Infrastructure/11405 gemini automation #12019

eugene-manuilov · 2026-01-02T10:18:45Z

Summary

Addresses issue:

Add Gemini AI automation to implement issues #11405

Relevant technical choices

PR Author Checklist

My code is tested and passes existing unit tests.
My code has an appropriate set of unit tests which all pass.
My code is backward-compatible with WordPress 5.2 and PHP 7.4.
My code follows the WordPress coding standards.
My code has proper inline documentation.
I have added a QA Brief on the issue linked above.
I have signed the Contributor License Agreement (see https://cla.developers.google.com/).

Do not alter or remove anything below. The following sections will be managed by moderators only.

Code Reviewer Checklist

Run the code.
Ensure the acceptance criteria are satisfied.
Reassess the implementation with the IB.
Ensure no unrelated changes are included.
Ensure CI checks pass.
Check Storybook where applicable.
Ensure there is a QA Brief.
Ensure there are no unexpected significant changes to file sizes.

Merge Reviewer Checklist

Ensure the PR has the correct target branch.
Double-check that the PR is okay to be merged.
Ensure the corresponding issue has a ZenHub release assigned.
Add a changelog message to the issue.

…11405-gemini-automation.

…ni CLI.

…de it.

…05-gemini-automation.

aaemnnosttv

Thanks @eugene-manuilov, this is a good start, just a few things to address and consider.

.github/workflows/gemini.yml

aaemnnosttv · 2026-01-07T19:41:22Z

.github/workflows/gemini.yml

+      - name: Run /implement command
+        run: |
+          gemini --yolo --model gemini-3-pro-preview "/implement ${{ inputs.issue_number }}"
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Since we can't further restrict the capabilities of the GITHUB_TOKEN here, we should perhaps exclude it since the model should only need read-only access which it should already have as a public repo. If it is needed, perhaps we can provide a PAT with read-only access. Pushing to the repo doesn't happen until the next step anyways so I'd think this should be ok.

Unfortunately, we need it here. I have updated the gemini settings to restrict the GitHub MCP to allow only the issue toolchain and excluded all tools except the one that reads issue details. Will it work for you?

Thanks – can you be more specific as to what the token is needed for? If it's readonly, then I would think it might even work without a token at all (except for rate limits), but otherwise, we could provide a token which is readonly using a fine-grained token. Even with the limited toolchain, I don't think we should expose/provide a model which is capable of writing anything.

Sure, let's use a fine-grained token that has access only to public repositories. Do you want me creating it or you will create it and add as GITHUB_READONLY_TOKEN?

We can do that, but it would require adding another token that needs rotating due to policy limitations.

How about we split it into two jobs and configure the permissions for each to be scoped as needed? That way we can still use the default GITHUB_TOKEN but it only needs write access to create the PR (correct?). I realize this would make it a little slower because we'd need to upload the changes as an artifact and then download them again afterwards to create a PR with.

Alternatively, we could keep it as a single job and change the permissions to be read only and then use the bot token for creating the PR since permissions only apply to the github token? This might be more appropriate anyways. WDYT?

Ok, I have moved PR creation and comment posting into a new job with write permissions and updated this job to have read-only permissions. It should solve all our concerns here, right?

.gemini/commands/implement.toml

Co-authored-by: Evan Mattson <[email protected]>

…05-gemini-automation.

docs/context/js/hooks.md

…05-gemini-automation.

aaemnnosttv

Thanks @eugene-manuilov , this is nearly there. Just a few last details. See also my reply about the token permissions.

aaemnnosttv · 2026-01-14T18:20:10Z

.gemini/settings.json

+		"exclude": [
+			"github__add_issue_comment",
+			"github__assign_copilot_to_issue",
+			"github__get_label",
+			"github__issue_write",
+			"github__list_issue_types",
+			"github__list_issues",
+			"github__search_issues",
+			"github__sub_issue_write"
+		]


Can we define this as an allowlist instead?

Yeah, good idea, updated.

aaemnnosttv · 2026-01-14T18:24:45Z

.gemini/commands/implement.toml

+**1. Understand the Task**
+   - Carefully read the Implementation Brief from Phase 1
+   - Break down complex requirements into discrete steps
+   - Plan your implementation approach before writing code
+   - Identify all files that need to be created, modified, or deleted


Let's update this to mention the AC being the actual requirements that must be met now that it's included in the context collected in phase 1.

aaemnnosttv · 2026-01-14T18:28:39Z

.gemini/commands/implement.toml

+
+Follow these implementation guidelines:
+
+**1. Understand the Task**


It might not make a difference for the model to comprehend, but as an ordered list, I think the formatting should only apply to the list item text, not the number, otherwise it doesn't become an actual list.

e.g.

step 1

step 2

rather than

1. step 1
2. step 2

Looking below, I can see the formatting is applied inconsistently where both forms are used in different places.

aaemnnosttv · 2026-01-14T18:30:01Z

.gemini/commands/implement.toml

+   Check compliance with the extracted "Acceptance criteria":
+   - ✓ Implementation fulfills all points in "Acceptance criteria"


Great! I still think it's probably worth mentioning in the instructions to understand the task beforehand though.

