Keeping Unattended Jobs From Failing Silently: A Preflight Gate for Gemini's Platform Changes

# preflight.py — a preflight gate for Gemini automation
import os
import re
import sys
import pathlib
from google import genai
from google.genai import errors as genai_errors
 
REPO_ROOT = pathlib.Path(os.environ.get("REPO_ROOT", "."))
MODEL = os.environ.get("PREFLIGHT_MODEL", "gemini-2.5-flash-lite")
 
class Violation(Exception):
    """A broken assumption. The message becomes the stop reason."""
 
def check_key_is_usable_and_restricted() -> str:
    """Confirm the key is valid and not blocked, via a minimal request."""
    key = os.environ.get("GEMINI_API_KEY")
    if not key:
        raise Violation("GEMINI_API_KEY is not set")
    client = genai.Client(api_key=key)
    try:
        # A minimal one-token call to keep cost and latency negligible
        client.models.generate_content(
            model=MODEL,
            contents="ok",
            config={"max_output_tokens": 1},
        )
    except genai_errors.ClientError as e:
        code = getattr(e, "status_code", None) or getattr(e, "code", None)
        # 403-class errors include "unrestricted key blocked" and "referrer not allowed"
        if code in (401, 403):
            raise Violation(
                f"Key was rejected (HTTP {code}). "
                "Check app/API restrictions or the key's validity"
            )
        raise
    return "key ok"

LEGACY_CLI = re.compile(r"(?<![\w-])gemini\s+(generate|chat|config|mcp)\b")
SCAN_SUFFIXES = {".sh", ".bash", ".yml", ".yaml", ".mjs", ".py"}
 
def check_no_legacy_cli() -> str:
    """Scan for lingering calls to the EOL old gemini CLI."""
    hits = []
    for path in REPO_ROOT.rglob("*"):
        if path.suffix.lower() not in SCAN_SUFFIXES:
            continue
        if any(part in {".git", "node_modules", ".next"} for part in path.parts):
            continue
        try:
            text = path.read_text(encoding="utf-8", errors="ignore")
        except OSError:
            continue
        for i, line in enumerate(text.splitlines(), 1):
            if line.lstrip().startswith("#"):
                continue  # skip comment lines
            if LEGACY_CLI.search(line):
                hits.append(f"{path.relative_to(REPO_ROOT)}:{i}")
    if hits:
        raise Violation(
            "Detected calls to the EOL old Gemini CLI: " + ", ".join(hits[:8])
        )
    return "no legacy CLI"

LEGACY_CALL = re.compile(r"\.generate_content\(|\.generateContent\(")
 
def audit_migration_debt(max_allowed: int = 0) -> str:
    """Count old generateContent call sites and WARN when over threshold."""
    count = 0
    sites = []
    for path in REPO_ROOT.rglob("*"):
        if path.suffix.lower() not in {".py", ".ts", ".js", ".mjs"}:
            continue
        if any(p in {".git", "node_modules", ".next"} for p in path.parts):
            continue
        try:
            text = path.read_text(encoding="utf-8", errors="ignore")
        except OSError:
            continue
        for i, line in enumerate(text.splitlines(), 1):
            if LEGACY_CALL.search(line):
                count += 1
                sites.append(f"{path.relative_to(REPO_ROOT)}:{i}")
    if count > max_allowed:
        print(f"::warning:: {count} call sites not migrated to Interactions API "
              f"(limit {max_allowed}): {', '.join(sites[:5])}")
    return f"migration debt: {count}"

def main() -> int:
    checks = [
        ("key", check_key_is_usable_and_restricted, True),   # True = FAIL-eligible
        ("legacy-cli", check_no_legacy_cli, True),
        ("migration-debt", lambda: audit_migration_debt(0), False),  # WARN only
    ]
    failed = False
    for name, fn, is_fatal in checks:
        try:
            print(f"[ok] {name}: {fn()}")
        except Violation as v:
            level = "FAIL" if is_fatal else "WARN"
            print(f"[{level}] {name}: {v}", file=sys.stderr)
            if is_fatal:
                failed = True
    return 1 if failed else 0
 
if __name__ == "__main__":
    sys.exit(main())

- name: Preflight gate
  run: python preflight.py
  env:
    GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
    REPO_ROOT: ${{ github.workspace }}
 
- name: Generate articles
  run: node generate.mjs   # never reached if preflight fails

# proceed to the main work only when preflight returns 0
python preflight.py && node generate.mjs || \
  echo "$(TZ=Asia/Tokyo date '+%F %T') preflight blocked run" >> preflight.log