release: engine 0.13.0 snapshot sync (BUSL-1.1)

.github/workflows/gemini-dispatch.yml

@@ -83,7 +83,7 @@ jobs:
 
       - name: 'Extract command'
         id: 'extract_command'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           EVENT_TYPE: '${{ github.event_name }}.${{ github.event.action }}'
           REQUEST: '${{ github.event.comment.body || github.event.review.body || github.event.issue.body }}'
@@ -135,7 +135,10 @@ jobs:
       pull-requests: 'write'
     with:
       additional_context: '${{ needs.dispatch.outputs.additional_context }}'
-    secrets: 'inherit'
+    secrets:
+      APP_PRIVATE_KEY: '${{ secrets.APP_PRIVATE_KEY }}'
+      GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+      GOOGLE_API_KEY: '${{ secrets.GOOGLE_API_KEY }}'
 
   triage:
     needs: 'dispatch'
@@ -149,7 +152,10 @@ jobs:
       pull-requests: 'write'
     with:
       additional_context: '${{ needs.dispatch.outputs.additional_context }}'
-    secrets: 'inherit'
+    secrets:
+      APP_PRIVATE_KEY: '${{ secrets.APP_PRIVATE_KEY }}'
+      GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+      GOOGLE_API_KEY: '${{ secrets.GOOGLE_API_KEY }}'
 
   invoke:
     needs: 'dispatch'
@@ -163,7 +169,10 @@ jobs:
       pull-requests: 'write'
     with:
       additional_context: '${{ needs.dispatch.outputs.additional_context }}'
-    secrets: 'inherit'
+    secrets:
+      APP_PRIVATE_KEY: '${{ secrets.APP_PRIVATE_KEY }}'
+      GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+      GOOGLE_API_KEY: '${{ secrets.GOOGLE_API_KEY }}'
 
   fallthrough:
     needs:

.github/workflows/gemini-invoke.yml

@@ -2,6 +2,13 @@ name: '▶️ Gemini Invoke'
 
 on:
   workflow_call:
+    secrets:
+      APP_PRIVATE_KEY:
+        required: false
+      GEMINI_API_KEY:
+        required: false
+      GOOGLE_API_KEY:
+        required: false
     inputs:
       additional_context:
         type: 'string'
@@ -37,9 +44,26 @@ jobs:
           permission-issues: 'write'
           permission-pull-requests: 'write'
 
+      - name: 'Check authentication configuration'
+        id: 'check_auth'
+        env:
+          HAS_GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY != '' }}
+          HAS_GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY != '' }}
+          HAS_WIF_PROVIDER: ${{ vars.GCP_WIF_PROVIDER != '' }}
+          HAS_USE_VERTEXAI: ${{ vars.GOOGLE_GENAI_USE_VERTEXAI != '' }}
+          HAS_USE_GCA: ${{ vars.GOOGLE_GENAI_USE_GCA != '' }}
+        run: |-
+          if [[ "${HAS_GEMINI_API_KEY}" == "true" || "${HAS_GOOGLE_API_KEY}" == "true" || "${HAS_WIF_PROVIDER}" == "true" || "${HAS_USE_VERTEXAI}" == "true" || "${HAS_USE_GCA}" == "true" ]]; then
+            echo "configured=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "configured=false" >> "${GITHUB_OUTPUT}"
+            echo "::warning::No Gemini authentication configured. Set one of: GEMINI_API_KEY secret, GOOGLE_API_KEY secret, or configure the GCP_WIF_PROVIDER, GOOGLE_GENAI_USE_VERTEXAI, or GOOGLE_GENAI_USE_GCA variables."
+          fi
+
       - name: 'Run Gemini CLI'
         id: 'run_gemini'
-        uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
+        if: '${{ steps.check_auth.outputs.configured == ''true'' }}'
+        uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # ratchet:exclude
         env:
           TITLE: '${{ github.event.pull_request.title || github.event.issue.title }}'
           DESCRIPTION: '${{ github.event.pull_request.body || github.event.issue.body }}'
@@ -49,6 +73,7 @@ jobs:
           ISSUE_NUMBER: '${{ github.event.pull_request.number || github.event.issue.number }}'
           REPOSITORY: '${{ github.repository }}'
           ADDITIONAL_CONTEXT: '${{ inputs.additional_context }}'
+          GEMINI_CLI_TRUST_WORKSPACE: 'true'
         with:
           gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'

.github/workflows/gemini-review.yml

@@ -2,6 +2,13 @@ name: '🔎 Gemini Review'
 
 on:
   workflow_call:
+    secrets:
+      APP_PRIVATE_KEY:
+        required: false
+      GEMINI_API_KEY:
+        required: false
+      GOOGLE_API_KEY:
+        required: false
     inputs:
       additional_context:
         type: 'string'
@@ -41,8 +48,25 @@ jobs:
       - name: 'Checkout repository'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
 
