google-github-actions / google-github-actions/run-gemini-cli
run-gemini-cli does not inherit authentication from google-github-actions/auth
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 285
- Avg merge
- 8h 8m
- Merged PRs (30d)
- 1
Description
Summary
When using google-github-actions/auth@v3 with credentials_json before run-gemini-cli@v0, the action does not inherit the authentication and emits the following warning:
No authentication method provided. Please provide one of 'gemini_api_key', 'google_api_key', or 'gcp_workload_identity_provider'.
Even though the GOOGLE_APPLICATION_CREDENTIALS environment variable is correctly set by the auth action, run-gemini-cli does not recognize it and requires explicit authentication parameters.
Expected Behavior
The action should recognize authentication established by google-github-actions/auth@v3, similar to how other Google GitHub Actions work (e.g., google-github-actions/deploy-cloudrun).
Observed Behavior
- The action emits "No authentication method provided" warning
- Gemini CLI fails to authenticate with Vertex AI
- The
ghCLI commands within Gemini sandbox also fail to authenticate (even withGH_TOKENenv var andsandbox: false)
Workflow Configuration
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@v3
with:
credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS_POC }}
create_credentials_file: true
- name: Automatic PR Review with Gemini
uses: google-github-actions/run-gemini-cli@v0
with:
use_vertex_ai: true
gcp_project_id: 'my-project'
gcp_location: 'global'
gemini_debug: true
settings: |
{
"model": "gemini-3-pro-preview",
"sandbox": false
}
prompt: |
Review this PR...
env:
GH_TOKEN: ${{ secrets.GH_PAT }}
Logs
The environment shows auth was successful:
GOOGLE_APPLICATION_CREDENTIALS: /home/runner/work/.../gha-creds-xxx.json
CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE: /home/runner/work/.../gha-creds-xxx.json
But the action still warns about missing authentication.
Workaround
Currently, users must either:
- Use
gcp_workload_identity_providerparameter (requires WIF setup) - Pin to an older version (e.g.,
@v0.1.17)
Environment
- Action version: v0.1.19 / v0.1.20
- Runner: ubuntu-latest
- Auth action: google-github-actions/auth@v3
Impact
This is a breaking change for users who were previously using credentials_json with the auth action. The action should either:
- Recognize
GOOGLE_APPLICATION_CREDENTIALSenvironment variable - Document that
gcp_workload_identity_provideris now required
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing authentication handling in run-gemini-cli when it follows google-github-actions/auth@v3 with credentials_json, using the reported workflow and logs as the reproduction. Verify whether GOOGLE_APPLICATION_CREDENTIALS is recognized for Vertex AI and whether the warning and Gemini CLI authentication failure disappear; document the required behavior in tests if the repository provides them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, google-cloud, typescript
- Domain
- authentication, ci-cd
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100