Extensions and GitHub Actions

Part 12 of 16

MCP servers: install from an approved list, pin versions, never set "trust": true, which “bypass[es] all tool call confirmations”, and give servers that read tickets, errors, chat or email read-only scopes (Gemini CLI docs).
Extensions: restrict them with security.allowedExtensions or blockGitExtensions, and read each manifest.
GitHub Actions: pin run-gemini-cli by SHA, never run it with --yolo on issues or pull requests from outsiders, and give it only the permissions and secrets it needs.

/* Without JS the drawer cannot open, so show the sidebar inline instead. */ @media (max-width: 900px) { .sidebar { position: static; transform: none; width: auto; box-shadow: none; } .navbar-toggle, .sidebar-head { display: none; } }

Security for Gemini Development: Extensions and GitHub Actions

Extensions and GitHub Actions