Add Gemini Vertex AI auth via `engine.auth` by Copilot · Pull Request #48170 · github/gh-aw

Copilot · 2026-07-26T08:40:21Z

Gemini workflows only supported static GEMINI_API_KEY auth, which blocked the recommended enterprise path via Vertex AI. This change adds a Gemini-specific engine.auth flow aligned with the existing Claude auth model and routes Gemini through AWF’s existing GCP/Vertex proxy contract.

Gemini engine.auth support
- Add GCP auth fields to the shared engine auth model:
  - provider: gcp
  - workload-identity-provider
  - service-account
  - scope
  - project
  - location
- Emit the corresponding AWF auth env vars for the firewall sidecar.
Gemini runtime switch to Vertex mode
- Detect engine.auth.type: github-oidc + provider: gcp as Gemini Vertex mode.
- In that mode:
  - stop requiring GEMINI_API_KEY
  - enable GOOGLE_GENAI_USE_VERTEXAI=true
  - set GOOGLE_CLOUD_PROJECT / GOOGLE_CLOUD_LOCATION
  - route traffic through the Vertex proxy target instead of the public Gemini API path
Validation and UX
- Add an activation-time validation step for required Vertex config instead of secret validation.
- Update auth failure detection to recognize Vertex hosts and suggest the GCP auth path, not just GEMINI_API_KEY.
AWF target/proxy wiring
- Add Gemini Vertex target selection for AWF config generation.
- Keep public Gemini and Vertex routing distinct so the generated proxy config matches the selected auth mode.
Docs
- Document Gemini Vertex AI auth in the auth reference.
- Update engine/auth summaries to show Gemini now supports both API key and Vertex/OIDC paths.

Example:

permissions:
  contents: read
  id-token: write

engine:
  id: gemini
  auth:
    type: github-oidc
    provider: gcp
    workload-identity-provider: projects/123456789012/locations/global/workloadIdentityPools/github/providers/github
    service-account: gemini-cli@my-project.iam.gserviceaccount.com
    project: my-project
    location: us-central1

Fixes GEMINI ENGINE - Add new authentication methods #47053

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 22.4 AIC · ⌖ 9.38 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13.6 AIC · ⌖ 9.97 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.17 AIC · ⌖ 8.22 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Adds Gemini Vertex AI authentication through GCP Workload Identity Federation and AWF proxy routing.

Changes:

Extends engine.auth with GCP configuration.
Adds Vertex runtime, validation, proxy targeting, and failure detection.
Documents and tests the new authentication path.

Show a summary per file

File	Description
`pkg/workflow/secret_validation_test.go`	Tests Vertex configuration validation.
`pkg/workflow/gemini_engine.go`	Implements Vertex runtime behavior.
`pkg/workflow/gemini_engine_test.go`	Tests Gemini Vertex execution and routing.
`pkg/workflow/engine.go`	Adds GCP auth fields and environment mapping.
`pkg/workflow/engine_includes_test.go`	Tests imported Vertex auth configuration.
`pkg/workflow/engine_config_test.go`	Tests GCP auth parsing.
`pkg/workflow/engine_config_parser.go`	Parses GCP auth fields.
`pkg/workflow/engine_api_targets.go`	Resolves Vertex API targets.
`pkg/workflow/domains.go`	Adds Vertex domains to sanitization.
`pkg/workflow/awf_helpers_test.go`	Tests AWF Vertex targets.
`pkg/workflow/awf_config.go`	Emits Vertex proxy configuration.
`pkg/parser/schemas/main_workflow_schema.json`	Defines GCP auth schema fields.
`docs/src/content/docs/reference/engines.md`	Lists Vertex authentication support.
`docs/src/content/docs/reference/auth.mdx`	Documents Vertex OIDC configuration.
`docs/src/content/docs/introduction/how-they-work.mdx`	Updates Gemini authentication summary.
`actions/setup/js/handle_agent_failure.test.cjs`	Tests Vertex failure detection.
`actions/setup/js/handle_agent_failure.cjs`	Recognizes Vertex authentication failures.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 17/17 changed files
Comments generated: 4
Review effort level: Medium

+			env["GOOGLE_API_KEY"] = geminiVertexAPIKeyPlaceholder
+			env["GOOGLE_VERTEX_BASE_URL"] = geminiVertexProxyURL


