Claude Code GitHub Actions: Setup, Workflows, and CI/CD Integration (2026)

claude
/install-github-app

name: Claude Code
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]

jobs:
  claude:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

name: Claude Code Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Review this PR for:
            - Code quality and adherence to project standards
            - Performance regressions
            - Security vulnerabilities
            - Missing error handling
          claude_args: "--max-turns 5"

name: Claude Implementation
on:
  issues:
    types: [opened, assigned]

jobs:
  implement:
    if: contains(github.event.issue.body, '@claude')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          claude_args: "--model claude-opus-4-6 --max-turns 15"

name: Weekly Maintenance
on:
  schedule:
    - cron: '0 9 * * 1'  # Every Monday at 9am UTC

jobs:
  maintenance:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Check for outdated dependencies.
            If any are found, create a PR updating them.
            Include a summary of what changed and why.
          claude_args: "--max-turns 10"

name: Security Review
on:
  pull_request:
    paths:
      - 'src/auth/**'
      - 'src/api/**'
      - 'src/middleware/**'

jobs:
  security:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Security-focused review. Check for:
            - SQL injection, XSS, CSRF vulnerabilities
            - Authentication/authorization bypasses
            - Secrets or credentials in code
            - Insecure deserialization
          claude_args: "--max-turns 5"

steps:
  - uses: actions/checkout@v4

  - name: Configure AWS Credentials (OIDC)
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
      aws-region: us-west-2

  - uses: anthropics/claude-code-action@v1
    with:
      use_bedrock: "true"
      claude_args: '--model us.anthropic.claude-sonnet-4-6'

claude_args: |
  --max-turns 10          # Limit conversation turns (default: 10)
  --model claude-opus-4-6 # Use Opus instead of Sonnet
  --mcp-config /path/to/config.json  # Load MCP servers
  --allowed-tools "Read,Write,Bash"   # Restrict tool access
  --append-system-prompt "Follow our coding standards"
  --debug                 # Enable debug output

# Project Standards

## Code Style
- Use TypeScript strict mode
- Prefer functional components with hooks
- No default exports except for pages

## Review Criteria
- All API endpoints must validate input
- Database queries must use parameterized queries
- Auth checks required on all protected routes

## Architecture
- src/lib/ for shared utilities
- src/components/ for React components
- src/app/api/ for API routes

jobs:
  review:
    runs-on: ubuntu-latest
    timeout-minutes: 10          # Kill runaway jobs
    concurrency:
      group: claude-${{ github.ref }}
      cancel-in-progress: true   # Cancel if new push arrives
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: "Review this PR"
          claude_args: "--max-turns 5"  # Cap iterations

# Fast review on all PRs
name: Quick Review
on:
  pull_request:
    types: [opened, synchronize]
jobs:
  quick-review:
    runs-on: ubuntu-latest
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: "Quick review: flag obvious bugs, security issues, and style violations"
          claude_args: "--max-turns 3"

---

# Deep review on PRs to main
name: Deep Review
on:
  pull_request:
    types: [opened, synchronize]
    branches: [main]
jobs:
  deep-review:
    runs-on: ubuntu-latest
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Thorough review. Check architecture, performance,
            security, test coverage, and documentation.
          claude_args: "--model claude-opus-4-6 --max-turns 10"

name: Issue Triage
on:
  issues:
    types: [opened]
jobs:
  triage:
    runs-on: ubuntu-latest
    permissions:
      issues: write
      contents: read
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Analyze this issue. Apply labels from:
            bug, feature, docs, performance, security.
            Add a priority label: P0 (critical), P1 (high),
            P2 (medium), P3 (low).
            Post a brief comment summarizing what area
            of the codebase this affects.
          claude_args: "--max-turns 3"

name: Docs Sync
on:
  pull_request:
    types: [closed]
    branches: [main]
    paths:
      - 'src/**'
jobs:
  sync-docs:
    if: github.event.pull_request.merged == true
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            The merged PR changed source code.
            Update any documentation that references
            the changed files. Create a new PR with
            the documentation updates.
          claude_args: "--max-turns 8"