publishing releases, pushing Docker images, setting up npmrc, tagging npm releases, and verifying releases.
Changelog
  • .github/actions/create-pull-request/action.yml
    • Updated the create-pull-request action to use environment variables for branch-name, pr-title, pr-body, and base-branch inputs when executing the gh pr create command.
  • .github/actions/npm-auth-token/action.yml
    • Modified the npm-auth-token action to pass github-token, package-name, wombat-token-cli, wombat-token-core, and wombat-token-a2a-server as environment variables to the shell script.
  • .github/actions/publish-release/action.yml
    • Updated the publish-release action to use environment variables for release-tag, release-version, dry-run, core-package-name, cli-package-name, a2a-package-name, previous-tag, and steps.release_branch.outputs.BRANCH_NAME across various steps including branch creation, package version updates, npm publishing, package installation, and GitHub release creation.
  • .github/actions/push-docker/action.yml
    • Refactored the push-docker action to use an environment variable for the ref-name input when determining the branch name.
  • .github/actions/push-sandbox/action.yml
    • Adjusted the push-sandbox action to pass github-ref-name, github-sha, steps.image_tag.outputs.FINAL_TAG, and steps.docker_build.outputs.uri as environment variables for image tagging, building, and publishing steps.
  • .github/actions/setup-npmrc/action.yml
    • Modified the setup-npmrc action to use an environment variable for the github-token input when configuring the .npmrc file.
  • .github/actions/tag-npm-release/action.yml
    • Updated the tag-npm-release action to use environment variables for core-package-name, version, channel, cli-package-name, and a2a-package-name when adding npm distribution tags and logging dry run messages.
  • .github/actions/verify-release/action.yml
    • Refactored the verify-release action to use environment variables for expected-version and npm-package inputs during version verification checks for both gemini and npx commands.
Ignored Files
  • Ignored by pattern: .github/workflows/** (8)
    • .github/workflows/chained_e2e.yml
    • .github/workflows/ci.yml
    • .github/workflows/deflake.yml
    • .github/workflows/eval.yml
    • .github/workflows/evals-nightly.yml
    • .github/workflows/release-patch-3-release.yml
    • .github/workflows/release-promote.yml
    • .github/workflows/trigger_e2e.yml
Activity
  • No human activity (comments, reviews, etc.) has been recorded on this pull request yet.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

@gemini-cli gemini-cli bot added the status/need-issue Pull requests that need to have an associated issue. label Feb 18, 2026
@github-actions
Copy link

github-actions bot commented Feb 18, 2026 •
edited
Loading

Size Change: -2 B (0%)

Total Size: 25.7 MB

ℹ️ View Unchanged
Filename Size Change
./bundle/gemini.js 25.2 MB -2 B (0%)
./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js 221 kB 0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js 227 kB 0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js 11.5 kB 0 B
./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js 132 B 0 B
./bundle/sandbox-macos-permissive-open.sb 890 B 0 B
./bundle/sandbox-macos-permissive-proxied.sb 1.31 kB 0 B
./bundle/sandbox-macos-restrictive-open.sb 3.36 kB 0 B
./bundle/sandbox-macos-restrictive-proxied.sb 3.56 kB 0 B
./bundle/sandbox-macos-strict-open.sb 4.82 kB 0 B
./bundle/sandbox-macos-strict-proxied.sb 5.02 kB 0 B

compressed-size-action

gemini-code-assist[bot]
gemini-code-assist bot reviewed Feb 18, 2026
View reviewed changes
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request refactors several GitHub Actions by moving direct inputs and steps.outputs references into explicit env variables within the run steps. This is a good practice that enhances readability, improves maintainability, and mitigates potential shell injection risks by ensuring variables are properly expanded and quoted. The changes are consistent across all modified action files and align with recommended GitHub Actions best practices.

@google-admin
Copy link
Contributor Author

google-admin commented Feb 23, 2026

Hello,

As mentioned in the PR description, this change will be force merged if it does not receive a response by EOD. Please merge the PR or, if it can't be merged, leave a comment explaining why.

Thanks,
-GHSS

@google-admin google-admin merged commit ac454bc into main Feb 26, 2026
23 of 24 checks passed
@google-admin google-admin deleted the lsc-1771432667.928861 branch February 26, 2026 17:58
heaventourist pushed a commit to heaventourist/gemini-cli that referenced this pull request Feb 26, 2026
@google-admin @benknutson-google @heaventourist
Refactor Github Action per b/485167538 (google-gemini#19443)
24a68da 
Co-authored-by: Ben Knutson <benknutson@google.com>
This was referenced Feb 26, 2026
Closed
Merged
galz10 pushed a commit that referenced this pull request Feb 26, 2026
@jerop
fix(github): resolve actionlint and yamllint regressions from #19443 (#…
020da58 
…20467)
@gemini-code-assist gemini-code-assist bot mentioned this pull request Feb 27, 2026
Merged
thacio added a commit to thacio/auditaria that referenced this pull request Feb 27, 2026
@thacio
Merge(Auto) Commit '020da5832': fix(github): resolve actionlint and y…
fe53f18 
…amllint regressions from google-gemini#19443
BryanBradfo pushed a commit to BryanBradfo/gemini-cli that referenced this pull request Mar 5, 2026
@google-admin @benknutson-google @BryanBradfo
Refactor Github Action per b/485167538 (google-gemini#19443)
c72be55 
Co-authored-by: Ben Knutson <benknutson@google.com>
BryanBradfo pushed a commit to BryanBradfo/gemini-cli that referenced this pull request Mar 5, 2026
@jerop @BryanBradfo
fix(github): resolve actionlint and yamllint regressions from google-…
68d2107 
…gemini#19443 (google-gemini#20467)
liamhelmer pushed a commit to badal-io/gemini-cli that referenced this pull request Mar 12, 2026
@google-admin @benknutson-google @liamhelmer
Refactor Github Action per b/485167538 (google-gemini#19443)
c065be8 
Co-authored-by: Ben Knutson <benknutson@google.com>
liamhelmer pushed a commit to badal-io/gemini-cli that referenced this pull request Mar 12, 2026
@jerop @liamhelmer
fix(github): resolve actionlint and yamllint regressions from google-…
07b20b8 
…gemini#19443 (google-gemini#20467)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@jackwotherspoon jackwotherspoon

Labels

status/need-issue Pull requests that need to have an associated issue.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@google-admin @jackwotherspoon @benknutson-google