CodeNote.net

Gemini CLI May Automatically Merge Your PR When You Ask It to Review

#gemini #cli #ai
Tadashi Shigeoka ·  Tue, December 2, 2025

AI-powered development tools are emerging one after another, dramatically improving our productivity. Gemini CLI, provided by Google, is one of them—a very convenient tool that allows you to call Gemini’s powerful features from the command line.

However, behind this convenience, there can be unexpected pitfalls. Today, I’ll share a scary experience I actually had when trying to get Gemini CLI to review a GitHub Pull Request (PR).

Background: Other AI Tools Have /review

AI code assistants like Claude Code and Codex CLI have a feature where you can request a review simply by mentioning /review on a GitHub PR. By default, these tools only post review comments and do not automatically perform destructive operations like Approve or Merge. Developers can use AI suggestions as a reference and make the final decision themselves.

On the other hand, Gemini CLI doesn’t have such a dedicated command. So I thought that if I asked in natural language with “Review PR [number],” I could achieve the same thing, and decided to try it.

What Happened?

I launched the gemini CLI in my Terminal app and executed the following command, specifying the target PR number.

gemini
 
Review PR 2354

My expectation was simply that the AI would read the PR diff and post review comments—nothing more. However, after executing the command, I froze when I looked at the terminal and the GitHub screen.

After the AI posted review comments, it automatically Approved the PR and, of all things, Merged it into the main branch.

Fortunately, this time it was a minor PR that would have been approved anyway, so no harm was done. But thinking about what would have happened if this had been a PR that needed Request changes makes me break into a cold sweat.

You can see the actual behavior in the following PR. You can observe that Approve and Merge were executed immediately after the AI posted review comments.

Why Is This Dangerous?

In software development, code review is an important process for ensuring quality. Based on reviewer feedback, code is modified, and after confirming all concerns are resolved, the reviewer Approves. The final merge is typically done by the developer themselves, taking responsibility after confirming that CI/CD tests have passed.

The current Review PR behavior of Gemini CLI bypasses this entire process.

  1. Unable to verify review comments: There’s no time for humans to check what the AI pointed out and what reasoning led to the Approve.
  2. Unintended merge: Even for minor fix PRs, having them merged while ignoring release cycles and other developers’ work is extremely dangerous.

Conclusion

Gemini CLI is a tool with great potential, but Review PR currently has the possibility of automatically performing everything from review to merge. Using it carelessly without understanding this behavior can lead to unintended merges.

When trying new commands for the first time, always exercise extreme caution, such as testing in a personal experimental repository.

Note: For production repositories, always verify the behavior in a test repository before using this feature.

AI tools are wonderful partners that accelerate our development, but it’s important to correctly understand their capabilities and behavior and use them appropriately. I hope this information helps everyone use AI safely.

That’s all from the Gemba, where I accidentally had Gemini CLI complete everything from PR review to Merge fully automatically.

References