+	if auth := workflowData.EngineConfig.Auth; auth != nil && strings.TrimSpace(auth.GCPLocation) != "" {
+		target := strings.TrimSpace(auth.GCPLocation) + "-aiplatform.googleapis.com"
+		awfHelpersLog.Printf("Using regional Gemini Vertex API target: %s", target)
+		return target
+	}


+	if vertexTarget := GetGeminiVertexAPITarget(config.WorkflowData, config.EngineName); vertexTarget != "" {
+		awfConfigLog.Printf("API proxy: custom vertex target=%s", vertexTarget)
+		targets["vertex"] = &AWFAPITargetConfig{Host: vertexTarget}


 var geminiLog = logger.New("workflow:gemini_engine")

+const (
+	geminiVertexProxyURL          = "http://host.docker.internal:10004"


pelikhan · 2026-07-26T09:35:15Z

@copilot resolve the merge conflicts on this branch.

github-actions · 2026-07-26T09:37:52Z

Hey @Copilot 🤖 — excellent work on implementing Gemini Vertex AI authentication! This PR looks solid:

✅ Focused implementation — cleanly adds engine.auth support for Gemini via GCP/Vertex, aligning with the existing Claude auth model

✅ Comprehensive coverage — updates schema, config parsing, runtime behavior, error messaging, docs, and includes tests across multiple scenarios

✅ Well-documented — clear explanation in the PR body with concrete YAML examples showing the Vertex AI auth flow

✅ Tests in place — changes to awf_helpers_test.go, engine_config_test.go, engine_includes_test.go, gemini_engine_test.go, and secret_validation_test.go verify the new auth path

✅ Resolves #47053 — directly addresses the enterprise Vertex AI auth request

This looks ready for review. Great job tackling both the auth layer and the proxy routing logic!

Generated by ✅ Contribution Check · sonnet46 · 61.7 AIC · ⌖ 10.4 AIC · ⊞ 6.2K · ◷

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-26T09:53:03Z

@copilot resolve the merge conflicts on this branch.

Resolved in cf07259.

gh-aw-bot · 2026-07-26T10:18:14Z

@copilot please run the pr-finisher skill, address the unresolved review feedback blocking the Vertex auth approach, and clearly state whether this PR still depends on upstream AWF support before maintainers continue review.

Unresolved review feedback:

copilot-pull-request-reviewer: Add Gemini Vertex AI auth via engine.auth #48170 (comment)
copilot-pull-request-reviewer: Add Gemini Vertex AI auth via engine.auth #48170 (comment)
copilot-pull-request-reviewer: Add Gemini Vertex AI auth via engine.auth #48170 (comment)
copilot-pull-request-reviewer: Add Gemini Vertex AI auth via engine.auth #48170 (comment)

Please make the next maintainer decision explicit in your reply.

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 22.4 AIC · ⌖ 9.38 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-26T10:33:28Z

@copilot please run the pr-finisher skill, address the unresolved review feedback blocking the Vertex auth approach, and clearly state whether this PR still depends on upstream AWF support before ma...

Addressed in ca8849c by reverting the unsupported Gemini Vertex/OIDC path and its docs/tests. The original feature still depends on upstream gh-aw-firewall Vertex bearer-token/OIDC support; this branch no longer contains that feature. Next maintainer decision: do not continue feature review on this PR as an implementation of Vertex auth—either close/supersede it until upstream support lands, or treat this as the cleanup revert.

gh-aw-bot · 2026-07-26T11:02:43Z

@copilot please run the pr-finisher skill, address the unresolved review feedback blocking the Vertex auth approach, and clearly state whether any remaining blocker needs maintainer input.

Unresolved review feedback:

copilot-pull-request-reviewer[bot]: Add Gemini Vertex AI auth via engine.auth #48170 (comment)
copilot-pull-request-reviewer[bot]: Add Gemini Vertex AI auth via engine.auth #48170 (comment)
copilot-pull-request-reviewer[bot]: Add Gemini Vertex AI auth via engine.auth #48170 (comment)
copilot-pull-request-reviewer[bot]: Add Gemini Vertex AI auth via engine.auth #48170 (comment)

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13.6 AIC · ⌖ 9.97 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-26T11:13:37Z

@copilot please run the pr-finisher skill, address the unresolved review feedback blocking the Vertex auth approach, and clearly state whether any remaining blocker needs maintainer input.

Unresolv...

