Problem

Currently, the Gemini CLI action provides general pull request review, but lacks a specialized security-focused pull request review workflow. As security becomes increasingly critical in software development, we need a dedicated security review process that can:

• Automatically analyze code changes for security vulnerabilities
• Provide detailed security-specific feedback with remediation guidance
• Integrate seamlessly into existing PR workflows
• Focus specifically on security concerns rather than general code quality

Solution

Update gemini-review.yml workflow to perform security reviews on pull requests.

• Add extensions input to action.yml: This will allow us to configure the security extension.
• Experiment in a test repository: We will test the security review extension in a separate repository until Improve PR Review Workflow #269 is resolved. This will allow us to work on the extension without impacting the PR review workflow in this repository.
  • Dogfood upstream: We will use the security review extension in a workflow in https://github.com/google-gemini/gemini-cli. This will allow us to test the extension without impacting PR review workflow in this repository.
• Integrate into PR review workflow: Once the extension is stable and issue Improve PR Review Workflow #269 is fixed, we will add the security review step to the main PR review workflow.
• Consolidate Feedback: Investigate how to generate both general and security feedback, then consolidate them to avoid duplication.

This approach will allow us to develop and test the security review functionality in a controlled environment before deploying it to the main repository.