antigravity-code-review.yml

Automated agentic code review, security audit, or test-suite generation via the Google Antigravity Python SDK (google-antigravity).

Supports three operational modes (code-review, security-audit, test-generation) and two execution policies (on-push for automatic PR updates and on-request for manual/dispatch runs).

Requires a GEMINI_API_KEY secret.

Inputs

Input	Type	Default	Description
mode	string	'code-review'	Operational mode: code-review, security-audit, or test-generation.
pr-number	string	''	Pull request number to analyze (required for workflow_dispatch).
prompt-addendum	string	''	Extra prompt instructions appended to the agent task prompt.
checkout-submodules	boolean	false	Check out git submodules.
model	string	''	Antigravity / Gemini model override passed to the SDK (optional).
trigger-policy	string	'any'	Enforcement mode: any, on-push, or on-request.
workload-identity-provider	string	''	Full GCP Workload Identity Provider resource name.
service-account	string	''	GCP Service Account email to impersonate.
max-diff-lines	string	'2000'	Maximum modified lines allowed in a PR diff before skipping review.
max-diff-files	string	'50'	Maximum modified files allowed in a PR diff before skipping review.
gcp-project	string	''	GCP project id. Required alongside workload-identity-provider for the OIDC credentials to be used: minting them authenticates to GCP, but the SDK only routes through Vertex AI when told to.
gcp-location	string	''	Vertex AI location (e.g. us-central1). Used with gcp-project.
fail-on-error	boolean	true	Whether a genuine error (metadata fetch, diff fetch, empty diff, execution failure) reddens the check. Defaults to true: those paths return before any PR comment is posted, so exiting 0 leaves a green check over a silent thread.

Secrets

Secret	Required	Description
GEMINI_API_KEY	no	Gemini / Antigravity API key.
SUBMODULES_TOKEN	no	Token used to check out private submodules.

Permissions

Grant contents: read, pull-requests: write, issues: write, and id-token: write.

Concurrency

Do not declare a top-level concurrency: block in your caller workflow. antigravity-code-review.yml manages per-PR concurrency internally on its antigravity-review job (group: antigravity-review-<mode>-<PR>). Adding a top-level concurrency: block in the caller with a PR-scoped group name causes GitHub Actions to detect a deadlock between the top-level workflow and the nested job, cancelling the run immediately (gha#437).

Example

# Copy to .github/workflows/antigravity-code-review.yml in your repo.
name: Antigravity Code Review & Audit

on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]
  workflow_dispatch:
    inputs:
      mode:
        description: 'Operational mode: code-review, security-audit, or test-generation'
        default: 'code-review'
        type: choice
        options:
          - code-review
          - security-audit
          - test-generation
      pr_number:
        description: 'Pull request number'
        type: string

jobs:
  antigravity-review:
    permissions:
      contents: read
      pull-requests: write
      issues: write
      id-token: write
    uses: Morrison-Lab/gha/.github/workflows/antigravity-code-review.yml@v2
    with:
      mode: ${{ inputs.mode || 'code-review' }}
      pr-number: ${{ inputs.pr_number }}
      trigger-policy: ${{ github.event_name == 'pull_request' && 'on-push' || 'on-request' }}
      # checkout-submodules: true
      # model: ''
      # prompt-addendum: |
      #   Repo-specific review guidance.
      # Vertex AI via Workload Identity Federation. All four are needed:
      # the first two authenticate to GCP, the last two are what route the
      # SDK through Vertex. Without them GEMINI_API_KEY is still required.
      # workload-identity-provider: 'projects/123/locations/global/workloadIdentityPools/p/providers/gh'
      # service-account: 'review-bot@my-project.iam.gserviceaccount.com'  # phi-allow: documentation placeholder, not a real address
      # gcp-project: 'my-project'
      # gcp-location: 'us-central1'
      # Skip the review on oversized diffs rather than spending on them.
      # max-diff-lines: '2000'
      # max-diff-files: '50'
      # Set false only where a review is genuinely optional; the default
      # reddens the check on a real error rather than passing silently.
      # fail-on-error: true
    secrets:
      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}