Skip to content
22 changes: 9 additions & 13 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: CI Tests

Check warning on line 1 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions

ci.yml:1: overly broad permissions: default permissions used due to no permissions: block

on:

Check failure on line 3 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

dangerous-triggers

ci.yml:3: use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely
push:
branches:
- main
Expand All @@ -17,57 +17,53 @@
default: ''

jobs:
test-go:

Check warning on line 20 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions

ci.yml:20: overly broad permissions: default permissions used due to no permissions: block
runs-on: ubuntu-latest
# This gates the job until a maintainer approves
environment: CI
steps:
- uses: actions/checkout@v4

Check failure on line 23 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 23 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

ci.yml:23: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
# Use the PR head for pull_request_target, otherwise the default ref
ref: ${{ github.event.pull_request.head.sha || github.event.inputs.ref || github.ref }}
# Persist credentials is false to prevent the PR code from using the GITHUB_TOKEN
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@v5

Check failure on line 30 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 30 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

ci.yml:30: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
go-version: '1.22'
- name: Run Go tests
working-directory: ./go
env:
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
run: go test ./...
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
run: go test -timeout 20m ./...

test-java:

Check warning on line 39 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions

ci.yml:39: overly broad permissions: default permissions used due to no permissions: block
runs-on: ubuntu-latest
environment: CI
steps:
- uses: actions/checkout@v4

Check failure on line 42 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 42 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

ci.yml:42: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
ref: ${{ github.event.pull_request.head.sha || github.event.inputs.ref || github.ref }}
persist-credentials: false
- name: Set up JDK 21
- name: Set up JDK 24
uses: actions/setup-java@v4

Check failure on line 47 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 47 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

ci.yml:47: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
java-version: '21'
java-version: '24'
distribution: 'temurin'
cache: maven
- name: Run Java tests
working-directory: ./java
env:
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
GOOGLE_API_KEY: ${{ secrets.GEMINI_API_KEY }}
run: mvn -B test

test-javascript:

Check warning on line 58 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions

ci.yml:58: overly broad permissions: default permissions used due to no permissions: block
runs-on: ubuntu-latest
environment: CI
steps:
- uses: actions/checkout@v4

Check failure on line 61 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 61 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

ci.yml:61: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
ref: ${{ github.event.pull_request.head.sha || github.event.inputs.ref || github.ref }}
persist-credentials: false
- name: Set up Node.js
uses: actions/setup-node@v4

Check failure on line 66 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 66 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

ci.yml:66: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
node-version: '20'
cache: 'npm'
Expand All @@ -78,19 +74,18 @@
- name: Run JavaScript tests
working-directory: ./javascript
env:
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
run: node --test *.test.js

test-python:

Check warning on line 80 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions

ci.yml:80: overly broad permissions: default permissions used due to no permissions: block
runs-on: ubuntu-latest
environment: CI
steps:
- uses: actions/checkout@v4

Check failure on line 83 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 83 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

ci.yml:83: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
ref: ${{ github.event.pull_request.head.sha || github.event.inputs.ref || github.ref }}
persist-credentials: false
- name: Set up Python
uses: actions/setup-python@v5

Check failure on line 88 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 88 in .github/workflows/ci.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

ci.yml:88: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
python-version: '3.11'
- name: Install dependencies
Expand All @@ -99,5 +94,6 @@
- name: Run Python tests
working-directory: ./python
env:
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
run: pytest .
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
# Discover and run all .py files as tests
run: python -m unittest discover -p "*.py"
6 changes: 0 additions & 6 deletions javascript/grounding.js
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,6 @@

import { GoogleGenAI } from "@google/genai";

// Ensure the API key is set in your environment variables
if (!process.env.GEMINI_API_KEY) {
throw new Error("GEMINI_API_KEY environment variable not set.");
}

// Define the thinking model centrally
const MODEL_ID = "gemini-3.7-flash";

const ai = new GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });
Expand Down
Loading