{ "@context": "https://schema.org", "@id": "https://aggr.aymericbeaumet.com/items/philschmid-de/2026-07-17-building-managed-agents-that-use-github-without-exposing/#webpage", "@type": [ "WebPage", "ArchiveComponent" ], "articleBody": "You can run the GitHub CLI (`gh`) inside a Gemini API [Managed Agents](https://ai.google.dev/gemini-api/docs/agents) without exposing your GitHub Personal Access Token (PAT) to the sandbox.\n\nThe [Network Configuration](https://ai.google.dev/gemini-api/docs/agent-environment#network-configuration) egress proxy injects your real token into outbound requests. The agent uses a dummy token locally, so the real token never enters the sandbox.\n\n## How it works\n\n1. **Dummy token**: The agent exports `GH_TOKEN=\"dummy\"` inside the sandbox to satisfy `gh`'s local auth checks.\n2. **Interception**: The egress proxy intercepts requests to `api.github.com` or `github.com`.\n3. **Transformation**: The proxy replaces the dummy token in the `Authorization` header with your real token.\n4. **Security**: The real token remains in the control plane and is never visible inside the sandbox.\n\n![Egress proxy injects GitHub token](https://www.philschmid.de/static/blog/managed-agents-gh/mermaid.jpg)\n\n## Prerequisites\n\n- **Gemini API Key**: Get your key from [Google AI Studio](https://aistudio.google.com/).\n\n- **GitHub Personal Access Token (PAT)**: I recommend a **Fine-grained PAT** restricted to the specific repositories your agent needs.\n\n To create one:\n\n 1. Go to GitHub -> **Settings** -> **Developer settings** -> **Personal access tokens** -> **Fine-grained tokens** or click [here](https://github.com/settings/personal-access-tokens/new).\n 2. Click **Generate new token**.\n 3. Under **Repository access**, select your target repositories.\n 4. Under **Permissions** -> **Repository permissions**, configure:\n - **Contents**: `Access: Read and write` (to clone and push code).\n - **Pull requests**: `Access: Read and write` (to open, review, and comment on PRs).\n - **Issues**: `Access: Read and write` (to create and comment on issues).\n 5. Click **Generate token** and copy it. It won't be shown again.\n\n## Example\n\nThis Python example spins up the agent in an isolated, ephemeral Linux environment, configures the network allowlist with header transformations, and runs `gh`.\n\nPython\n\n```python\nimport base64\nimport os\nfrom google import genai\n \n# GitHub PAT from host\nGITHUB_PAT = os.environ.get(\"GITHUB_PAT\")\nif not GITHUB_PAT:\n raise ValueError(\"Set GITHUB_PAT environment variable on the host.\")\n \n# Base64-encode for Git HTTPS auth\ngit_auth_str = f\"x-oauth-basic:{GITHUB_PAT}\"\ngit_auth_base64 = base64.b64encode(git_auth_str.encode(\"utf-8\")).decode(\"utf-8\")\n \nclient = genai.Client()\n \n# Shim: auto-installs gh, injects dummy token, ensures git HTTPS and no prompt\nshim_script = \"\"\"#!/bin/bash\nREAL_GH=\"/workspace/gh_install/bin/gh\"\n \nif [ ! -f \"$REAL_GH\" ]; then\n echo \"GitHub CLI not found. Installing to /workspace/gh_install...