feat(pr-generator-infra): configure Cloud Run job, Workflows definition, and Dockerfile#28431
feat(pr-generator-infra): configure Cloud Run job, Workflows definition, and Dockerfile#28431joneba-google wants to merge 2 commits into
Conversation
|
📊 PR Size: size/M
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request establishes the core infrastructure for the Gemini CLI Issue-to-PR Code Generation Pipeline. It provides the necessary container environment, job specifications, and workflow orchestration logic to automate the processing of GitHub issues, ensuring robust execution and failure recovery via Firestore integration. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a Dockerfile, a Cloud Run Job configuration, and a Google Cloud Workflow to orchestrate code generation and evaluation. The review feedback highlights several critical issues in the workflow configuration: the repository URL and GCP project ID are hardcoded instead of being dynamically resolved, there is a mismatch in the Firestore database and collection names between the workflow and the job configuration, and there are high-severity path traversal vulnerabilities due to a lack of validation on the Firestore document ID and GitHub metadata fields before constructing database paths.
| - repo_url: "https://github.com/joneba-google/gemini-cli-clone" | ||
| - workflow_execution_id: '${sys.get_env("GOOGLE_CLOUD_WORKFLOW_EXECUTION_ID")}' | ||
|
|
||
| # Decode Pub/Sub message | ||
| - pubsub_message_bytes: '${base64.decode(event.data.message.data)}' | ||
| - firestore_doc_str: '${text.decode(pubsub_message_bytes)}' | ||
| - firestore_doc: '${json.decode(firestore_doc_str)}' |
There was a problem hiding this comment.
The repository URL is currently hardcoded to a specific personal clone (https://github.com/joneba-google/gemini-cli-clone). This will cause the PR generator to always run against this repository, completely ignoring the actual repository owner and name from the incoming Pub/Sub event.
To make the pipeline dynamic and support any repository triggering the event, construct the repo_url dynamically using the decoded firestore_doc.github_metadata fields.
- workflow_execution_id: '${sys.get_env("GOOGLE_CLOUD_WORKFLOW_EXECUTION_ID")}'
# Decode Pub/Sub message
- pubsub_message_bytes: '${base64.decode(event.data.message.data)}'
- firestore_doc_str: '${text.decode(pubsub_message_bytes)}'
- firestore_doc: '${json.decode(firestore_doc_str)}'
- repo_url: '${"https://github.com/" + firestore_doc.github_metadata.owner + "/" + firestore_doc.github_metadata.repo}'There was a problem hiding this comment.
It's currently hard coded for testing. I plan to make this change when transitioning it to the gemini-cli repo.
gemini-cli
Bot
added
the
status/need-issue
joneba-google
changed the title
1 participant
Overview
This PR introduces the foundational cloud infrastructure and container configurations for the Gemini CLI SSR Code Generation Pipeline. It establishes the containerized runtime environment, declarative Cloud Run Job specifications, and the Eventarc-triggered Cloud Workflow that coordinates Pub/Sub ingestion and failure recovery.
──────
Summary of Changes
1. Container Specification (Dockerfile)
• Configures a python:3.11-slim base image with Node.js 20 runtime support, Git, bubblewrap sandbox utilities, and root CA certificates.
• Installs core Python dependencies (google-antigravity, pydantic, google-cloud-firestore, google-genai, google-cloud-aiplatform).
• Packages the pipeline orchestrator and system prompt instructions under /app/workflow and sets the container entrypoint.
2. Declarative Cloud Run Job (job.yaml)
• Defines the pr-gen-job resource configuration in region us-central1.
• Allocates 2 vCPUs and 8Gi RAM with a 3600-second execution timeout.
• Binds dedicated runtime service account code-gen-job-execution-sa@gcli-intern-project-2026.iam.gserviceaccount.com.
• Injects environment variables for Firestore (FIRESTORE_DATABASE=test-gcli-db-clone, FIRESTORE_COLLECTION=test_issues) and maps the GEMINI_API_KEY from Secret Manager.
3. Cloud Workflow Orchestration (workflow.yaml)
• Event Ingestion: Decodes incoming Pub/Sub issue payloads and determines explicit or derived Firestore document IDs (github_{owner}{repo}{issue_number}).
• Secret Access: Fetches GitHub authentication keys (PR_GEN_GITHUB_PUSH_KEY) dynamically from Secret Manager.
• Execution Tracking: Injects the active ${sys.get_env("GOOGLE_CLOUD_WORKFLOW_EXECUTION_ID")} into the Cloud Run container environment overrides (EXECUTION_ID).
• Resilient Failure Handling: Catches container-level crashes or timeouts via a try/except block and performs a transactional patch on the Firestore document to set status: "NEEDS_HUMAN", log failure
details, and release concurrency locks.