From 60970e9f650de4899b47f17ec7150d38b969cab4 Mon Sep 17 00:00:00 2001
From: Yash Datta <saucam@gmail.com>
Date: Fri, 10 Jul 2026 01:27:32 +0800
Subject: [PATCH] devops: add the Gemini review bot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Same setup as codeoid/codeoid-ui: jgunnink/gemini-review-bot pinned to
the v1.3.0 commit, reviews on PR open, /gemini-review comment
re-reviews on demand, gemini-flash-latest (the action's own
free-tier-optimized default — see its PRD). No CodeRabbit config here
to remove; GEMINI_API_KEY is already set on this repo.

Requires the GEMINI_API_KEY repository secret (already set).
---
 .github/workflows/gemini-review.yml | 42 +++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 .github/workflows/gemini-review.yml

diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yml
new file mode 100644
index 0000000..9cb5f87
--- /dev/null
+++ b/.github/workflows/gemini-review.yml
@@ -0,0 +1,42 @@
+name: Gemini code review
+
+on:
+  pull_request:
+    types: [opened]
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+# One review in flight per PR; a newer request supersedes a stale run.
+concurrency:
+  group: gemini-review-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    # Run on PR open, or on a PR comment containing the re-review command.
+    if: >
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'issue_comment' &&
+       github.event.issue.pull_request &&
+       startsWith(github.event.comment.body, '/gemini-review'))
+    runs-on: ubuntu-latest
+    # Guards runner minutes if the Gemini API or action ever hangs.
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      # Pinned to v1.3.0 — bump deliberately, this action receives the API key.
+      - uses: jgunnink/gemini-review-bot@37b292a16543cd97f443416bf803dd863583c53b # v1.3.0
+        with:
+          gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
+          # No `model:` override — inherits the action's own default,
+          # gemini-flash-latest. That's a ROLLING alias (not a pinned
+          # snapshot like gemini-2.5-flash): Google repoints it to their
+          # current best free-tier flash model, and it's the exact id the
+          # action's PRD calls out as "cheapest/fastest; fits free-tier
+          # quota" and the one its own spike-test workflow verifies against.
+          # Pin an explicit model here only if you need reproducible
+          # review behavior across time more than you need it current.