+      - name: 'Check authentication configuration'
+        id: 'check_auth'
+        env:
+          HAS_GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY != '' }}
+          HAS_GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY != '' }}
+          HAS_WIF_PROVIDER: ${{ vars.GCP_WIF_PROVIDER != '' }}
+          HAS_USE_VERTEXAI: ${{ vars.GOOGLE_GENAI_USE_VERTEXAI != '' }}
+          HAS_USE_GCA: ${{ vars.GOOGLE_GENAI_USE_GCA != '' }}
+        run: |-
+          if [[ "${HAS_GEMINI_API_KEY}" == "true" || "${HAS_GOOGLE_API_KEY}" == "true" || "${HAS_WIF_PROVIDER}" == "true" || "${HAS_USE_VERTEXAI}" == "true" || "${HAS_USE_GCA}" == "true" ]]; then
+            echo "configured=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "configured=false" >> "${GITHUB_OUTPUT}"
+            echo "::warning::No Gemini authentication configured. Set one of: GEMINI_API_KEY secret, GOOGLE_API_KEY secret, or configure the GCP_WIF_PROVIDER, GOOGLE_GENAI_USE_VERTEXAI, or GOOGLE_GENAI_USE_GCA variables."
+          fi
+
       - name: 'Run Gemini pull request review'
-        uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
+        if: '${{ steps.check_auth.outputs.configured == ''true'' }}'
+        uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # ratchet:exclude
         id: 'gemini_pr_review'
         env:
           GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
@@ -51,6 +75,7 @@ jobs:
           PULL_REQUEST_NUMBER: '${{ github.event.pull_request.number || github.event.issue.number }}'
           REPOSITORY: '${{ github.repository }}'
           ADDITIONAL_CONTEXT: '${{ inputs.additional_context }}'
+          GEMINI_CLI_TRUST_WORKSPACE: 'true'
         with:
           gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
@@ -65,6 +90,7 @@ jobs:
           use_vertex_ai: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}'
           upload_artifacts: '${{ vars.UPLOAD_ARTIFACTS }}'
           workflow_name: 'gemini-review'
+          github_pr_number: '${{ github.event.pull_request.number || github.event.issue.number }}'
           settings: |-
             {
               "model": {
@@ -84,13 +110,12 @@ jobs:
                     "--rm",
                     "-e",
                     "GITHUB_PERSONAL_ACCESS_TOKEN",
-                    "ghcr.io/github/github-mcp-server:v0.18.0"
+                    "ghcr.io/github/github-mcp-server:v0.27.0"
                   ],
                   "includeTools": [
                     "add_comment_to_pending_review",
-                    "create_pending_pull_request_review",
                     "pull_request_read",
-                    "submit_pending_pull_request_review"
+                    "pull_request_review_write"
                   ],
                   "env": {
                     "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"

.github/workflows/gemini-scheduled-triage.yml

@@ -40,7 +40,7 @@ jobs:
     steps:
       - name: 'Get repository labels'
         id: 'get_labels'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7.0.1
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.0.1
         with:
           # NOTE: we intentionally do not use the minted token. The default
           # GITHUB_TOKEN provided by the action has enough permissions to read
@@ -85,16 +85,33 @@ jobs:
           ISSUE_COUNT="$(echo "${ISSUES}" | jq 'length')"
           echo "✅ Found ${ISSUE_COUNT} issue(s) to triage! 🎯"
 