Addressed in 6759cbe. I restored the last incidental pkg/workflow/awf_config.go diff so this branch no longer contains any of the reverted Vertex/OIDC implementation, and I verified make agent-report-progress passes locally. The linked review threads are now obsolete because the code they referred to was removed in ca8849c. Remaining blocker needing maintainer input: yes — the original Gemini Vertex auth feature still depends on upstream gh-aw-firewall / AWF Vertex bearer-token OIDC support, so maintainers should either close or supersede this PR until that upstream support lands, or treat this PR only as the cleanup revert.

gh-aw-bot · 2026-07-26T12:10:22Z

@copilot please run the pr-finisher skill and summarize the current maintainer-ready state for this PR.

Unresolved review feedback:

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.17 AIC · ⌖ 8.22 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Initial plan

29e721a

Copilot AI assigned Copilot and pelikhan Jul 26, 2026

Copilot AI linked an issue Jul 26, 2026 that may be closed by this pull request

GEMINI ENGINE - Add new authentication methods #47053

Closed

Copilot started work on behalf of pelikhan July 26, 2026 08:41 View session

feat: add gemini vertex auth support

44d204f

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add new authentication methods for Gemini engine~~ Add Gemini Vertex AI auth via engine.auth Jul 26, 2026

Copilot finished work on behalf of pelikhan July 26, 2026 09:02

Copilot AI requested a review from pelikhan July 26, 2026 09:02

pelikhan marked this pull request as ready for review July 26, 2026 09:25

Copilot AI review requested due to automatic review settings July 26, 2026 09:25

Copilot started reviewing on behalf of pelikhan July 26, 2026 09:26 View session

Copilot AI reviewed Jul 26, 2026

View reviewed changes

Copilot started work on behalf of pelikhan July 26, 2026 09:36 View session

github-actions Bot mentioned this pull request Jul 26, 2026

[Contribution Check Report] Contribution Check — 2026-07-26 #48091

Closed

Merge origin/main into copilot/add-authentication-methods

cf07259

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 26, 2026 09:53

github-actions Bot mentioned this pull request Jul 26, 2026

[pr-sous-chef] pr-sous-chef run report #48081

Closed

Copilot started work on behalf of gh-aw-bot July 26, 2026 10:18 View session

Revert unsupported Gemini Vertex auth path

ca8849c

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 26, 2026 10:33

Copilot AI requested a review from gh-aw-bot July 26, 2026 10:33

Copilot started work on behalf of gh-aw-bot July 26, 2026 11:03 View session

Restore awf_config.go to base state

6759cbe

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 26, 2026 11:14

pelikhan closed this Jul 26, 2026

github-actions Bot deleted the copilot/add-authentication-methods branch August 3, 2026 02:25

Navigation Menu

Uh oh!

Add Gemini Vertex AI auth via `engine.auth` - #48170

Add Gemini Vertex AI auth via `engine.auth`#48170
pelikhan with Copilot wants to merge 5 commits into
mainfrom
copilot/add-authentication-methods

Copilot AI commented Jul 26, 2026 •

edited by github-actions Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

pelikhan commented Jul 26, 2026

Uh oh!

github-actions Bot commented Jul 26, 2026

Uh oh!

Copilot AI commented Jul 26, 2026

Uh oh!

gh-aw-bot commented Jul 26, 2026

Uh oh!

Copilot AI commented Jul 26, 2026

Uh oh!

gh-aw-bot commented Jul 26, 2026

Uh oh!

Copilot AI commented Jul 26, 2026

Uh oh!

gh-aw-bot commented Jul 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		env["GOOGLE_API_KEY"] = geminiVertexAPIKeyPlaceholder
		env["GOOGLE_VERTEX_BASE_URL"] = geminiVertexProxyURL

Uh oh!

Conversation

Copilot AI commented Jul 26, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

pelikhan commented Jul 26, 2026

Uh oh!

github-actions Bot commented Jul 26, 2026

Uh oh!

Copilot AI commented Jul 26, 2026

Uh oh!

gh-aw-bot commented Jul 26, 2026

Uh oh!

Copilot AI commented Jul 26, 2026

Uh oh!

gh-aw-bot commented Jul 26, 2026

Uh oh!

Copilot AI commented Jul 26, 2026

Uh oh!

gh-aw-bot commented Jul 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 26, 2026 •

edited by github-actions Bot

Loading