Not sure where you mean we need to add it. Can you clarify?

aaemnnosttv · 2026-01-14T18:32:48Z

.github/workflows/gemini.yml

+  implement:
+    name: Implement Issue
+    runs-on: ubuntu-latest
+    timeout-minutes: 60


This seems longer than reasonable. How long have we seen it take so far?

I don't know how much time it can take when we actually trigger it as a GitHub workflow. Let's have 60 for now and update once we see how it actually works.

…05-gemini-automation.

…creation using patch files and granular permissions.

…ad of a read-only one.

…inclusion list.

eugene-manuilov added 6 commits January 2, 2026 10:49

Merge branch 'infra/11750-context-documentation' into infrastructure/…

151bdb8

…11405-gemini-automation.

Expand Gemini context settings.

59d8f2e

Configure Gemini settings for MCP servers.

d1b7c91

Add implement.toml Gemini command.

73030b5

Add GitHub Actions workflow to automate issue implementation via Gemi…

412a038

…ni CLI.

Add PHPUnit testing documentation and update Gemini settings to inclu…

244a263

…de it.

eugene-manuilov marked this pull request as ready for review January 4, 2026 08:31

Eugene Manuilov added 5 commits January 6, 2026 17:25

Remove unnecessary --prompt flag from Gemini CLI command.

b049e25

Pin @google/gemini-cli to version 0.22.5 in the Gemini workflow.

7daa5b0

Merge remote-tracking branch 'origin/develop' into infrastructure/114…

0bcda2e

…05-gemini-automation.

Reformat Gemini workflow YAML indentation.

960ae91

Merge remote-tracking branch 'origin/develop' into infrastructure/114…

087f637

…05-gemini-automation.

eugene-manuilov requested a review from aaemnnosttv January 7, 2026 18:37

aaemnnosttv requested changes Jan 7, 2026

View reviewed changes

eugene-manuilov and others added 7 commits January 8, 2026 14:07

Apply suggestions from code review

4998b8a

Co-authored-by: Evan Mattson <[email protected]>

Merge remote-tracking branch 'origin/develop' into gemini.

b72651b

Address code review feedback.

a4248f1

Merge remote-tracking branch 'origin/develop' into infrastructure/114…

83b1d73

…05-gemini-automation.

Update gemini version to 0.23.0.

31f27c1

Fix issues in context files and in the implement command.

585b7cf

Update the github mcp settings to whitelist only issue reading tools.

56f7b2d

eugene-manuilov commented Jan 12, 2026

View reviewed changes

docs/context/js/hooks.md Outdated Show resolved Hide resolved

eugene-manuilov requested a review from aaemnnosttv January 12, 2026 15:33

Eugene Manuilov added 4 commits January 14, 2026 15:21

Merge remote-tracking branch 'origin/develop' into infrastructure/114…

c1a2f34

…05-gemini-automation.

Replace @ escaping to use the back slash approach.

873d47c

Update the gemini workflow to use a readonly token to read an issue.

4255bc0

Update the implement command to enforce usage of tests.

f515e39

aaemnnosttv reviewed Jan 14, 2026

View reviewed changes

eugene-manuilov added 2 commits January 15, 2026 10:52

Merge remote-tracking branch 'origin/develop' into infrastructure/114…

19bf854

…05-gemini-automation.

Refactor Gemini workflow to separate implementation and pull request …

d94350c

…creation using patch files and granular permissions.

eugene-manuilov and others added 3 commits January 15, 2026 11:00

Update Gemini workflow to use the default GITHUB_TOKEN secret inste…

04ee04d

…ad of a read-only one.

Switch Gemini GitHub tool configuration from an exclusion list to an …

c6b0c71

…inclusion list.

Update Gemini implement command configuration.

1a22b2d


		Follow these implementation guidelines:

		1. Understand the Task

		Check compliance with the extracted "Acceptance criteria":
		- ✓ Implementation fulfills all points in "Acceptance criteria"

Infrastructure/11405 gemini automation #12019

Are you sure you want to change the base?

Infrastructure/11405 gemini automation #12019

Uh oh!

Conversation

eugene-manuilov commented Jan 2, 2026

Summary

Relevant technical choices

PR Author Checklist

Code Reviewer Checklist

Merge Reviewer Checklist

Uh oh!

aaemnnosttv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aaemnnosttv left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

e.g.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants