run-gemini-cli GEMINI.md

Development instructions for a reusable GitHub Action, a packaged automation step that runs in GitHub workflows. They cover its manifest, portable shell commands, inputs and outputs, and secret handling.

In plain words
What is it for?
Use them when changing the action’s workflow, manifest, inputs, outputs, dependencies, portability, or security practices.
Why use it?
They clarify how to extend the action safely and keep its configuration accurate for projects that reuse it.

Instructions file for Gemini CLI

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/google-github-actions/run-gemini-cli/gemini-md
Clone the repo
git clone --depth 1 https://github.com/google-github-actions/run-gemini-cli

Made for: Gemini CLI.

Per session 551 This file is loaded in full into every session.
When invoked 551 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00551 $0.00551
Opus 5 $0.00275 $0.00275
Sonnet 5 $0.00110 $0.00110
Haiku 4.5 $0.00055 $0.00055

Measured yesterday against content hash e5b9a80a04d5, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

run-gemini-cli GEMINI.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

GEMINI.md · 40 lines

How it starts

The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Guidelines for Developing this GitHub Action

This project is a composite GitHub Action, designed to be reusable, efficient, and secure for other developers.

Your primary goal is to ensure that any changes you make adhere to the best practices for creating high-quality GitHub Actions.

Core Principles for This Action

  1. Understand the action.yml Manifest:

    • This is the heart of the action. It defines inputs, outputs, branding, and the execution steps.
    • When adding or modifying functionality, ensure the action.yml is updated clearly and correctly.
    • Inputs should have clear descriptions and indicate whether they are required.
  2. Embrace Composability:

    • This is a composite action, meaning it runs a series of shell commands. This makes it lightweight and fast.
    • Prefer using standard, portable shell commands (sh) to ensure compatibility across different runners.
    • Avoid introducing complex dependencies that would require a containerized action unless absolutely necessary.
  3. Security is Paramount:

    • Never expose secrets. Set required tokens and keys as environment variables using secrets in your workflows.
    • Principle of Least Privilege: When documenting required permissions for the action (in the README.md), always recommend the minimum set of permissions necessary for the action to function.
  4. Prioritize User Experience:

    • Clear Documentation: The README.md is our user manual. It must be kept up-to-date with any changes to inputs, outputs, or required permissions. Usage examples are critical.
    • Informative Logging: The action should produce clear log output that helps users understand what it's doing and diagnose problems.
    • Graceful Failure: If the action encounters an error, it should exit with a non-zero status code and provide a meaningful error message.
  5. Maintain Workflow Examples:

    • The files in the /examples directory are crucial for demonstrating how to use this action.
    • Ensure they are kept in sync with the latest features and best practices.

Read the full file on GitHub · 40 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 40 lines · 551 tokens per session scan A e5b9a80a04d5

Subscribe to this mod's changes

run-gemini-cli GEMINI.md is an instructions file published in the GitHub repository google-github-actions/run-gemini-cli (2,064 stars, last pushed 10d ago), licensed Apache-2.0. It adds 551 tokens to every session, about $0.0028 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.