feat(ci): add Gemini auto review and invoke workflows

[DeanChensj]

Same config as in adk-python-community

[sasha-gitg]

Overview

This PR introduces three new GitHub Actions workflows (gemini-dispatch.yml, gemini-invoke.yml, and gemini-review.yml) to integrate Gemini CLI for automated PR reviews and issue interactions. Overall, the structure is clean, but there is a critical logic flaw in the dispatch workflow and a few configuration improvements needed.

Review Comments

1. .github/workflows/gemini-dispatch.yml (Lines +16-19, +101-114)

   • Issue: The pull_request trigger includes ready_for_review. However, in the Extract command step, eventType === 'pull_request.opened' is checked, but pull_request.ready_for_review is not handled. This causes ready_for_review events to fall through to command = 'fallthrough'. Consequently, the fallthrough job runs and posts a failure comment ("🤖 I'm sorry @Actor, but I was unable to process your request.") whenever a draft PR is marked as ready for review.
   • Why: Potential Bug / Logic Error. Users will receive false-positive failure notifications when marking PRs ready for review.
   • Fix: Update the condition to handle ready_for_review:

     if(eventType==='pull_request.opened'||eventType==='pull_request.ready_for_review'){core.setOutput('command','review');}

   • Severity: Critical

2. .github/workflows/gemini-invoke.yml (Lines +304-305) & .github/workflows/gemini-review.yml (Lines +418-419)

   • Issue: In the settings JSON block, GITHUB_PERSONAL_ACCESS_TOKEN is configured as "${GITHUB_TOKEN}".
   • Why: Potential Bug / Best Practice. If run-gemini-cli does not perform environment variable expansion within the JSON payload before passing it to the docker container, the container will receive the literal string "${GITHUB_TOKEN}" rather than the actual token.
   • Fix: Use GitHub Actions expression syntax to interpolate the token directly into the JSON string, or verify that run-gemini-cli explicitly expands environment variables in settings:

     "env": {
     "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ env.GITHUB_TOKEN }}"
     }

   • Severity: Major

3. .github/workflows/gemini-review.yml (Lines +406-421)

   • Issue: The mcpServers.github block omits includeTools. In contrast, gemini-invoke.yml explicitly restricts tools using includeTools.
   • Why: Security / Least Privilege. Omitting includeTools exposes all available tools from github-mcp-server to the model during PR reviews. Although workflow permissions are scoped, adhering to least privilege is best practice.
   • Fix: Explicitly restrict includeTools to the specific tools required by the review prompt:

     "includeTools": [
     "pull_request_read",
     "add_comment_to_pending_review",
     "pull_request_review_write"
     ]

   • Severity: Suggestion

[DeanChensj]

Addressed your comments, thanks @sasha-gitg

[adk-bot]

Thank you @DeanChensj for your contribution! 🎉

Your changes have been successfully imported and merged via Copybara in commit fd8b492.

Closing this PR as the changes are now in the main branch.