\" >&2\n mkdir -p /workspace/gh_install\n curl -sSLo /workspace/gh_install/gh.tar.gz https://github.com/cli/cli/releases/download/v2.40.1/gh_2.40.1_linux_amd64.tar.gz >&2\n tar --no-same-owner -xf /workspace/gh_install/gh.tar.gz -C /workspace/gh_install --strip-components=1 >&2\n rm -f /workspace/gh_install/gh.tar.gz >&2\n echo \"GitHub CLI installed.\" >&2\nfi\n \nexport GH_TOKEN=\"dummy_token_to_bypass_cli_check\"\nexport GIT_TERMINAL_PROMPT=0\n\"$REAL_GH\" config set git_protocol https >/dev/null 2>&1 || true\nexec \"$REAL_GH\" \"$@\"\n\"\"\"\n \nagent_prompt = \"\"\"\nUse the GitHub CLI wrapper at `/workspace/bin/gh` to show the logged in user info, and clone the repository 'octocat/Spoon-Knife' to '/workspace/Spoon-Knife'.\n\"\"\"\n \ninteraction = client.interactions.create(\n agent=\"antigravity-preview-05-2026\",\n input=agent_prompt,\n environment={\n \"type\": \"remote\",\n \"sources\": [\n {\n \"type\": \"inline\",\n \"content\": shim_script,\n \"target\": \"/workspace/bin/gh\"\n }\n ],\n \"network\": {\n \"allowlist\": [\n {\n \"domain\": \"api.github.com\", # GitHub API \n \"transform\": [{\"Authorization\": f\"Bearer {GITHUB_PAT}\"}]\n },\n {\n \"domain\": \"github.com\", # Git over HTTPS rule\n \"transform\": [{\"Authorization\": f\"Basic {git_auth_base64}\"}]\n },\n {\n \"domain\": \"*\"\n }\n ]\n }\n }\n)\n \nprint(interaction.output_text)\n# Logged in as philschmid; cloned octocat/Spoon-Knife to /workspace/Spoon-Knife\n```\n\nGitHub uses different auth schemes depending on the request. API calls to `api.github.com` expect a `Bearer` token, while Git operations against `github.com` require base64-encoded `Basic` auth.\n\nThe wildcard entry (`\"domain\": \"*\"`) lets the sandbox reach everything else, e.g. downloading the `gh` binary, fetching release assets, etc. You can lock this down to specific domains like `objects.githubusercontent.com` if you prefer tighter controls.\n\n## Persistent \"GitHub agent\"\n\nTo make the agent autonomous and avoid setup delays, you can create a managed agent that auto-installs the `gh` CLI. It reuses the environment after the first interaction to keep the installed `gh` binary across calls.\n\nPython\n\n```python\nimport base64\nimport os\nfrom google import genai\n \n# GitHub PAT from host\nGITHUB_PAT = os.environ.get(\"GITHUB_PAT\", \"TOKEN_HERE\")\n \ngit_auth_str = f\"x-oauth-basic:{GITHUB_PAT}\"\ngit_auth_base64 = base64.b64encode(git_auth_str.encode(\"utf-8\")).decode(\"utf-8\")\n \nclient = genai.Client()\n \nsystem_instruction = \"\"\"\nYou are a senior code reviewer. You have access to the GitHub CLI via a shim wrapper script at `/workspace/bin/gh`.\nFirst run `chmod +x /workspace/bin/gh` so that the wrapper script is executable. Then always use `/workspace/bin/gh` (or `bash /workspace/bin/gh`) for any GitHub operations.\nDo NOT use the standard `gh` command directly, as it will not have the correct authentication token.\n\"\"\"\n \n# Shim: auto-installs gh, injects dummy token, forces HTTPS and disables interactive prompts\nshim_script = \"\"\"#!/bin/bash\nREAL_GH=\"/workspace/gh_install/bin/gh\"\n \nif [ ! -f \"$REAL_GH\" ]; then\n echo \"GitHub CLI not found. Installing to /workspace/gh_install...