-
Notifications
You must be signed in to change notification settings - Fork 328
Infrastructure/11405 gemini automation #12019
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 18 commits
151bdb8
59d8f2e
d1b7c91
73030b5
412a038
244a263
b049e25
7daa5b0
0bcda2e
960ae91
087f637
4998b8a
b72651b
a4248f1
83b1d73
31f27c1
585b7cf
56f7b2d
c1a2f34
873d47c
4255bc0
f515e39
19bf854
d94350c
04ee04d
c6b0c71
1a22b2d
f3c169c
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Large diffs are not rendered by default.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,53 @@ | ||
| { | ||
| "contextFileName": "AGENTS.md" | ||
| } | ||
| "context": { | ||
| "fileName": [ | ||
| "AGENTS.md", | ||
| "docs/context/js/component-conventions.md", | ||
| "docs/context/js/module-architecture.md", | ||
| "docs/context/js/widgets.md", | ||
| "docs/context/js/feature-tours.md", | ||
| "docs/context/js/jsdoc.md", | ||
| "docs/context/js/notifications.md", | ||
| "docs/context/js/tests.md", | ||
| "docs/context/js/utils.md", | ||
| "docs/context/js/state-management.md", | ||
| "docs/context/js/hooks.md", | ||
| "docs/context/js/storybook.md", | ||
| "docs/context/js/event-tracking.md", | ||
| "docs/context/js/feature-flags.md", | ||
| "docs/context/php/admin-features.md", | ||
| "docs/context/php/asset-management.md", | ||
| "docs/context/php/context-pattern.md", | ||
| "docs/context/php/dependency-injection.md", | ||
| "docs/context/php/module-architecture.md", | ||
| "docs/context/php/naming-conventions.md", | ||
| "docs/context/php/phpunit.md", | ||
| "docs/context/php/prompts-and-dismissals.md", | ||
| "docs/context/php/rest-api.md", | ||
| "docs/context/php/settings-management.md", | ||
| "docs/context/php/storage-patterns.md", | ||
| "docs/context/php/trait-composition.md" | ||
| ] | ||
| }, | ||
| "mcpServers": { | ||
| "github": { | ||
| "trust": false, | ||
| "httpUrl": "https://api.githubcopilot.com/mcp/?toolsets=issues", | ||
| "headers": { | ||
| "Authorization": "Bearer ${GITHUB_TOKEN}" | ||
| } | ||
| } | ||
| }, | ||
| "tools": { | ||
| "exclude": [ | ||
| "github__add_issue_comment", | ||
| "github__assign_copilot_to_issue", | ||
| "github__get_label", | ||
| "github__issue_write", | ||
| "github__list_issue_types", | ||
| "github__list_issues", | ||
| "github__search_issues", | ||
| "github__sub_issue_write" | ||
| ] | ||
| } | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| name: Gemini Implement Issue | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| issue_number: | ||
| description: GitHub issue number to implement | ||
| required: true | ||
| type: number | ||
|
|
||
| jobs: | ||
| implement: | ||
| name: Implement Issue | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 60 | ||
|
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This seems longer than reasonable. How long have we seen it take so far?
Collaborator
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I don't know how much time it can take when we actually trigger it as a GitHub workflow. Let's have |
||
| permissions: | ||
| contents: write | ||
| issues: write | ||
| pull-requests: write | ||
| services: | ||
| mysql: | ||
| image: mysql:5.7 | ||
| env: | ||
| MYSQL_ROOT_PASSWORD: wordpress | ||
| ports: | ||
| - 3306:3306 | ||
| options: --health-cmd="mysqladmin ping" --health-interval=5s --health-timeout=2s --health-retries=3 | ||
| env: | ||
| DB_HOST: 127.0.0.1 | ||
| DB_PORT: 3306 | ||
| MYSQL_USER: root | ||
| MYSQL_PASSWORD: wordpress | ||
| MYSQL_DATABASE: wordpress_test | ||
| WP_VERSION: latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version-file: .nvmrc | ||
| cache: npm | ||
| - name: Install SVN | ||
| run: sudo apt-get update && sudo apt-get install -y subversion | ||
| - name: Setup PHP | ||
| uses: shivammathur/setup-php@v2 | ||
| with: | ||
| php-version: '7.4' | ||
| extensions: mysqli, runkit7, uopz | ||
| tools: composer:2.1 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Get Composer Cache Directory | ||
| id: composer-cache | ||
| run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" | ||
| - name: Cache Composer dependencies | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: ${{ steps.composer-cache.outputs.dir }} | ||
| key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-composer- | ||
| - name: Validate Composer configuration | ||
| run: composer validate --strict | ||
| - name: Install Composer dependencies | ||
| run: composer install --no-interaction --no-progress | ||
| - name: Install npm dependencies | ||
| run: npm ci -w assets -w storybook -w tests/js -w tests/e2e --include-workspace-root | ||
| - name: Set up WordPress test data | ||
| run: tests/phpunit/bin/install-wp-tests.sh "${MYSQL_DATABASE}" "${MYSQL_USER}" "${MYSQL_PASSWORD}" "${DB_HOST}":"${DB_PORT}" "${WP_VERSION}" | ||
| - name: Install Gemini CLI | ||
| run: | | ||
| npm install -g @google/gemini-cli@0.23.0 | ||
| gemini --version | ||
| - name: Run /implement command | ||
| run: | | ||
| gemini --yolo --model gemini-3-pro-preview "/implement ${{ inputs.issue_number }}" | ||
| env: | ||
| GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
Comment on lines
+74
to
+79
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Since we can't further restrict the capabilities of the GITHUB_TOKEN here, we should perhaps exclude it since the model should only need read-only access which it should already have as a public repo. If it is needed, perhaps we can provide a PAT with read-only access. Pushing to the repo doesn't happen until the next step anyways so I'd think this should be ok.
Collaborator
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Unfortunately, we need it here. I have updated the gemini settings to restrict the GitHub MCP to allow only the
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Thanks – can you be more specific as to what the token is needed for? If it's readonly, then I would think it might even work without a token at all (except for rate limits), but otherwise, we could provide a token which is readonly using a fine-grained token. Even with the limited toolchain, I don't think we should expose/provide a model which is capable of writing anything.
Collaborator
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Sure, let's use a fine-grained token that has access only to public repositories. Do you want me creating it or you will create it and add as
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We can do that, but it would require adding another token that needs rotating due to policy limitations. How about we split it into two jobs and configure the Alternatively, we could keep it as a single job and change the
Collaborator
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Ok, I have moved PR creation and comment posting into a new job with write permissions and updated this job to have read-only permissions. It should solve all our concerns here, right? |
||
| - name: Create Pull Request | ||
| id: create-pr | ||
| uses: peter-evans/create-pull-request@v7 | ||
| with: | ||
| commit-message: 'Implement issue #${{ inputs.issue_number }}' | ||
| branch: gemini/issue-${{ inputs.issue_number }} | ||
| title: 'Implement #${{ inputs.issue_number }}' | ||
| body: | | ||
| 🤖 Automated implementation of issue #${{ inputs.issue_number }} | ||
|
|
||
| Generated by Gemini CLI using the `/implement` command. | ||
|
|
||
| **Review checklist:** | ||
| - [ ] Code follows documented principles | ||
| - [ ] Tests pass locally | ||
| - [ ] Linting passes | ||
| - [ ] Manual testing completed | ||
| - [ ] Code review score ≥ 0.85 | ||
| draft: true | ||
| - name: Comment on issue | ||
| if: steps.create-pr.outputs.pull-request-number | ||
| run: | | ||
| gh issue comment ${{ inputs.issue_number }} --body "🤖 Automated implementation created in PR #${{ steps.create-pr.outputs.pull-request-number }} | ||
|
|
||
| This is a draft PR generated by Gemini CLI. Please review the changes, run tests, and verify quality before marking ready for review." | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we define this as an allowlist instead?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, good idea, updated.