gemini-review-bot

KO | EN

gitlite — search

#anthropic #terminal #machine-learning #api #computer-vision #video #containers #react-native #security #devops

gemini-review-bot

(★ 9)

Review your PRs with Gemini & your API key

File Explorer

ZIP Download

- - ci.yml
  - gemini-review.yml
  - spike.yml
- gemini-review.yml
- org-caller-workflow.yml
- org-reusable-workflow.yml
- auth.ts
- config.ts
- diff.ts
- gemini.ts
- github.ts
- main.ts
- minimatch.ts
- parse.ts
- prompt.ts
- trigger.ts
- types.ts
- auth.test.ts
- config.test.ts
- diff.test.ts
- e2e.test.ts
- gemini.test.ts
- github.test.ts
- parse.test.ts
- prompt.test.ts
- thread.test.ts
- trigger.test.ts
.gitignore
action.yml
BUILD_PLAN.md
LICENSE
package-lock.json
package.json
PRD.md
README.md
tsconfig.json

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

AI code review for GitHub pull requests, powered by the **Gemini API** and **Google Cloud Vertex AI**.
A free, open-source GitHub Action — a drop-in replacement for the sunsetting Gemini Code
Assist review bot. No hosted service: it runs on your own runner with your own API key.

- 🔎 Reviews PR diffs and posts **inline comments** with code **suggestions**.
- 🏷️ Labels findings **🔴 Critical / 🟠 High / 🟡 Medium / 🟢 Low**.
- 💬 **Follow-up Q&A**: reply to any review comment thread with `/gemini <question>` or `/gemini-review <question>`.
- 🎯 **On-demand line reviews**: start a review comment on any diff line with `/gemini <question>`.
- ⚡ Reviews automatically when a PR is **opened**; re-review the whole PR with `/gemini-review`.
- 👀 Reacts with an **eyes** emoji the moment it picks up a request, so you know it's working.
- 🧩 Configurable model, ignores, and limits.

## Quick start (single repo)

1. Obtain an API key:
   - **Google AI Studio (Gemini API):** Create an API key at [Google AI Studio](https://aistudio.google.com/) and save it as `GEMINI_API_KEY`.
   - **Vertex AI / Agent Platform (Google Cloud):** Use an Agent Platform or Vertex AI API key and save it as `AGENT_PLATFORM_API_KEY` (recommended for standard Google Cloud postpay billing).
2. Add your key as a repository secret (either `GEMINI_API_KEY` or `AGENT_PLATFORM_API_KEY`).
3. (Optional) Run the **spike** workflow ([.github/workflows/spike.yml](.github/workflows/spike.yml))
   to confirm your key + model id work and you're within quota.
4. Add `.github/workflows/gemini-review.yml` (see [examples/gemini-review.yml](examples/gemini-review.yml)).

## Org-wide setup (one key for many repos)

Set `GEMINI_API_KEY` or `AGENT_PLATFORM_API_KEY` **once** as an organization secret
(Org → Settings → Secrets and variables → Actions), scoped to selected repos, then:

1. Add the reusable workflow to your org's `.github` repo
   ([examples/org-reusable-workflow.yml](examples/org-reusable-workflow.yml)).
2. Add the tiny caller to each repo
   ([examples/org-caller-workflow.yml](examples/org-caller-workflow.yml)).

Notes:
- **Billing & Quota:** For AI Studio keys (`GEMINI_API_KEY`), one key = one quota bucket shared across all repos, subject to AI Studio prepaid credit balances. For organizations with multiple active repos, using Vertex AI / Agent Platform (`AGENT_PLATFORM_API_KEY`) is recommended to leverage standard Google Cloud postpay billing and avoid prepaid credit exhaustion interruptions.
- **Plan limits:** restricting an org secret to *private* repos needs GitHub Team/Enterprise
  (public repos work on Free).
- **Scope it:** grant the secret to *selected* repos, not "all". Fork PRs never receive org
  secrets — which aligns with this action's same-repo-only rule.

## Configuration

Settings live in **two different files** — don't mix them up:

1. **The workflow** (`.github/workflows/gemini-review.yml`) runs the action and passes
   **action inputs** under `with:`.
2. **The config file** (`.github/gemini-review.yml` — note: *not* in `workflows/`) holds
   review settings. It's optional.

### Action inputs (workflow `with:`)

| Input                    | Required | Description                                                                                    |
| ------------------------ | -------- | ---------------------------------------------------------------------------------------------- |
| `gemini_api_key`         | see note | Google AI Studio API key (Gemini API endpoints). Pass a secret.                                |
| `agent_platform_api_key` | see note | Vertex AI / Agent Platform API key (Vertex AI endpoints). Pass a secret.                       |
| `github_token`           | no       | Token for posting comments. Defaults to the automatic `GITHUB_TOKEN`.                           |
| `model`                  | no       | Gemini model id. Overrides the config file.                                                    |
| `instructions`           | no       | Extra review guidance. Overrides the config file.                                              |
| `config_path`            | no       | Path to the config file. Default: `.github/gemini-review.yml`.                                 |

> [!NOTE]
> ### Authentication & Recent Billing Changes (Prepaid vs. Postpay)
> Either `gemini_api_key` (or `GEMINI_API_KEY` env var) or `agent_platform_api_key` (or `AGENT_PLATFORM_API_KEY` / `AGENT_PLATFORM_KEY` env var) must be provided:
>
> - **Google AI Studio (`gemini_api_key`):** Connects to default Gemini API endpoints. Google AI Studio has transitioned paid tiers to a **prepaid billing model** requiring developers to purchase credits upfront or configure auto-reload. If your prepaid balance drops to zero or free-tier rate limits are reached, review requests will fail.
> - **Vertex AI / Agent Platform (`agent_platform_api_key`):** Connects directly to Google Cloud **Vertex AI** endpoints (`vertexai: true`). This is recommended for teams that want to use standard **Google Cloud postpay billing** (monthly invoicing), existing GCP commitments, or Agent Platform keys without managing separate upfront prepaid credit balances.
>
> When using Vertex AI, the default model alias `gemini-flash-latest` automatically resolves to `gemini-2.5-flash`.

```yaml
# Option A: Using Google AI Studio (default Gemini API)
- uses: jgunnink/gemini-review-bot@v1
  with:
    gemini_api_key: ${{ secrets.GEMINI_API_KEY }}

# Option B: Using Vertex AI / Agent Platform (recommended for GCP postpay billing)
- uses: jgunnink/gemini-review-bot@v1
  with:
    agent_platform_api_key: ${{ secrets.AGENT_PLATFORM_API_KEY }}
```

### Config file (`.github/gemini-review.yml`, optional)

```yaml
model: gemini-flash-latest      # default; Gemini model id
max_diff_bytes: 400000          # skip review above this diff size
max_findings: 10                # maximum number of review findings (default: 10)
ignore:                         # extra globs (merged with built-in defaults)
  - "docs/**"
instructions: |                 # optional extra review guidance
  Flag any new module that ships without tests.
```

`model` and `instructions` can be set in either place; the action input wins when both are
set. `max_diff_bytes`, `max_findings`, and `ignore` are config-file only.

Built-in ignores (always applied): lockfiles, `dist/`, `build/`, `*.min.js`, `vendor/`,
`*.snap`, `go.sum`.

## How it works
 
- **Full PR review:** `pull_request` / `issue_comment` → 👀 reaction added to acknowledge the request (the
  `/gemini-review` comment, or the PR description on auto-review) → diff fetched via Octokit → filtered by ignores + size
  caps → prompt built (diff framed as untrusted data) → **Gemini API call with a
  `responseSchema`** (native JSON, no fragile parsing) → findings validated → inline comments
  + rolling summary posted as `github-actions[bot]` → 👀 reaction replaced with 👍 on completion.
- **Inline thread Q&A / Line inquiries:** `pull_request_review_comment` containing `/gemini` or `/gemini-review`
  (or `@gemini`) → 👀 reaction added to the comment → comment thread history and diff hunk fetched →
  Gemini generates a targeted markdown response (with `suggestion` code blocks when appropriate) → posted
  directly as a reply in the review thread → 👀 reaction replaced with 👍 on completion.

See [PRD.md](PRD.md) and [BUILD_PLAN.md](BUILD_PLAN.md) for the full spec.

## Limitations (v1)

- **Same-repo PRs only** (fork PRs unsupported — security/token reasons).
- Reviews the **diff** (+ PR title/body), not the whole repo. No agentic file exploration.
- Inline comments **stack** on re-review; the summary comment updates in place.
- **Quota & billing limits:** Free-tier AI Studio keys are strictly rate-limited; paid AI Studio keys require maintaining an active prepaid credit balance. Use `agent_platform_api_key` with Vertex AI if you prefer standard Google Cloud postpay billing and enterprise quotas.

## Development

```bash
npm install        # local dev only — do NOT commit the resulting lockfile (see below)
npm run typecheck
npm test
npm start          # runs src/main.ts directly on Node 24 (native TS — no build step)
```

### Updating dependencies

CI and the action run on Linux with strict `npm ci`, so `package-lock.json` must be
generated on Linux — a macOS/Windows lockfile omits Linux-only optional native bindings
(e.g. Vitest's `unrs-resolver`) and breaks `npm ci`. After changing deps, regenerate it in a
Linux container and commit only that lockfile:

```bash
docker run --rm -v "$PWD":/app -w /app node:24-slim \
  bash -c "rm -rf node_modules package-lock.json && npm install"
```

## License

MIT

gemini-review-bot

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

gemini-review-bot

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README