pull #11

kalvinparker · 2025-11-02T16:43:28Z

No description provided.

Removed unnecessary instructions from README.

Chore/add readme trivy

Main

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5 to 6. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v5...v6) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

Update Readme.md

Bumps node from 22-alpine to 25-alpine. --- updated-dependencies: - dependency-name: node dependency-version: 25-alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

…ions/checkout-5 Bump actions/checkout from 4 to 5

…ker/build-push-action-6 Bump docker/build-push-action from 5 to 6

Main

Copilot

Pull Request Overview

This pull request transitions from a specific versioned dependency to using the latest version, updates the Node.js base image, adds comprehensive security documentation, and consolidates GitHub Actions workflows.

Changes package dependency from a specific version to "latest"
Updates Node.js base image from version 22 to version 25
Adds security policy, usage instructions, and update documentation
Consolidates multiple GitHub Actions workflows into a single unified workflow

Reviewed Changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
package.json	Updates @google/gemini-cli dependency from pinned version to "latest"
Dockerfile	Updates Node.js base image from version 22 to version 25
README.md	Fixes typo, updates documentation to reflect new workflow names and enhanced security features
USAGE.md	Adds comprehensive usage instructions for running the containerized application
UPDATE-PACKAGE.md	Adds documentation for manual and automated package update processes
SECURITY.md	Adds formal security policy with vulnerability reporting guidelines
.github/workflows/build-and-scan.yml	Adds new consolidated workflow for building and scanning images
.github/workflows/docker-build-scan.yml	Removes old workflow file
.github/workflows/docker-build-scan-publish.yml	Removes old workflow file
.github/workflows/release.yml	Removes old release workflow file
.github/dependabot.yml	Adds Dependabot configuration for automated dependency management

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-02T16:45:12Z

README.md

 # secure-gemini

-This repository contains a minimal, security-conscious Docker image for running the Google Gemini CLI (`@google/gemini-cli`). The image is built on `node:22-alpine`, uses a non-root user, upgrades base packages, updates npm, and runs `npm audit` during the image build as a security gate.
+This repository contains a minimal, security-harneded Docker image for running the Google Gemini CLI (`@google/gemini-cli`). The image is built on `node:22-alpine`, uses a non-root user, upgrades base packages, updates npm, and runs `npm audit` during the image build as a security gate.


Corrected spelling of 'harneded' to 'hardened'.

Suggested change

This repository contains a minimal, security-harneded Docker image for running the Google Gemini CLI (`@google/gemini-cli`). The image is built on `node:22-alpine`, uses a non-root user, upgrades base packages, updates npm, and runs `npm audit` during the image build as a security gate.

This repository contains a minimal, security-hardened Docker image for running the Google Gemini CLI (`@google/gemini-cli`). The image is built on `node:22-alpine`, uses a non-root user, upgrades base packages, updates npm, and runs `npm audit` during the image build as a security gate.

Copilot · 2025-11-02T16:45:12Z

README.md

 # secure-gemini

-This repository contains a minimal, security-conscious Docker image for running the Google Gemini CLI (`@google/gemini-cli`). The image is built on `node:22-alpine`, uses a non-root user, upgrades base packages, updates npm, and runs `npm audit` during the image build as a security gate.
+This repository contains a minimal, security-harneded Docker image for running the Google Gemini CLI (`@google/gemini-cli`). The image is built on `node:22-alpine`, uses a non-root user, upgrades base packages, updates npm, and runs `npm audit` during the image build as a security gate.


The README states the image is built on node:22-alpine, but the Dockerfile now uses node:25-alpine. These should be consistent. Update the README to match the actual Node.js version used in the Dockerfile (once the Dockerfile version is corrected).

Copilot · 2025-11-02T16:45:12Z

README.md

+This project isn't just a `Dockerfile`; it's a complete, secure software lifecycle.

-This repository contains a minimal, security-conscious Docker image for running the Google Gemini CLI (`@google/gemini-cli`). The image is built on `node:22-alpine`, uses a non-root user, upgrades base packages, updates npm, and runs `npm audit` during the image build as a security gate.
+- ✅ **Hardened Base Image:** Built on `node:22-alpine` and patches OS packages (`apk upgrade`) during the build to mitigate known vulnerabilities.


The README references node:22-alpine, but the Dockerfile now uses node:25-alpine. Update this reference to match the actual version used in the Dockerfile (once the Dockerfile version is corrected).

Copilot · 2025-11-02T16:45:13Z

.github/dependabot.yml

+    # reviewers:
+    #   - "kalvinparker"
+
+  # 2. Check for updates to the Docker base image (node:22-alpine)


The comment references node:22-alpine, but the Dockerfile now uses node:25-alpine. Update this comment to reflect the actual base image version (once the Dockerfile version is corrected).

Suggested change

# 2. Check for updates to the Docker base image (node:22-alpine)

# 2. Check for updates to the Docker base image (node:25-alpine)

Copilot · 2025-11-02T16:45:13Z

package.json

 {
  "dependencies": {
-    "@google/gemini-cli": "^0.8.2"
+    "@google/gemini-cli": "latest"


Using 'latest' for dependencies is not recommended in production as it can lead to unpredictable builds and potential breaking changes. Consider using a specific version with a caret (^) or tilde (~) range instead, such as ^0.9.0 or pinning to a specific version.

Suggested change

"@google/gemini-cli": "latest"

"@google/gemini-cli": "^0.9.0"

Copilot · 2025-11-02T16:45:13Z

README.md


 ```powershell
-docker build -t secure-gemini-cli:latest .
+docker build -t secure-gemini-cli:latest


The docker build command is missing the build context argument. It should be docker build -t secure-gemini-cli:latest . (note the period at the end representing the current directory as the build context).

Suggested change

docker build -t secure-gemini-cli:latest

docker build -t secure-gemini-cli:latest .

Copilot · 2025-11-02T16:45:14Z

SECURITY.md

+
+| Version | Supported          |
+| ------- | ------------------ |
+| `master` branch | :white_check_mark: |


The table references master branch, but line 15 and other parts of the document refer to the main branch. This should be consistent. Use main instead of master to match the actual branch name.

Suggested change

| `master` branch | :white_check_mark: |

| `main` branch | :white_check_mark: |

kalvinparker and others added 30 commits October 16, 2025 22:19

Clean up README by removing redundant text

a89bc5e

Removed unnecessary instructions from README.

Update Dockerfile

f5b54a8

Merge pull request #3 from kalvinparker/chore/add-readme-trivy

82a8bc6

Chore/add readme trivy

Merge branch 'master' into main

8ac6dfa

latest trivy scan release updated

b83fc1e

Update docker-build-scan-publish.yml

89e18f0

Update docker-build-scan.yml

4b41a44

Update docker-build-scan.yml

43923ea

Create build-and-scan.yml

d30b3f0

Create build-and-scan.yml

a81bec3

Delete .github/workflows/docker-build-scan-publish.yml

af0387b

Delete .github/workflows/docker-build-scan.yml

ab97d19

Rename build-and-scan.yml to pr-scan.yml

800b6d6

Update pr-scan.yml

e5d57bb

Delete .github/workflows/docker-build-scan-publish.yml

6c8f150

Update and rename build-and-scan.yml to pr-scan.yml

c2f4bfb

deleted

ef4a9a9

Merge branch 'master'

07fc702

Deleted

5636a63

Merge pull request #4 from kalvinparker/main

808b1d5

Main

Create SECURITY.md

0b57099

Create dependabot.yml

d38e16e

Update Readme.md

b5dec98

Update SECURITY.md

2d3d858

Update README.md

0945643

Merge branch 'master' into main

eae757a

Merge pull request #9 from kalvinparker/main

d52e44c

Update Readme.md

Update README.md

65f67ce

kalvinparker and others added 27 commits October 19, 2025 21:04

Fixed README.md

a25af86

Update README.md

8397702

Update README.md

cbe983a

Merge branch 'master' of https://github.com/kalvinparker/secure-gemini

07aea94

Update README.md

ae37d96

Update README.md

89d88a3

Updated package details

9b3233f

Update dependabot.yml

c0e50e9

Update

fbb98d0

Update README.md

2a5f274

Update README.md

98c9dca

Update README.md

7db353f

Update README.md

7e2f647

Update package.json

c6d8c84

Bump node from 22-alpine to 25-alpine

90e626a

Bumps node from 22-alpine to 25-alpine. --- updated-dependencies: - dependency-name: node dependency-version: 25-alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

Merge pull request #5 from kalvinparker/dependabot/github_actions/act…

e05b051

…ions/checkout-5 Bump actions/checkout from 4 to 5

Merge pull request #7 from kalvinparker/dependabot/github_actions/doc…

ae79d2b

…ker/build-push-action-6 Bump docker/build-push-action from 5 to 6

Created INSTALLATION.md

caee35b

Merge branch 'master' of https://github.com/kalvinparker/secure-gemini

d9974c8

Renamed INSTALLATION.md to USAGE.md

fb75f39

Update README.md

ccdfc81

Restore SECURITY.md from historical commit 2d3d858

dacdaa4

Add repository metadata to SECURITY.md

d477658

docs(security): Update contact information in SECURITY.md

f782d3a

chore(security): sync SECURITY.md from profile-template

1b7c3d4

Merge branch 'master' into main

cfbf566

Merge pull request #10 from kalvinparker/main

68262fb

Main

kalvinparker requested a review from Copilot November 2, 2025 16:43

kalvinparker merged commit bb9ad9e into chore/add-readme-trivy Nov 2, 2025
6 checks passed

Copilot AI reviewed Nov 2, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

pull #11

pull #11

Uh oh!

kalvinparker commented Nov 2, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Nov 2, 2025

Uh oh!

Copilot AI Nov 2, 2025

Uh oh!

Copilot AI Nov 2, 2025

Uh oh!

Copilot AI Nov 2, 2025

Uh oh!

Copilot AI Nov 2, 2025

Uh oh!

Copilot AI Nov 2, 2025

Uh oh!

Copilot AI Nov 2, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	This repository contains a minimal, security-harneded Docker image for running the Google Gemini CLI (`@google/gemini-cli`). The image is built on `node:22-alpine`, uses a non-root user, upgrades base packages, updates npm, and runs `npm audit` during the image build as a security gate.
	This repository contains a minimal, security-hardened Docker image for running the Google Gemini CLI (`@google/gemini-cli`). The image is built on `node:22-alpine`, uses a non-root user, upgrades base packages, updates npm, and runs `npm audit` during the image build as a security gate.

	# 2. Check for updates to the Docker base image (node:22-alpine)
	# 2. Check for updates to the Docker base image (node:25-alpine)

	"@google/gemini-cli": "latest"
	"@google/gemini-cli": "^0.9.0"

	docker build -t secure-gemini-cli:latest
	docker build -t secure-gemini-cli:latest .

	\| `master` branch \| :white_check_mark: \|
	\| `main` branch \| :white_check_mark: \|

pull #11

pull #11

Uh oh!

Conversation

kalvinparker commented Nov 2, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 2, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 2, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 2, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 2, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 2, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 2, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 2, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants