CI/CD Pipelines with Claude Code

Why Put Claude in Your Pipeline?

Code review doesn't scale. The more PRs your team opens, the longer everyone waits. Reviewer quality drops under load. Small issues slip to production.

Picture every PR getting a thorough first pass within minutes of opening. Not a human review (you still need those), but an automated sweep that catches the obvious stuff: missing types, security issues, convention violations, stray console.logs.

Wire Claude Code into GitHub Actions and you get automated PR reviews, issue triage, even feature implementation triggered by an @claude mention. It reads your CLAUDE.md for conventions, understands your codebase, and posts results directly to your PRs. Same Claude Code you use locally, just running headlessly in CI.

Setting Up the GitHub Action

The official action is anthropics/claude-code-action@v1. Two ways to get it running.

Quick path: run /install-github-app inside Claude Code. It walks you through everything. Installs the GitHub App, sets up your API key as a repo secret, copies the workflow file. About two minutes.

Manual path: install the Claude Code GitHub App yourself, add ANTHROPIC_API_KEY as a GitHub Secret, create the workflow file:

name: Claude Code
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
 
jobs:
  claude:
    if: contains(github.event.comment.body, '@claude')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
    steps:
      - uses: actions/checkout@v4
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

Once committed, anyone on your team can mention @claude in any PR comment or issue. It checks out your code, reads the full conversation context, and takes action.

What Can You Actually Do With It?

The interaction model is conversational. Mention @claude in a comment, write what you want in plain language.

"@claude implement this feature based on the issue description." Claude reads the issue, writes code, pushes a commit to the PR branch. You review the diff like any other commit.

"@claude fix the TypeError in the auth middleware." It finds the code, diagnoses the issue, pushes a fix.

"@claude how should I implement auth for this service?" It analyzes your codebase and posts recommendations that fit your existing patterns.

The prompt parameter in your workflow config lets you trigger automatic behavior. Set it to /review and Claude performs a structured code review on every PR automatically, no @claude mention needed.

- uses: anthropics/claude-code-action@v1
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    prompt: "/review"

prompt accepts custom instructions, and claude_args lets you pass CLI flags for finer control.

Making CLAUDE.md Work for CI

Your CLAUDE.md matters just as much in CI as locally. When Claude runs in your pipeline, it reads CLAUDE.md to understand conventions, coding standards, review criteria. That's where you define what "good" looks like for your team.

Include error handling patterns, naming conventions, test coverage expectations, architectural boundaries. The more specific you are, the more useful the automated feedback. Vague rules produce vague reviews. It's basically your team's code review checklist, written once and applied to every single PR without anyone getting tired or distracted.

Schedule-Based Automation

You don't have to wait for someone to say @claude. Cron schedules let you set up proactive automation: a daily workflow that scans for stale PRs, generates summary reports, or triages overnight issues.

on:
  schedule:
    - cron: "0 9 * * 1-5"  # Weekdays at 9am UTC

Routine housekeeping, handled automatically, every morning before anyone's opened their laptop.

Security and Cost Considerations

Running an AI agent in your pipeline means thinking about permissions and money.

Security: API key goes in GitHub Secrets, always. Limit workflow permissions to the minimum. The example above uses contents: read, pull-requests: write, and issues: write. That covers most use cases. And always review Claude's suggestions before merging. Treat its commits like any other contributor's code.

Cost: you're paying for GitHub Actions minutes and API tokens. Use --max-turns in claude_args to cap how long Claude works. Set job timeouts. Write specific prompts. "@claude fix this null check" costs far less than "@claude refactor this entire module." The difference in token spend is dramatic.

If your org uses AWS Bedrock or Google Vertex AI, route Claude through those instead of the direct API. You get to use existing billing and compliance infrastructure.

Custom GitHub App Branding

Want the bot comments under your own brand instead of the generic Claude Code app? Create a custom GitHub App. Branded avatar, branded name on all comments. Same functionality underneath, just looks way more polished in PR threads.

Try It

Set up a minimal workflow in a test repo first. Don't start with your production codebase.

mkdir ci-test && cd ci-test
git init
mkdir -p .github/workflows

Create .github/workflows/claude.yml with the workflow shown above. Add a simple CLAUDE.md:

echo "## Code Standards
- Use TypeScript strict mode
- All functions must have JSDoc comments
- No console.log in production code" > CLAUDE.md

Push to GitHub, add your ANTHROPIC_API_KEY secret in repo settings, open a PR with some intentionally sloppy code (missing types, a stray console.log), and comment "@claude review this PR." Watch it catch the issues and post feedback inline.

Once it works on a test repo, bringing it to real projects is just copying the workflow file and adding the secret.

Under the Hood

The GitHub Action runs on the Agent SDK (covered elsewhere in this course). It spins up Claude Code in headless mode, feeds it the PR diff and conversation context, and lets it work within the context window like a local session. Results post back through the GitHub API.

Anything you can do with Claude Code locally, you can automate in CI. Start with automated reviews, get comfortable with the output quality, then branch out into more ambitious workflows.