Claude Code GitHub Actions

• Code Review: automatic review on every pull request, without writing a workflow
• Claude Code on the web: Claude Code sessions from your browser or phone
• Claude Agent SDK: custom automation outside GitHub Actions. The Claude Code GitHub Action is built on the SDK
• GitHub Enterprise Server: Claude Code with self-hosted GitHub

​

Setup

• Quick setup: run /install-github-app from Claude Code. Claude Code installs the GitHub App, adds your authentication secret, and prepares the workflow pull request for you
• Manual setup: install the app, add the secret, and copy the workflow file into your repository yourself. Use this path when you don’t run Claude Code locally, when the command fails, or when you want full control of the workflow files

​

Quick setup

• If Claude Code already has an API key, it reuses that key, and offers to keep the repository’s existing ANTHROPIC_API_KEY secret if one is already set
• Otherwise, choose between creating a long-lived token with your Claude subscription and pasting in an API key

• Run /install-github-app again. When the repository already has a claude.yml, select Update workflow file with latest version. Claude Code pushes fresh copies of the workflow files to a new branch and opens the pull request, the same as a first install.
• Add the --comment argument and the claude_args line from the review workflow example to the checked-in file yourself, which keeps any other edits you made to it.

​

Manual setup

​

Set up for an organization

• Install the Claude GitHub App once at the organization level, choosing all repositories or a selected list
• Store the authentication secret as an organization-level Actions secret so each repository doesn’t need its own copy
• Add the workflow file to each repository that should run the Claude Code GitHub Action, or define the job once as a reusable workflow that each repository calls

• anthropic_federation_rule_id: the federation rule ID, fdrl_...
• anthropic_organization_id: your Anthropic organization ID
• anthropic_service_account_id: the service account ID, svac_.... Optional, since the federation rule you create in the Console already targets a service account
• anthropic_workspace_id: the workspace ID, wrkspc_.... Optional when the federation rule targets a single workspace

​

Uninstall

• Workflow files: delete the workflows that use anthropics/claude-code-action from .github/workflows/. If you used quick setup, look for claude.yml and, if you selected the review workflow, claude-code-review.yml. With the workflows deleted, the Claude Code GitHub Action no longer runs
• Secrets: delete the ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN secret from the repository, and from organization-level Actions secrets if you shared it across repositories. If you delete a secret, the credential it held stays valid. To retire an API key entirely, also delete the key in the Claude Console
• GitHub App: uninstall the Claude GitHub App in your repository or organization settings under GitHub Apps, but only if you don’t use it for another Claude feature, such as Code Review or web auto-fix

​

GitHub App permissions

​

Interactive and automation modes

• Interactive mode: when the workflow provides no prompt input, Claude waits for the trigger phrase, @claude by default, in an issue or pull request comment, in a pull request review, or in the body or title of a newly opened issue, then responds to that request. Progress and results appear as a comment on the triggering issue or PR.
• Automation mode: when the workflow provides a prompt input, Claude runs without waiting for a mention, subject only to the checks on who can trigger runs. By default, results appear in the workflow run log rather than a comment. Claude can post to the issue or pull request when the prompt directs it to and it has a tool that can post, as in the code-review example.

​

Who can trigger runs

• Write access: on issue and pull request events, the triggering user must have write access to the repository. To allow specific users without write access, set allowed_non_write_users and pass your own github_token input. Events that no user authors, such as a schedule trigger, skip this check.
• Human actor: on every event, the Claude Code GitHub Action rejects a bot actor unless you list it in allowed_bots, which keeps bots from triggering Claude in a loop. This check also applies to scheduled runs, which GitHub attributes to a repository user, usually the one who last changed the workflow’s cron schedule. If that user is a bot, list it in allowed_bots.

​

Example use cases

​

Respond to @claude mentions

name: Claude Code
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
jobs:
  claude:
    if: contains(github.event.comment.body, '@claude')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write
      actions: read
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

• id-token: write: required for the Claude Code GitHub Action’s default GitHub App authentication
• actions: read: lets Claude read CI results on PRs
• actions/checkout: gives Claude a local copy of the repository to work in
• if: keeps runners from starting on comments that don’t mention