\" >&2\n mkdir -p /workspace/gh_install\n curl -sSLo /workspace/gh_install/gh.tar.gz https://github.com/cli/cli/releases/download/v2.40.1/gh_2.40.1_linux_amd64.tar.gz >&2\n tar --no-same-owner -xf /workspace/gh_install/gh.tar.gz -C /workspace/gh_install --strip-components=1 >&2\n rm -f /workspace/gh_install/gh.tar.gz >&2\n echo \"GitHub CLI installed.\" >&2\nfi\n \nexport GH_TOKEN=\"dummy_token_to_bypass_cli_check\"\nexport GIT_TERMINAL_PROMPT=0\n\"$REAL_GH\" config set git_protocol https >/dev/null 2>&1 || true\nexec \"$REAL_GH\" \"$@\"\n\"\"\"\n \nclient.agents.create(\n id=\"github-reviewer-agent\",\n base_agent=\"antigravity-preview-05-2026\",\n base_environment={\n \"type\": \"remote\",\n \"sources\": [\n {\n \"type\": \"inline\",\n \"content\": shim_script,\n \"target\": \"/workspace/bin/gh\"\n },\n {\n \"type\": \"inline\",\n \"content\": system_instruction,\n \"target\": \"/AGENTS.md\"\n }\n ],\n \"network\": {\n \"allowlist\": [\n {\n \"domain\": \"api.github.com\",\n \"transform\": [{\"Authorization\": f\"Bearer {GITHUB_PAT}\"}]\n },\n {\n \"domain\": \"github.com\",\n \"transform\": [{\"Authorization\": f\"Basic {git_auth_base64}\"}]\n },\n {\"domain\": \"*\"}\n ]\n }\n }\n)\n```\n\nThe first interaction clones the base environment and triggers `gh` installation.\n\nPython\n\n```python\ninteraction_1 = client.interactions.create(\n agent=\"github-reviewer-agent\",\n input=\"Which GitHub user is logged in?\",\n environment=\"remote\",\n)\n \nprint(interaction_1.output_text)\n# ... currently logged-in GitHub user is **philschmid**.\n```\n\nFor subsequent calls, pass `interaction_1.environment_id` to reuse the same container, keeping the installed `gh` binary and inheriting the network transforms. Optionally pass `previous_interaction_id=interaction_1.id` as well if you want to retain conversation history across turns.\n\nPython\n\n```python\ninteraction_2 = client.interactions.create(\n agent=\"github-reviewer-agent\",\n input=\"View the pull request #12 in repository 'octocat/Spoon-Knife' and summarize the changes.\",\n environment=interaction_1.environment_id,\n previous_interaction_id=interaction_1.id\n)\n \nprint(interaction_2.output_text)\n# Based on the inspection of pull request #12 in the\n```\n\n## Conclusion\n\nYou can give Managed Agents access to GitHub without putting secrets in the sandbox. A dummy token satisfies `gh` locally, and the egress proxy injects the real PAT on the way out.\n\nFor more on Managed Agents, environments, and network transforms, see the [Managed Agents docs](https://ai.google.dev/gemini-api/docs/agents) and [Network configuration](https://ai.google.dev/gemini-api/docs/agent-environment#network-configuration).\n\n* * *\n\nThanks for reading! If you have any questions or feedback, please let me know on [Twitter](https://twitter.com/_philschmid) or [LinkedIn](https://www.linkedin.com/in/philipp-schmid-a6a2bb196/).\n", "authors": [], "captured_at": "2026-09-27T19:29:15.293681927+00:00", "category": "programming", "content_html": "

You can run the GitHub CLI (gh) inside a Gemini API Managed Agents without exposing your GitHub Personal Access Token (PAT) to the sandbox.

\n

The Network Configuration egress proxy injects your real token into outbound requests. The agent uses a dummy token locally, so the real token never enters the sandbox.

\n

How it works

\n
    \n
  1. Dummy token: The agent exports GH_TOKEN="dummy" inside the sandbox to satisfy gh's local auth checks.
    2. \n
  2. Interception: The egress proxy intercepts requests to api.github.com or github.com.
    3. \n
  3. Transformation: The proxy replaces the dummy token in the Authorization header with your real token.
    4. \n
  4. Security: The real token remains in the control plane and is never visible inside the sandbox.
    5. \n
\n

\"Egress

\n

Prerequisites

\n\n

Example

\n

This Python example spins up the agent in an isolated, ephemeral Linux environment, configures the network allowlist with header transformations, and runs gh.

\n

Python

\n
import base64\nimport os\nfrom google import genai\n \n# GitHub PAT from host\nGITHUB_PAT = os.environ.get("GITHUB_PAT")\nif not GITHUB_PAT:\n    raise ValueError("Set GITHUB_PAT environment variable on the host.")\n \n# Base64-encode for Git HTTPS auth\ngit_auth_str = f"x-oauth-basic:{GITHUB_PAT}"\ngit_auth_base64 = base64.b64encode(git_auth_str.encode("utf-8")).decode("utf-8")\n \nclient = genai.Client()\n \n# Shim: auto-installs gh, injects dummy token, ensures git HTTPS and no prompt\nshim_script = """#!/bin/bash\nREAL_GH="/workspace/gh_install/bin/gh"\n \nif [ ! -f "$REAL_GH" ]; then\n    echo "GitHub CLI not found. Installing to /workspace/gh_install..." >&2\n    mkdir -p /workspace/gh_install\n    curl -sSLo /workspace/gh_install/gh.tar.gz https://github.com/cli/cli/releases/download/v2.40.1/gh_2.40.1_linux_amd64.tar.gz >&2\n    tar --no-same-owner -xf /workspace/gh_install/gh.tar.gz -C /workspace/gh_install --strip-components=1 >&2\n    rm -f /workspace/gh_install/gh.tar.gz >&2\n    echo "GitHub CLI installed." >&2\nfi\n \nexport GH_TOKEN="dummy_token_to_bypass_cli_check"\nexport GIT_TERMINAL_PROMPT=0\n"$REAL_GH" config set git_protocol https >/dev/null 2>&1 || true\nexec "$REAL_GH" "$@"\n"""\n \nagent_prompt = """\nUse the GitHub CLI wrapper at `/workspace/bin/gh` to show the logged in user info, and clone the repository 'octocat/Spoon-Knife' to '/workspace/Spoon-Knife'.\n"""\n \ninteraction = client.interactions.create(\n    agent="antigravity-preview-05-2026",\n    input=agent_prompt,\n    environment={\n        "type": "remote",\n        "sources": [\n            {\n                "type": "inline",\n                "content": shim_script,\n                "target": "/workspace/bin/gh"\n            }\n        ],\n        "network": {\n            "allowlist": [\n                {\n                    "domain": "api.github.com", # GitHub API \n                    "transform": [{"Authorization": f"Bearer {GITHUB_PAT}"}]\n                },\n                {\n                    "domain": "github.com", # Git over HTTPS rule\n                    "transform": [{"Authorization": f"Basic {git_auth_base64}"}]\n                },\n                {\n                    "domain": "*"\n                }\n            ]\n        }\n    }\n)\n \nprint(interaction.output_text)\n# Logged in as philschmid; cloned octocat/Spoon-Knife to /workspace/Spoon-Knife\n
\n

GitHub uses different auth schemes depending on the request. API calls to api.github.com expect a Bearer token, while Git operations against github.com require base64-encoded Basic auth.

\n

The wildcard entry ("domain": "*") lets the sandbox reach everything else, e.g. downloading the gh binary, fetching release assets, etc. You can lock this down to specific domains like objects.githubusercontent.com if you prefer tighter controls.

\n

Persistent "GitHub agent"

\n

To make the agent autonomous and avoid setup delays, you can create a managed agent that auto-installs the gh CLI. It reuses the environment after the first interaction to keep the installed gh binary across calls.

