google-github-actions / google-github-actions/run-gemini-cli

run-gemini-cli does not inherit authentication from google-github-actions/auth

Open
#455 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area/auth github_actions kind/bug priority/p1 status/gemini-cli-fix
Dominant language
TypeScript
Stars
2.1k
Forks
285
Avg merge
8h 8m
Merged PRs (30d)
1

Description

Summary

When using google-github-actions/auth@v3 with credentials_json before run-gemini-cli@v0, the action does not inherit the authentication and emits the following warning:

No authentication method provided. Please provide one of 'gemini_api_key', 'google_api_key', or 'gcp_workload_identity_provider'.

Even though the GOOGLE_APPLICATION_CREDENTIALS environment variable is correctly set by the auth action, run-gemini-cli does not recognize it and requires explicit authentication parameters.

Expected Behavior

The action should recognize authentication established by google-github-actions/auth@v3, similar to how other Google GitHub Actions work (e.g., google-github-actions/deploy-cloudrun).

Observed Behavior

  1. The action emits "No authentication method provided" warning
  2. Gemini CLI fails to authenticate with Vertex AI
  3. The gh CLI commands within Gemini sandbox also fail to authenticate (even with GH_TOKEN env var and sandbox: false)

Workflow Configuration

- name: Authenticate to Google Cloud
  uses: google-github-actions/auth@v3
  with:
    credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS_POC }}
    create_credentials_file: true

- name: Automatic PR Review with Gemini
  uses: google-github-actions/run-gemini-cli@v0
  with:
    use_vertex_ai: true
    gcp_project_id: 'my-project'
    gcp_location: 'global'
    gemini_debug: true
    settings: |
      {
        "model": "gemini-3-pro-preview",
        "sandbox": false
      }
    prompt: |
      Review this PR...
  env:
    GH_TOKEN: ${{ secrets.GH_PAT }}

Logs

The environment shows auth was successful:

GOOGLE_APPLICATION_CREDENTIALS: /home/runner/work/.../gha-creds-xxx.json
CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE: /home/runner/work/.../gha-creds-xxx.json

But the action still warns about missing authentication.

Workaround

Currently, users must either:

  1. Use gcp_workload_identity_provider parameter (requires WIF setup)
  2. Pin to an older version (e.g., @v0.1.17)

Environment

  • Action version: v0.1.19 / v0.1.20
  • Runner: ubuntu-latest
  • Auth action: google-github-actions/auth@v3

Impact

This is a breaking change for users who were previously using credentials_json with the auth action. The action should either:

  1. Recognize GOOGLE_APPLICATION_CREDENTIALS environment variable
  2. Document that gcp_workload_identity_provider is now required

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing authentication handling in run-gemini-cli when it follows google-github-actions/auth@v3 with credentials_json, using the reported workflow and logs as the reproduction. Verify whether GOOGLE_APPLICATION_CREDENTIALS is recognized for Vertex AI and whether the warning and Gemini CLI authentication failure disappear; document the required behavior in tests if the repository provides them.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, google-cloud, typescript
Domain
authentication, ci-cd
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.