Securing Google Gemini in GitHub Actions with Harden-Runner

Ashish Kurmi’s post, published on 9 September 2025, explains how to secure Google Gemini in GitHub Actions by pairing observability with Harden-Runner’s runtime monitoring. It notes that Gemini’s hybrid approach provides native observability via Google Cloud but lacks runtime security visibility, a gap Harden-Runner can fill in CI/CD pipelines.

The article highlights a real-world example where Harden-Runner captured network calls, processes, and API interactions during a Gemini review, revealing 51 HTTPS events across 9 destinations. It also details how Gemini’s architecture involves Google APIs, container registries, and npm releases, underscoring the multiple trust boundaries at play.

The conclusion emphasises using native Gemini features such as Workload Identity Federation and Google Cloud audit logs in combination with runtime security monitoring to achieve defence-in-depth for AI-powered CI/CD deployments.