From 73bfebed834bf9d8e88fd206556cf3860b4e16a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Roberto=20D=C3=ADaz?= <robertodimen@gmail.com>
Date: Fri, 17 Jul 2026 13:12:44 +0200
Subject: [PATCH 1/2] chore: add automated Gemini PR review workflow

Triggers on pull_request (opened/reopened/synchronize), runs
google-github-actions/run-gemini-cli with the code-review extension
to post an automated review on every PR. Requires GEMINI_API_KEY
(already set at the CartAI-Labs org level).
---
 .github/workflows/gemini-review.yml | 97 +++++++++++++++++++++++++++++
 .gitignore                          |  4 ++
 2 files changed, 101 insertions(+)
 create mode 100644 .github/workflows/gemini-review.yml

diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yml
new file mode 100644
index 0000000..7f2f327
--- /dev/null
+++ b/.github/workflows/gemini-review.yml
@@ -0,0 +1,97 @@
+name: '🔎 Gemini Review'
+
+on:
+  pull_request:
+    types:
+      - 'opened'
+      - 'reopened'
+      - 'synchronize'
+
+concurrency:
+  group: '${{ github.workflow }}-review-${{ github.event.pull_request.number }}'
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: 'bash'
+
+jobs:
+  review:
+    if: |-
+      github.event.pull_request.head.repo.fork == false
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 7
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+      issues: 'write'
+      pull-requests: 'write'
+    steps:
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8' # ratchet:actions/checkout@v6
+        with:
+          persist-credentials: 'false'
+
+      - name: 'Prepare prompt context'
+        shell: 'bash'
+        run: |-
+          mkdir -p .gemini
+          jq -n \
+            --arg repo "${REPOSITORY}" \
+            --arg pr "${PULL_REQUEST_NUMBER}" \
+            '{repository: $repo, pull_request_number: $pr}' > .gemini/context.json
+        env:
+          REPOSITORY: '${{ github.repository }}'
+          PULL_REQUEST_NUMBER: '${{ github.event.pull_request.number }}'
+
+      - name: 'Run Gemini pull request review'
+        uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
+        id: 'gemini_pr_review'
+        env:
+          GEMINI_CLI_TRUST_WORKSPACE: 'true'
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+        with:
+          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          workflow_name: 'gemini-review'
+          github_pr_number: '${{ github.event.pull_request.number }}'
+          settings: |-
+            {
+              "model": {
+                "maxSessionTurns": 25
+              },
+              "telemetry": {
+                "enabled": true,
+                "target": "local",
+                "outfile": ".gemini/telemetry.log"
+              },
+              "mcpServers": {
+                "github": {
+                  "command": "docker",
+                  "args": [
+                    "run",
+                    "-i",
+                    "--rm",
+                    "-e",
+                    "GITHUB_PERSONAL_ACCESS_TOKEN",
+                    "ghcr.io/github/github-mcp-server:v0.27.0"
+                  ],
+                  "includeTools": [
+                    "add_comment_to_pending_review",
+                    "pull_request_read",
+                    "pull_request_review_write"
+                  ],
+                  "env": {
+                    "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
+                  }
+                }
+              },
+              "tools": {
+                "core": []
+              }
+            }
+          extensions: |
+            [
+              "https://github.com/gemini-cli-extensions/code-review"
+            ]
+          prompt: '/pr-code-review'
diff --git a/.gitignore b/.gitignore
index ecfd382..1242065 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,3 +48,7 @@ src/main/resources/META-INF/additional-spring-configuration-metadata.json
 
 # Antigravity & Agent Customizations
 .agents/
+
+# Gemini CLI (gemini-review workflow)
+.gemini/
+gha-creds-*.json

From 1dcd245f92d425f1005b7ee2efa61fba0d40c912 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Roberto=20D=C3=ADaz?= <robertodimen@gmail.com>
Date: Fri, 17 Jul 2026 13:13:24 +0200
Subject: [PATCH 2/2] fix: reference GEMINI_PR_REVIEWER secret name

---
 .github/workflows/gemini-review.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yml
index 7f2f327..a3f9a45 100644
--- a/.github/workflows/gemini-review.yml
+++ b/.github/workflows/gemini-review.yml
@@ -50,9 +50,9 @@ jobs:
         env:
           GEMINI_CLI_TRUST_WORKSPACE: 'true'
           GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
-          GEMINI_API_KEY: '${{ secrets.GEMINI_API_KEY }}'
+          GEMINI_API_KEY: '${{ secrets.GEMINI_PR_REVIEWER }}'
         with:
-          gemini_api_key: '${{ secrets.GEMINI_API_KEY }}'
+          gemini_api_key: '${{ secrets.GEMINI_PR_REVIEWER }}'
           workflow_name: 'gemini-review'
           github_pr_number: '${{ github.event.pull_request.number }}'
           settings: |-