+      - name: 'Check authentication configuration'
+        id: 'check_auth'
+        env:
+          HAS_GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY != '' }}
+          HAS_GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY != '' }}
+          HAS_WIF_PROVIDER: ${{ vars.GCP_WIF_PROVIDER != '' }}
+          HAS_USE_VERTEXAI: ${{ vars.GOOGLE_GENAI_USE_VERTEXAI != '' }}
+          HAS_USE_GCA: ${{ vars.GOOGLE_GENAI_USE_GCA != '' }}
+        run: |-
+          if [[ "${HAS_GEMINI_API_KEY}" == "true" || "${HAS_GOOGLE_API_KEY}" == "true" || "${HAS_WIF_PROVIDER}" == "true" || "${HAS_USE_VERTEXAI}" == "true" || "${HAS_USE_GCA}" == "true" ]]; then
+            echo "configured=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "configured=false" >> "${GITHUB_OUTPUT}"
+            echo "::warning::No Gemini authentication configured. Set one of: GEMINI_API_KEY secret, GOOGLE_API_KEY secret, or configure the GCP_WIF_PROVIDER, GOOGLE_GENAI_USE_VERTEXAI, or GOOGLE_GENAI_USE_GCA variables."
+          fi
+
       - name: 'Run Gemini Issue Analysis'
         id: 'gemini_issue_analysis'
         if: |-
-          ${{ steps.find_issues.outputs.issues_to_triage != '[]' }}
-        uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
+          ${{ steps.find_issues.outputs.issues_to_triage != '[]' && steps.check_auth.outputs.configured == 'true' }}
+        uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # ratchet:exclude
         env:
           GITHUB_TOKEN: '' # Do not pass any auth token here since this runs on untrusted inputs
           ISSUES_TO_TRIAGE: '${{ steps.find_issues.outputs.issues_to_triage }}'
           REPOSITORY: '${{ github.repository }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
+          GEMINI_CLI_TRUST_WORKSPACE: 'true'
         with:
           gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
@@ -159,7 +176,7 @@ jobs:
         env:
           AVAILABLE_LABELS: '${{ needs.triage.outputs.available_labels }}'
           TRIAGED_ISSUES: '${{ needs.triage.outputs.triaged_issues }}'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7.0.1
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.0.1
         with:
           # Use the provided token so that the "gemini-cli" is the actor in the
           # log for what changed the labels.

.github/workflows/gemini-triage.yml

@@ -2,6 +2,13 @@ name: '🔀 Gemini Triage'
 
 on:
   workflow_call:
+    secrets:
+      APP_PRIVATE_KEY:
+        required: false
+      GEMINI_API_KEY:
+        required: false
+      GOOGLE_API_KEY:
+        required: false
     inputs:
       additional_context:
         type: 'string'
@@ -31,7 +38,7 @@ jobs:
     steps:
       - name: 'Get repository labels'
         id: 'get_labels'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7.0.1
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.0.1
         with:
           # NOTE: we intentionally do not use the given token. The default
           # GITHUB_TOKEN provided by the action has enough permissions to read
@@ -55,16 +62,33 @@ jobs:
             core.info(`Found ${labelNames.length} labels: ${labelNames.join(', ')}`);
             return labelNames;
 
+      - name: 'Check authentication configuration'
+        id: 'check_auth'
+        env:
+          HAS_GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY != '' }}
+          HAS_GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY != '' }}
+          HAS_WIF_PROVIDER: ${{ vars.GCP_WIF_PROVIDER != '' }}
+          HAS_USE_VERTEXAI: ${{ vars.GOOGLE_GENAI_USE_VERTEXAI != '' }}
+          HAS_USE_GCA: ${{ vars.GOOGLE_GENAI_USE_GCA != '' }}
+        run: |-
+          if [[ "${HAS_GEMINI_API_KEY}" == "true" || "${HAS_GOOGLE_API_KEY}" == "true" || "${HAS_WIF_PROVIDER}" == "true" || "${HAS_USE_VERTEXAI}" == "true" || "${HAS_USE_GCA}" == "true" ]]; then
+            echo "configured=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "configured=false" >> "${GITHUB_OUTPUT}"
+            echo "::warning::No Gemini authentication configured. Set one of: GEMINI_API_KEY secret, GOOGLE_API_KEY secret, or configure the GCP_WIF_PROVIDER, GOOGLE_GENAI_USE_VERTEXAI, or GOOGLE_GENAI_USE_GCA variables."
+          fi
+
       - name: 'Run Gemini issue analysis'
         id: 'gemini_analysis'
         if: |-
-          ${{ steps.get_labels.outputs.available_labels != '' }}
-        uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
+          ${{ steps.get_labels.outputs.available_labels != '' && steps.check_auth.outputs.configured == 'true' }}
+        uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # ratchet:exclude
         env:
           GITHUB_TOKEN: '' # Do NOT pass any auth tokens here since this runs on untrusted inputs
           ISSUE_TITLE: '${{ github.event.issue.title }}'
           ISSUE_BODY: '${{ github.event.issue.body }}'
           AVAILABLE_LABELS: '${{ steps.get_labels.outputs.available_labels }}'
+          GEMINI_CLI_TRUST_WORKSPACE: 'true'
         with:
           gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}'
           gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}'
@@ -125,7 +149,7 @@ jobs:
           ISSUE_NUMBER: '${{ github.event.issue.number }}'
           AVAILABLE_LABELS: '${{ needs.triage.outputs.available_labels }}'
           SELECTED_LABELS: '${{ needs.triage.outputs.selected_labels }}'
-        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7.0.1
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.0.1
         with:
           # Use the provided token so that the "gemini-cli" is the actor in the
           # log for what changed the labels.