From afed16b32cff2c4a2f683323633427593e343bb6 Mon Sep 17 00:00:00 2001 From: Sumit Date: Wed, 4 Nov 2026 10:37:37 +0530 Subject: [PATCH 1/3] fix(workflows): allowlist activate_skill and mcp_github_* in pr-review example --- .github/workflows/gemini-review.yml | 5 ++++- examples/workflows/pr-review/gemini-review.yml | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yml index 6bdb62238..794d22825 100644 --- a/.github/workflows/gemini-review.yml +++ b/.github/workflows/gemini-review.yml @@ -116,7 +116,10 @@ jobs: } }, "tools": { - "core": [] + "core": [ + "activate_skill", + "mcp_github_*" + ] } } extensions: | diff --git a/examples/workflows/pr-review/gemini-review.yml b/examples/workflows/pr-review/gemini-review.yml index 07f087544..9b2a963ad 100644 --- a/examples/workflows/pr-review/gemini-review.yml +++ b/examples/workflows/pr-review/gemini-review.yml @@ -112,7 +112,10 @@ jobs: } }, "tools": { - "core": [] + "core": [ + "activate_skill", + "mcp_github_*" + ] } } extensions: | From 73b4d80afec628d3eed3f6d36630455054d9a304 Mon Sep 17 00:00:00 2001 From: Sumit Date: Wed, 4 Nov 2026 10:44:35 +0530 Subject: [PATCH 2/3] chore(ci): ignore zizmor unpinned-uses for self-referencing run-gemini-cli@main --- .github/workflows/gemini-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yml index 794d22825..3a187526a 100644 --- a/.github/workflows/gemini-review.yml +++ b/.github/workflows/gemini-review.yml @@ -58,7 +58,7 @@ jobs: ADDITIONAL_CONTEXT: '${{ inputs.additional_context }}' - name: 'Run Gemini pull request review' - uses: 'google-github-actions/run-gemini-cli@main' # ratchet:exclude + uses: 'google-github-actions/run-gemini-cli@main' # ratchet:exclude # zizmor: ignore[unpinned-uses] id: 'gemini_pr_review' env: GEMINI_CLI_TRUST_WORKSPACE: 'true' From 5dc347a5185cb0480971c74e73b2ae2507ef171e Mon Sep 17 00:00:00 2001 From: Sumit Date: Wed, 4 Nov 2026 10:46:54 +0530 Subject: [PATCH 3/3] chore(ci): pin run-gemini-cli to commit hash in gemini-review workflow --- .github/workflows/gemini-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yml index 3a187526a..f26891c75 100644 --- a/.github/workflows/gemini-review.yml +++ b/.github/workflows/gemini-review.yml @@ -58,7 +58,7 @@ jobs: ADDITIONAL_CONTEXT: '${{ inputs.additional_context }}' - name: 'Run Gemini pull request review' - uses: 'google-github-actions/run-gemini-cli@main' # ratchet:exclude # zizmor: ignore[unpinned-uses] + uses: 'google-github-actions/run-gemini-cli@387c8ddb7a72078825da941758b811b9153c71e8' # ratchet:exclude id: 'gemini_pr_review' env: GEMINI_CLI_TRUST_WORKSPACE: 'true'