\n

Python

\n
import base64\nimport os\nfrom google import genai\n \n# GitHub PAT from host\nGITHUB_PAT = os.environ.get("GITHUB_PAT", "TOKEN_HERE")\n \ngit_auth_str = f"x-oauth-basic:{GITHUB_PAT}"\ngit_auth_base64 = base64.b64encode(git_auth_str.encode("utf-8")).decode("utf-8")\n \nclient = genai.Client()\n \nsystem_instruction = """\nYou are a senior code reviewer. You have access to the GitHub CLI via a shim wrapper script at `/workspace/bin/gh`.\nFirst run `chmod +x /workspace/bin/gh` so that the wrapper script is executable. Then always use `/workspace/bin/gh` (or `bash /workspace/bin/gh`) for any GitHub operations.\nDo NOT use the standard `gh` command directly, as it will not have the correct authentication token.\n"""\n \n# Shim: auto-installs gh, injects dummy token, forces HTTPS and disables interactive prompts\nshim_script = """#!/bin/bash\nREAL_GH="/workspace/gh_install/bin/gh"\n \nif [ ! -f "$REAL_GH" ]; then\n    echo "GitHub CLI not found. Installing to /workspace/gh_install..." >&2\n    mkdir -p /workspace/gh_install\n    curl -sSLo /workspace/gh_install/gh.tar.gz https://github.com/cli/cli/releases/download/v2.40.1/gh_2.40.1_linux_amd64.tar.gz >&2\n    tar --no-same-owner -xf /workspace/gh_install/gh.tar.gz -C /workspace/gh_install --strip-components=1 >&2\n    rm -f /workspace/gh_install/gh.tar.gz >&2\n    echo "GitHub CLI installed." >&2\nfi\n \nexport GH_TOKEN="dummy_token_to_bypass_cli_check"\nexport GIT_TERMINAL_PROMPT=0\n"$REAL_GH" config set git_protocol https >/dev/null 2>&1 || true\nexec "$REAL_GH" "$@"\n"""\n \nclient.agents.create(\n    id="github-reviewer-agent",\n    base_agent="antigravity-preview-05-2026",\n    base_environment={\n        "type": "remote",\n        "sources": [\n            {\n                "type": "inline",\n                "content": shim_script,\n                "target": "/workspace/bin/gh"\n            },\n            {\n                "type": "inline",\n                "content": system_instruction,\n                "target": "/AGENTS.md"\n            }\n        ],\n        "network": {\n            "allowlist": [\n                {\n                    "domain": "api.github.com",\n                    "transform": [{"Authorization": f"Bearer {GITHUB_PAT}"}]\n                },\n                {\n                    "domain": "github.com",\n                    "transform": [{"Authorization": f"Basic {git_auth_base64}"}]\n                },\n                {"domain": "*"}\n            ]\n        }\n    }\n)\n
\n

The first interaction clones the base environment and triggers gh installation.

\n

Python

\n
interaction_1 = client.interactions.create(\n    agent="github-reviewer-agent",\n    input="Which GitHub user is logged in?",\n    environment="remote",\n)\n \nprint(interaction_1.output_text)\n# ... currently logged-in GitHub user is **philschmid**.\n
\n

For subsequent calls, pass interaction_1.environment_id to reuse the same container, keeping the installed gh binary and inheriting the network transforms. Optionally pass previous_interaction_id=interaction_1.id as well if you want to retain conversation history across turns.

\n

Python

\n
interaction_2 = client.interactions.create(\n    agent="github-reviewer-agent",\n    input="View the pull request #12 in repository 'octocat/Spoon-Knife' and summarize the changes.",\n    environment=interaction_1.environment_id,\n    previous_interaction_id=interaction_1.id\n)\n \nprint(interaction_2.output_text)\n# Based on the inspection of pull request #12 in the\n
\n

Conclusion

\n

You can give Managed Agents access to GitHub without putting secrets in the sandbox. A dummy token satisfies gh locally, and the egress proxy injects the real PAT on the way out.

\n

For more on Managed Agents, environments, and network transforms, see the Managed Agents docs and Network configuration.

\n
\n

Thanks for reading! If you have any questions or feedback, please let me know on Twitter or LinkedIn.

\n", "content_markdown": "You can run the GitHub CLI (`gh`) inside a Gemini API [Managed Agents](https://ai.google.dev/gemini-api/docs/agents) without exposing your GitHub Personal Access Token (PAT) to the sandbox.\n\nThe [Network Configuration](https://ai.google.dev/gemini-api/docs/agent-environment#network-configuration) egress proxy injects your real token into outbound requests. The agent uses a dummy token locally, so the real token never enters the sandbox.\n\n## How it works\n\n1. **Dummy token**: The agent exports `GH_TOKEN=\"dummy\"` inside the sandbox to satisfy `gh`'s local auth checks.\n2. **Interception**: The egress proxy intercepts requests to `api.github.com` or `github.com`.\n3. **Transformation**: The proxy replaces the dummy token in the `Authorization` header with your real token.\n4. **Security**: The real token remains in the control plane and is never visible inside the sandbox.\n\n![Egress proxy injects GitHub token](https://www.philschmid.de/static/blog/managed-agents-gh/mermaid.jpg)\n\n## Prerequisites\n\n- **Gemini API Key**: Get your key from [Google AI Studio](https://aistudio.google.com/).\n\n- **GitHub Personal Access Token (PAT)**: I recommend a **Fine-grained PAT** restricted to the specific repositories your agent needs.\n\n To create one:\n\n 1. Go to GitHub -> **Settings** -> **Developer settings** -> **Personal access tokens** -> **Fine-grained tokens** or click [here](https://github.com/settings/personal-access-tokens/new).\n 2. Click **Generate new token**.\n 3. Under **Repository access**, select your target repositories.\n 4. Under **Permissions** -> **Repository permissions**, configure:\n - **Contents**: `Access: Read and write` (to clone and push code).\n - **Pull requests**: `Access: Read and write` (to open, review, and comment on PRs).\n - **Issues**: `Access: Read and write` (to create and comment on issues).\n 5. Click **Generate token** and copy it. It won't be shown again.\n\n## Example\n\nThis Python example spins up the agent in an isolated, ephemeral Linux environment, configures the network allowlist with header transformations, and runs `gh`.\n\nPython\n\n```python\nimport base64\nimport os\nfrom google import genai\n \n# GitHub PAT from host\nGITHUB_PAT = os.environ.get(\"GITHUB_PAT\")\nif not GITHUB_PAT:\n raise ValueError(\"Set GITHUB_PAT environment variable on the host.\")\n \n# Base64-encode for Git HTTPS auth\ngit_auth_str = f\"x-oauth-basic:{GITHUB_PAT}\"\ngit_auth_base64 = base64.b64encode(git_auth_str.encode(\"utf-8\")).decode(\"utf-8\")\n \nclient = genai.Client()\n \n# Shim: auto-installs gh, injects dummy token, ensures git HTTPS and no prompt\nshim_script = \"\"\"#!/bin/bash\nREAL_GH=\"/workspace/gh_install/bin/gh\"\n \nif [ ! -f \"$REAL_GH\" ]; then\n echo \"GitHub CLI not found. Installing to /workspace/gh_install...\" >&2\n mkdir -p /workspace/gh_install\n curl -sSLo /workspace/gh_install/gh.tar.gz https://github.com/cli/cli/releases/download/v2.40.1/gh_2.40.1_linux_amd64.tar.gz >&2\n tar --no-same-owner -xf /workspace/gh_install/gh.tar.gz -C /workspace/gh_install --strip-components=1 >&2\n rm -f /workspace/gh_install/gh.tar.gz >&2\n echo \"GitHub CLI installed.\" >&2\nfi\n \nexport GH_TOKEN=\"dummy_token_to_bypass_cli_check\"\nexport GIT_TERMINAL_PROMPT=0\n\"$REAL_GH\" config set git_protocol https >/dev/null 2>&1 || true\nexec \"$REAL_GH\" \"$@\"\n\"\"\"\n \nagent_prompt = \"\"\"\nUse the GitHub CLI wrapper at `/workspace/bin/gh` to show the logged in user info, and clone the repository 'octocat/Spoon-Knife' to '/workspace/Spoon-Knife'.