Gemini engine fails with AWF proxy: GEMINI_API_BASE_URL points to proxy but proxy has no Gemini handler

[arthurfvives]

Description

When using engine: gemini in a workflow, the run fails with exit code 41:

Please set an Auth method in your /home/runner/.gemini/settings.json or specify 
one of the following environment variables before running: GEMINI_API_KEY, 
GOOGLE_GENAI_USE_VERTEXAI, GOOGLE_GENAI_USE_GCA

The secret GEMINI_API_KEY is correctly configured as a repository secret
(visible as *** in the logs).

Root cause

The AWF infrastructure sets GEMINI_API_BASE_URL to http://host.docker.internal:10003
(the AWF API proxy), but the proxy reports no Gemini support:

[INFO] API proxy enabled: OpenAI=false, Anthropic=false, Copilot=false
[WARN] ⚠️  API proxy enabled but no API keys found in environment

The Gemini CLI receives GEMINI_API_BASE_URL pointing to a proxy that doesn't
understand the Gemini protocol. It then fails to authenticate, even though
GEMINI_API_KEY is set in the environment.

Steps to reproduce

1. Add GEMINI_API_KEY as a repository Actions secret
2. Install a workflow with engine: gemini
3. Trigger the workflow

[lpcox]

🔗 AWF tracking issue: https://github.com/github/gh-aw-firewall/issues/github/gh-aw-firewall#1806

Generated by Firewall Issue Dispatcher · ● 720.5K · ◷