Gemini CLI in CI: the free tier meets GitHub Actions

Gemini CLI has a property that makes it unusually easy to bolt into automation: it behaves like a well-mannered Unix citizen. gemini -p "summarize the failing tests" runs one turn, prints to stdout, and exits; stdin pipes in; the exit code means what it should. Where some vendors treat headless operation as an afterthought, here it feels like part of the design. That's the same posture I described for Claude Code in headless CI.

Add the generous free tier and an official GitHub Action, and the cost of experimenting with agents in your pipeline rounds to zero. That is the pitch, and it is mostly true. The practice needs more care than the demo suggests.

The patterns that pay off

• PR summaries. On pull request open, feed the diff to a headless prompt and post the result as a comment: what changed, what looks risky, where a reviewer should start. Read-only, immediately useful, easy to ignore when it misses.
• Issue triage. On issue open, let the agent label, spot duplicates, and ask the reporter for the missing reproduction steps. Drudgery nobody mourns, and a wrong label costs seconds.
• Scheduled chores. A weekly job that checks the docs against the code they describe, flags dead feature flags, or drafts a dependency-bump summary. Output lands as an issue or a draft PR, never as a direct change.
• On-demand mentions. Tag the bot in a comment and it answers with repository context. Useful, and also the spot where untrusted input concentrates (more on that below).

The minimal PR-summary job is two commands in a workflow step:

git diff origin/main...HEAD | gemini -p "Summarize this diff for reviewers. Lead with risk." > summary.md
gh pr comment "$PR_NUMBER" --body-file summary.md

Guardrails for unattended runs

In CI nobody is watching the approval prompts, so the agent runs with auto-approval (the mode whose own name warns you) or a pinned allowlist of tools. That changes the safety math completely, and three rules become non-negotiable.

• Pin permissions to the floor. Scope the workflow token to exactly what the job needs: contents read, plus issue or PR write, and nothing more. Pin the Action by commit hash. The agent's capabilities should be the workflow's grants, not its ambitions.
• No secrets in context. The model reads whatever the job can read, and issue text is attacker-controlled input; a hostile issue asking the bot to print its environment is not hypothetical. Keep deploy keys out of the agent's reach entirely, and never pipe raw CI logs into a prompt. Logs leak tokens more often than anyone admits.
• Output as PR, not push. Everything the agent produces should arrive as a comment, an issue, or a pull request that a human merges. An unattended agent with direct push access is how a mislabeled chore becomes an incident.

Treat an unattended agent like a contributor you have never met: minimum permissions, no secrets, and every change through review.

The free-tier catch

Now the honest part. The free tier that makes local use so pleasant fits CI awkwardly. Its friendliest form authenticates through an interactive Google login, which a headless runner cannot perform, so pipelines want an API key stored as a repository secret, and the key tiers carry their own, tighter allowances. Worse for determinism: under quota pressure the CLI can quietly fall back to a smaller, faster model. In a chat you barely notice; in a pipeline it means the same workflow produces noticeably different output quality depending on the time of day. For anything on the critical path, pay for capacity and pin the model explicitly.

Start where the blast radius is zero: PR summaries and triage on the free tier, read-mostly permissions, output as comments. A week of diffs will tell you whether the summaries earn their place. That's the same adoption logic I argue for AI in DevOps generally. Graduate to scheduled chores once you trust the output shape, keep write access behind human review indefinitely, and when the triage bot finally rate-limits into silence mid-week, treat that as the signal that it has earned a real budget.