bug(output): do not print output by default #202
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
It's possible to trick the LLM into printing sensitive information from the environment like access keys or credentials. While GitHub Actions secret masking + shell_command restrictions provide some protections, the best protection is to suppress Gemini CLI output in the logs. The output is still accessible via the `summary` and `error` fields on the GitHub Action, in case later steps do want to print or inspect the output.
![gemini-cli[bot]](https://avatars.githubusercontent.com/in/1473539?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
📋 Review Summary
This is an excellent security enhancement that significantly reduces the risk of exposing sensitive information in workflow logs. By default, the action will no longer print the Gemini response or errors, instead making them available as step outputs. This is a much safer approach.
🔍 General Feedback
- The change is simple, effective, and directly addresses the security concern.
- The pull request description is clear and explains the rationale well.
- This change improves the default security posture of the action, which is a huge win for users.
jerop
approved these changes
Aug 20, 2025
Merged
google-github-actions-bot
added a commit
that referenced
this pull request
Aug 26, 2025
## What's Changed * fix(output): separate the stdout and stderr logs by @sethvargo in #186 * fix: correct step numbering in setup_workload_identity.sh by @jasmeetsb in #188 * Try and address TOCTOU issues in gemini-cli.yml by @sethvargo in #187 * chore: bump `actions/checkout` GitHub Actions by @Marukome0743 in #193 * docs: add gitignore recommendations across all workflows by @jerop in #198 * chore: bump `actions/create-github-app-token` from 2.0.6 to 2.1.1 by @Marukome0743 in #200 * bug(output): do not print output by default by @sethvargo in #202 * Add GOOGLE_API_KEY variable by @vivekkairi in #201 * Stream live output if (and only if) debug mode is enabled by @sethvargo in #207 * bug(debug): use `vars` (not `env`) when enabling debug mode by @sethvargo in #211 * feat: Add GEMINI_MODEL support by @vivekkairi in #214 * feat(actions): use the dispatcher pattern to separate concerns by @sethvargo in #212 * bug(ci): set id-token permissions by @sethvargo in #223 * chore: add a debugger by @sethvargo in #226 * Add release notes generation example in awesome list by @jerop in #225 * feat(invoke): update invoke prompt to better separate execution flow by @sethvargo in #227 * chore(ci): refactor scheduled triage workflow by @sethvargo in #232 * Fix triage workflow by @sethvargo in #233 * Auto trigger PR reviews when they are from branches in repo by @jerop in #234 * rename workflow from `gemini-issue-scheduled-triage` to `gemini-scheduled-triage` by @jerop in #238 * feat: rename triage workflows by @jerop in #240 * feat: rename gemini-cli to gemini-invoke by @jerop in #239 * rename PR review workflow to be consistent with the rest by @jerop in #241 * feat(workflows): refactor examples/workflows to use dispatch pattern by @jerop in #242 * feat: pin example workflows to v0 by @jerop in #246 * add google_api_key input in gemini-triage workflows by @jerop in #243 * feat: add best practices guide by @jerop in #245 ## New Contributors * @vivekkairi made their first contribution in #201 **Full Changelog**: v0.1.11...v0.1.12
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It's possible to trick the LLM into printing sensitive information from the environment like access keys or credentials. While GitHub Actions secret masking + shell_command restrictions provide some protections, the best protection is to suppress Gemini CLI output in the logs. The output is still accessible via the
summaryanderrorfields on the GitHub Action, in case later steps do want to print or inspect the output.