ikaruce/Gemini Code Security Reviewer
AI-powered security review GitHub Action using Gemini CLI custom commands
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Feb 21, 2026
- License
- None
Pinned Snippet
uses: ikaruce/gemini-code-security-review@4d59c1d4c1903738d21ff09cd6be40371ede5832 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| comment-pr | Whether to comment on PRs with findings | no | true |
| upload-results | Whether to upload results as artifacts | no | true |
| geminicli-timeout | Timeout for Gemini CLI analysis in minutes | no | 20 |
| gemini-api-key | Google Gemini API key | no | "" |
| gemini-model | Gemini model to use (e.g., gemini-2.5-pro, gemini-2.0-flash) | no | "" |
| run-every-commit | Run on every commit (skips cache check). Warning: may increase false positives on PRs with many commits. | no | false |
Outputs
| name | description |
|---|---|
| findings-count | Number of security findings (HIGH + MEDIUM) |
| results-file | Path to the results markdown file |