Claude Code in GitHub Actions: the safe patterns

Two ways to run it, and when each is right

Most teams should start with the action. The raw CLI is the right call for one specific shape: a job that reads a diff, emits a verdict, and is not allowed to touch anything.

Setting up the official action

gh auth login        # the installer checks for the GitHub CLI
claude               # in the repository you want to connect
# then, inside the session:
/install-github-app

# an API key from the Claude Console
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

# or a subscription token, generated locally with: claude setup-token
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

• To avoid a long-lived secret entirely, use OIDC workload identity federation: set anthropic_federation_rule_id and anthropic_organization_id, and grant the job id-token: write.
• Rolling out across an organisation: install the app once at organisation level, store the secret as an organisation Actions secret, and define the job once as a reusable workflow.

Interactive mode, automation mode, and who may trigger a run

The action decides how to run from your configuration, and the difference is one input.

name: Claude Code
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]

jobs:
  claude:
    if: contains(github.event.comment.body, '@claude')
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write        # required for the action's GitHub App auth
      actions: read          # lets Claude read CI results on the PR
    steps:
      - uses: actions/checkout@v6
        with: { fetch-depth: 1 }

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          claude_args: |
            --max-turns 15
            --model claude-sonnet-5

The trigger that will get you compromised

The defence is capability, not prompting. An agent with read-only tools and a token that cannot merge cannot act on an instruction hidden in a diff, whatever that instruction says. Do not attempt to solve this with a system prompt telling the model to ignore instructions in code it reads: that is a request, and the whole problem is that requests are not boundaries.

• On public repositories GitHub withholds secrets from fork-triggered runs entirely, so a review workflow on pull_request runs only for branches in the same repository. That is the correct behaviour, not a bug to work around.
• Give the reviewer job contents: read and pull-requests: read, and let a separate step post the comment.
• Restrict tools explicitly with --allowedTools "Read,Grep,Glob" in claude_args. Default permissions are designed for a human sitting there.
• Pass untrusted text through an environment variable and a file rather than interpolating it into a shell command, which also closes the ordinary shell-injection hole that exists here independently of the agent.

A bounded read-only job with the raw CLI

When you want a verdict rather than a collaborator, the CLI is smaller and every knob is visible.

name: agent-review
on:
  pull_request:                 # NOT pull_request_target

permissions:
  contents: read
  pull-requests: write

concurrency:
  group: agent-review-${{ github.ref }}
  cancel-in-progress: true

jobs:
  review:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
        with: { fetch-depth: 0 }

      - run: npm install -g @anthropic-ai/claude-code@2.1.219

      - name: Review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          DISABLE_AUTOUPDATER: "1"
        run: |
          git diff origin/${{ github.base_ref }}...HEAD > diff.patch

          claude -p "Review this diff. Report only defects that will actually
                     occur, each with the triggering input. No style comments.
                     If nothing is wrong, say so in one line." \
            --allowedTools "Read,Grep,Glob" \
            --model claude-sonnet-5 \
            --output-format json < diff.patch > out.json

          jq -r '.result' out.json > review.md
          echo "cost: \$$(jq -r '.total_cost_usd' out.json)" >> $GITHUB_STEP_SUMMARY

      - name: Comment
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh pr comment ${{ github.event.number }} --body-file review.md

Keeping the bill bounded

Every run consumes two things: GitHub Actions minutes on the runner, and tokens against your key or subscription. Both are unattended, which is exactly why they run away.

Questions people ask

Keep reading