\n\"\"\"\n \ninteraction = client.interactions.create(\n agent=\"antigravity-preview-05-2026\",\n input=agent_prompt,\n environment={\n \"type\": \"remote\",\n \"sources\": [\n {\n \"type\": \"inline\",\n \"content\": shim_script,\n \"target\": \"/workspace/bin/gh\"\n }\n ],\n \"network\": {\n \"allowlist\": [\n {\n \"domain\": \"api.github.com\", # GitHub API \n \"transform\": [{\"Authorization\": f\"Bearer {GITHUB_PAT}\"}]\n },\n {\n \"domain\": \"github.com\", # Git over HTTPS rule\n \"transform\": [{\"Authorization\": f\"Basic {git_auth_base64}\"}]\n },\n {\n \"domain\": \"*\"\n }\n ]\n }\n }\n)\n \nprint(interaction.output_text)\n# Logged in as philschmid; cloned octocat/Spoon-Knife to /workspace/Spoon-Knife\n```\n\nGitHub uses different auth schemes depending on the request. API calls to `api.github.com` expect a `Bearer` token, while Git operations against `github.com` require base64-encoded `Basic` auth.\n\nThe wildcard entry (`\"domain\": \"*\"`) lets the sandbox reach everything else, e.g. downloading the `gh` binary, fetching release assets, etc. You can lock this down to specific domains like `objects.githubusercontent.com` if you prefer tighter controls.\n\n## Persistent \"GitHub agent\"\n\nTo make the agent autonomous and avoid setup delays, you can create a managed agent that auto-installs the `gh` CLI. It reuses the environment after the first interaction to keep the installed `gh` binary across calls.\n\nPython\n\n```python\nimport base64\nimport os\nfrom google import genai\n \n# GitHub PAT from host\nGITHUB_PAT = os.environ.get(\"GITHUB_PAT\", \"TOKEN_HERE\")\n \ngit_auth_str = f\"x-oauth-basic:{GITHUB_PAT}\"\ngit_auth_base64 = base64.b64encode(git_auth_str.encode(\"utf-8\")).decode(\"utf-8\")\n \nclient = genai.Client()\n \nsystem_instruction = \"\"\"\nYou are a senior code reviewer. You have access to the GitHub CLI via a shim wrapper script at `/workspace/bin/gh`.\nFirst run `chmod +x /workspace/bin/gh` so that the wrapper script is executable. Then always use `/workspace/bin/gh` (or `bash /workspace/bin/gh`) for any GitHub operations.\nDo NOT use the standard `gh` command directly, as it will not have the correct authentication token.\n\"\"\"\n \n# Shim: auto-installs gh, injects dummy token, forces HTTPS and disables interactive prompts\nshim_script = \"\"\"#!/bin/bash\nREAL_GH=\"/workspace/gh_install/bin/gh\"\n \nif [ ! -f \"$REAL_GH\" ]; then\n echo \"GitHub CLI not found. Installing to /workspace/gh_install...\" >&2\n mkdir -p /workspace/gh_install\n curl -sSLo /workspace/gh_install/gh.tar.gz https://github.com/cli/cli/releases/download/v2.40.1/gh_2.40.1_linux_amd64.tar.gz >&2\n tar --no-same-owner -xf /workspace/gh_install/gh.tar.gz -C /workspace/gh_install --strip-components=1 >&2\n rm -f /workspace/gh_install/gh.tar.gz >&2\n echo \"GitHub CLI installed.\" >&2\nfi\n \nexport GH_TOKEN=\"dummy_token_to_bypass_cli_check\"\nexport GIT_TERMINAL_PROMPT=0\n\"$REAL_GH\" config set git_protocol https >/dev/null 2>&1 || true\nexec \"$REAL_GH\" \"$@\"\n\"\"\"\n \nclient.agents.create(\n id=\"github-reviewer-agent\",\n base_agent=\"antigravity-preview-05-2026\",\n base_environment={\n \"type\": \"remote\",\n \"sources\": [\n {\n \"type\": \"inline\",\n \"content\": shim_script,\n \"target\": \"/workspace/bin/gh\"\n },\n {\n \"type\": \"inline\",\n \"content\": system_instruction,\n \"target\": \"/AGENTS.md\"\n }\n ],\n \"network\": {\n \"allowlist\": [\n {\n \"domain\": \"api.github.com\",\n \"transform\": [{\"Authorization\": f\"Bearer {GITHUB_PAT}\"}]\n },\n {\n \"domain\": \"github.com\",\n \"transform\": [{\"Authorization\": f\"Basic {git_auth_base64}\"}]\n },\n {\"domain\": \"*\"}\n ]\n }\n }\n)\n```\n\nThe first interaction clones the base environment and triggers `gh` installation.\n\nPython\n\n```python\ninteraction_1 = client.interactions.create(\n agent=\"github-reviewer-agent\",\n input=\"Which GitHub user is logged in?