Gemini Guardrails

✓ Policy Experimental Devex Build And Ci

Enforces Gemini-specific CI safety standards. Validates that Gemini CLI invocations do not use dangerous flags and use structured JSON output.

Add gemini to your lunar-config.yml:

uses: github://earthly/lunar-lib/policies/gemini@v1.0.5

Get Started View on GitHub

Included Guardrails

This policy includes 2 guardrails that enforce standards for your devex build and ci.

Guardrail

`cli-safe-flags`

Ensures Gemini CLI invocations in CI do not use dangerous permission-bypassing flags. Flags like --yolo and -y remove safety guardrails that prevent the AI from executing arbitrary code without human approval.

gemini ci safety dangerous flags permissions

View Guardrail

Guardrail

`cli-structured-output`

Ensures Gemini CLI invocations in CI use structured JSON output instead of plain text. JSON output makes AI automation deterministic and parseable.

gemini json output structured output ci automation

View Guardrail

How Guardrails Fit into Lunar

Lunar guardrails define your engineering standards as code. They evaluate data collected by integrations and produce pass/fail checks with actionable feedback.

Policies support gradual enforcement—from silent scoring to blocking PRs or deployments—letting you roll out standards at your own pace without disrupting existing workflows.

Learn How Lunar Works →

↓ Integrations Gather Data

Collectors extract metadata from code, CI pipelines, tool outputs, and scans

{ } Centralized as JSON

All data merged into each component's unified metadata document

✓ Guardrails Enforce Standards This Policy

Real-time feedback in PRs and AI workflows

Example Evaluated Data

This policy evaluates structured metadata from the Component JSON. Here's an example of the data it checks:

{ } component.json Example Input

{
  "ai": {
    "native": {
      "gemini": {
        "cicd": {
          "cmds": [
            {
              "cmd": "gemini run --json 'review this PR'",
              "tool": "gemini",
              "version": "0.1.0"
            }
          ]
        }
      }
    }
  }
}

Required Integrations

This policy evaluates data gathered by one or more of the following integration(s). Make sure to enable them in your lunar-config.yml.

Collector Code Analysis Required

Gemini Collector

Provides Gemini CI command data from ai.native.gemini.cicd

Configuration

Configure this policy in your lunar-config.yml.

Inputs

Input	Required	Default	Description
`dangerous_flags`	Optional	`--yolo,-y`	Comma-separated dangerous flags for Gemini CLI

Documentation

View on GitHub

Gemini Guardrails

Gemini-specific CI safety and conventions guardrails.

Overview

This policy enforces Gemini-specific CI standards. It validates that Gemini CLI invocations in CI pipelines do not use dangerous permission-bypassing flags and use structured JSON output for deterministic automation.

Policies

Policy	Severity	Description
`cli-safe-flags`	error	Gemini CLI must not use `--yolo` or `-y` flags
`cli-structured-output`	warning	Gemini CLI in CI should use structured JSON output

Required Data

Path	Provided By	Description
`.ai.native.gemini.cicd.cmds[]`	`gemini` collector	Gemini CLI invocations captured in CI

Installation

collectors:
  - uses: github://earthly/lunar-lib/collectors/gemini@main
    on: ["domain:your-domain"]

policies:
  - uses: github://earthly/lunar-lib/policies/gemini@main
    enforcement: report-pr

Examples

Passing

Gemini CLI using safe flags and structured output:

{
  "ai": {
    "native": {
      "gemini": {
        "cicd": {
          "cmds": [
            {
              "cmd": "gemini run --json 'review this PR'",
              "tool": "gemini"
            }
          ]
        }
      }
    }
  }
}

Failing

Gemini CLI using dangerous flag:

{
  "ai": {
    "native": {
      "gemini": {
        "cicd": {
          "cmds": [
            {
              "cmd": "gemini run --yolo 'deploy to prod'",
              "tool": "gemini"
            }
          ]
        }
      }
    }
  }
}

Remediation

cli-safe-flags: Remove --yolo and -y from Gemini CI invocations. Use scoped permissions instead.
cli-structured-output: Add --json or equivalent structured output flag to Gemini CLI invocations in CI.

Open Source

This policy is open source and available on GitHub. Contribute improvements, report issues, or fork it for your own use.

View Repository

Common Use Cases

Explore how individual guardrails work with specific integrations.

Cli Safe Flags + Gemini Collector Ensures Gemini CLI invocations in CI do not use dangerous...

→

Cli Structured Output + Gemini Collector Ensures Gemini CLI invocations in CI use structured JSON output instead of plain...

→

Ready to Automate Your Standards?

See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 100+ built-in guardrails.

Works with any process

AI agent rules & prompt files

Post-mortem action items

Security & compliance policies

Testing & quality requirements

Automate Now

Paste your AGENTS.md or manual process doc and get guardrails in minutes

Book a Demo