ActionRank
Check your actions

Run Gemini CLI

Actively maintained

google-github-actions/run-gemini-cli · Apache-2.0

A GitHub Action invoking the Gemini CLI.

★ 2.1k starsLast commit 26 days agoLatest v0.1.22
D
51
/ 100
Security 0Maintenance 92Popularity 63Reliability 70

Security signals

OpenSSF ScorecardNo data
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilities1 advisory(ies)
  • CVE-2026-12537critical

    Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

    Published Apr 24, 2026

How to use it safely

Recommended: pin to commit SHA
uses: google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489 # v0.1.22

Mutable tags like v0.1.22 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489 # v0.1.22

Score breakdown

Security (35%)0
Popularity (20%)63
Maintenance (30%)92
Reliability (15%)70