\",\n environment=\"remote\",\n)\n \nprint(interaction_1.output_text)\n# ... currently logged-in GitHub user is **philschmid**.\n```\n\nFor subsequent calls, pass `interaction_1.environment_id` to reuse the same container, keeping the installed `gh` binary and inheriting the network transforms. Optionally pass `previous_interaction_id=interaction_1.id` as well if you want to retain conversation history across turns.\n\nPython\n\n```python\ninteraction_2 = client.interactions.create(\n agent=\"github-reviewer-agent\",\n input=\"View the pull request #12 in repository 'octocat/Spoon-Knife' and summarize the changes.\",\n environment=interaction_1.environment_id,\n previous_interaction_id=interaction_1.id\n)\n \nprint(interaction_2.output_text)\n# Based on the inspection of pull request #12 in the\n```\n\n## Conclusion\n\nYou can give Managed Agents access to GitHub without putting secrets in the sandbox. A dummy token satisfies `gh` locally, and the egress proxy injects the real PAT on the way out.\n\nFor more on Managed Agents, environments, and network transforms, see the [Managed Agents docs](https://ai.google.dev/gemini-api/docs/agents) and [Network configuration](https://ai.google.dev/gemini-api/docs/agent-environment#network-configuration).\n\n* * *\n\nThanks for reading! If you have any questions or feedback, please let me know on [Twitter](https://twitter.com/_philschmid) or [LinkedIn](https://www.linkedin.com/in/philipp-schmid-a6a2bb196/).\n", "dateCreated": "2026-09-27T19:29:15.293681927+00:00", "date_created": "2026-07-17T00:00:00+00:00", "date_modified": "2026-07-17T00:00:00+00:00", "date_published": "2026-07-17T00:00:00+00:00", "description": "Build Gemini Managed Agents that use the GitHub CLI without exposing your PAT. The egress proxy injects your real token into outbound requests while the sandbox only sees a dummy token.", "external_url": "https://www.philschmid.de/managed-agents-gh", "git": { "commit": "ebb0941c5c06a2ab2377342d607535262a3e969e", "path": "items/philschmid-de/2026/07/2026-07-17-building-managed-agents-that-use-github-without-exposing.md", "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/ebb0941c5c06a2ab2377342d607535262a3e969e/items/philschmid-de/2026/07/2026-07-17-building-managed-agents-that-use-github-without-exposing.md" }, "id": "urn:aggr:item:09f72419a2d4072c17c4414e1182d560fbd54c27", "isBasedOn": { "@id": "https://www.philschmid.de/managed-agents-gh" }, "mainEntity": { "@id": "https://www.philschmid.de/managed-agents-gh", "@type": "CreativeWork", "archivedAt": { "@id": "https://aggr.aymericbeaumet.com/items/philschmid-de/2026-07-17-building-managed-agents-that-use-github-without-exposing/#webpage" }, "dateModified": "2026-07-17T00:00:00+00:00", "datePublished": "2026-07-17T00:00:00+00:00", "headline": "Building Managed Agents That Use GitHub Without Exposing Your Token", "timeRequired": "PT5M", "url": "https://www.philschmid.de/managed-agents-gh", "wordCount": 1011 }, "name": "Archived snapshot: Building Managed Agents That Use GitHub Without Exposing Your Token", "preview": null, "reading_minutes": 5, "replicated_at": null, "source": "philschmid-de", "source_name": "philschmid.de - RSS feed", "summary": "Build Gemini Managed Agents that use the GitHub CLI without exposing your PAT. The egress proxy injects your real token into outbound requests while the sandbox only sees a dummy token.", "tags": [], "temporalCoverage": "2026-09-27T19:29:15.293681927+00:00", "title": "Building Managed Agents That Use GitHub Without Exposing Your Token", "url": "https://aggr.aymericbeaumet.com/items/philschmid-de/2026-07-17-building-managed-agents-that-use-github-without-exposing/", "word_count": 1011 }